Users of the state-approved MAX ̶s̶p̶y̶w̶e̶a̶r̶ messenger in Russia may be interested in the following article. Any that also use Tor VPN beta almost certainly will be - especially point 3 in the “Precautions” list below. What follows is a machine translation. An archive of the original article is here. I cannot verify the accuracy of anything herein, but I’ve seen the source (https://ntc.party) referred to elsewhere in other articles here on censorship in Russia e.g. this one.
Russian messenger MAX has been spotted accessing foreign IP detection services and competitors’ servers.
Users of the specialized NTC forum (available only via IPv6), dedicated to researching internet censorship and block circumvention, have discovered unusual network behavior in the Russian messenger MAX. This concerns the official APK from the official website .
The scheme was fairly straightforward: in one case, they used PCAPdroid , an app that simulates a VPN on an Android device to intercept network traffic without requiring root access, thus allowing them to monitor, analyze, and block network connections made by apps on the device. In another case, they analyzed traffic from an emulator, specifically noting that the system image in the emulator was “clean,” with no other messaging apps or additional software installed.
According to observations (PCAPdroid dumps are posted on the forum), the MAX messenger regularly pings several services simultaneously to determine the external IP address, some of which are foreign. Among the domains that surfaced during the scan, in addition to Russian services, foreign services are also visible:
Using IP detection services in itself isn’t a crime—for example, it might be necessary to properly configure P2P calls via WebRTC. However, VK (the creators of Max) has long had its own STUN servers designed specifically for this purpose, and therefore there’s no need to use third-party, especially foreign, services.
Furthermore, two things raised alarm bells among forum participants. First, there were too many IP checks and too many different sources. If the goal is simply to “find an external IP,” one service is usually sufficient. When there are multiple, it looks like an attempt to double-check the result and piece together a “picture” from different perspectives. Second, the list of outgoing connections also shows MAX client requests to domains associated with Telegram and WhatsApp:
This already looks like a network environment check (for example, which domains are being blocked by the ISP) and whether competitors are available or blocked. For example, the mmg.whatsapp.net domain is used by WhatsApp to download media via direct links. Roskomnadzor is currently blocking this domain, and it could be conveniently used to monitor whether content from a specific URL is loading from this domain. Considering that Roskomnadzor’s blocking of “prohibited” domains often doesn’t occur immediately, but only after receiving approximately 16 KB of data from the “prohibited server,” or instead of blocking, it simply slows down.
The api.ipify.org service is hosted on Cloudflare’s network, and checkip.amazonaws.com is hosted on Amazon’s AWS cloud. Both Cloudflare and Amazon are also frequently subject to Roskomnadzor’s “16kb” and “trigger” blocking (see here and here ), and this can also be a fairly typical check.
Taking into account the above, accessing several external IP determination services in different locations can also be used to check whether the user is accessing the Internet “directly” or through a VPN/proxy (based on discrepancies between IP checks, routing, and the availability of individual resources).
For example, if a user’s VPN/proxy client has split routing configured, whereby traffic to foreign resources goes through a proxy/VPN, and traffic to Russian addresses goes directly, then similar checks, when using Russian and foreign services simultaneously, will show different IP addresses in different ASs, which will allow for fairly reliable detection of the presence of a proxy/VPN and even the identification of the proxy/VPN server’s output IP address (which, with a simple setup, almost always matches the input) and subsequently block access to it.
And let’s not forget that, since last year, Article 13.52 of the Code of Administrative Offenses of the Russian Federation (violation of the procedure for using hardware and software accessing information resources and information and telecommunications networks with restricted access on the territory of the Russian Federation) has imposed fines on VPN/proxy owners for failure to comply with the prohibition on providing access to information resources with restricted access on the territory of the Russian Federation, as well as for failure to comply with the established procedure for interaction with Roskomnadzor.
Precautions:
-
Do not use MAX;
-
If it is necessary to use it, place it on a separate “clean” and isolated device;
-
When using a VPN/proxy, configure split tunneling to separate routes not by GeoIP, but by application (especially considering that not only Max, but any domestic application can do this);
-
Use a chain of two proxy servers rather than just one; alternatively, use two IP addresses on the proxy server (one for incoming and one for outgoing connections), or, if you only have one IP address on the server, route outgoing traffic from the proxy to Cloudflare WARP.
