TLDR Tech / InfoSec
Forging the government's lottery: China's civic apps run on a shared reward backend with no real secret
Chinese local government and state‑media apps rely on shared “interactive marketing” SaaS platforms where tenants are separated mainly by a client_id, but the signing scheme meant to protect reward campaigns uses a public salt and an HMAC key served openly via an init endpoint, making points, quizzes, and lottery draws forgeable at scale. Farmers automate civic app actions such as article reading, quizzes, and sweepstakes using plaintext scripts, solve CAPTCHAs with ddddocr, and cash out rewards to Alipay, while some scripts target Beijing municipal social‑services quizzes and answer them automatically with Xunfei Spark, creating fake engagement and lottery entries tied to citizen accounts.
Read the full story