Uncovering and Exploiting Hidden APIs in Mobile Super Apps
Chao Wang, Yue Zhang, Zhiqiang Lin

TL;DR
This paper presents APIScope, a tool combining static and dynamic analysis to uncover undocumented, insecure APIs in super apps like WeChat and TikTok, revealing security vulnerabilities and potential attack vectors.
Contribution
The paper introduces a systematic approach to identify hidden APIs in super apps, demonstrating their existence and security risks across multiple popular platforms.
Findings
All five tested super apps contain hidden APIs.
Many hidden APIs lack security checks and can be exploited.
Reported vulnerabilities led to patches and bug bounties.
Abstract
Mobile applications, particularly those from social media platforms such as WeChat and TikTok, are evolving into "super apps" that offer a wide range of services such as instant messaging and media sharing, e-commerce, e-learning, and e-government. These super apps often provide APIs for developers to create "miniapps" that run within the super app. These APIs should have been thoroughly scrutinized for security. Unfortunately, we find that many of them are undocumented and unsecured, potentially allowing miniapps to bypass restrictions and gain higher privileged access. To systematically identify these hidden APIs before they are exploited by attackers, we developed a tool APIScope with both static analysis and dynamic analysis, where static analysis is used to recognize hidden undocumented APIs, and dynamic analysis is used to confirm whether the identified APIs can be invoked by an…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Privacy, Security, and Data Protection · Internet Traffic Analysis and Secure E-voting
