When the U.S. has Google as its most popular search engine, Russia has Yandex.
The search engine that is also an advertising firm, is accused for harvesting user data. That, is according to a report from a security researcher Zach Edwards, who has discovered Yandex's analytics code embedded inside 52,000 apps on both Apple and Google software.
Through the analytics code, the researcher concluded that Yandex is allegedly harvesting data from millions of iOS users, and sending sensitive information to Russia.
According to Edwards, the apps that have the analytics code are dangerous to people with high-threat profile or working in high-profile jobs. This is because the data can potentially be used to attack home networks, and/or conduct other forms of digital surveillance.
The analytics code in question, is called the AppMetrica API, which can be used by third-party developers to get analytics data for their apps.
The apps that use the AppMetrica API include messaging services, games, location-sharing tools, and a number of VPN apps.
Seven of the VPNs are identified explicitly target the Ukrainians.
The total downloads of apps with the API reach hundreds of millions.
In a tweet, Edwards even said that Yandex is part of Russia's "propaganda machine."
ICYMI
Yandex = part of the Putin- Russian propaganda machine https://t.co/rHZAmqp4Ze— (@thezedwards) March 1, 2022
Responding to Edwards' claim, Yandex said that it acknowledged that the data collected through its API and other services do get sent to Russian servers.
Yandex acknowledged its software collects "device, network, and IP address" information, and that the data is stored "both in Finland and in Russia." The company however, said that the data is "non-personalized and very limited."
"Although theoretically possible, in practice it is extremely hard to identify users based solely on such information collected. Yandex definitely cannot do this."
The company also stressed that it had a strict process for dealing with government requests for data, which includes turning out any requests that do not comply with relevant procedural and legal requirements.
While Yandex has a stance against its own government, the company is just like any other companies operating in Russian, in which it is powerless against Kremlin.
If Russian officials want data from Yandex, the company can do nothing to stop that from happening.
Cher Scarlett, a former principal software engineer in global security at Apple, said that once user information is sent to servers in Russia, Yandex could be obliged to submit it to the government under local laws. Other experts said that the metadata of the sort collected by Yandex could be used to identify users.
But still, Yandex defended its tool, comparing it to the development kits provided by Google and other search engines.
The company also said that so far at least, it has never given out any information on users of any apps with AppMetrica installed on them to the government.
The news was first delivered by The Financial Times.
It is said that Zach Edwards first made the discovery regarding Yandex’s code as part of an app auditing he was doing.
Following Edwards' finding, the newspaper enlisted four other independent experts to corroborate on Edwards' research.
The news about Yandex harvesting the data from Android and iOS users came after the company reportedly laid off dozens of its U.S.-based workers.
The company had an autonomous vehicle fleet in Ann Arbor, Michigan, and it claimed that the state suspended their licenses. This includes stopping the tests and deployments of Yandex's delivery robots at its campuses in Ohio and Arizona.
According to reports, the licenses where suspended due to Russia's invasion of Ukraine.
Further reading: Kaspersky Becomes The First Russian Company Added To U.S. Security Risk List
