Topic
Yandex
Step-by-Step Guide to Removing Personal Data from Search Engines, Databases and Social Networks
Privacy & Surveillance
TLS MITM and Throttling to 10 Mbps: Two Distinct Network Degradation Patterns Observed in Russia
Privacy & Surveillance
Password Reset Fails to Evict Attackers: What Persists in Compromised Email Accounts
OtherYandex Maps Adds Upcoming Speed Limits and Camera Direction Details to Navigation
Yandex Maps has updated its navigation mode to display speed restrictions on upcoming road segments along the entire route. Drivers can now see a sequence of limits in advance, such as 80 km/h followed by 60 km/h after an interchange and then 40 km/h. The application also provides more detailed information about the two nearest traffic cameras, including the specific lane they target and whether they monitor oncoming or same-direction traffic. Voice alerts now warn users when a camera measures speed after the vehicle has already passed it. Pilot testing showed positive effects on speed limit compliance. The changes aim to make urban and highway driving more predictable by removing the need to guess restrictions or camera focus ahead.
Scammers Target Remote Workers with Fake Compensation for Home Internet and Devices
Russian remote employees are being targeted by fraudsters impersonating employers, government agencies, and corporate IT departments. Attackers lure victims with promises of compensation for home internet costs and personal computers, directing them to fake sites for identity verification or SMS code submission. Instead of receiving payments, victims risk handing over account credentials or banking details to criminals. Another tactic involves urgent messages from supposed IT services demanding immediate access renewal or software updates via malicious links. The pressure of urgency aims to bypass caution, leading users to click links, enter passwords, or execute files before verifying the sender. Home networks present additional risks because users manage their own routers and connected devices, unlike secured office environments. Experts from Yandex recommend changing default router passwords, updating firmware, disabling quick device pairing, and isolating smart devices on a separate guest network.
Yandex Details Alice Voice Assistant Audio Buffering and Data Handling in Android Apps
Yandex has issued a detailed technical response to an analysis of its Android applications that raised concerns over potential collection of audio, contacts, bank card data, and other sensitive information. The company acknowledged the existence of a cyclic audio buffer that retains approximately 1.5 seconds of sound before an activation phrase and 0.5 seconds after it, with some pre-command audio possibly transmitted to servers for speech recognition quality checks. Yandex clarified that the Alice assistant only listens locally for the wake word when the app is open and does not continuously record conversations. Access to contacts was explained as necessary for voice commands such as calling entries from the address book, with the full book sent on first sync and only changes thereafter, without hashing to support accurate speech processing. The firm rejected claims of reading messaging app conversations and stated that bank card details are routed directly to an isolated PCI DSS-compliant environment rather than standard application servers.
Yandex Go Develops Custom DSL to Handle Complex Dynamic Ride Pricing Logic
Yandex Go has moved its ride pricing algorithm out of the main service code into a dedicated domain-specific language to avoid frequent deployments and tangled conditional logic. The pricing system accounts for geozones, demand surges, discounts, toll roads, extra stops, and special requirements such as transporting pets or sports equipment. Parameters are collected in parallel, dependencies are modeled as a graph, and requests run asynchronously on userver so that a single slow source does not break the entire calculation. Because rules change on average twice a week, keeping the logic in C++ would require rebuilding and redeploying 50 pods for roughly 40 minutes each time. The new DSL supports conditions, functions, immutable values, and fold operations instead of loops; rules are chained so each step receives the current price and metadata and returns an updated result. ANTLR 4 defines the grammar while the Z3 verifier ensures programs cannot produce invalid prices. The platform is already used by Yandex Taxi, Delivery, and the electric-vehicle charging service.
Yandex Alice AI Replaces VK Marusya in Russia's Mandatory Preinstalled Apps List for 2027
Russian authorities have approved the official list of software that device manufacturers and sellers must preinstall on smartphones, tablets, and computers starting in 2027. The updated requirements maintain most of the previous selections without major disruption. The only notable change involves voice assistants, where Yandex Alice AI will now take the place previously held by VK Marusya. This adjustment reflects ongoing government efforts to promote domestic software through mandatory preinstallation policies. The regulation continues to focus on ensuring Russian-developed applications receive prominent placement on new devices sold in the country.
Yandex Apps Leak Pre-Trigger Audio Buffers, Payment Data, and Contacts via Reverse Engineering
Reverse engineering of Yandex Search and Yandex Browser APKs reveals extensive data collection practices on Android devices. The apps maintain a server-controlled pre-trigger audio buffer that captures up to three seconds or more of microphone input before the wake word Alice is detected. WiFi fingerprinting, full contact book synchronization via ContentObserver, and transmission of PAN and CVV details to mobpayment.yandex.net occur before tokenization. Additional findings include 94 JavaScript Bridge methods, logcat exfiltration with AES encryption, hardcoded Yandex DNS servers, and a native surveillance library named libquarkenstein_daemons.so. The analysis also covers passive geolocation, cell tower data collection, and inventory of installed applications including competitors such as Chrome, Firefox, WhatsApp, and Telegram. These mechanisms operate under remote configuration flags and bypass several Android privacy restrictions through manifest queries.
Yandex Rolls Out Universal Anti-Fraud Platform to Block Bots and Manipulation Schemes
Yandex has begun deploying its Universal Anti-Fraud system, a single AI-driven platform designed to detect bots, ticket scalping, and other forms of digital fraud across multiple services. The new solution can be integrated into a service within two to four days, replacing the previous months-long process of building separate defenses for each product. Dozens of Yandex services, including Eda, Afisha, Puteshestviya, and applications powered by Alice, are already connected to the platform. In Afisha the system identifies bots that mass-book tickets for popular events to create artificial scarcity, while in Eda it flags repeated fraudulent complaints aimed at obtaining compensation. The platform combines neural networks, analytical methods, and more than one hundred attack-pattern rules, analyzing traffic in real time and applying service-specific parameters. A key advantage is centralized updating: once a new fraud scheme is identified, protections are distributed instantly to all connected products.
Personal Digital Resilience: Strategies to Secure Access Chains and Preserve Data Portability
The article explores how individuals can strengthen their digital infrastructure against service outages, lost access, and data loss without turning maintenance into a full-time project. It defines digital resilience through two pillars: security against unauthorized access and reduced dependence on any single provider, especially when regulators in different jurisdictions interfere. The author maps real-world processes to digital services, access methods, and stored data, then outlines recovery formulas for each failure scenario. Practical steps include auditing password-manager entries, eliminating circular dependencies, separating recovery roots by jurisdiction, and exporting data in portable formats. Special attention is given to secrets such as TOTP seeds and recovery codes, which are stored in an encrypted offline archive whose master password exists only on paper. The resulting structure features two independent trees rooted at Yandex and Google, with all critical services backed by verifiable exports and tested recovery paths.
DeepSeek User Conversations Appear in Google Search Results via Publicly Shared Links
Conversations between users and the Chinese AI service DeepSeek, including Russian-language exchanges, have surfaced in Google search results. The exposed pages belong to Shared Conversations that users themselves made public through shareable links. These pages display full question-and-answer histories along with the names of any uploaded documents. No actual breach of DeepSeek occurred, and security researchers note that search engines indexed similar public chatbot dialogues more than a year ago. MWS AI confirmed that no closed chat histories or account access were exposed. Meanwhile, Yandex stated that links to conversations with its Alice AI assistant are blocked from indexing, remain active for only 14 days, and do not transmit attached files to recipients.