Telegram Android app is a stalker’s dream

Popular instant messaging service Telegram provides optional end-to-end encrypted messaging and, in general, is highly focused on protecting user privacy.

Despite these efforts, some security experts have advised against using it if you want to keep your identity and your messages secret.

While some, like crypto expert Matthew Green, have a problem with the encryption employed by the app, operational security pro The Grugq pointed out other failings: linked identifiers, error prone defaults, contact theft, and considerable leaking of metadata.

This last problem has been illustrated by Ola Flisbäck, a consultant at Sony Mobile Communications, who showed how the service leaks user metadata that could help attackers discover with whom a user is talking to.

With the help of a command-line interface client for Telegram, he was able to see metadata leaked by a Telegram Android app.

“The Telegram Android app sends a notification to all contacts when it becomes or stops being the ‘foreground’ app on the device,” he explained. “Using that information alone it’s at times easy to make guesses about who’s talking to who if you have several contacts in common with a ‘victim’. An ‘attacker’ will sometimes see the victim and another contact taking turns going active/inactive as they pass messages back and forth.”

Why this metadata leaking is a problem, the situation is made worse by the fact that the only thing that an attacker has to know in order to “automatically subscribe to the victim’s metadata” is the victim’s phone number. The attacker can simply add the victim as a contact and start sniffing, and the victim won’t be notified of any of it, nor will the attacker be shown in his or her Telegram contacts.

“The attacker then takes guesses at what Telegram contacts the victim may have. Adding them as Android contacts makes them automatic Telegram contacts and the metadata analysis can begin. Using the metadata the attacker may have a good chance of figuring out who the victim is communicating with and when,” he noted.