In a recent investigation, researchers have uncovered alarming capabilities embedded within Max, the messaging app that the Russian government has effectively mandated for its citizens. This app, developed by VK, integrates various functionalities, including messaging, banking, and government services, into a single platform. However, its design raises significant concerns regarding user privacy and security.
Unveiling the Backdoor
Led by Roya Ensafi, an associate professor of computer science at the University of Michigan, the research team conducted a thorough analysis of Max. Their findings indicate that the app possesses the ability to secretly capture screenshots of users’ devices and access sensitive information stored within mini-apps, messages, and payment records. Moreover, it can impersonate users and inject code into other applications without their consent.
Ensafi pointed out that this capability to inject code could potentially transform Max into a tool for cyberattacks, raising the stakes for users and governments alike. She characterized Max as “a blueprint that any government can replicate,” suggesting that other nations, such as Iran, Kazakhstan, and India, might adopt similar strategies in the future.
Despite its extensive reach, Ensafi noted that Max is unable to penetrate popular messaging platforms like Telegram or WhatsApp, which have been blocked by the Russian government. This limitation underscores the lengths to which the state has gone to control digital communication within its borders.
Mandatory Adoption and Performative Use
Since September 1 of last year, the Russian government has mandated the preinstallation of Max on new smartphones, effectively compelling its use among citizens. The blocking of WhatsApp in February and Telegram in April further consolidates the government’s grip on digital communication.
However, insider accounts suggest that the actual usage of Max within political circles may be more performative than practical. One Kremlin insider revealed that they and their peers had resorted to purchasing secondary phones solely to comply with the mandate, stating, “It’s all for show. Nobody in political circles actually uses it.”
As Ensafi emphasizes, the evolution of Max is indicative of a broader digital control system that Russia has been developing over the past decade. The implications of this research serve as a cautionary tale for users and governments worldwide, highlighting the potential for technology to be wielded as a tool of surveillance and control.
