Don't Trust the Super-App: A Case Study of Russia's Max
Researchers show super-apps like Russia's Max can silently capture mini-app UI, storage, network traffic, and authentication, enabling untraceable user impersonation.
The paper challenges the assumption that super-apps are trusted intermediaries, citing WeChat's passive cross-mini-app tracking, Russia's Max's entanglement with state prosecution of online speech, and Iran's Bale operating during a prolonged internet shutdown. Using Max as a case study, the authors demonstrate that a super-app can capture mini-app UI, read and write mini-app local storage, inject arbitrary JavaScript into mini-app runtimes, mediate network traffic, and control authentication context, enabling silent user impersonation without trace. They argue these capabilities are inherent to the super-app architecture and call for mobile OS and app store interventions to close the blind spot.
- Super-app architectural privileges enable silent surveillance and impersonation of mini-app users.
- Demonstrated capabilities: UI capture, storage access, JavaScript injection, traffic mediation, auth control.
- WeChat already shown to passively track activity across mini-apps at large scale.
- Russia's Max parent company reportedly entangled with state prosecution of online speech.
- Authors urge mobile OS and app store interventions to close the architectural gap.
From the original article
1 min read at arxiv.orgSuper-apps, an emerging mobile architecture, host third-party mini-apps inside a single app, allowing users to access diverse services. A decade of security research on the super-app ecosystem has all assumed super-apps to be a trusted intermediary.
By Richa Priyanka · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.