Search papers, labs, and topics across Lattice.
This paper introduces a hybrid security framework aimed at enhancing the compliance and safety of WeChat Mini Programs by assessing the visual UI design and network behavior. Utilizing YOLOv8 for image analysis, the framework detects and evaluates the positioning and sizing of interactive elements, while mitmproxy captures and analyzes data requests to identify unsafe redirections. The key finding reveals significant compliance issues, such as improperly sized buttons leading to accidental clicks, which pose risks to user security and financial safety.
Misplaced buttons in WeChat Mini Programs can lead to involuntary payments and serious security breaches, highlighting a critical gap in mobile app compliance.
With the continuous development of the WeChat ecosystem, WeChat Mini Programs, due to their advantages of not requiring installation, using little memory, and being ready to use instantly, have seen a surge in user numbers and have now become an indispensable service carrier in mobile internet. However, as Mini Programs rapidly became popular, issues regarding the compliance of their interface interaction design and the safety of operational behavior have become increasingly apparent. Many Mini Programs have problems such as clickable buttons and icons not being standard in size, or ad pop-ups and payment entrances being placed in a way that is easy to misclick. The close or cancel buttons are often too small or hidden, making it easy to accidentally click on ads or payment content, and difficult to accurately click the cancel button. This can result in involuntary payments or being redirected to illegal pages, causing unnecessary financial losses and seriously harming users'property security and legal rights. To address the above issues, this article develops a detection program to check the position and size of various icons and buttons in Mini Programs, and analyze whether redirected links fall within a safe range. YOLOv8 is used to identify various buttons in images, displaying the corresponding icon and its data based on the mouse click position. Violations are flagged and recorded. At the same time, mitmproxy is used to capture relevant data requests generated during clicks, analyzing the safety of redirections, and presenting key information for user observation.
