Unsafe telegram

Link to the author's channel - https://t.me/darkhackerlab

The content of the article:

1. Security of standard telegram chats

2. Security of secret chats

3. Anonymity of users, from the point of view of the special services

4. Anonymity of users, from the point of view of a cyber investigator

5. Personalized advertising in telegram

6. The reputation of the project and the strange inconsistencies in its history.

7. Conclusions

Security of standard telegram chats

The issue of security in standard Telegram chats raises many questions.
How does it work? The user sends a message, which, like an electronic pigeon, is delivered to the server, and then the server forwards it to the recipient.

The message traveling between the server and the sender or recipient is encrypted, but the server itself has unsecured correspondence, since there is no end-to-end encryption in standard chats.

What can the server do with your correspondence? Whatever your heart desires: it can save it and keep it for years, even after you have deleted it. The server can transfer your correspondence to third parties, whether they are law enforcement agencies or corrupt Telegram employees. In addition, the server may be hacked, and your correspondence may fall into the hands of unknown people.

How do I check that the server is not abusing your correspondence? This is not possible without access to the server. The Telegram server side has, please note, CLOSED source code, so it is almost impossible to understand what is happening there.

An ordinary Telegram user does not know where, to whom, or for what purpose his account or correspondence data is being transmitted, or what is happening on the server at all.

The security of secret chats in telegram

The issue of the security of secret chats in Telegram is causing a lot of discussion. Many experts who understand the topic claim that secret Telegram chats use end-to-end encryption, which makes them virtually impenetrable to third parties.

However, why aren't secret chats considered completely safe? They use defective, potentially insecure end-to-end encryption. What exactly is wrong? To start communicating with end-to-end encryption, you need to generate a random number. In normal end-to-end encryption, this number is generated directly on users' devices, but in Telegram, please note, this number is generated on the server.

What is the danger here? The server can fully read all your correspondence in a secret chat. And the server, as mentioned earlier, has a closed source code, so it is almost impossible to check whether it does this or not.

In addition, Telegram chats use the unreliable MTProto 2.0 encryption protocol, which has never been subjected to an external security audit. The contests that Telegram conducts to crack this protocol are not actual proof of the security of MTProto 2.0. Moreover, the amount of winnings is not so significant as to attract serious agencies.

Anonymity of users from the server's point of view

The anonymity of users in the context of the server is of interest. Let's figure out who has potential access to Telegram servers or to whom Telegram can provide data, perhaps informally:

1. Telegram employees.

2. At least the special services of the “Union of 14 Eyes”, which includes: the USA, Great Britain, Australia, Canada, New Zealand, Denmark, France, the Netherlands, Norway, Germany, Belgium, Italy, Sweden, Spain.

But what about the transparency policy? Let's pay attention to the jurisdiction of Telegram as a company - this is the United States and the United Kingdom, where the GAG ORDER law applies, providing for the completely hidden transfer of data to the country's special services.

Telegram stated that it would only transmit terrorist data! But is it worth believing that a company with a multimillion-dollar audience, which, of course, received requests for data from countries of jurisdiction, is still successfully operating without complying with the laws of the countries of jurisdiction? It is obvious that a company that feels good and develops complies with the laws of the countries of its jurisdictions.

What data can Telegram collect?

1. Phone number.

2. The IP address.

3. Fingerprints of your device, that is, the model of your device, its technical characteristics, including unique identifiers that immediately identify a specific device.

Telegram also has a history of ID data, and you can upload this data yourself at any time. Therefore, changing the device, IDs, or number is unlikely to help maintain anonymity on the same account.

Anonymity of users from the point of view of a cyber investigator, an OSINT specialist

The anonymity of users in the context of a cyber investigator or an OSINT specialist is a difficult task. Each account has a unique, unchangeable identifier that does not change when the user name is changed.

There are several key areas for deanonymization, each of which provides specific tools:

1. Checking your account for information leaks in databases.

2. Search for account mentions using specialized Telegram search engines. If such mentions are found, the context is revealed. Mentions can be both on channels and in public chats.

3. Social engineering in direct contact with the user or other informants.

4. Traps-bots (honeypots), bots masquerading as certain functionality, requesting the account's phone number.

5. Honeypots, loggers in links, files, articles on the Telegraph (there are other resources where you can easily place a logger). It is possible to use specialized malware.

There are other methods of deanonymization. It is impossible to say 100% in advance whether the investigation will be successful, but according to statistics from the Internet Search company, 98% of investigations on the Telegram account end in success.

The capabilities of cyber-investigators are significantly less than those of the special services, but there are still enough of them, and Telegram does not seem to pay attention to this and does not make it difficult for cyber-investigators to work.

Personalized advertising in Telegram

Recently, an advertisement appeared in the Telegram, and it is worth noting that it is personalized, which implies the possibility of deanonymization. I won't tell you how it works because of ethical considerations. Just know that Telegram is already adapting ads to suit you, as well as many other social networks.

The reputation of the project

When the facts run out, we can only assume. These assumptions are strongly influenced by the reputation of the project - this is important. Let's start with what happened before the Telegram - VKontakte. Pavel Durov claimed that VK servers do not keep logs of some user data, but after the sale of the social network, it turned out that these logs are being maintained. In 2018, Telegram launched a PR campaign. Durov received a Telegram registration form, which he had to fill out. Durov stated on his social network that Roskomnadzor wanted confidential user data from him. In response, Roskomnadzor even released a post explaining what kind of questionnaire it was. Durov actively advertised his messenger as safe and private. Many people believed in it, many did not even know about its technical characteristics. The PR campaign was a success, almost the whole country believed that Telegram was not cooperating with the special services, and Durov was a hero fighting against the system. Durov conducted a whole PR campaign, perhaps no one had done such a thing before. It's amazing how government agencies reacted to this - they sued to give out encryption keys, tried to block, tried to get the data from the Telegram. Didn't everything work out too well for Durov? Have you ever thought that this was a PR campaign prepared with the state? It was only in 2019 that it became possible to hide the phone number, before that the number was available to everyone, and all accounts created before 2019 have already been compromised and are not anonymous. In May 2022, a hint of paid features was found in the description of the messenger, instead of the phrase "Telegram is free forever. No ads. No subscription fee" appeared "Telegram provides free unlimited cloud storage for chats and media." A premium subscription was released soon after. Telegram is moving further and further away from the original values of the project, it is gradually turning into something like Instagram, almost all updates are aimed at this, and not at anonymity, privacy and user safety.

Conclusions:

1. Standard Telegram chats do not provide adequate security.

2. Secret Telegram chats are also not completely secure.

3. Telegram cooperates with special services.

4. Cyber intelligence experts have long learned how to work with Telegram.

5. Telegram is gradually turning into Instagram, moving away from the original goals of the project.