Hacking audio system from Yandex, stream. Misplaced corporations

Hey.

Everybody out there is aware of about this story, however nobody talks about it out loud, as a result of Yandex is the most important advertiser in Russia and it’s not straightforward to deal with it firm. Though the story itself is essential from the viewpoint of product improvement safety inside Yandex, {hardware} and software program safety from outdoors interference, and simply the enterprise mannequin chosen by the corporate for a number of of the their outcomes.

For me, my expertise of this story started in a barely improbable approach: I obtained a message {that a} mail merchandise was ready for me on the submit workplace. I didn’t count on any parcels, I used to be not even going to select it up till I acquired a message from a buddy that he had ready a shock for me: “Obtain my parcel, there’s a model new product from Yandex look ahead to you, you’ll prefer it.” The field contained “Duo Max Station”, which was proven on the finish of final 12 months; there was nothing new. At first look, every thing was acquainted, and the joke was unbelievable to me. All the pieces turned clear after I turned on the station and it began working outdoors the usual interface from Yandex, however with the corporate’s providers. My buddy paid 7,000 rubles for the station as a substitute of 43 thousand within the official retailer of the corporate, and he purchased it second hand. And he or she continued to work, no interruption occurred. Let’s determine how this occurred and what are the issues inside Yandex.

The price of the “Duo Max Station” is three value ranges in Russia

In December 2023, the corporate confirmed Yandex Station Duo Max, its flagship product geared up with a 10-inch display screen, in addition to the standard capabilities of a sensible speaker.

Presently, the worth of “Duo Max” within the Yandex firm retailer is 45 thousand rubles, in federal retail – from 38 to 43 thousand rubles, with out extra bonuses.

If you happen to take a look at Yandex.Market, a complete scattering of sellers will supply this station for 32-33 thousand rubles.

On Avito, a brand new “Duo Max” will be purchased for 27-28 thousand rubles, that is the bottom value, as a result of some gamers throw too many merchandise that don’t promote effectively at retail.

The format of the station itself is very controversial; it’s copied from Western analogues; SberPortal appeared earlier than in Russia, which at present prices 20 thousand rubles. The concept is precisely the identical – a sensible speaker with a display screen to manage a sensible residence, conversations, and so forth. If we take note of the gross sales of SberPortal, they weren’t superb; the product entered the market a lot worse.

Yandex noticed direct competitor gross sales figures, however with the intention to obtain probably the most environment friendly buy value, they determined that they might select a bigger measurement of Duo Max and supply as much as 4 totally different shade schemes (madness for mannequin of this value, nobody simply does that). The reasoning, apparently, was additionally primarily based on the truth that Yandex in Russia occupies greater than 90% of the good speaker market, there may be a longtime viewers and it will likely be simpler to promote Duo Max to it than all different corporations. Actually there’s something in such reasoning, on the stage of friction, however not by arduous calculation. If you happen to knew how choices are generally made in massive corporations, you’d be stunned on the lack of calculation and any error in your actions a number of steps forward.

So, be aware that “Duo Max” is offered for 5-7 thousand rubles on many websites; these are the audio system that the corporate provides by subscription. It is humorous that when in 2018, I instructed Yandex workers learn how to get the largest loss, that’s, create subscriptions for Yandex.Station. The corporate took the concept, rapidly tailored to their state of affairs and rubbed their fingers with ever-increasing gross sales.

Generally you simply should push individuals in the precise course, realizing their logic, want to steal different individuals’s concepts and incapability to transform them into actual enterprise. The consequence was not lengthy in coming; the general administration of {hardware} subscriptions from Yandex has changed into an entire headache for the corporate; It turned frequent to steal stations from subscriptions, they flooded the secondary market with them, and many purchasers acquired bricks for his or her cash, however Yandex washed its fingers of it. We wrote about this individually. The primary factor is that this was nonetheless a sale that the corporate recorded in its personal account. In the present day, in response to a tough estimate, about half of the subscription stations are people who find yourself on the secondary market. There are millions of adverts for the sale of those stations. Assess the dimensions of the market.

For instance, Duo Max will be bought with a subscription for one 12 months, three or 5 years. Within the final case, the month-to-month cost is 1,799 rubles, for 3 years – 2,889 rubles (for many customers that is the subscription provided). It isn’t tough to deceive Yandex, which is why the market is stuffed with “Duo Max Stations” for 6-7 thousand rubles. These are subscription bought fashions that have been stolen from the corporate. Theft is dangerous, however Yandex has executed nothing over time to cease this assault. It is simply an extension.

However why purchase Duo Max for that sort of cash? For elements? It’s low cost and cheerful, which kills the official service, as a result of there is no such thing as a motive to purchase spare elements from Yandex, they’re simply dearer. It’s cheaper to purchase such a stolen station within the authentic packaging on the secondary market and disassemble it.

What’s the lack of Yandex on Duo Max?

We won’t think about all audio system stolen from Yandex, as a result of we’re significantly excited by Duo Max. In response to the data I used to be in a position to be taught from my sources, it’s at present believed that round 11 thousand Duo Max have been stolen utilizing a typical scheme. This occurred within the first half of 2024. The variety of thefts is rising each month, so within the second half of 2024 we will count on it to be at the least a 3rd greater.

Let’s do a easy calculation. The price value of Duo Max for Yandex is about 24 thousand rubles with out taking into consideration advertising and marketing prices.

Let’s work out the economics of the unit when promoting one subscription station, as an instance we take one for 3 years. The corporate receives one cost of 2889 rubles, after which funds cease. The corporate’s web loss from the sale of the station is lower than 21,111 rubles. If we take 11 thousand stations for the primary half of the 12 months as a place to begin, we get 232 million rubles in direct losses. Throughout the framework of Yandex, it’s a drop within the ocean; the corporate makes a lot larger income in different tasks and might flip a blind eye to losses like that (I am unsure that is excellent news for shareholders, he talks about it. the effectivity of the corporate as a complete). If we calculate that the variety of stolen stations shall be about 25,000 per 12 months, the whole loss on one product is 527 million rubles (solely half a billion rubles on the Duo Max station alone, a trifle, which it?).

However the state of affairs with Duo Max is rather more harmful for Yandex, as a result of it exhibits issues inside the firm, the lack to handle the event of its personal merchandise and to shut it from interference from the aspect. outdoors the capabilities of the builders aren’t sufficient for this; low {qualifications}.

Hacking “Duo Max” – station from “Yandex” with out subscription

The station they despatched me isn’t any totally different from the conventional one, besides that it has been hacked. My buddy purchased it for 7 thousand rubles! I purchased a number of of those stations to play with and shock my associates.

If you happen to take a look at adverts for the sale of such stations, yow will discover them for 9 thousand rubles and even cheaper (many individuals purchase three or 4 items, and the worth is decrease).

What are you getting? The truth is, a damaged column wherein the Yandex account works (there may be music, Kinopoisk, and so forth, you possibly can enter any account). Yandex at present doesn’t block such accounts, which doesn’t take away the query that you’re utilizing an merchandise de facto stolen from the corporate. Though not many see it this fashion.

It’s fascinating that since it’s inside Android, you possibly can set up your individual purposes. And so they ran on this file (low cost file with audio system for that sort of cash, stationery).

It is clearly a damaged product and has a ton of limitations on how voice instructions work and so forth. This isn’t to say that you’re going to get a completed product, like the unique Duo Max station. However taking a look at enthusiastic third-party builders who create their very own firmware and purposes for damaged stations, I can say that it begins to reside its personal life. It’s not only a damaged toy, however a full-fledged mannequin that may be purchased for pennies. Therefore the rise in gross sales within the second half of the 12 months.

Yandex’s makes an attempt to stop the closure of Duo Max haven’t but been profitable, because the product was developed de facto on the a part of the associate (saving on improvement; Yandex didn’t contact something be underneath the hood, as a result of he would not know the way to do that). What precisely on this case results in a rise in losses from stealing a subscription station and hacking after that, which even a schoolchild can cope with (the directions plain and easy).

The issue right here is far wider than the instant lack of Yandex. The shortage of management over its personal product implies that Yandex doesn’t know precisely how the station works, what vulnerabilities the builders have added, and engineers do not need sufficient information the corporate to test {hardware} and software program. Why do I believe this? The reply is clear – the corporate has been preventing for six months to cease hacking Duo Max, however they cannot do something about it, the hackers present class firm each time and continues to do the identical. Multiply this by the truth that the corporate has comparatively just lately launched all of the supply code of its primary merchandise (which is totally complicated), and we’ve got a superb setting for to tug down the corporate’s outcomes. They’re de facto harmful, in fact, should you shield your privateness and your knowledge. However the determination is at all times yours, solely while you lose one thing priceless, you will be unable to say that you weren’t warned about the opportunity of such loss.