{"id":"https://openalex.org/W4388958931","doi":"https://doi.org/10.1145/3605762.3624430","title":"TrustedDomain Compromise Attack in App-in-app Ecosystems","display_name":"TrustedDomain Compromise Attack in App-in-app Ecosystems","publication_year":2023,"publication_date":"2023-11-23","ids":{"openalex":"https://openalex.org/W4388958931","doi":"https://doi.org/10.1145/3605762.3624430"},"language":"en","primary_location":{"id":"doi:10.1145/3605762.3624430","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605762.3624430","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605762.3624430","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3605762.3624430","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5080958549","display_name":"Zhibo Zhang","orcid":"https://orcid.org/0009-0001-7324-6090"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhibo Zhang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0001-7324-6090","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093328792","display_name":"Zhangyue Zhang","orcid":"https://orcid.org/0009-0005-2188-0398"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhangyue Zhang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0005-2188-0398","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046500178","display_name":"Keke Lian","orcid":"https://orcid.org/0009-0005-9026-8995"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Keke Lian","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0005-9026-8995","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028747752","display_name":"Guangliang Yang","orcid":"https://orcid.org/0000-0001-7066-0109"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangliang Yang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-7066-0109","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101455341","display_name":"Lei Zhang","orcid":"https://orcid.org/0000-0002-9298-2536"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lei Zhang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-9298-2536","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017552210","display_name":"Yuan Zhang","orcid":"https://orcid.org/0000-0003-0726-9996"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Zhang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0003-0726-9996","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052437722","display_name":"Min Yang","orcid":"https://orcid.org/0000-0001-9714-5545"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9714-5545","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I24943067"],"apc_list":null,"apc_paid":null,"fwci":1.2053,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.82610734,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"51","last_page":"57"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9955000281333923,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7504696846008301},{"id":"https://openalex.org/keywords/app-store","display_name":"App store","score":0.6403815746307373},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.5992698669433594},{"id":"https://openalex.org/keywords/mobile-apps","display_name":"Mobile apps","score":0.5927826166152954},{"id":"https://openalex.org/keywords/compromise","display_name":"Compromise","score":0.5642855763435364},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.5507711172103882},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5283644199371338},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.4939456582069397},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.44707268476486206},{"id":"https://openalex.org/keywords/trusted-computing","display_name":"Trusted Computing","score":0.4273822605609894},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.41492941975593567},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.3457198143005371},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2511005401611328}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7504696846008301},{"id":"https://openalex.org/C2779794324","wikidata":"https://www.wikidata.org/wiki/Q3814081","display_name":"App store","level":2,"score":0.6403815746307373},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.5992698669433594},{"id":"https://openalex.org/C2988145974","wikidata":"https://www.wikidata.org/wiki/Q620615","display_name":"Mobile apps","level":2,"score":0.5927826166152954},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.5642855763435364},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.5507711172103882},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5283644199371338},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4939456582069397},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.44707268476486206},{"id":"https://openalex.org/C2776831232","wikidata":"https://www.wikidata.org/wiki/Q966812","display_name":"Trusted Computing","level":2,"score":0.4273822605609894},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.41492941975593567},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3457198143005371},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2511005401611328},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3605762.3624430","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605762.3624430","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605762.3624430","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3605762.3624430","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605762.3624430","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605762.3624430","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.5600000023841858,"id":"https://metadata.un.org/sdg/15","display_name":"Life in Land"}],"awards":[{"id":"https://openalex.org/G3062299927","display_name":null,"funder_award_id":"21QA1400700","funder_id":"https://openalex.org/F4320327803","funder_display_name":"Shanghai Rising-Star Program"},{"id":"https://openalex.org/G4764057691","display_name":null,"funder_award_id":"62172104, 62172105, 61972099, 62102093, 62102091","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5909397362","display_name":null,"funder_award_id":"61972099","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6002904008","display_name":null,"funder_award_id":"62102091","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7071978877","display_name":null,"funder_award_id":"62102093","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7309927977","display_name":null,"funder_award_id":"2021YFB3101200","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G7607136314","display_name":null,"funder_award_id":"62172104","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8590833815","display_name":null,"funder_award_id":"21TQ140 0100","funder_id":"https://openalex.org/F4320321851","funder_display_name":"Fudan University"},{"id":"https://openalex.org/G8928773622","display_name":null,"funder_award_id":"62172105","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321851","display_name":"Fudan University","ror":"https://ror.org/013q1eq08"},{"id":"https://openalex.org/F4320327803","display_name":"Shanghai Rising-Star Program","ror":null},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4388958931.pdf","grobid_xml":"https://content.openalex.org/works/W4388958931.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W1577719850","https://openalex.org/W1974977720","https://openalex.org/W2129596343","https://openalex.org/W2148009765","https://openalex.org/W2510134782","https://openalex.org/W2756264071","https://openalex.org/W2904279077","https://openalex.org/W2990714382","https://openalex.org/W2997611631","https://openalex.org/W3009502465","https://openalex.org/W3097802856","https://openalex.org/W3121930976","https://openalex.org/W3130179069","https://openalex.org/W3165906163","https://openalex.org/W4237358558","https://openalex.org/W4308391531","https://openalex.org/W4308643064","https://openalex.org/W4324007043","https://openalex.org/W4384302769"],"related_works":["https://openalex.org/W3142571737","https://openalex.org/W2890710341","https://openalex.org/W2605037362","https://openalex.org/W3173766926","https://openalex.org/W3120409491","https://openalex.org/W785354139","https://openalex.org/W4387360127","https://openalex.org/W4226085607","https://openalex.org/W2011781116","https://openalex.org/W4367026699"],"abstract_inverted_index":{"Emerging":[0],"app-in-app":[1,35,72,142,174],"ecosystems":[2,73,175],"(e.g.,":[3],"WeChat)":[4],"provide":[5],"a":[6,46,92],"lightweight":[7],"and":[8,23,55,121,157,179],"efficient":[9],"WebView-based":[10],"runtime":[11,127],"for":[12,150,163],"mini-apps,":[13],"which":[14,108],"frequently":[15],"load":[16],"rich":[17],"web":[18,57,78],"content":[19,40],"from":[20,52],"remote":[21],"servers":[22],"access":[24],"sensitive":[25],"resources":[26],"via":[27],"APIs":[28],"provided":[29],"by":[30,38],"the":[31,34,39,65,81,118,132,137,140,147,151,154,185],"super-apps":[32,44],"(a.k.a.":[33],"frameworks).":[36],"Inspired":[37],"security":[41],"policy":[42],"(CSP),":[43],"enforce":[45],"domain-based":[47,66],"allowlist":[48,67,82,119,155],"to":[49,116,184],"prevent":[50],"mini-apps":[51],"loading":[53],"untrusted":[54],"malicious":[56],"content.":[58],"In":[59],"this":[60],"paper,":[61],"we":[62,90,130,145,188],"observe":[63],"that":[64,172],"mechanism":[68,156],"is":[69],"unreliable":[70],"in":[71,139,166],"because":[74],"it":[75],"assumes":[76],"all":[77,182],"pages":[79],"under":[80],"domain":[83],"are":[84,181],"trusted.":[85],"To":[86],"demonstrate":[87],"such":[88],"weakness,":[89],"propose":[91,158],"novel":[93],"attack":[94,105,124],"called":[95],"Trusted":[96],"Domain":[97],"Compromise":[98],"(TDC)":[99],"Attack,":[100],"along":[101],"with":[102],"two":[103],"interesting":[104],"vectors,":[106],"through":[107],"attackers":[109],"can":[110],"manipulate":[111],"unsafe":[112],"domains":[113],"or":[114,125],"URLs":[115],"bypass":[117],"check":[120],"launch":[122],"phishing":[123],"abuse":[126],"APIs.":[128],"Thereafter,":[129],"conduct":[131],"first":[133],"empirical":[134],"study":[135],"on":[136],"TDCAttack":[138],"real-world":[141,167,193],"ecosystems.":[143],"Specifically,":[144],"investigate":[146],"underlying":[148],"reasons":[149],"failure":[152],"of":[153],"an":[159],"automated":[160],"analysis":[161],"framework":[162],"identifying":[164],"TDCAttacks":[165],"mini-apps.":[168,194],"Our":[169],"experiment":[170],"shows":[171],"popular":[173],"including":[176],"WeChat,":[177],"Alipay,":[178],"Baidu":[180],"vulnerable":[183],"TDCAttack.":[186],"Further,":[187],"have":[189],"identified":[190],"26":[191],"exploitable":[192]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}