{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T17:55:20Z","timestamp":1775066120212,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":53,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3690302","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"1701-1715","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["The Not-So-Silent Type: Vulnerabilities in Chinese IME Keyboards' Network Security Protocols"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-6239-9725","authenticated-orcid":false,"given":"Jeffrey","family":"Knockel","sequence":"first","affiliation":[{"name":"Citizen Lab, University of Toronto, Toronto, Ontario, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7525-3342","authenticated-orcid":false,"given":"Mona","family":"Wang","sequence":"additional","affiliation":[{"name":"Princeton University, Princeton, New Jersey, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1409-9754","authenticated-orcid":false,"given":"Zo\u00eb","family":"Reichert","sequence":"additional","affiliation":[{"name":"Citizen Lab, University of Toronto, Toronto, Ontario, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Comparing the Usability of Cryptographic APIs. In 2017 IEEE Symposium on Security and Privacy (SP). 154--171","author":"Acar Yasemin","year":"2017","unstructured":"Yasemin Acar, Michael Backes, Sascha Fahl, Simson Garfinkel, Doowon Kim, Michelle L. Mazurek, and Christian Stransky. 2017. Comparing the Usability of Cryptographic APIs. In 2017 IEEE Symposium on Security and Privacy (SP). 154--171."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/4908134"},{"key":"e_1_3_2_1_3_1","volume-title":"Timing side-channel attacks on SSH. Ph.,D. Dissertation","author":"Bhanu Harikrishnan","unstructured":"Harikrishnan Bhanu. 2010. Timing side-channel attacks on SSH. Ph.,D. Dissertation. Clemson University. Copyright - Database copyright ProQuest LLC; ProQuest does not claim copyright in the individual underlying works; Last updated - 2024-07--18."},{"key":"e_1_3_2_1_4_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"B\u00f6ck Hanno","year":"2018","unstructured":"Hanno B\u00f6ck, Juraj Somorovsky, and Craig Young. 2018. Return Of Bleichenbachertextquoterights Oracle Threat (ROBOT). In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 817--849."},{"key":"e_1_3_2_1_5_1","volume-title":"You Shouldntextquoterightt Collect My Secrets: Thwarting Sensitive Keystroke Leakage in Mobile IME Apps. In 24th USENIX Security Symposium (USENIX Security 15)","author":"Chen Jin","year":"2015","unstructured":"Jin Chen, Haibo Chen, Erick Bauman, Zhiqiang Lin, Binyu Zang, and Haibing Guan. 2015. You Shouldntextquoterightt Collect My Secrets: Thwarting Sensitive Keystroke Leakage in Mobile IME Apps. In 24th USENIX Security Symposium (USENIX Security 15). USENIX Association, Washington, D.C., 657--690."},{"key":"e_1_3_2_1_6_1","unstructured":"Jakub Dalek Katie Kleemola Adam Senft Christopher Parsons Andrew Hilts Sarah McKune Jason Q Ng Masashi Crete-Nishihata John Scott-Railton and Ron Deibert. 2015. A chatty squirrel: Privacy and security issues with uc browser. Technical Report. The Citizen Lab."},{"key":"e_1_3_2_1_7_1","first-page":"1","article-title":"Android: From reversing to decompilation","volume":"1","author":"Desnos Anthony","year":"2011","unstructured":"Anthony Desnos and Geoffroy Gueguen. 2011. Android: From reversing to decompilation. Proc. of Black Hat Abu Dhabi, Vol. 1 (2011), 1--24.","journal-title":"Proc. of Black Hat Abu Dhabi"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-61638-0_26"},{"key":"e_1_3_2_1_9_1","volume-title":"Proceedings of the 2013 Conference on Internet Measurement Conference","author":"Durumeric Zakir","unstructured":"Zakir Durumeric, James Kasten, Michael Bailey, and J. Alex Halderman. 2013. Analysis of the HTTPS certificate ecosystem. In Proceedings of the 2013 Conference on Internet Measurement Conference (Barcelona, Spain) (IMC '13). Association for Computing Machinery, New York, NY, USA, 291--304."},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of the 2014 Conference on Internet Measurement Conference","author":"Durumeric Zakir","unstructured":"Zakir Durumeric, Frank Li, James Kasten, Johanna Amann, Jethro Beekman, Mathias Payer, Nicolas Weaver, David Adrian, Vern Paxson, Michael Bailey, and J. Alex Halderman. 2014. The Matter of Heartbleed. In Proceedings of the 2014 Conference on Internet Measurement Conference (Vancouver, BC, Canada) (IMC '14). Association for Computing Machinery, New York, NY, USA, 475--488."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516693"},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS'11)","author":"Egele Manuel","year":"2011","unstructured":"Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vigna. 2011. PiOS: Detecting Privacy Leaks in iOS Applications. In Proceedings of the Network and Distributed System Security Symposium (NDSS'11)."},{"key":"e_1_3_2_1_13_1","volume-title":"7th USENIX Workshop on Free and Open Communications on the Internet (FOCI 17)","author":"Espinoza Antonio M.","year":"2017","unstructured":"Antonio M. Espinoza, William J. Tolley, Jedidiah R. Crandall, Masashi Crete-Nishihata, and Andrew Hilts. 2017. Alice and Bob, who the FOCI are they?: Analysis of end-to-end encryption in the LINE messaging application. In 7th USENIX Workshop on Free and Open Communications on the Internet (FOCI 17). USENIX Association, Vancouver, BC."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382205"},{"key":"e_1_3_2_1_15_1","volume-title":"Automated Detection of SSL\/TLS Man-in-the-Middle Vulnerabilities in Android Apps. In Network and Distributed System Security Symposium (NDSS). Internet Society","author":"Justin Sahs Garret Greenwood David Sounthiraraj","year":"2014","unstructured":"David Sounthiraraj Justin Sahs Garret Greenwood and Zhiqiang Lin Latifur Khan. 2014. SMV-HUNTER: Large Scale, Automated Detection of SSL\/TLS Man-in-the-Middle Vulnerabilities in Android Apps. In Network and Distributed System Security Symposium (NDSS). Internet Society, San Diego, CA. 1--14."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23055"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068856"},{"key":"e_1_3_2_1_18_1","unstructured":"Lanlan Huang and Xiaoyi Lin. 2021. Chinese keyboard apps on the spot over suspicion of privacy violation. https:\/\/www.globaltimes.cn\/page\/202101\/1214202.shtml"},{"key":"e_1_3_2_1_19_1","unstructured":"Mara Hvistendahl. 2020. How a Chinese AI Giant made chatting -- and surveillance -- easy. https:\/\/www.wired.com\/story\/iflytek-china-ai-giant-voice-chatting-surveillance\/"},{"key":"e_1_3_2_1_20_1","unstructured":"iiMedia. 2023. https:\/\/www.iimedia.cn\/c400\/92144.html"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCChina.2014.7008273"},{"key":"e_1_3_2_1_22_1","unstructured":"Jeffrey Knockel Sarah McKune and Adam Senft. 2016. Baidu's and don'ts: privacy and security issues in Baidu browser. Technical Report. The Citizen Lab."},{"key":"e_1_3_2_1_23_1","volume-title":"Crandall","author":"Knockel Jeffrey","year":"2018","unstructured":"Jeffrey Knockel, Thomas Ristenpart, and Jedidiah R. Crandall. 2018. When Textbook RSA is Used to Protect the Privacy of Hundreds of Millions of Users. CoRR, Vol. abs\/1802.03367 (2018). showeprint[arXiv]1802.03367 http:\/\/arxiv.org\/abs\/1802.03367"},{"key":"e_1_3_2_1_24_1","unstructured":"Jeffrey Knockel Adam Senft and Ron Deibert. 2016. A Tough Nut to Crack: A Further Look at Privacy and Security Issues in UC Browser."},{"key":"e_1_3_2_1_25_1","unstructured":"Jeffrey Knockel Adam Senft and Ronald Deibert. 2016. WUP! There It Is: Privacy and Security Issues in QQ Browser. Citizen Lab report. Technical Report. The Citizen Lab."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40041-4_24"},{"key":"e_1_3_2_1_27_1","volume-title":"Analyzing Prominent Mobile Apps in Latin America. In Workshop on Free and Open Communications on the Internet (FOCI 2024). Privacy Enhancing Technologies Symposium","author":"Kujath Beau","unstructured":"Beau Kujath, Jeffrey Knockel, Paul Aguilar, Diego Morabito, Masashi Crete-Nishihata, and Jedidiah R. Crandall. 2024. Analyzing Prominent Mobile Apps in Latin America. In Workshop on Free and Open Communications on the Internet (FOCI 2024). Privacy Enhancing Technologies Symposium, Bristol, UK, 83--92."},{"key":"e_1_3_2_1_28_1","unstructured":"McAfee Labs. 2015. Apps Sending Plain HTTP Put Personal Data at Risk. https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/apps-sending-plain-http-put-personal-data-risk\/"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2668152.2668154"},{"key":"e_1_3_2_1_30_1","volume-title":"IccTA: Detecting Inter-Component Privacy Leaks in Android Apps. In 2015 IEEE\/ACM 37th IEEE International Conference on Software Engineering","volume":"1","author":"Li Li","year":"2015","unstructured":"Li Li, Alexandre Bartel, Tegawend\u00e9 F. Bissyand\u00e9, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, and Patrick McDaniel. 2015. IccTA: Detecting Inter-Component Privacy Leaks in Android Apps. In 2015 IEEE\/ACM 37th IEEE International Conference on Software Engineering, Vol. 1. IEEE, Florence, Italy, 280--291."},{"key":"e_1_3_2_1_31_1","unstructured":"Shumin Liao. 2021. iFlytek Sinks After Chinese AI Firm?s Virtual Keyboard Is Pulled From App Stores. https:\/\/www.yicaiglobal.com\/news\/iflytek-sinks-after-chinese-ai-firm-virtual-keyboard-is-pulled-from-app-stores"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3036232"},{"key":"e_1_3_2_1_33_1","unstructured":"Bill Marczak and John Scott-Railton. 2020. Move Fast and Roll Your Own Crypto: A Quick Look at the Confidentiality. Technical Report. The Citizen Lab."},{"key":"e_1_3_2_1_34_1","volume-title":"SoK: A Critical Evaluation of Efficient Website Fingerprinting Defenses. In 2023 IEEE Symposium on Security and Privacy (SP). 969--986","author":"Mathews Nate","year":"2023","unstructured":"Nate Mathews, James K Holland, Se Eun Oh, Mohammad Saidur Rahman, Nicholas Hopper, and Matthew Wright. 2023. SoK: A Critical Evaluation of Efficient Website Fingerprinting Defenses. In 2023 IEEE Symposium on Security and Privacy (SP). 969--986."},{"key":"e_1_3_2_1_35_1","volume-title":"SoK: Lessons Learned from SSL\/TLS Attacks","author":"Meyer Christopher","unstructured":"Christopher Meyer and J\u00f6rg Schwenk. 2014. SoK: Lessons Learned from SSL\/TLS Attacks. In Information Security Applications, Yongdae Kim, Heejo Lee, and Adrian Perrig (Eds.). Springer International Publishing, Cham, 189--209."},{"key":"e_1_3_2_1_36_1","volume-title":"Matyas","author":"Meyer Carl H.","year":"1982","unstructured":"Carl H. Meyer and Stephen M. Matyas. 1982. Cryptography: a new dimension in computer data security. John Wiley & Sons, New York, NY, USA."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1353\/tech.2012.0132"},{"key":"e_1_3_2_1_38_1","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Oltrogge Marten","year":"2015","unstructured":"Marten Oltrogge, Yasemin Acar, Sergej Dechand, Matthew Smith, and Sascha Fahl. 2015. To Pin or Not to PintextemdashHelping App Developers Bullet Proof Their TLS Connections. In 24th USENIX Security Symposium (USENIX Security 15). USENIX Association, Washington, D.C., 239--254."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2766498.2766522"},{"key":"e_1_3_2_1_40_1","unstructured":"Palo Alto Networks. 2013. Is Baidu Secretly Collecting Japanese User Data? https:\/\/www.paloaltonetworks.com\/blog\/2013\/12\/baidu-secretly-collecting-japanese-user-data\/"},{"key":"e_1_3_2_1_41_1","unstructured":"David Prock. 2023. GrapheneOS Network Permissions not being honored. https:\/\/github.com\/GrapheneOS\/os-issue-tracker\/issues\/2810"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3232755.3232779"},{"key":"e_1_3_2_1_43_1","first-page":"15","article-title":"KeyDrown","volume":"2018","author":"Schwarz Michael","year":"2018","unstructured":"Michael Schwarz, Moritz Lipp, Daniel Gruss, Samuel Weiser, Clementine Lucie Noemie Maurice, Raphael Spreitzer, and Stefan Mangard. 2018. KeyDrown: Eliminating Software-Based Keystroke Timing Side-Channel Attacks. In Network and Distributed System Security Symposium 2018. 15. Network and Distributed System Security Symposium 2018, NDSS'18 ; Conference date: 18-02--2018 Through 21-02--2018.","journal-title":"Eliminating Software-Based Keystroke Timing Side-Channel Attacks. In Network and Distributed System Security Symposium"},{"key":"e_1_3_2_1_44_1","unstructured":"Claude E Shannon. 1945. A Mathematical Theory of Cryptography. Technical Report. Bell Telephone Labs."},{"key":"e_1_3_2_1_45_1","volume-title":"Timing Analysis of Keystrokes and Timing Attacks on SSH. In 10th USENIX Security Symposium (USENIX Security 01)","author":"Song Dawn Xiaodong","year":"2001","unstructured":"Dawn Xiaodong Song, David Wagner, and Xuqing Tian. 2001. Timing Analysis of Keystrokes and Timing Attacks on SSH. In 10th USENIX Security Symposium (USENIX Security 01). USENIX Association, Washington, D.C."},{"key":"e_1_3_2_1_46_1","volume-title":"Proceedings of the 2016 Internet Measurement Conference","author":"Springall Drew","unstructured":"Drew Springall, Zakir Durumeric, and J. Alex Halderman. 2016. Measuring the Security Harm of TLS Crypto Shortcuts. In Proceedings of the 2016 Internet Measurement Conference (Santa Monica, California, USA) (IMC '16). Association for Computing Machinery, New York, NY, USA, 33--47."},{"key":"e_1_3_2_1_47_1","unstructured":"Masaki Suenaga. 2005. IME as a possible keylogger. https:\/\/www.virusbulletin.com\/virusbulletin\/2005\/11\/ime-possible-keylogger\/"},{"key":"e_1_3_2_1_48_1","unstructured":"The Five Eyes. 2012. Synergising Network Analysis Tradecraft. https:\/\/www.eff.org\/document\/20150521-cbc-synergising-network-analysis-tradecraft"},{"key":"e_1_3_2_1_49_1","volume-title":"IPSEC, WTLS.... In Advances in Cryptology -- EUROCRYPT","author":"Vaudenay Serge","year":"2002","unstructured":"Serge Vaudenay. 2002. Security Flaws Induced by CBC Padding -- Applications to SSL, IPSEC, WTLS.... In Advances in Cryptology -- EUROCRYPT 2002, Lars R. Knudsen (Ed.). Springer Berlin Heidelberg, Berlin, Heidelberg, 534--545."},{"key":"e_1_3_2_1_50_1","volume-title":"Fake Input Method Editor","author":"Labs ThreatSeeker Network Websense Security","unstructured":"Websense Security Labs ThreatSeeker Network. 2010. Fake Input Method Editor (IME) Trojan. https:\/\/blog.pages.kr\/739"},{"key":"e_1_3_2_1_51_1","volume-title":"Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security","author":"Yang Zhemin","unstructured":"Zhemin Yang, Min Yang, Yuan Zhang, Guofei Gu, Peng Ning, and X. Sean Wang. 2013. AppIntent: analyzing sensitive data transmission in android for privacy leakage detection. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (Berlin, Germany) (CCS '13). Association for Computing Machinery, New York, NY, USA, 1043--1054."},{"key":"e_1_3_2_1_52_1","volume-title":"China Smartphone Market Analysis","author":"Zhang Archie","year":"2023","unstructured":"Archie Zhang. 2024. China Smartphone Market Analysis 2023. https:\/\/www.counterpointresearch.com\/research_portal\/china-smartphone-market-analysis-2023-q4\/"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623705"}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690302","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3690302","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T06:13:27Z","timestamp":1755843207000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690302"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":53,"alternative-id":["10.1145\/3658644.3690302","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3690302","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}