Doctor of Philosophy, The Ohio State University, 2025, Computer Science and Engineering
The super app paradigm, exemplified by platforms such as \textsc{WeChat} and \textsc{AliPay}, has revolutionized the mobile app landscape by enabling third-party developers to deploy add-ons within these apps. These add-ons, known as miniapps, leverage user data hosted by the super app platforms to provide a wide range of services, such as shopping and gaming. Compared to web apps, this paradigm benefits from deeper integration with device resources and critical host app components. This integration elevates super apps to the level of comprehensive ``operating systems”, managing both mobile and web resources. These include peripheral devices like Bluetooth, cloud-based services such as databases, and privacy-sensitive data like account details and phone numbers. However, this expanded access introduces significant security challenges. Malicious actors exploiting vulnerabilities in super apps could impact vast user bases and spread malware through social networks, such as group chats and contact lists, causing severe consequences. Recent studies have highlighted persistent vulnerabilities and design flaws in super apps, making them attractive targets for attackers.
The super apps involve complex communication model between users, developers, and platforms, which makes the ecosystem more vulnerable for intrusion when mistrust occurs. On the front-end side, miniapps often have to communicate with other miniapps to accomplish complicated tasks. However, unlike a web app that uses network domains (\ie, IP addresses) to navigate between different web apps, a miniapp uses a unique global {\tt appId} assigned by the super app to navigate between miniapps. Unfortunately, any missing checks of the sender's {\tt appId} in a receiver miniapp can lead to exploitation. On the back-end side, sensitive data access relies on encryption protocol centered around a specific master key. In the early stage of super apps, there is a lack of systematic identification of the leakage, re (open full item for complete abstract)
Committee: Zhiqiang Lin (Advisor); Carter Yagemann (Committee Member); Michael Bond (Committee Member)
Subjects: Computer Science