Interesting video reverse engineering the Yandex Browser app. I'd say this is an Android reverse engineering channel focused on Russian apps, with the intent, well to advertise VPNs. Not the worst idea.
It's not in English, so I'll write the summary here.
The tools used:
- apktool - APK reverse engineerin tool.
- jadx - Dex to Java decompiler. Dex is basically VM bytecode.
- VSCode to read the Java code.
What was found:
This is pretty much all just telemetry.
Yandex browser asks android whether you are using a VPN via API, stores GPS geolocation, ad identificators, the closest celltower, WIFI information. It seems they're using AppFlyer, an Israeli company, whose mission is apparently to protect ad owners from wasting their money on bot farms. It can scan interfaces, system files, detect Frida and emulators.
Yandex Browser asks for a lot of permissions, most notably QUERY_ALL_PACKAGES. Then, it searches for specific apps on the device. The list is quite huge:
1. Yandex Browser ecosystem related apps.
2. Other popular browsers.
3. Privacy-focused browsers, such as TOR, brave, duckduckgo.
4. Vendor browsers.
5. Smaller niche browsers.
6. Search engines.
7. VPNs and censorship bypass apps. Interestingly they only mention 2 of them in the list. (Hola and something called "com.security.xvpn.z35kb")
8. Crypto, finances. (Metamask, cryptotab, kz.homecredit)
9. Utils, launchers, other various stuff.
Yandex browser then analyses the apps for something called "Suspicious permissions" and stores this data.
Now, YB is not the only app like this, pretty much all Russian bigtech is. Delivery, music, social networking, messengers, etc.
Another interesting video:
Marcus says he spent most of his time analysing Telegram and it proved to be extremely tough, according to him. Perhaps not surprisingly, after all, they have a very generous bug bounty program - they are willing to pay 10k-100k for a bug.
In comparison, MAX had its private RSA key in its source code. Select infographics related to this attached.
What's also interesting there's a lot of server-side configs. The server can set whether you're allowed to enable the dev menu, gather chat metadata, alter VPN behavior, enable SDK logs for audio calls.
This could be the possible reason the MAX app was removed from app stores, basically it looks quite a bit like spyware. Then again pretty much everything is nowadays, so I'm not sure how much this matters.
Btw, I found this: https://github.com/user1342/Awesome-Android-Reverse-Engineering
There's even some CTF's there, wow.