Digital Surveillance in Your Pocket: Audit Uncovers Tracking and Weak Cryptography in 11 Top Russian Android Apps

An independent researcher has published a detailed audit of 11 popular Russian Android applications, revealing widespread use of tracking libraries, outdated cryptographic keys, and VPN detection mechanisms that raise significant privacy concerns.

The analysis covered major apps from banks, government services, marketplaces, and navigation providers, including VK, Sberbank, T-Bank, Gosuslugi, Avito, VTB, 2GIS, RuStore, Yandex Pay, Ozon Bank, and Goskluch. Researchers applied static analysis with MobSF, jadx, and androguard, combined with passive logcat monitoring during cold starts, without decrypting traffic or bypassing SSL pinning.

Key Findings on Cryptographic Weaknesses

Six applications still rely on legacy signing keys that fall below modern standards. VK, Sberbank, Gosuslugi, Avito, and Ozon Bank use RSA-1024, while Yandex Pay employs DSA-1024. According to NIST SP 800-57, these key sizes have been considered obsolete since 2013, creating theoretical risks for supply-chain style attacks via forged updates.

Tracker Ecosystem and Data Sharing

Huawei Mobile Services (HMS) appeared in ten of the eleven apps, with Gosuslugi containing 78,571 references alone. VK led with eleven trackers total, including heavy integration of its own VK_SDK across seven other applications in the set. Gosuslugi itself sends signals to VK, Yandex AppMetrica, Firebase, and Huawei ecosystems even before user consent.

VPN Detection via WebRTC

Five applications — VK, T-Bank, Sberbank, Gosuslugi, and Avito — scored HIGH for VPN detection through classic WebRTC ICE candidate leaks. This technique exposes real IP addresses even when users route traffic through VPN tunnels, blurring the line between anti-fraud measures and surveillance.

Standout Performer: Goskluch

Goskluch, the government electronic signature app, achieved the lowest risk score of 42.4/100. It uses a compliant RSA-2048 key, limits trackers to HMS and Firebase, shows no VPN detection, and requests only seven dangerous permissions. At first launch it contacts only RuStore, Crashlytics, and Firebase domains.

The researcher emphasized that absolute numbers are affected by code obfuscation and that the study focused on observable static patterns rather than runtime data exfiltration.