TeleGapper, a black-box dynamic analysis framework, is presented, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps by capturing runtime network traffic, identifying third-party communications, and comparing observed data flows against disclosed privacy information.
Abstract
Telegram Mini Apps are Web applications embedded within the Telegram client, forming an ecosystem of third-party services within one of the world's most widely used messaging platforms. Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored. Unlike ecosystems such as WeChat, which rely on tightly controlled, proprietary execution frameworks, Telegram adopts a different model: Mini Apps run inside a WebView, combining platform-provided context with standard Web capabilities and unrestricted outbound networking. This enables applications to transmit sensitive information to analytics, advertising, tracking, or other third parties through ordinary Web requests, often with limited visibility. Privacy disclosures are therefore critical for transparency. Telegram allows Mini Apps either to define an application-specific privacy policy or to rely on a platform-provided default policy. While the latter reduces the developer's disclosure burden, it may lead to generic statements that do not accurately capture actual data practices of individual Mini Apps. In this paper, we present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps by capturing runtime network traffic, identifying third-party communications, and comparing observed data flows against disclosed privacy information. We evaluate 278 working Mini Apps collected from tApps Center, a community-driven catalogue for discovering third-party applications in Telegram. We find that 59.4% contact at least one undisclosed third party, 78.8% rely exclusively on Telegram's default privacy policy, and none provides a consent or opt-out mechanism. These findings expose a substantial transparency and compliance gap in a widely used yet understudied ecosystem.
Telegram, with over 450 million daily active users, has introduced Mini Apps---web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials---such as session tokens and wallet mnemonic phrases---in plaintext on client devices, exposing users to unauthorized access, impersonation, and financial exploitation. While insecure client-side storage is a known risk in web applications, the Telegram Mini App ecosystem presents a uniquely dangerous combination of factors absent from prior work: no platform-level security review, no storage access restrictions, a financially motivated user base handling live cryptocurrency assets, and a WebView environment that offers weaker protections than standalone browsers. To investigate this threat, we present TENET, a purpose-built auditing tool whose design decisions---pattern selection, entropy thresholds, and charset validation---are grounded in the structural properties of the secrets targeted and empirically validated against a ground-truth dataset. We screened 61 Mini Apps using a stratified, popularity-weighted sampling strategy based on popularity. Of the 37 applications that met our processing criteria and were analyzed, 30 exhibited security flaws, which we classify into three severity tiers: plaintext storage, recoverable encryption, and replayable tokens. Notably, even Telegram's official Wallet exhibits a severe vulnerability that may lead to full account compromise. Following our responsible disclosure, Telegram implemented two new secure-storage APIs, and our post-remediation verification confirmed that its official Wallet no longer exposes the recovery mnemonic in plaintext. Finally, we propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.
Andrea Ciccotelli, Federico Zappone, Roberto Di Pietro· 0 citations
The systematic and excessive data collection practices of tech companies have rendered online privacy both a necessity and a sought-after commodity. However, while the privacy risks of the web, mobile, and IoT ecosystems have been extensively examined, desktop environments have been largely overlooked. As desktop apps continue to be widely used, they remain a critical yet understudied dimension of user privacy. In this paper, we address this gap by presenting the first, to our knowledge, comprehensive study of the mechanisms designed to regulate and disclose data collection and sharing practices in the macOS ecosystem. We adopt an app-development-centric view, and shed light on the interactions between the various macOS mechanisms that mediate apps'data access. Driven by our findings, we develop NutriScan, an analysis framework that incorporates both static and dynamic analysis techniques to create a consolidated view of macOS apps'data practices and disclosures. We use our system to dynamically analyze 1K macOS apps, and find that 85% of them access user-data APIs without disclosing it. 49.7% also exfiltrate data to advertising entities and hosting providers, 12.5% of which do so without a corresponding disclosure. We find that desktop apps are being leveraged by online trackers to enrich user profiles and device fingerprints, thus shedding new light on the true scope of the online tracking ecosystem. Our analysis reveals how the macOS app ecosystem is comprised of disjoint mechanisms with divergent data abstractions, thus increasing complexity for developers while also facilitating undisclosed privacy-invasive practices. Accordingly, we propose a series of mitigations that aim to both streamline the data disclosure process for developers and improve Apple's app vetting process.
Jyotirmay Chauhan, Kostas Solomos, Mir Masood Ali et al.· 0 citations
A layered system model and an analysis pipeline that uses prior history as the temporal baseline, applies cumulative pruning and cross-proof propagation to each proof's Commitment Set, and recursively traces the survivors through historical hidden-state transitions to derive the final transaction-level Anonymity Set Size is proposed.
Hanze Guo, Stefanos Chaliasos, Yebo Feng et al.· 0 citations
One of the core privacy features of smartphone operating systems is a permission framework that requires explicit user consent before granting apps access to private data. Such systems are deeply integrated into Google's Android and Apple's iOS, which together account for the majority of the smartphone operating system market. While permission systems can be seen as milestones in user empowerment and privacy protection, they offer users only a binary choice: whether an app can access a specific resource or not. As soon as an app is allowed to read a resource, the operating system loses control over its further use. Most apps have Internet access and can send permission-protected data, like a user's location, over the Internet, which can harm user privacy. To solve this problem, we present an addition to current permission systems that splits apps into multiple sandboxed processes to enforce fine-grained privacy and data-flow controls on smartphones. By default, our design forces apps to process permission-protected data locally on the device, thereby eliminating the need for apps to request runtime permissions for local-only use cases. We implement a proof-of-concept based on the Android Open Source Project code base. We showcase our framework's practicability by adapting multiple app use cases to our system, benchmarking its computational overhead, and discussing the implications for platform operators, developers, and users.
Lucas Becker, David Breuer, Matthias Hollick· Proceedings on Privacy Enhan...· 0 citations
This work presents the first privacy- and security-oriented measurement of M365 third-party applications, and finds that only 1,069 of them expose both descriptions and permission sets, with significant inconsistencies in transparency across official distribution channels.
Vincenzo Longo, Alberto Verna, Nikhil Jha et al.· 0 citations
Large Language Models (LLMs) such as ChatGPT, Gemini, Claude, etc. have become integral tools for technical writing, software development, and communication. However, these systems, despite privacy assurances, still expose a significant privacy risk. User prompts often contain personally identifiable or proprietary information that is transmitted in plain-text to external providers, where it may be logged or accessed despite opt-out policies. This research aims to address this gap by designing a lightweight local encryption middleware that acts as a privacy firewall between users and remote AI APIs. Before a message is sent, the middleware automatically detects sensitive entities (Personally Identifiable Information or PII) and replaces them with typed placeholders such as [PERSON_1] or [ORG_1]. A local mapping (with optional authenticated encryption at rest) links these placeholders to their original values, allowing the system to reconstruct (rehydrate) the final response once the model replies. This design aims to reduce the exposure of sensitive information in human-readable form while maintaining the AI output. We evaluate the system in terms of detection accuracy, reconstruction fidelity, and utility preservation, demonstrating a practical solution for privacy-preserving LLM interaction.
Aditya Vishwakarma, Wencen Wu· International Conference on...· 0 citations
