Durev VPN Accused of Plagiarizing Independent Researchers' Articles for Commercial YouTube Promotion
Independent researcher zarazaexe has accused the commercial VPN service Durev VPN of repurposing multiple technical articles for YouTube advertising without attribution or permission.
The original publications covered reverse engineering of the MAX messenger, analysis of Russian TSPU whitelist mechanisms, examination of MinTsifry root certificates, and a detailed review of the Teleга client. Durev VPN converted these texts into video scripts, changed first-person statements to references to their own specialists, and removed any mention of the source author or project name.
One video titled СРОЧНО УДАЛИ СЕРТИФИКАТ МИНЦИФРЫ accumulated 795,000 views within two days. The service's Telegram bot lists 260,000 users, and the cheapest subscription costs 313 rubles per month. Rough calculations suggest that even modest conversion rates could generate several million rubles in recurring revenue from the viewed content.
Direct textual overlaps include the claim that specialists scanned 46 million Russian IP addresses and found 63,000 entries in permitted whitelists, identical descriptions of default-deny and fail-closed architectures, and matching explanations of ECH behavior under DPI inspection. The video also repeated an earlier factual error from the source article regarding total UDP blocking inside whitelists.
Additional videos reused findings from the MAX messenger analysis, including the behavior of class com.my.tracker.core.o.f, MediaDrm Widevine UUID handling in TEE, and the network_security_config.xml flag that permits cleartext traffic. Some material was also drawn from articles published by runetfreedom.
When contacted, the Durev VPN representative demanded proof of patents, suggested the research was generated by Claude, and later invoked fair use while refusing to add attribution. After receiving a DMCA warning, the representative stated the issue would be reviewed by their lawyer within one week. The researcher published the complete conversation and noted that the disputed segment referencing the 46-million-address scan was later edited out of the published video.
The service itself is registered in Kazakhstan. Its client uses the Happ application on non-Android platforms and offers test access for 17 rubles. Measured performance on the test profile showed 494 ms latency with 20 Mbit/s download and 46 Mbit/s upload speeds.
Related articles
VK Tech Rolls Out Unified AI Assistant Across VK WorkSpace Corporate Tools
VK Tech is preparing a unified AI Assistant for its VK WorkSpace platform, along with semantic search and an MCP server to connect autonomous agents. The features target small and medium businesses as well as large corporations by automating routine tasks in messaging, email, and calendar services. Semantic search will allow users to locate documents, emails, and messages by meaning rather than exact titles or phrasing. Meeting recordings will be automatically transcribed with extraction of key topics, decisions, and action items. The AI Assistant launches first in the Messenger module of the On-Premise version, with cloud SaaS availability scheduled for October and later expansion to Mail, Disk, and Calendar. Access remains strictly limited by user permissions and company policies. An MCP server will also be introduced, enabling AI agents to query data, prepare meeting materials, and perform actions inside the platform services, initially supporting Messenger and extending to other modules by year-end.
Russia Weighs Passenger Fees of Up to 1000 Rubles to Fund Domestic Aircraft Leasing
Russian authorities are discussing a new surcharge on air tickets to cover leasing and operating costs of locally produced planes. The proposed fees range from 500 rubles on domestic flights to 1000 rubles on international routes, with some sources mentioning higher figures of 700 and 2000 rubles respectively. The initiative involves the Ministry of Transport, the Ministry of Industry and Trade, and Rostec, though no final decisions on amounts or collection methods have been made. Revenue estimates suggest the measure could generate 68 to 84 billion rubles annually based on 2025 passenger volumes, with total collections targeted at 200-250 billion rubles between 2027 and 2030. Funds would subsidize the gap between high production costs of models such as the MC-21 and SJ-100 and the discounted prices offered to airlines, while also addressing elevated maintenance and fuel expenses. Officials expect serial production after 2030 to lower costs and eliminate the need for the surcharge, yet experts caution that added fees risk raising ticket prices and reducing overall passenger traffic.
EVTX Record Recovery: Advanced Carving Techniques for Damaged Windows Event Logs
Positive Technologies researchers detail methods for carving EVTX records directly from raw disk images, memory dumps, and virtual machine snapshots when standard file system access fails. The approach bypasses corrupted MFT structures or wiped partitions by scanning for ElfChnk and record signatures. Their Go-based library parses both intact and damaged EVTX files, recovering events even when checksums mismatch. The article explains the three-layer EVTX structure including file headers, 64 KB chunks, and BinXML records with template substitution for space efficiency. Two carving strategies are presented: chunk-level recovery that restores full field names via per-chunk caches, and record-level extraction that pulls values without templates. The work supports faster incident reconstruction in ransomware cases where attackers encrypt entire VDI or VHDX images.
Google Testing Optional Google Account Unlock for Forgotten Android PINs
Google is developing a backup unlock method that lets Android users regain access to their devices through a linked Google Account instead of performing a full factory reset. The feature, discovered in Android 17 QPR2 Beta 5, appears under the name Unlock with Google Account and would be disabled by default. Users would need to enable it manually in the Device unlock settings before forgetting their PIN, password, or pattern. The change aims to prevent permanent loss of local data such as photos and documents that lack cloud backups. The mechanism revives a capability removed after Android 4.4, when forgotten patterns could be cleared using Google Account credentials. Factory Reset Protection would remain in place after any reset. The code reference is not yet functional, carries no official announcement, and may be altered or dropped before release.