Max, a Russian messenger that became the country’s most popular app this summer, is helping to spy on users, The Guardian reports, citing a paper by researchers from the University of Michigan, the University of Calgary, the Georgia Institute of Technology and the Indian Institute of Technology (Delhi). Max is a product of VKontakte, a company closely linked to the Russian state.
It is a “super app” in the mould of China’s WeChat, combining an ecosystem of services on a single platform. It allows users to access numerous mini-apps, from banking applications to messaging services and government services.
The Max app installs a “backdoor” into the entire mini-program ecosystem on every user’s device, said Roya Ensafi, an associate professor in the University of Michigan’s computer technology department.
“We have been studying Russia’s tightening control over the internet over the past decade. What Max provides is the most ingenious and, at the same time, the most frightening tactic of authoritarian governments,” she said.
Ensafi’s team downloaded the version of the app available in Russia. The researchers found that the software can take screenshots independently and access the contents of mini-programmes without users’ knowledge. The app has access to all information stored in its mini-programmes, including payments and messages. It can even inject code into mini-programmes, which, Ensafi said, means the Russian government could use Max to carry out cyberattacks. Max does not have access to third-party apps such as Telegram or any other messengers.
Public-sector employees, as well as university students and school pupils, have been forced to install Max as an alternative to Telegram and the foreign-owned WhatsApp. In particular, according to a student, Daniil, who studies in St Petersburg, he was told to install the app shortly before the start of the academic year because, without a QR code generated there, he would not be allowed into university buildings or dormitories.
Max has not yet replaced Telegram as Russians’ main source of news. Public channels, which media outlets, bloggers and officials use to disseminate news and statements, are far less developed on Max: only a few have attracted an audience comparable to the biggest channels on Telegram. Several Max users contacted by the Guardian said the app strongly resembles Telegram in design and functionality.
Russia’s success in rapidly rolling out Max should be a “wake-up call”, Ensafi said. China took 35 years to reach its current state of digital authoritarianism. But Russia introduced these sweeping restrictions — herding people into a state-controlled internet — in just a decade.
“The world is changing, the infrastructure of private communication is changing — and the advance of authoritarian governments is very aggressive,” she said.