A security audit of 11 popular Russian Android applications, including banking, government, and marketplace services, revealed 237 vulnerabilities. The study utilized static analysis (SAST) and logcat monitoring to assess privacy risks, tracking mechanisms, and cryptographic standards.
Six of the eleven applications, including Sberbank and Gosuslugi, use outdated signing keys (RSA-1024 or DSA-1024), which do not meet modern security standards. Only 2GIS uses the recommended RSA-4096 key. Furthermore, 10 out of 11 apps integrate Huawei Mobile Services (HMS), with some instances showing tens of thousands of references.
Banking apps like Sberbank, VTB, and T-Bank were found to hold extensive permissions, including the ability to install packages without user confirmation and access external storage. These apps, along with others, also utilize WebRTC to detect VPN usage, which can potentially leak real IP addresses.
Gosklyuch emerged as the most secure application in the sample, scoring 42.4 out of 100 on the risk scale. It uses modern signing keys, minimal permissions, and lacks aggressive tracking SDKs. Conversely, RuStore showed the highest number of exported components without restricted permissions, posing a potential security risk.
The researcher suggests that users mitigate these risks through DNS filtering, utilizing isolated work profiles for financial apps, and manually revoking unnecessary permissions. The report emphasizes that while some findings are standard anti-fraud measures, others represent significant technical debt.
