MiniBLE: Exploring Insecure BLE API Usages in Mini-Programs
Zidong Zhang, Jianqi Du, Wenrui Diao, Jianliang Wu · 2023
As the ecosystem of emerging mini-programs rapidly develops, an increasing number of IoT devices, particularly BLE devices, are providing accompanying mini-programs as a convenient means for end users to control these IoT devices. The associated security issues have also attracted researchers' interest recently. However, existing research on mini-program security primarily focuses on their permissions, common development bugs, and cross-mini-program communications with little attention on interactions between mini-program and IoT devices. We propose MiniBLE, a static taint analysis tool for analyzing BLE mini-programs, focusing on detecting insecure BLE pairing issues. MiniBLE was used to analyze 41,276 real-world mini-programs, demonstrating its effectiveness in identifying potential vulnerabilities. We show MiniBLE with some preliminary results and a real-world case study in this work-in-progress (WIP) paper.