Digital Surveillance in Your Pocket: Audit Uncovers Tracking and Weak Cryptography in 11 Top Russian Android Apps
An independent researcher has published a detailed audit of 11 popular Russian Android applications, revealing widespread use of tracking libraries, outdated cryptographic keys, and VPN detection mechanisms that raise significant privacy concerns.
The analysis covered major apps from banks, government services, marketplaces, and navigation providers, including VK, Sberbank, T-Bank, Gosuslugi, Avito, VTB, 2GIS, RuStore, Yandex Pay, Ozon Bank, and Goskluch. Researchers applied static analysis with MobSF, jadx, and androguard, combined with passive logcat monitoring during cold starts, without decrypting traffic or bypassing SSL pinning.
Key Findings on Cryptographic Weaknesses
Six applications still rely on legacy signing keys that fall below modern standards. VK, Sberbank, Gosuslugi, Avito, and Ozon Bank use RSA-1024, while Yandex Pay employs DSA-1024. According to NIST SP 800-57, these key sizes have been considered obsolete since 2013, creating theoretical risks for supply-chain style attacks via forged updates.
Tracker Ecosystem and Data Sharing
Huawei Mobile Services (HMS) appeared in ten of the eleven apps, with Gosuslugi containing 78,571 references alone. VK led with eleven trackers total, including heavy integration of its own VK_SDK across seven other applications in the set. Gosuslugi itself sends signals to VK, Yandex AppMetrica, Firebase, and Huawei ecosystems even before user consent.
VPN Detection via WebRTC
Five applications — VK, T-Bank, Sberbank, Gosuslugi, and Avito — scored HIGH for VPN detection through classic WebRTC ICE candidate leaks. This technique exposes real IP addresses even when users route traffic through VPN tunnels, blurring the line between anti-fraud measures and surveillance.
Standout Performer: Goskluch
Goskluch, the government electronic signature app, achieved the lowest risk score of 42.4/100. It uses a compliant RSA-2048 key, limits trackers to HMS and Firebase, shows no VPN detection, and requests only seven dangerous permissions. At first launch it contacts only RuStore, Crashlytics, and Firebase domains.
The researcher emphasized that absolute numbers are affected by code obfuscation and that the study focused on observable static patterns rather than runtime data exfiltration.
Related articles
rkn-block-checker 0.6.0 Adds Local Web UI and Reduces False Positives on Anti-Bot Responses
The open-source tool rkn-block-checker received a major update in version 0.6.0 that improves accuracy when detecting Russian ISP censorship blocks. The previous version incorrectly flagged sites protected by anti-bot systems as blocked by Roskomnadzor because it searched for common stub-page strings without checking HTTP status codes. A new logic layer now separates rate-limit responses such as HTTP 429 from genuine provider stub pages that typically return 200 OK or 451. The release also introduces a fully local Web UI built with Python’s standard-library HTTP server and vanilla JavaScript, eliminating the need for heavy frameworks. Results stream in real time via NDJSON so users can watch checks complete without polling or WebSocket connections. The project remains available on PyPI and GitHub under the MIT license.
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin addresses common challenges in data masking during a recent webinar titled 'Data Masking: Battle of Opinions'. The discussion covers why masking remains essential even when encryption is deployed, how to preserve application functionality after anonymization, and the performance trade-offs of processing large databases such as 5 TB PostgreSQL instances. Different masking types including static, dynamic, selective, and streaming are explained with specific use cases for DevOps pipelines, external contractors, and BI systems. The article also examines why machine learning alone is insufficient for discovering personal data and why custom scripts fail at scale across heterogeneous environments like PostgreSQL and Oracle. Practical recommendations include combining masking with encryption, using deterministic transformations for deduplication, and separating replication from masking tasks to avoid production impact.
MAX Desktop Client Tested for VPN Detection on Windows, No Tracking Signs Found
A Habra user named Slava_B conducted an experiment on September 8, 2026, to determine whether the MAX desktop client on Windows could detect or route traffic through a VPN configured at the router level. The setup used a Keenetic router that directed Russian resources directly while sending other connections via an OpenConnect tunnel to a European VPS, with no VPN client or virtual adapter present in Windows itself. Monitoring tools including Process Monitor, Wireshark, TCPView, and tcpdump revealed that MAX.exe and MAX-service.exe processes communicate locally and connect to MAX/ONEME infrastructure along with AppTracer services. The application repeatedly accessed MachineGuid, computer name, proxy settings, device IDs, and microphone/camera information, though these reads may support diagnostics and anti-fraud functions. No connections appeared on the VPN interface, and the client did not attempt to reach IP-checking services, Telegram, or WhatsApp. The researcher noted that TLS traffic was not decrypted, so actual transmission of identifiers could not be confirmed, and results apply only to this router-based configuration.