I Can Tell Your Secrets: Inferring Privacy Attributes from Mini-app Interaction History in Super-apps

• URL: http://arxiv.org/abs/2503.10239v1
• Date: Thu, 13 Mar 2025 10:29:40 GMT
• Title: I Can Tell Your Secrets: Inferring Privacy Attributes from Mini-app Interaction History in Super-apps
• Abstract summary: This paper reveals a new privacy leakage source in super-apps: mini-app interaction history (Mini-H) and operation history (Op-H)<n>Mini-H refers to the history of mini-apps accessed by users, such as their frequency and categories. Op-H captures user interactions within mini-apps, including button clicks, bar drags, and image views.<n>We design a mini-app interaction history-oriented inference attack (THEFT), to exploit this new vulnerability.
• Score: 14.642699257599991
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Super-apps have emerged as comprehensive platforms integrating various mini-apps to provide diverse services. While super-apps offer convenience and enriched functionality, they can introduce new privacy risks. This paper reveals a new privacy leakage source in super-apps: mini-app interaction history, including mini-app usage history (Mini-H) and operation history (Op-H). Mini-H refers to the history of mini-apps accessed by users, such as their frequency and categories. Op-H captures user interactions within mini-apps, including button clicks, bar drags, and image views. Super-apps can naturally collect these data without instrumentation due to the web-based feature of mini-apps. We identify these data types as novel and unexplored privacy risks through a literature review of 30 papers and an empirical analysis of 31 super-apps. We design a mini-app interaction history-oriented inference attack (THEFT), to exploit this new vulnerability. Using THEFT, the insider threats within the low-privilege business department of the super-app vendor acting as the adversary can achieve more than 95.5% accuracy in inferring privacy attributes of over 16.1% of users. THEFT only requires a small training dataset of 200 users from public breached databases on the Internet. We also engage with super-app vendors and a standards association to increase industry awareness and commitment to protect this data. Our contributions are significant in identifying overlooked privacy risks, demonstrating the effectiveness of a new attack, and influencing industry practices toward better privacy protection in the super-app ecosystem.

Related papers

• Don't Trust the Super-App: A Case Study of Russia's Max [6.434185166424619]
  Super-apps host third-party mini-apps inside a single app.<n>We show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps.
  arXiv  Detail & Related papers  (2026-09-10T17:08:00Z)
• TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps [3.345437353879255]
  Telegram Mini Apps are Web applications embedded within the Telegram client.<n>Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored.<n>We present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps.
  arXiv  Detail & Related papers  (2026-08-13T15:51:18Z)
• Do Phone-Use Agents Respect Your Privacy? [97.81424230136075]
  We introduce MyPhoneBench, a verifiable evaluation framework for privacy behavior in mobile agents.<n>We operationalize privacy-respecting phone use as permissioned access, minimal disclosure, and user-controlled memory through a minimal privacy contract.<n>Across five frontier models on 10 mobile apps and 300 tasks, we find that task success, privacy-compliant task completion, and later-session use of saved preferences are distinct capabilities.
  arXiv  Detail & Related papers  (2026-04-01T14:50:50Z)
• Privacy Beyond Pixels: Latent Anonymization for Privacy-Preserving Video Understanding [56.369026347458835]
  We introduce a novel formulation of visual privacy preservation for video foundation models that operates entirely in the latent space.<n>Current privacy preservation methods on input-pixel-level anonymization require retraining the entire utility video model.<n>A lightweight Anonym Adapter Module (AAM) removes private information from video features while retaining general task utility.
  arXiv  Detail & Related papers  (2025-11-11T18:56:27Z)
• A First Look at Privacy Risks of Android Task-executable Voice Assistant Applications [2.865294888425256]
  This paper presents a user-centric comprehensive empirical study on privacy risks in Android task-executable VA applications.<n>We cross-check their privacy declarations across six sources, including privacy labels, policies, and manifest files.<n>We uncover three significant privacy threat models: (1) privacy misdisclosure in mega apps, where integrated mini apps such as Alexa skills are inadequately represented; (2) privilege escalation via inter-application interactions, which exploit Android's communication mechanisms to bypass user consent; and (3) abuse of Google system applications, enabling apps to evade the declaration of dangerous permissions.
  arXiv  Detail & Related papers  (2025-09-28T06:47:06Z)
• AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents [75.85554113398626]
  We develop a benchmark called AgentDAM to evaluate how well existing and future AI agents can limit processing of potentially private information. Our benchmark simulates realistic web interaction scenarios and is adaptable to all existing web navigation agents.
  arXiv  Detail & Related papers  (2025-03-12T19:30:31Z)
• PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Action [54.11479432110771]
  PrivacyLens is a novel framework designed to extend privacy-sensitive seeds into expressive vignettes and further into agent trajectories. We instantiate PrivacyLens with a collection of privacy norms grounded in privacy literature and crowdsourced seeds. State-of-the-art LMs, like GPT-4 and Llama-3-70B, leak sensitive information in 25.68% and 38.69% of cases, even when prompted with privacy-enhancing instructions.
  arXiv  Detail & Related papers  (2024-08-29T17:58:38Z)
• Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code [19.7220607313348]
  Mini-applications, commonly referred to as mini-apps, are compact software programs embedded within larger applications or platforms. This paper investigates the potential of employing Large Language Models (LLMs) to detect privacy breaches within WeChat Mini Programs.
  arXiv  Detail & Related papers  (2024-02-12T01:55:40Z)
• MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis [14.835715789786137]
  MiniApps, operating within larger SuperApps, have revolutionized user experiences by offering a wide range of services without the need for individual app downloads.<n>Despite existing privacy regulations and platform guidelines, there is a lack of effective mechanisms to safeguard user privacy fully.<n>We introduce MiniScope, a novel two-phase hybrid analysis approach, specifically designed for the MiniApp environment.
  arXiv  Detail & Related papers  (2024-01-06T13:54:36Z)
• Systematic Analysis of Security and Vulnerabilities in Miniapps [12.900904404633957]
  Miniapps are of great importance in the mobile internet sector. Miniapps can directly impact compromising the integrity of sensitive data. This paper proposes a triad threat model focusing on users, servers and attackers to mitigate the security risk of miniapps.
  arXiv  Detail & Related papers  (2023-11-19T17:47:26Z)
• ATLAS: Automatically Detecting Discrepancies Between Privacy Policies and Privacy Labels [2.457872341625575]
  We introduce the Automated Privacy Label Analysis System (ATLAS) ATLAS identifies possible discrepancies between mobile app privacy policies and their privacy labels. We find that, on average, apps have 5.32 such potential compliance issues.
  arXiv  Detail & Related papers  (2023-05-24T05:27:22Z)
• The Privacy Onion Effect: Memorization is Relative [76.46529413546725]
  We show an Onion Effect of memorization: removing the "layer" of outlier points that are most vulnerable exposes a new layer of previously-safe points to the same attack. It suggests that privacy-enhancing technologies such as machine unlearning could actually harm the privacy of other users.
  arXiv  Detail & Related papers  (2022-06-21T15:25:56Z)
• SPAct: Self-supervised Privacy Preservation for Action Recognition [73.79886509500409]
  Existing approaches for mitigating privacy leakage in action recognition require privacy labels along with the action labels from the video dataset. Recent developments of self-supervised learning (SSL) have unleashed the untapped potential of the unlabeled data. We present a novel training framework which removes privacy information from input video in a self-supervised manner without requiring privacy labels.
  arXiv  Detail & Related papers  (2022-03-29T02:56:40Z)
• Analysis of Longitudinal Changes in Privacy Behavior of Android Applications [79.71330613821037]
  In this paper, we examine the trends in how Android apps have changed over time with respect to privacy. We examine the adoption of HTTPS, whether apps scan the device for other installed apps, the use of permissions for privacy-sensitive data, and the use of unique identifiers. We find that privacy-related behavior has improved with time as apps continue to receive updates, and that the third-party libraries used by apps are responsible for more issues with privacy.
  arXiv  Detail & Related papers  (2021-12-28T16:21:31Z)
• Emerging App Issue Identification via Online Joint Sentiment-Topic Tracing [66.57888248681303]
  We propose a novel emerging issue detection approach named MERIT. Based on the AOBST model, we infer the topics negatively reflected in user reviews for one app version. Experiments on popular apps from Google Play and Apple's App Store demonstrate the effectiveness of MERIT.
  arXiv  Detail & Related papers  (2020-08-23T06:34:05Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.