Fraud in the WeChat Mini Program Ecosystem

Original report text

This text version is reconstructed based on the 27-page original PDF, retaining the report narrative, chapters and research scope; the cover, repeated table of contents and purely decorative pages are not repeated. Localized figures are placed in context throughout this web edition, with the original PDF retained for reference.

Table of Contents 1. Current status of the cybercrime ecosystem activities in WeChat mini program

1.1. Attacks against WeChat Mini Programs are growing rapidly, and the attacks are mainly promotion abuse

1.2. Online businesses in traditional industries have become the hardest hit area by attacks, with attacks spread across all walks of life

1.3. Mini-program attack costs are low and the attack is easy to scale

1.4. There are many ways to make money, and cash red envelopes are the most favored by cybercrime ecosystem

1Enlarge

1.5. The cybercrime ecosystem around WeChat Mini Programs has formed a mature industry chain

1. Analysis of the cybercrime ecosystem chain of WeChat Mini Programs

1. 1. Upstream of the industrial chain

1. 2. Midstream of the industrial chain

1. 3. Downstream of the industrial chain

1234567Enlarge

1. Analysis of Mini Program Attack Cases

3.1. The one-yuan purchase activity of a certain financial service platform was attacked

3.2. The cash activities of a certain life service platform were attacked

3.3. The rush buying activity of a certain brand of tea beverage company was attacked

1Enlarge

1. Difficulties in attack and defense of WeChat Mini Programs and protection ideas

1. 1. Difficulties in attacking and defending WeChat Mini Programs

1. 2. Protection ideas for mini programs

1. Current status of WeChat mini program the cybercrime ecosystem activities

1.1. Attacks against WeChat Mini Programs are growing rapidly, and the attacks are mainly promotion abuse.

With the rapid growth of WeChat mini-programs themselves and the maturity of the cybercrime ecosystem chain attached to mini-programs, attacks against mini-programs have also shown a rapid growth trend. Based on the cybercrime ecosystem tool data captured by the Threat Hunter business security intelligence platform, we have calculated the trend in the number of WeChat Mini Program automated attack tools from January 2020 to the present, as shown below:

The emergence of a large number of automated attack tools, on the one hand, shows that WeChat Mini Programs have brought enough benefits to cybercrime ecosystem, so that professional cybercriminal groups are willing to invest resources and technology; on the other hand, it also shows that the current security of WeChat Mini Programs cannot effectively block or limit cybercrime ecosystem, thus leading to the activity of cybercriminal attacks.

The current attack targets are mainly marketing activities carried out by enterprises on mini programs, through false registrations, false invitations, and scalpers.

fraud through panic buying and other methods has caused losses in marketing expenses and at the same time, corporate business has not achieved healthy growth. In the long run, automated attacks (also known as BOT attacks) will also bring more security risks, including malicious crawling of enterprise data/user data, interface traffic manipulation, CC attacks causing service unavailability, etc. The influx of a large number of spam accounts will also cause huge damage to the platform's ecology, including the spread of illegal activities such as online pornography, online gambling, and online fraud, the manipulation of public opinion by online trolls, and the release of false advertising.

1.2. Online businesses in traditional industries have become the hardest hit area by attacks, with attacks spread across all walks of life.

Relying on WeChat, mini programs have natural advantages in terms of convenience, stability, and user reach. This makes mini programs the first choice for many traditional industries to expand their business from offline channels to online services, and has played a huge role. On the other hand, these companies relatively lack understanding of cybercrime ecosystem and experience in offensive and defensive confrontation. Therefore, while enjoying the dividends brought by WeChat Mini Programs, they have also become key targets of cybercriminal attacks. Based on data from the Threat Hunter business security intelligence platform, we divided the attacked mini programs by industry and calculated the proportion of attacks, as follows:

It can be seen that attacks are spread across all walks of life that are closely related to our lives. We selected some industries to make a brief inventory.

Food and catering: "Food is the first priority for the people." The traditional food and catering industry, represented by wine, beverages, refreshments, snacks, etc., has expanded from offline channels to online services with the help of WeChat Mini Programs to provide customers with more convenient and better services. However, it has also been targeted by the cybercrime ecosystem and has become the industry most attacked by the cybercrime ecosystem. Attacks on WeChat Mini Programs in the food and catering industry mainly include free orders, coupon grabbing, flash sales, etc.

E-commerce shopping: E-commerce shopping has always been a key industry for cybercriminal attacks. In addition to the leading Internet e-commerce platforms, some e-commerce platforms built by traditional enterprises have also emerged in the mini program ecosystem. These platforms often conduct social marketing and consumption through business models such as group buying, price bargaining, and point redemption. However, this business model has been familiar and exploited by the cybercrime ecosystem, and the profits of merchants are often captured by the cybercrime ecosystem.

Life services/travel accommodation: Internet services have covered all aspects of our lives and travel, ranging from takeout, express delivery, taxis, and hotels to marriage, education, medical care, and elderly care. There are both large and small Internet companies, as well as non-interactive enterprises undergoing digital transformation, as well as online services developed by the government to improve the quality of residents or attract tourists.

1Enlarge

While ordinary people have gained convenience in their lives, cybercriminal groups have also gained benefits from it.

Real estate/automobile manufacturing: Real estate and automobile manufacturing can be said to be very typical traditional industries. In the wave of digital transformation, these companies use mini programs to carry out their original businesses, such as viewing houses/cars, buying houses/cars, renting houses/cars, etc.; on the other hand, they also use mini programs to enrich and expand their business, such as providing owner/car owner services, holding welfare activities, etc. Among the welfare activities, there are some online activities to invite friends to help, and cybercriminal groups can easily profit from them.

Supermarkets/Digital Home Appliances/Clothes and Accessories/Beauty and Care: The biggest change in the digital transformation of these industries is the expansion of product sales from physical stores to online, including mini programs. Most companies tend to learn from e-commerce marketing ideas. For example, some well-known domestic and foreign sports brands, cosmetics brands, etc. will launch their own marketing activities during certain periods of time (holidays or e-commerce promotion days, etc.) to give users large enough discounts. These discounts in physical stores are given to customers who really want to shop, while these discounts online often fall into the hands of cybercrime ecosystem, such as scalpers and shoe speculators.

1.3. Mini-program attack costs are low and attacks can be easily scaled up.

Account resources and device resources are the main costs of cybercriminal attacks. Mini program accounts rely on WeChat authorized login. The current selling price is only 0.1 to 0.5 yuan per account. In contrast, App accounts mainly rely on receiving SMS verification codes on mobile phones. The price is generally much higher, and the prices of some popular services are even more expensive (note: this is limited to the price comparison of single authorization/code reception, and does not include the sale of maintained accounts or old accounts).

The larger the scale of cybercriminal attacks and the more accounts required, the more obvious the price advantage of mini programs in account resources will be.

In addition, according to the analysis of Threat Hunter-Guigu Lab security experts, the current attack tools against WeChat Mini Programs are almost all protocol attacks, and protocol attacks do not require mobile phones, group control and other equipment resources, so the cost of attacks is greatly reduced. Several common ways for cybercrime ecosystem to implement automated attacks are compared as follows:

Once beyond the limitations of the device, even a rudimentary cybercriminal group can easily carry out large-scale attacks.

1.4. There are many ways to make money, and cash red envelopes are the most favored by cybercrime ecosystem.

The spread among WeChat friends is the simplest and best marketing fission method for WeChat Mini Programs. In order to stimulate users to repost and share their mini programs more, companies will provide users with various incentives that are attractive enough, and these often become cybercriminal groups' profit methods. The main profit methods are as follows:

1Enlarge

1234567Enlarge

Cash red envelopes: WeChat red envelopes have been integrated into our lives, and many companies also use cash red envelopes in mini programs to market and acquire customers. Since cash red envelopes can be quickly realized through WeChat payment, cash red envelopes have become the most favored way for cybercrime ecosystem to make money, and threat actors also like to use WeChat withdrawal records to show off their "achievements":

Although the amount of cash obtained by a single account is often not high, since the attack applet can easily be scaled up, the overall income obtained by cybercriminal groups will be very high.

Lottery: Although the lottery is a probabilistic event, due to cybercriminal groups' advantage in "heads", it is basically guaranteed to make a steady profit; and some lottery prizes themselves are cash red envelopes, and there are even some high-value products, such as iPhones, branded sneakers, etc., which will make cybercrime ecosystem flock to them.

Points: Earn points by completing tasks, and then the points can be exchanged for rewards. Some rewards include cash red envelopes or easily cashable products, such as recharge of phone bills, so they will also attract many cybercrime operators.

Product bargains/coupons: Mainly from many e-commerce platforms on mini programs, use these two methods to market your own products. cybercriminal groups will focus on high-quality or popular products, as well as coupons with high discounts and no-threshold coupons.

Virtual/physical goods: Virtual goods that are commonly used in marketing activities are relatively easy to sell, such as membership cards of major video websites, shopping cards on e-commerce platforms, and offline product redemption coupons. Although physical goods can be sold through platforms such as Xianyu and Zhuanzhuan, the long realization cycle and the cost of sending and receiving goods make cybercrime ecosystem relatively cautious and generally choose daily necessities (such as paper towels, cooking oil, etc.) and popular Internet celebrity items (such as popular blind boxes, Starbucks cups, etc.).

1.5. The cybercrime ecosystem around WeChat Mini Programs has formed a mature industry chain

To judge whether an industrial chain is mature, we can evaluate it from two aspects: 1. Whether there is a stable group of practitioners; 2. Whether a stable supply relationship has been formed. In the cybercrime ecosystem chain surrounding WeChat Mini Programs, account supply and automated tool development are key links, and a relatively stable practitioner population and supply relationship have been formed.

Account supply: The account resources of mini programs were mainly sold through card issuance platforms or Q group advertising in the early days, with little reach.

The quantity and stability cannot be guaranteed; and currently there is a cybercrime ecosystem: WeChat authorization platform that specifically provides authorized login for WeChat Mini Programs. On the one hand, account resources are fully guaranteed, and on the other hand, it also better connects upstream and downstream. According to our statistics:

• There are currently more than 10 active WeChat authorized platforms

123456Enlarge

1Enlarge

• The number of WeChat accounts that can be used to log in to mini programs on the head platform exceeds one million

• Most platforms support API docking and can be quickly integrated into automated attack tools. Automated tool development: More and more cybercrime ecosystem tool authors are involved in the development of mini program attack tools. Some tool authors will also advertise on the program interface to undertake the customized development of mini program attack tools:

According to our statistics, in the past 1 month:

• More than 90 tool authors have published attack tools targeting WeChat Mini Programs

• The top 10 tool authors have published more than 10 times

• The No. 1 tool author has published 57 times, nearly 2 times per day. In the next chapter, we will further analyze the industry chain and reveal more details.

2. Analysis of WeChat Mini Program cybercrime ecosystem chain

The cybercrime ecosystem chain surrounding WeChat Mini Programs can be roughly divided into upstream, midstream and downstream according to different roles and division of labor.

The upstream supplies resources, the downstream implements attacks and monetizes, and the midstream connects the upstream and downstream and provides assistance for attacks. As shown below:

12345678Enlarge

Some roles are unique to the WeChat Mini Program cybercrime ecosystem chain, so let’s focus on them.

2.1. Upstream of the industrial chain

• Number merchants

Login to the mini program must be through a WeChat account, so the mini program account resource is essentially a WeChat account. There are two main types of WeChat accounts sold by cybercrime ecosystem:

1. human participant accounts: Most of these accounts come from people who are not financially well-off. When they are in financial distress, they use their personal WeChat ID to

Rent or sell. Since they are genuine-user accounts, such accounts are basically not restricted by WeChat when they enter the cybercrime ecosystem. They are often used by threat actors for some huge profits or illegal activities, such as advertising traffic, online gambling, online fraud, etc. Of course, the selling price of such accounts is also very high, with one account usually costing hundreds.

1. Machine account: This type of account mainly comes from the WeChat account maintenance studio. Nowadays, cybercriminal groups are also advancing with the times, and there are specialized

A platform that provides account maintenance services. The account maintenance studio realizes cloud account maintenance by calling the interface provided by the platform. For example, a certain cloud account maintenance platform provides a very rich account maintenance interface:

The studio only needs to purchase the services of the cloud platform without investing in equipment, and the fraud controls and confrontation are all handled by the cloud platform. Professional matters are left to professional people, and the division of labor is more detailed.

Whether it is a account operated by a real user or a machine account, if it is later restricted by WeChat due to illegal activities, it can still be used to log in to the mini program. There are a large number of restricted WeChat accounts on the cybercrime ecosystem market, and there are account merchants who specialize in collecting WeChat a16 or 62 data, authorizing third parties to log in, including WeChat Mini Programs, official accounts, etc.:

A16 and 62 data are identity credential data generated after logging in to WeChat. With a16 or 62 data, you can log in to WeChat without account password and verification.

2.2. Midstream of the industrial chain

• WeChat authorization platform

1234Enlarge

It is inefficient to directly connect account providers and downstream companies, so a platform connecting account providers and downstream companies emerged: the WeChat authorization platform.

To understand the WeChat authorization platform, we must first understand the principle of WeChat authorization login. The official WeChat document gives the process of mini program login: https://developers.weixin.qq.com/miniprogram/dev/framework/open-ability/login.html. The flow chart is as follows:

To sum up, it can be divided into 2 steps:

1. Call wx.login() to obtain the temporary login credential code and send it back to the developer server;

1. After the developer server gets the code, it initiates a login request to the WeChat interface service, and the WeChat interface service returns

Important data such as session_key and openid are sent to the developer server to complete the login and return to the customized login state.

The role of the WeChat authorization platform lies in step 1. cybercriminal groups can obtain the code through the WeChat authorization platform without calling wx.login(). On the one hand, attacks against mini programs are completely separated from the operating environment of mini programs. On the other hand, the WeChat authorization platform reserves a large number of WeChat accounts, which can provide a large number of account resources for attacks. Most WeChat authorization platforms provide API interfaces that can be easily integrated into automated attack tools. The following is the API interface description of one of the platforms:

You can see that in addition to the code, the bound phone number, nickname, personalized signature and other information can also be obtained.

There are currently more than 10 active WeChat authorized platforms. The cumulative number of apps and applets supported by these platforms reaches tens of thousands. Apps and applets that can provide cybercrime ecosystem profit margins are basically on the support list.

• Transcoding robot Transcoding robot is also a unique product of the WeChat Mini Program cybercrime ecosystem: for attackers, it is necessary to specify the beneficiary, such as attack assistance invitation activities, and the initiator of the invitation needs to be specified in the attack parameters. In this case, a transcoding robot is needed.

Take a certain brand of car company's mini program to attract new customers as an example:

1. Log in to the applet with the threat actors income account and send the invitation link to the transcoding robot.

1. The transcoding robot can automatically extract link information, mainly the page and parameters that jump after opening the mini program.

It contains the identity information of the inviter.

1. Some threat actors will also use human-operated fraud platforms (about human-operated fraud platforms, you can read Threat Hunter’s previous post

"Research Report on human-operated fraud cybercrime ecosystem": https://zhuanlan.zhihu.com/p/160828150), inviting human participants to assist in fraud. Therefore, the transcoding robot will also convert the link information into a WeChat Mini Program code to facilitate the WeChat code scanning operation.

Transcoding robots are generally paid per use, but there are also some free transcoding robots, and some cybercrime ecosystem technology forums even open source the code. Here we briefly introduce the transcoding robot implemented using WeChat PC client. The principle is as follows:

1. Start PC WeChat and inject the message interception module into the WeChat process;

1. Message interception module hook is the key function for WeChat to receive messages;

1. Determine the type of message received. If the mini program forwards the message, parse and extract the link information.

The text, pictures, emoticons, mini programs and other messages we send are consistent in message format:

Different types of messages will have different message bodies. For mini programs, the message body is a text in XML format, in which the tag <weappinfo> contains relevant information, as shown below:

2.3. Downstream of the industrial chain

• Crack mini program

The downstream is the direct initiator of attacks, and for professional cybercrime ecosystem, tools will be developed to implement automated attacks to obtain greater benefits. The first step is to crack the applet and figure out the business logic and core algorithm of the applet.

123456789Enlarge

The cracking steps are as follows:

1. Extract the mini-program package: The mini-program package for mobile WeChat is located at:

12Enlarge

123456789101112131415Enlarge

/data/data/com.tencent.mm/MicroMsg/{{User hash value}}/appbrand/pkg directory, suffix

It is a .wxapkg file; the PC WeChat applet package is located in the directory: {{My Documents}}\WeChatFiles\Applet\{{Mini Program AppID}}\{{Mini Program Version}}, a file named __APP__.wxapkg;

1. Unpack the mini program package: The file structure of the mini program package has been clearly studied and made public. There are also open source projects on the Internet.

Projects and tools can extract source code files from WeChat Mini Program packages;

1234567891011121314Enlarge

1. Analyze the code: Import the source code into the WeChat developer tool to facilitate reading and debugging, and combine it with dynamic packet capture and determination.

Bit and analyze key codes, such as the construction of business interface requests.

• After the development tool completes the cracking of the WeChat Mini Program, the tool developer usually first manually tests to complete the attack process, and then writes the tool code to realize the automated operation. Developers will access the API interfaces of multiple WeChat authorization platforms in the tool, and will also access the API interfaces of the SMS verification-code receiving service, CAPTCHA-solving service, and agent IP platform. These are all reusable. For different WeChat Mini Programs, tool developers do not need to modify much code, so the cost of developing a new WeChat Mini Program attack tool is not high for them.

After the tool is developed, the developer will sell it to those who carry out the attack through some channels. Some tools are sold publicly, and QQ groups are usually used to keep in touch and communicate, including usage tutorials, tool update notifications, download and purchase addresses, etc. The purchase address generally points to a store on a certain card issuance platform. Developers earn revenue by selling card keys, which are priced based on the length of use of the tool:

Some tool developers will develop agents to acquire more users and expand their profits; some tool developers will also launch attacks themselves. In order to reduce risks, they will provide the tools for free after a period of time, thereby achieving the effect of "the law does not punish the public".

123456Enlarge

3. Analysis of WeChat Mini Program attack cases

After understanding the industry chain, we selected several typical cases to give everyone a more intuitive and realistic experience of cybercriminal attacks on WeChat Mini Programs.

3.1. The one-yuan purchase activity of a financial service platform was attacked

From August 20 to August 27, a leading financial service platform’s mini program launched the “Invite friends, buy good items worth 1,000 yuan for 1 yuan” activity. You can invite friends to help you bargain, and the price of the product can be reduced to 1 yuan at most. This is attractive enough for the cybercrime ecosystem. At around 7 a.m. on the 20th, that is, more than 7 hours after the event started, a tool author completed the development of an automated attack tool. After the attack was successful, some cybercriminal groups also showed off the profits:

Inviting friends to help negotiate prices can quickly achieve user fission through sharing and forwarding of mini programs. Therefore, it is one of the most commonly used marketing methods to acquire customers on mini programs. It is also a very typical mini program attack scenario. Let’s take one of these tools as an example to see how threat actors carry out automated attacks. First, import the list of invitees who need help from the tool interface.

12Enlarge

Table:

Then obtain the assist account code through the WeChat authorization platform and authorize the login applet:

After successful login, attack the assistance interface to complete the assistance to the threat actors inviter account:

3.2. The cash activities of a certain life service platform were attacked

In order to attract users, a life service platform launched a cash activity. There is an activity cycle every week. Within an activity cycle, an account can earn cash by checking in, inviting friends, placing orders, etc., and you can withdraw cash if you exceed 50. As mentioned earlier, cash activities can be quickly realized through WeChat payment, which is the most favored way to make money by cybercrime ecosystem. This activity is no exception:

Although the cash earned each time is not much, for cybercrime ecosystem, a large number of accounts can be obtained through the WeChat authorization platform, and batch attacks can be carried out with automated tools. The final overall income will be very considerable.

3.3. The rush buying activity of a certain brand of tea beverage company was attacked

This is a limited-time sale event on the mini program. The promotion is buy 1 get 1 free. You can buy 2 coupons for the price of 1 coupon. Since the coupons for this tea drink are very easy to sell, they were targeted by threat actors. During the event, a large number of promotion-abuse actors transaction information appeared:

At the same time, automated attack tools have also appeared. Before the activity starts, the time, number and delay of the attack can be set on the tool interface:

When the activity time is up, access to the snap-up purchase interface will be automatically triggered:

4. Difficulties in attack and defense of WeChat Mini Programs and protection ideas

4.1. Attack and defense difficulties of WeChat Mini Programs

As there are more and more attack cases on mini programs, mini program security has gradually attracted the attention of business parties and the security industry. Compared with Apps and Web applications, Mini Programs bring a new plane of attack and defense. The difficulty is that some existing protection solutions cannot be effectively applied to Mini Programs, resulting in less than ideal protection effects. For example, the following solutions:

• Device fingerprint device information is an important input parameter for business security fraud controls. Whether device fingerprinting can achieve better results depends on whether the collected information can form a unique ID of the device and determine whether the device is risky. out of authority and

Due to security considerations such as privacy, there is not much device information that can be collected by the applet. It can collect device information, such as brand model, screen size, resolution, power, network type, etc., but cannot form a unique and stable device ID, and cannot use this information to determine whether the device is risky.

At the same time, since current cybercriminal attacks on WeChat Mini Programs basically use protocol attacks, cybercriminal groups can arbitrarily forge device information in initiated business requests, which makes device fingerprinting minimally effective in protecting WeChat Mini Programs.

• Security scanning scans the front-end and back-end of the mini program manually or automatically to check whether there are application vulnerabilities such as SQL injection, XSS cross-site scripting, directory traversal, and information leakage. However, the current cybercriminal attacks against WeChat Mini Programs are almost never carried out through application vulnerabilities. cybercriminal groups are an automated attack launched by forging business requests. The machine traffic it generates does not carry any vulnerability characteristics or malicious code, and is no different from normal requests.

Security scanning can detect vulnerabilities in WeChat Mini Programs early and avoid vulnerability attacks; but it does not provide any protection against non-vulnerability attacks.

• Security hardening Security hardening refers to a series of obfuscations and transformations on the front-end code of a mini program. While the execution logic remains unchanged, it reduces its readability and increases the difficulty for attackers to analyze the logic of the front-end code, thereby protecting the security of the mini program. Common transformation methods include: string encryption, variable name obfuscation, inserting junk code, calling equivalent transformations, control flow flattening, etc.

Security hardening can indeed raise the threshold of attack to a certain extent and dissuade novice cybercrime operators, but it still cannot defeat cybercrime operators with strong technical capabilities. Moreover, the code logic of the main body of the mini program will basically not change significantly, so the cracking is a one-time operation. As long as the benefits are large enough, the time cost required for cracking is acceptable for cybercrime ecosystem.

In addition, security hardening will inevitably bring about a certain degree of performance loss and stability degradation, and is inconvenient for debugging, so it is not widely used at present. We randomly selected 30 WeChat Mini Programs as analysis targets. After decompiling these WeChat Mini Programs, we found that none of the WeChat Mini Programs had obfuscated and reinforced the code. The situation is not optimistic.

• Interface protection performs signature verification on access to important business interfaces, which is one of the effective means to resist machine traffic. The most common method is to carry a signature (or token) in the interface request parameter or request header. The signature is generated by an algorithm with a certain strength on the front end of the mini program. The back end of the mini program verifies the legitimacy of the signature based on the corresponding algorithm. If the verification fails, it refuses to respond to this request. For the protocol attacks that WeChat Mini Programs mainly face, it can indeed increase the attack threshold. But the problem lies in the asymmetry between offense and defense.

Since the mini program code cannot be updated in real time, once the signature algorithm is cracked, it is necessary to wait until a new version of the mini program is released before the new signature algorithm can be upgraded. Releasing a new version requires a lot of time to comply with the product plan and undergo complete testing, which often leaves enough attack time for cybercrime ecosystem and greatly reduces the protective effect.

Since the protection effects of these existing protection solutions are relatively limited, we need to consider the characteristics of the mini program itself and combine cybercriminal groups attack intelligence and case analysis to tailor security protection suitable for mini programs.

4.2. Ideas for protecting WeChat Mini Programs

• Pay attention to the value of intelligence

"How can you know how to defend against an unknown attack?" Regardless of the product form, intelligence is very important for security offense and defense. Through intelligence, you can immediately sense whether there is an attack on one's own applet and the scale of the attack, and extract the technology and attack logic used by cybercrime ecosystem from the intelligence to carry out targeted countermeasures.

Here is a practical case: last year, a travel company used a mini program to attract users through a game and gave high cash rewards to those who passed the game. Under normal circumstances, players cannot clear the level within the specified time and need to rely on inviting friends to extend the game time. However, analysis of attack tools captured from the Threat Hunter business intelligence platform revealed that threat actors only need to forge interface requests for successful clearance, and can skip game levels and directly receive cash rewards. Based on this piece of information, the business side quickly made repairs to avoid further losses.

• Design reasonable rules. Reasonable rules need to be sufficiently attractive to normal users to ensure normal business operations; on the other hand, they need to increase the cost of cybercriminal attacks or reduce their benefits. Here are some suggestions on rule design for your reference.

1 cash red envelope:

1234Enlarge

It is not recommended to withdraw money instantly to allow time for review;

2 coupons:

If there are some low-value and easy-to-cash products on the platform (such as 10 yuan to recharge phone bills), no-threshold coupons are not recommended;

3 draws:

For some accounts that may have problems (for example, the IP address comes from the IDC computer room, lack of reporting of hidden activities, etc.), reduce the probability of winning.

4 Assistance to invite/bargain:

This is the most distinctive marketing method of WeChat Mini Programs. Since it is often necessary to invite multiple people, cybercriminal groups will use proxy IPs to avoid the problem of a single IP address when attacking. However, whether it is base station IP or ADSL dial-up IP, there are situations where good people and bad people mix it, resulting in a certain proportion of false alarms. The risk IP will be judged only after the number of people who have hit the risk IP can be large.

Significantly reduces the false alarm rate.

For example, when assistance requires inviting 5 people, and only 1 person hits the risky IP, the false positive rate is 1%; if 2 people hit the risky IP at the same time, the false positive rate is reduced to 0.01%, and if 5 people hit the risky IP at the same time, the false positive rate is negligible. The threshold for the number of people can be set based on the actual situation.

• Dynamic protection based on WeChat Mini Programs The idea of dynamic protection has been widely used in Apps and Web applications. The core idea is: the attack surface that is more fierce against cybercriminal groups attack and defense, such as the signature algorithm of interface protection, the code is not fixed, but changes dynamically. This makes it difficult for threat actors to find attack anchors and cannot carry out stable attacks.

For mini programs, the difficulty of this solution is that the code of the mini program can only be updated when a new version of the mini program is released, and cannot be dynamically distributed. In theory, only fixed code can be executed. However, we can change our thinking and take the signature algorithm as an example:

An algorithm = several algorithm fragments + fixed execution sequence. We place the algorithm fragments of all signature algorithms in the code file on the front end of the mini program out of order, and then dynamically issue the execution sequence on the back end, as shown below:

If there are 100 sets of algorithms, they correspond to 100 execution sequences, and one execution sequence is randomly issued each time to achieve the effect of dynamic signature. However, since all algorithm fragments are exposed locally, even if scrambled and obfuscated encryption is performed, it is difficult to guarantee that it will not be cracked over time. Therefore, it is still necessary to maintain an offensive and defensive confrontation with the cybercrime ecosystem. With the help of intelligence, we can effectively detect whether cybercriminal groups have bypassed protection, so that we can upgrade the algorithm in a targeted manner.

This is also our current main mini program protection solution.

• Written at the end, there is no technical solution that can solve certain types of security problems once and for all. The same is true for mini program security. More people need to participate, brainstorm, strengthen communication and cooperation, and jointly build security. We publish this report in the hope that it will spark more thinking and discussion in the industry and safeguard the healthy development of the mini program ecosystem.

About Threat Hunter

Threat Hunter takes cybercrime ecosystem intelligence capability building and attack and defense technology as its core to provide enterprises with business anti-fraud and API data security solutions. Through the business risk monitoring system, risk intelligence data capabilities and rich offensive and defensive experience of threat actors, it helps enterprises solve business fraud problems such as account security, marketing anti-fraud, traffic fraud, API security, etc., improves defensive effectiveness for enterprise fraud controls, and ensures the healthy development of the enterprise's online business.

Currently, it has cooperated with more than 300 corporate customers including Tencent, Alibaba, ByteDance, Baidu, Huawei, JD.com, China Merchants Bank, Huatai Securities, Didi, Pinduoduo, and iQiyi.