When Apps Become Super: Dissecting the Security Risks of Super Apps
Speaker:
Mr. YANG Yuqing
Ph.D. candidate, Department of Computer Science and Engineering
The Ohio State University
Abstract:
The Super App computing paradigm, debuted in 2017 by world’s social computing giant WeChat, has revolutionized the mobile app architecture. By integrating a standalone execution engine for light-weight miniapp packages, the super apps allow third-party developers to integrate customized services to billions of super app users. Simultaneously, with the powerful features provided by super apps comes the imminent risk from attackers, who actively attempt to exploit the super app ecosystem, inflicting privacy and losses of billions of users, as well as millions of developers.
In this talk, Yuqing will dissect the concept of super app paradigm with a specific focus on the security risks from super app vulnerabilities and miniapp malware. First, he will discuss communication channel vulnerabilities we identified in front-ends and back-ends, followed by a dissection of miniapp malware against miniapp vetting, and malicious behaviors against the platform prior and after the miniapp vetting process. In the end, he will discuss mitigation countermeasures and open problems to improve the security and privacy in the realm of super apps.
Biography:
Yuqing Yang is a third-year PhD candidate at the Department of Computer Science and Engineering of The Ohio State University. His research interest primarily focuses on vulnerability and malware detection in mobile and web security, particularly in super apps. His papers have been published in prestigious conferences, such as ACM CCS, SIGMETRICS, and ICSE. He was a reviewer for many top-tier journals and conferences, including TIFS, TOSEM, DSN, USENIX Security, IEEE Security & Privacy, and ACM CCS. His researches have also been acknowledged by top super app vendors, including Tencent and Baidu.
Enquiries:
Professor MENG Wei (wei@cse.cuhk.edu.hk)
Mr. WONG O-Bong (obong@cse.cuhk.edu.hk)
** ALL ARE WELCOME **