Over the past 48 hours, security and privacy in messengers were in the spotlight.

Researchers from InterSecLab and RKS Global published an analysis of the national messenger MAX. According to them, the app is designed so that the operator can remotely turn surveillance and censorship features on and off for individual accounts — without app updates and without notifying the user. MAX has no end-to-end encryption: “secret” chats are just messages with disappearing timers, and servers can read conversations. The address book is uploaded to servers in plaintext. The app stops working when it detects a VPN. Servers scan messages and links, and voice messages are transcribed and analyzed. MAX also contains multiple telemetry systems and resists study — it shuts down when analysis tools are detected. For XConnect users, this matters because it shows how different privacy models can be across messengers and why it is worth paying attention to what data is transmitted and how.

The second item is a translation of research into a Telegram Desktop vulnerability related to proxy support. A controlled proxy could, with a single 407 Proxy Authentication Required response, make the app and the Qt library silently initiate Windows NTLM authentication. In the lab, researchers confirmed a relay attack up to code execution with SYSTEM privileges, as well as a leak of up to 65 KB of memory per exchange. They sent a report to Telegram, and a fix appeared, but their names were not included in public attribution. For XConnect users, this is a reminder that even tools for bypassing “Cheburnet” can have their own vulnerabilities and should be updated.

There was also a report about a hack of the Bitget crypto exchange: according to updated data, about $351.6 million was stolen. Hot and warm wallets were affected; cold storage was not. The exchange promises to cover losses from its own fund. For XConnect users, this is a signal about the risks of centralized services.

On service availability, Russians complained about Steam being unavailable. Most reports came from Moscow and the Moscow region, Altai and Stavropol regions, Chechnya, Khakassia and Kursk region. Users reported errors 118 and 105, and in some cases a VPN helped. Similar outages were already recorded in late August and the first half of September.

In regulation, the Finance Ministry is discussing a proposal to introduce 22% VAT on cross-border e-commerce goods — a variation of the “Google tax.” A customs fee of 100 rubles per parcel worth up to 200 euros was also proposed. For XConnect users, this means possible price increases for foreign purchases and subscriptions.

Finally, a technical note on Russian Trusted Root CA: standard monitoring cannot see sites using Mincifry certificates because this root is not included in international trust stores. The author proposes a two-pass verification limited to .ru, .su and .рф domains. For XConnect users, this is useful as an example of careful certificate trust handling.

Overall, the period showed that privacy, availability and regulation remain interconnected. Some stories have limited data, so we will keep watching.