Security flaw in Chinese apps: Reward system can be manipulated
Multiple apps share the same backend, and security secrets are not protected.
1Introduction
Several Chinese civic and government-supported apps were found to use the same reward and lottery backend. In this system, the secret key used to ensure the authenticity of reward claims and draw outcomes is not actually protected. Researchers discovered that this key is stored on the client side and can be easily recovered.
2Shared Backend
The fact that the apps use the same backend means that if a security flaw is found, the entire system is at risk. This situation could lead to manipulation of reward and lottery mechanisms. Researchers traced this shared backend starting from a GitHub repository.
3Security Secrets
The secret key used to validate reward claims and draw outcomes is stored on the client side. The ease with which this key can be recovered seriously undermines the system's security. Researchers were able to use this key to generate valid reward claims and winning draw results.
4Manipulation Risk
The recovery of the secret key means users could manipulate reward claims and draw outcomes. This calls into question the reliability of the apps and could lead to users being exposed to unfair practices within the system.
5Research Process
Researchers started from a GitHub repository and traced their way to the shared backend. After examining the reward validation flow, they identified where the secret key was stored. This process highlights how the system's security vulnerabilities were uncovered.
6Conclusion and Importance
This discovery underscores the need for app developers to review their security measures. Shared backends and unprotected secret keys pose significant security risks. Promptly addressing such vulnerabilities is critical to ensuring user safety.