Yandex Apps Leak Pre-Trigger Audio Buffers, Payment Data, and Contacts via Reverse Engineering
Security researchers have reverse-engineered two Yandex Android applications and uncovered extensive surveillance capabilities that affect millions of users across Samsung, Xiaomi, Honor, and Realme devices. The findings, presented in a multi-part series, detail how Yandex Search and Yandex Browser collect audio, location, payment, and contact data with minimal user visibility.
Audio Pre-Trigger Buffer
The voice assistant Alice continuously records microphone input into a ring buffer. When the wake word is detected, the application sends the preceding audio segment to Yandex servers. The buffer size is not fixed in code but is controlled remotely through parameters such as HasPreroll, buffer-size-ms, and loggingSoundLengthBeforeTriggerMs. Default configuration uses 48000 samples at 16 kHz, equaling three seconds, yet the server can extend this window arbitrarily or disable the feature entirely.
Audio flows from AudioRecord through the circular buffer, Opus or AAC encoding, and WebSocket transmission to wss://uniproxy.alice.yandex.net. The pre-trigger content is also used for biometric voiceprint construction.
WiFi Fingerprinting and Passive Geolocation
Applications scan nearby WiFi access points, collecting BSSID, SSID, and RSSI values. These data are sent to startup.mobile.yandex.net for server-side geolocation accurate to 10-50 meters indoors. The same mechanism registers a passive location provider that intercepts coordinates obtained by any other application on the device and records cellular tower identifiers including MCC, MNC, Cell ID, and LAC/TAC.
Payment Data Handling
Before tokenization, primary account number (PAN) and CVV values are transmitted to mobpayment.yandex.net. Researchers contrast this server-side approach with client-side tokenization used by Stripe, Braintree, and Adyen, noting that any logging failure or compromise of intermediate servers could expose card details.
JavaScript Bridge and Contact Exfiltration
Twenty-one addJavascriptInterface calls expose 94 @JavascriptInterface methods. Any cross-site scripting vulnerability on a yandex.ru subdomain grants attackers direct access to native device functions. Contact data are monitored in real time via ContentObserver on ContactsContract.Contacts.CONTENT_URI. Names, phone numbers, emails, organizations, photos, and call logs are serialized with protobuf and uploaded over HTTP POST with OAuth authorization. The application also reads numbers from WhatsApp, Telegram, and Viber using MIME-type filters.
Additional Surveillance Mechanisms
Runtime.getRuntime().exec("logcat -d") attempts to capture system logs, which are AES-encrypted and exfiltrated. PackageManager.getInstalledApplications and shell commands enumerate all installed applications, including banking apps, VPN clients, and content blockers. Hardcoded DNS servers 77.88.8.8 and 77.88.8.1 bypass system, VPN, and DoH configurations. A native library, libquarkenstein_daemons.so, implements audio pipelines, process manipulation, and encryption routines.
Remote configuration flags exceeding seventy allow the server to enable map saving, force Alice activation, or delay permission requests for years. The analysis concludes that these practices operate within the bounds of the published terms of service yet rely on architecture considered outdated by modern payment and privacy standards.
Related articles
rkn-block-checker 0.6.0 Adds Local Web UI and Reduces False Positives on Anti-Bot Responses
The open-source tool rkn-block-checker received a major update in version 0.6.0 that improves accuracy when detecting Russian ISP censorship blocks. The previous version incorrectly flagged sites protected by anti-bot systems as blocked by Roskomnadzor because it searched for common stub-page strings without checking HTTP status codes. A new logic layer now separates rate-limit responses such as HTTP 429 from genuine provider stub pages that typically return 200 OK or 451. The release also introduces a fully local Web UI built with Python’s standard-library HTTP server and vanilla JavaScript, eliminating the need for heavy frameworks. Results stream in real time via NDJSON so users can watch checks complete without polling or WebSocket connections. The project remains available on PyPI and GitHub under the MIT license.
Digital Surveillance in Your Pocket: Audit Uncovers Tracking and Weak Cryptography in 11 Top Russian Android Apps
An independent security researcher conducted a static analysis and passive logcat review of 11 popular Russian Android applications from banks, government services, marketplaces, and navigation tools. The audit identified 237 vulnerabilities in total, including six apps signed with outdated RSA-1024 or DSA-1024 keys that violate current NIST standards. VK led the risk ranking with 11 trackers and a 98/100 surveillance score, while Gosuslugi transmitted analytics signals to VK, Yandex, Google, and Huawei ecosystems. Five apps used WebRTC ICE candidate leaks to detect VPN usage, potentially bypassing user privacy protections. Only Goskluch scored low at 42.4/100 by limiting trackers to two, avoiding VPN detection, and using a compliant RSA-2048 signing key. The methodology relied solely on MobSF, jadx, and logcat without bypassing SSL pinning or requiring root access.
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin addresses common challenges in data masking during a recent webinar titled 'Data Masking: Battle of Opinions'. The discussion covers why masking remains essential even when encryption is deployed, how to preserve application functionality after anonymization, and the performance trade-offs of processing large databases such as 5 TB PostgreSQL instances. Different masking types including static, dynamic, selective, and streaming are explained with specific use cases for DevOps pipelines, external contractors, and BI systems. The article also examines why machine learning alone is insufficient for discovering personal data and why custom scripts fail at scale across heterogeneous environments like PostgreSQL and Oracle. Practical recommendations include combining masking with encryption, using deterministic transformations for deduplication, and separating replication from masking tasks to avoid production impact.