Russia’s state-backed messaging app Max can secretly change how it surveils individual users, researchers at InterSecLab find

The Kremlin-backed Max messenger has broad capabilities for tracking users, but their configuration can vary from account to account and is controlled by its developer, the Russian social media company VK. That’s according to a new report from the digital security lab InterSecLab, which Meduza has reviewed. For nine weeks, the report’s authors observed how the messenger worked using real accounts, intercepted its network traffic before the point of encryption, and checked each observation against the app’s code. Here are the key findings from the lab’s report.

Key finding: Max behaves differently depending on the user. VK can activate specific features for individual accounts without updating the app or changing its interface.

Max has no end-to-end encryption, and VK can access the contents of users’ correspondence. In the messenger’s “secret chats,” messages aren’t encrypted: they are simply deleted on a timer. The researchers say the term “secret chat” is deliberately misleading in Max’s case, since Telegram uses the same term for a mode of correspondence that does have end-to-end encryption.

Max can be configured individually for each account to: decrypt voice messages on VK’s servers, block message sending when a VPN is detected, collect data on the user’s actions within the app, and send information about the user’s identity to third-party services. The researchers also found a feature that was not active during testing: it would let Max obtain information about all the apps installed on a user’s device.

Every time Max launches, it sends VK a single report on the user’s network environment: public IP address, mobile carrier information, VPN activity, and the availability of other internet services. VK updates this report each time the app opens. The researchers say the IP address alone is enough to determine a user’s approximate location.

Max uploads a user’s entire address book to VK’s servers in unencrypted form. The app matches the names in it to phone numbers and syncs the data every time changes are made. In the process, VK gains access to the numbers of people who never registered with Max. One earlier analysis of the app claimed that numbers were hashed before being uploaded, but InterSecLab’s researchers disproved this.

A phone number alone can reveal a great deal about a Max user. In response to a request, Max returns the account ID, display name, and account creation date, then within 15 minutes sends information on when the user was last online. The person being searched for receives no notification of any kind, and the researchers found no limit on how many such requests can be made.

Max stops working if it detects a VPN, requiring users to turn it off before they can send a message. The restriction can be bypassed by moving the VPN to the router, the researchers wrote, though not all users know this workaround.

New Max accounts receive a curated list of 25 recommended channels before users make a single search query. The list includes state media outlets, officials, and pro-war journalists, including accounts for the Russian state news agency RIA Novosti, the Russian television channel NTV, Izvestia, Vladimir Solovyov, and Dmitry Medvedev.