Chinese Civic Apps’ Shared Reward Backend Lets Attackers Forge Government Lottery Wins
The post shows that dozens of Chinese city and state‑media apps run on a single multi‑tenant SaaS platform, isolated only by a client_id. Because the signing process uses a public salt and serves the HMAC key on request, an attacker can forge reward‑campaign requests—including sweepstakes and Alipay cash‑outs—across any tenant.