Features for covertly tracking users have been discovered in the Max messaging app
A wide range of features capable of collecting data on users and their activity has been discovered in the Russian government-backed messaging app Max.
This is reported by Russian Telegram channels.
There are reports of potential advanced monitoring tools, including activity analysis and push notifications. The developers or official representatives of the service have not yet publicly commented on these claims.
A programmer going by the nickname zarazaex thoroughly reverse-engineered the app’s APK file and posted the results of his research on Habr. It turned out that Max collects a list of contacts and installed apps, can take screenshots of chats, conduct covert audio recording, create fake chats, and delete messages directly from the phone without a trace.
Additionally, the messenger can determine the user’s real IP address even when a VPN is enabled and uses a built-in device identifier that cannot be reset even after uninstalling the app or restoring the phone to factory settings.
It is also claimed that Max sends hidden commands and push notifications to collect data, including the user’s location, secretly records audio during calls, and then uploads it to a server where it is stored without end-to-end encryption.
The messenger also contains tools for speech recognition, keyword detection, and voice-based identification. Additionally, Max forces the app to update and collects the entire address book, and the server can download all logs and contacts with a single click.
Earlier, the Kremlin temporarily refused to block Telegram due to the failure with “Max.”
The Russian State Duma immediately passed amendments to the Housing Code in the second and third readings, requiring apartment buildings to maintain chat groups on the national messenger Makh.
Putin’s Makh messenger turned out to be 60 times less popular than Telegram.
