The Max messenger, developed by the Kremlin-backed VK, has emerged as a significant player in the realm of digital communication, yet its capabilities for user tracking raise substantial concerns. A recent report from the digital security lab InterSecLab sheds light on the intricate workings of this messaging app, revealing that its features can vary widely from one user to another, all under the control of VK.
Key Findings from InterSecLab’s Report
Over a nine-week period, researchers meticulously monitored Max’s functionality using real accounts, intercepting network traffic prior to encryption and cross-referencing their findings with the app’s code. The following insights were drawn from their comprehensive analysis:
- User-Specific Behavior: Max’s behavior is not uniform; VK can tailor specific features for individual accounts without necessitating an app update or interface change.
- Lack of End-to-End Encryption: Unlike many contemporary messaging platforms, Max does not offer end-to-end encryption. VK retains access to users’ correspondence, with messages in “secret chats” merely set to delete after a specified time, misleadingly termed as “secret” when compared to Telegram’s secure offerings.
- Custom Configurations: Each Max account can be individually configured to perform various actions, such as decrypting voice messages on VK’s servers, blocking message sending when a VPN is detected, and collecting user activity data.
- Network Reporting: Upon launch, Max sends a report to VK detailing the user’s network environment, including public IP address and mobile carrier information, which can pinpoint a user’s approximate location.
- Address Book Upload: The app uploads users’ entire address books in an unencrypted format to VK’s servers, allowing VK to access contacts of individuals who have never registered with Max, debunking previous claims of pre-upload number encryption.
- Information Retrieval: A simple phone number query can yield extensive information about a Max user, including account ID, display name, and last online status, all without notifying the user being searched.
- VPN Detection: Max ceases to function if it detects a VPN, compelling users to disable it to send messages, although a workaround exists for those knowledgeable enough to implement it.
- Curated Content Recommendations: New users are presented with a curated list of 25 recommended channels, predominantly featuring state media and pro-government figures, before they even initiate a search.
This report underscores the complexities and potential privacy implications associated with Max, raising questions about user autonomy and data security in the digital age. As the landscape of communication continues to evolve, the scrutiny of such applications becomes increasingly vital for both users and regulators alike.
