不要信任超级应用：俄罗斯 Max 的案例研究

中文摘要 AI 辅助

超级应用是一种新兴的移动架构，在单个应用内托管第三方小程序，允许用户访问各种服务。十年来对超级应用生态系统的安全研究一直假设超级应用是可信的中介。我们认为这种隐含的信任难以证明：中国的微信已被证明会以前所未有的规模被动跟踪用户在小程序间的活动；据报道，俄罗斯 Max 的母公司与国家起诉网络言论深度纠缠；而伊朗的 Bale 据报道因其国家支持而在全球最长的互联网关闭期间运作。在本文中，我们展示了恶意超级应用如何拥有不可否认的能力，在不留下任何痕迹的情况下悄然破坏小程序和用户的安全与隐私。以 Max 为例，我们展示了它如何捕获小程序用户界面、读写小程序本地存储、向小程序运行时注入任意 JavaScript、调解小程序网络流量，并控制认证上下文，从而能够实现静默的用户冒充。遗憾的是，由于设计赋予超级应用的架构特权，这些能力在任何超级应用中都会显现。我们认为，迫切需要移动操作系统和应用商店的干预，以在进一步利用之前关闭这一架构盲点。

英文摘要

Super-apps, an emerging mobile architecture, host third-party mini-apps inside a single app, allowing users to access diverse services. A decade of security research on the super-app ecosystem has all assumed super-apps to be a trusted intermediary. We argue this implicit trust is difficult to justify: China's WeChat is already shown to passively track its user's activity across mini-apps at extraordinary scale; Russia's MAX's parent company is reported to be deeply entangled with the state prosecution of online speech; and Iran's Bale was reported to be functioning in the world's longest internet shutdown due to its state-backed support. In this paper, we show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps and users without leaving any trace. Using MAX as an example, we show how it can capture mini-app UI, read and write mini-app local storage, inject arbitrary JavaScript into a mini-app's runtime, mediate mini-app network traffic, and control authentication context in ways that can enable silent user impersonation. Sadly, these capabilities manifest themselves in any super-app because of the architectural privileges granted to them by design. We argue that mobile OS and app store interventions are urgently needed to close this architectural blind spot before it is further exploited.

发表机构

• University of Michigan（密歇根大学）
• University of Calgary（卡尔加里大学）
• Georgia Institute of Technology（佐治亚理工学院）
• Indian Institute of Technology, Delhi（德里印度理工学院）

机构由 AI 辅助整理，请以论文原文为准。