A Russian resident checks their phone before voting. [TASS]
A Russian resident checks their phone before voting. [TASS]

Max, the messaging app the Russian government has effectively mandated its citizens use, was designed with capabilities that allow sweeping access to users' devices, researchers have found. The research team said the structure amounts to a backdoor.

According to the Guardian on Friday (local time), a research team led by Roya Ensafi, an associate professor of computer science at the University of Michigan, published findings after downloading and analyzing Max.

The team found that Max can secretly capture screenshots of a device's screen and app content without the user's knowledge, and can access information stored in mini-apps, messages and payment records.

It can also impersonate users and inject code into other apps without their awareness.

Ensafi said the ability to inject code means the Russian government could use Max as a tool for cyberattacks.

She described Max as "a blueprint that any government can replicate," adding that countries such as Iran, Kazakhstan and India could attempt similar approaches in the near future.

However, she said Max cannot penetrate Telegram or WhatsApp if a user has those apps installed. Russia has blocked both at the government level.

[TASS]
[TASS]

Max is a super-app developed by Russian social media company VK that bundles messaging, banking, payments and government services into a single platform.

Russia made preinstallation of Max mandatory on new smartphones starting Sept. 1 last year, in effect compelling its use. The country blocked WhatsApp in February this year and Telegram in April.

Yet testimony from within Russia's power circles suggests Max use there is largely performative. One Kremlin insider told the Guardian on condition of anonymity that they and their acquaintances had bought a second phone solely to have Max installed. "It's all for show. Nobody in political circles actually uses it," the person said.

Meanwhile, Ensafi said Russia had built a digital control system over the past decade and that the case should be taken as a warning sign.


dbsdn1110@heraldcorp.com