{"id":"https://openalex.org/W4394966854","doi":"https://doi.org/10.1109/tifs.2024.3390553","title":"The Dark Forest: Understanding Security Risks of Cross-Party Delegated Resources in Mobile App-in-App Ecosystems","display_name":"The Dark Forest: Understanding Security Risks of Cross-Party Delegated Resources in Mobile App-in-App Ecosystems","publication_year":2024,"publication_date":"2024-01-01","ids":{"openalex":"https://openalex.org/W4394966854","doi":"https://doi.org/10.1109/tifs.2024.3390553"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2024.3390553","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3390553","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5080958549","display_name":"Zhibo Zhang","orcid":"https://orcid.org/0009-0001-7324-6090"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhibo Zhang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0001-7324-6090","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101455341","display_name":"Lei Zhang","orcid":"https://orcid.org/0000-0002-9298-2536"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lei Zhang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-9298-2536","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028747752","display_name":"Guangliang Yang","orcid":"https://orcid.org/0000-0001-7066-0109"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangliang Yang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-7066-0109","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yanjun Chen","orcid":"https://orcid.org/0009-0000-3966-6078"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanjun Chen","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0000-3966-6078","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101622579","display_name":"Jiahao Xu","orcid":"https://orcid.org/0009-0006-8410-2371"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiahao Xu","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052437722","display_name":"Min Yang","orcid":"https://orcid.org/0000-0001-9714-5545"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]},{"id":"https://openalex.org/I4210120250","display_name":"Shanghai Technical Institute of Electronics & Information","ror":"https://ror.org/01wh3jw63","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210120250"]},{"id":"https://openalex.org/I4210126530","display_name":"Data Assurance and Communication Security","ror":"https://ror.org/02z2gfm30","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210126530","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China","Engineering Research Center of Cyber Security Auditing and Monitoring, Shanghai, China","Shanghai Institute of Intelligent Electronics & Systems, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9714-5545","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]},{"raw_affiliation_string":"Engineering Research Center of Cyber Security Auditing and Monitoring, Shanghai, China","institution_ids":["https://openalex.org/I4210126530"]},{"raw_affiliation_string":"Shanghai Institute of Intelligent Electronics & Systems, Shanghai, China","institution_ids":["https://openalex.org/I4210120250"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4077,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.80328867,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":"19","issue":null,"first_page":"5434","last_page":"5448"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9940000176429749,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9919000267982483,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7201547622680664},{"id":"https://openalex.org/keywords/ecosystem","display_name":"Ecosystem","score":0.6525446176528931},{"id":"https://openalex.org/keywords/mobile-apps","display_name":"Mobile apps","score":0.5687007308006287},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.41885361075401306},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.3720695376396179},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.3396361768245697},{"id":"https://openalex.org/keywords/ecology","display_name":"Ecology","score":0.13699489831924438}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7201547622680664},{"id":"https://openalex.org/C110872660","wikidata":"https://www.wikidata.org/wiki/Q37813","display_name":"Ecosystem","level":2,"score":0.6525446176528931},{"id":"https://openalex.org/C2988145974","wikidata":"https://www.wikidata.org/wiki/Q620615","display_name":"Mobile apps","level":2,"score":0.5687007308006287},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.41885361075401306},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3720695376396179},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3396361768245697},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.13699489831924438},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2024.3390553","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2024.3390553","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.5199999809265137,"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15"}],"awards":[{"id":"https://openalex.org/G5909397362","display_name":null,"funder_award_id":"61972099","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6002904008","display_name":null,"funder_award_id":"62102091","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7071978877","display_name":null,"funder_award_id":"62102093","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7309927977","display_name":null,"funder_award_id":"2021YFB3101200","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G7607136314","display_name":null,"funder_award_id":"62172104","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8928773622","display_name":null,"funder_award_id":"62172105","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":47,"referenced_works":["https://openalex.org/W36948825","https://openalex.org/W38766468","https://openalex.org/W1486263771","https://openalex.org/W1988111369","https://openalex.org/W2005476560","https://openalex.org/W2066428817","https://openalex.org/W2119249378","https://openalex.org/W2148009765","https://openalex.org/W2167661907","https://openalex.org/W2188710721","https://openalex.org/W2536021772","https://openalex.org/W2560459036","https://openalex.org/W2598567693","https://openalex.org/W2754689772","https://openalex.org/W2756264071","https://openalex.org/W2766169223","https://openalex.org/W2781246331","https://openalex.org/W2794889514","https://openalex.org/W2808406842","https://openalex.org/W2895489719","https://openalex.org/W2904279077","https://openalex.org/W2947593054","https://openalex.org/W2987774250","https://openalex.org/W2997611631","https://openalex.org/W3009502465","https://openalex.org/W3049518349","https://openalex.org/W3097802856","https://openalex.org/W3106490093","https://openalex.org/W3130179069","https://openalex.org/W3165906163","https://openalex.org/W3194926883","https://openalex.org/W4281754643","https://openalex.org/W4308391531","https://openalex.org/W4384302769","https://openalex.org/W4385413429","https://openalex.org/W4385489203","https://openalex.org/W4388857088","https://openalex.org/W4388858806","https://openalex.org/W6713329725","https://openalex.org/W6714048833","https://openalex.org/W6754450948","https://openalex.org/W6764197484","https://openalex.org/W6766914566","https://openalex.org/W6776564092","https://openalex.org/W6781164098","https://openalex.org/W6782007757","https://openalex.org/W6788222877"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2890710341","https://openalex.org/W4386428464","https://openalex.org/W4386943045","https://openalex.org/W3048828723","https://openalex.org/W2900969150","https://openalex.org/W1504696296","https://openalex.org/W3046338786","https://openalex.org/W2179620014","https://openalex.org/W2808363712"],"abstract_inverted_index":{"In":[0,129],"app-in-app":[1,148,179,215],"ecosystems,":[2],"mobile":[3],"applications":[4],"(i.e.,":[5,16],"host":[6,74,100,210],"apps)":[7],"often":[8],"delegate":[9],"their":[10,143,221],"rich":[11],"resources":[12,34,71],"to":[13,22,45,57,77,109,188,209],"hosted":[14],"parties":[15],"sub-apps),":[17],"which":[18],"can":[19,186],"be":[20],"utilized":[21],"provide":[23],"millions":[24],"of":[25,92,111,118,138,168,206,213],"effective":[26],"services":[27],"including":[28,156],"shopping,":[29],"banking,":[30],"and":[31,42,47,52,63,90,97,102,106,142,161,197,217],"government.":[32],"These":[33],"vary":[35],"from":[36],"system":[37],"abilities":[38],"(e.g.,":[39,50],"web":[40],"socket":[41],"GPS":[43],"location)":[44],"app":[46,211],"user":[48,200],"data":[49],"storage":[51],"phone":[53],"number).":[54],"This":[55],"leads":[56],"an":[58],"important":[59],"research":[60],"question\u2014carefully":[61],"design":[62],"enforce":[64],"security":[65,83,113,127,140,144,171,184],"regulations":[66,84,141,172],"on":[67],"these":[68,112,126],"cross-party":[69],"delegated":[70],"(CPDR).":[72],"Real-world":[73],"apps,":[75],"according":[76],"our":[78,119,207],"study,":[79],"adopt":[80],"11":[81],"common":[82,170],"in":[85,146],"protecting":[86],"the":[87,116,134,139,169],"integrity,":[88],"confidentiality,":[89],"availability":[91],"CPDR.":[93],"However,":[94],"existing":[95],"practice":[96],"compliance":[98],"between":[99],"apps":[101],"sub-apps":[103],"are":[104,173],"vague":[105],"inconsistent,":[107],"leading":[108],"violations":[110,167],"regulations.":[114,128],"To":[115],"best":[117],"knowledge,":[120],"no":[121],"prior":[122],"works":[123],"have":[124],"studied":[125,178],"this":[130],"paper,":[131],"we":[132],"perform":[133],"first":[135],"systematic":[136],"study":[137],"weaknesses":[145],"real-world":[147],"ecosystems.":[149,180],"We":[150,164,202],"propose":[151],"three":[152],"novel":[153],"attack":[154],"vectors":[155],"masquerade":[157],"attack,":[158,160],"data-driven":[159],"channel":[162],"hijacking.":[163],"find":[165],"that":[166],"widespread":[174],"among":[175],"all":[176,205],"9":[177],"More":[181],"importantly,":[182],"such":[183,191],"weakness":[185],"lead":[187],"severe":[189],"consequences":[190],"as":[192],"manipulating":[193],"sub-apps\u2019":[194],"back-end":[195],"servers":[196],"stealing":[198],"sensitive":[199],"data.":[201],"responsibly":[203],"report":[204],"findings":[208],"developers":[212],"affected":[214],"ecosystems":[216],"help":[218],"them":[219],"fix":[220],"vulnerabilities.":[222]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}