Protecting Network Traffic of One Billion: Reverse-Engineering Chinese Cryptography

The speakers start from the observation that the security community has largely focused on TLS-protected traffic, while many large Chinese apps with hundreds of millions of users rely on proprietary network cryptography. They organize the research around three case studies: the custom protocol behind WeChat traffic, cloud-based keyboard apps, and browsers popular in China.

For WeChat, the team found that requests were encrypted twice by overlapping schemes that had accumulated over about a decade, with separately stored keys and handshakes. They also showed that mini-program usage data, including search terms and viewed products, was forwarded back to the company by default. In the keyboard apps, one vendor's Windows and Android versions were open to a padding oracle attack, which let a network eavesdropper decrypt keystrokes in transit and, in one case, recover part of a key through an XOR side effect. The browser study described hardcoded keys, weak custom ciphers, an easily factored RSA public key, and update mechanisms that skipped proper signature checks, exposing hardware identifiers and visited URLs.

Most vendors moved to standard TLS after disclosure, though some did not fully fix their issues. The speakers argue that these ecosystems are understudied, that flaws there are often easy to find with ordinary tools such as Wireshark, and that researchers should study network encryption in China.