Don't Trust the Super-App: A Case Study of Russia's Max
[Kryptografia i bezpieczeństwo] Autorzy: Richa Priyanka, Aaron Ortwein, Joel Reardon i 3 więcej
Super-apps, an emerging mobile architecture, host third-party mini-apps inside a single app, allowing users to access diverse services. A decade of security research on the super-app ecosystem has all assumed super-apps to be a trusted intermediary. We argue this implicit trust is difficult to justify: China's WeChat is already shown to passively track its user's activity across mini-apps at extraordinary scale; Russia's MAX's parent company is reported to be deeply entangled with the state prosecution of online speech; and Iran's Bale was reported to be functioning in the world's longest internet shutdown due to its state-backed support. In this paper, we show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps and users without leaving any trace. Using MAX as an example, we show how it can capture mini-app UI, read and writ…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo