Over the past 18 months, tens of millions of Russians have been forced to install a new app on their phones – a violet-blue button designed for messaging and payments, called Max. Authorities have touted it as a patriotic alternative to Telegram and WhatsApp; Russian glitterati have promoted it in rap videos and comic routines. This summer, it became the country’s most-used messaging app.
It is a product of VKontakte, the Russian social media company, which is deeply entangled with the Russian state. The Russian president, Vladimir Putin, reportedly owns an indirect stake in Max. Max is Russia’s version of a “super-app,” combining an ecosystem of services into a single platform.
It is a container for a number of “mini-apps” that now facilitate everyday life in Russia – banking apps, a messaging service that aims to replace Telegram, and apps for essential government services. The best-known super-app in the world is WeChat, China’s everything platform which facilitates the state’s social controls. But while WeChat was developed over decades, in step with China’s other internet controls, Max has been imposed on a population that once had mostly-free internet access.
Now, forensic research has revealed a fuller picture of Max’s powerful surveillance capabilities. These amount to a “backdoor” into its entire mini-app ecosystem on every user’s device, said Roya Ensafi, an associate professor of computer science at the University of Michigan. Max is “a blueprint any government can follow” towards digital authoritarianism, said Ensafi.
It represents the cutting edge of what governments such as Iran, Kazakhstan and India may soon try to achieve. Ensafi’s team were able to download the version of the app used in Russia. They found that Max can screenshot users’ devices – and the contents of its mini-apps – without their knowledge.
It can access all the information stored in these mini-apps, their messages and payments. It can impersonate its users without them knowing. It can even inject code into mini-apps – which would mean, said Ensafi, that the Russian government could use Max to launch cyberattacks.
Extract — continue reading at the source.
