[Xploitd]

How Telegram can be used to de-anonymize you

 

TLDR: Just like signal, you need to put your phone number to sign up on Telegram, that makes it unsuitable for Anonymous use. And because anonymity isn't there, deniability is not possible either.

IntroductionYou might see people offering you to contact them on Telegram for illegal services on DN platforms like Pitch/Dread.
Here's some examples:


http://opbible7nans45sg33cbyeiwqmlp5fu7l...mity/1.png


http://opbible7nans45sg33cbyeiwqmlp5fu7l...mity/2.png


In most cases, they either want to scam you, or want to put you behind bars.
Why shouldn't I use Telegram?Telegram has multiple intentional flaws, that make it not suitable for Private or Anonymous use.
Telegram shares your data with Law Enforcement

 

If Telegram receives a valid order from the relevant judicial authorities that confirms you're a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities. If any data is shared, we will include such occurrences in a quarterly transparency report published at: https://t.me/transparency.

source: Telegram's Privacy Policy

Note: The transparency report is locked to your registration country and placed behind a sign-up wall, you can view it without signing up here.

http://opbible7nans45sg33cbyeiwqmlp5fu7l...mity/3.png


After the arrest of Pavel Durov (Telegram's CEO) in August 2024, Telegram had a spike in amount of data handed over to LE's of various countries.
For example, in 2024, Telegram had complied to 14641 requests from Indian government, handing over information of 23535 users.






http://opbible7nans45sg33cbyeiwqmlp5fu7l...nymity.png


Phone number verification
Just like Signal, to register on Telegram, you have to provide your phone number and verify it through SMS.
Even if you bought a fake number, you'd still have to register on it with a mobile client, since registration is inaccessible for Desktop clients.
After you create you account, anyone who knows your phone number can see your Telegram profile.



No E2EE by default
http://opbible7nans45sg33cbyeiwqmlp5fu7l...rivacy.png

By default, all your messages are stored in plaintext on Telegram's data centers. Telegram can access them at any time and share them with Law Enforcement.
Though it does feature E2EE in Secret Chats, it is only accessible on a mobile device or a Mac, which makes it not suitable for Private use.
People getting prosecuted by using TelegramHere are examples of people getting prosecuted after using Telegram for sensitive purposes:


Case 1:http://opbible7nans45sg33cbyeiwqmlp5fu7lklu6jd6f3mivrjeqadco5yd.onion//opsec/telegramnoanonymity/case1.png

source
Hacker on Dread from France registered a Telegram account to get more customers.
Consequences: Arrest with Cybercrime charges, released due to lack of evidence.


http://opbible7nans45sg33cbyeiwqmlp5fu7l...case2.avif

Case 2:
Jehanzeb Amar, 29, from London and Salahydin Warsame, 29, from Birmingham, used a Telegram bot to distribute large amounts of cocaine.
Consequences: Both imprisoned for 13 and 10 years respectively.
Case 3:Benjamin Hunt, 26, of Boston, used Telegram to advertise and sell a total of 2310 pills containing Fentanyl, several firearms and firearm parts for Bitcoin.
Consequences: 20 years in prison and a fine of $1 million.

Hidden Content

You must register or login to view this content.