Russia’s state-backed messaging app Max can secretly change how it surveils individual users, researchers at InterSecLab find
The Kremlin-backed Max messenger has broad capabilities for tracking users, but their configuration can vary from account to account and is controlled by its developer, the Russian social media company VK. That’s according to a new report from the digital security lab InterSecLab, which Meduza has reviewed. For nine weeks, the report’s authors observed how the messenger worked using real…
The Kremlin-sponsored messaging app Max, developed by Russian social media company VK, has the ability to covertly modify surveillance settings for individual users, a new report from the digital security lab InterSecLab reveals. The InterSecLab researchers observed the app's behavior over a period of nine weeks, examining real accounts and intercepting network traffic before encryption.
Key findings include Max's varying configurations, lack of end-to-end encryption, and VK's capacity to access users' correspondence. "Secret chats" in Max are not encrypted and messages are only deleted based on a timer, misleading users due to the similar terminology used by Telegram. VK can individually configure Max for each account to perform actions such as decrypting voice messages on VK's servers, blocking message sending when a VPN is detected, collecting user data, and transmitting user identity information to third-party services.
During testing, the researchers found an additional feature allowing Max to obtain information about all apps installed on a user's device. Every time Max is opened, it sends VK a report containing the user's network environment, including IP address, mobile carrier information, VPN activity, and the availability of other internet services.
The IP address alone can indicate a user's approximate location. Max also uploads a user's entire address book to VK's servers in unencrypted form, revealing phone numbers of people who have never registered with the app. The app matches names in the address book to phone numbers and syncs the data whenever changes are made. Despite claims that phone numbers were hashed before being uploaded, InterSecLab disproved this assertion.
When detecting a VPN, Max stops functioning and requires users to disable it to send messages. However, users can bypass this restriction by routing the VPN through their router. Upon creating a new Max account, users receive a pre-selected list of 25 recommended channels, predominantly consisting of state media outlets, officials, and pro-war journalists.
Written by urgent.news from Meduza (English)'s reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
