2

My friend is part of a business of about 10 people that provide stock and share advice to paying members in a Telegram group. It's a quite expensive pay monthly group of loyal enough customers who benefit from the group's secrecy and so a leak compromises the success of the group. There are over 200 members in the group currently. Recently a user within the group has been leaking this information to a Discord channel and charging non-members a fee to access to it.

My friend found out who the user was but it appears they have multiple accounts still running and hidden throughout the current 200 users. They appear to be using bots to glean information directly from the group.

How could we catch these information leaks using some kind of trickery and subterfuge such as a canary trap? A canary trap is likely not possible as each user of the group receives the exact same information via the group chat so that option is likely out but there must be some other sneaky way.

The vetting process to enter the group is very strict so once we can identify this user and all associated accounts we should be able to ban them permanently.

  • 3
    There seems to be a disconnection between the statement "The vetting process to enter the group is very strict" and that the user managed to have multiple accounts. – Ángel Jan 25 '18 at 23:24
  • Perhaps they used friends identities to open these accounts but when I joined it took hours to take care of the vetting. – hydroxy Jan 26 '18 at 0:22
  • How exactly is the vetting done? How many fake accounts do you estimate to be there? How many messages get sent every day/week through the Telegram chat? Is every message copied into the Discord chat? – Tom K. Jan 26 '18 at 12:32
1

Attempting an 'Andropov' (revealing different information to several people and check what got leaked is said to have been a favourite technique of Y. Andropov) on such a group is impractical. Even if you created new different groups and assigned each user to one, leaking different information from the one supplied or skipping a leak etc. are obvious counterstrategies and the truth would be really slow in coming out.

You might try a countersting - subscribe to your own Telegram group with several fake names and, if possible (I don't know Telegram) ask for some information on specific topics, to establish a pattern. Supply this information to yourself. After a while, subscribe to the Discord channel anonymously and offer the unknown manager a lot of money for a different specific information (say, the dirt about Bill Gates). Then see whether someone asks for that information in the Telegram group. This, too, is obvious enough - but sometimes greedy people don't see the obvious.

Checking registration patterns could offer some valuable insights. I guess that whoever did it at a certain point decided to cheat, and that's when he created the additional accounts to keep his finger in - but they aren't probably very many, as they are paying accounts, are they not? You might try following the money. Or the times of payment. Or the date of account creation. Note that you might now have figured out who the fake account is, while the original account of the culprit was opened before it (i.e. your culprit is John Smith, who created a fake account under Joe Small. And you discovered that Joe Small leaked, and killed that account - but John Smith is still onboard).

The best move however would be to change dissemination strategy. Use a series of one-on-one connections, so that you can discriminate what information goes out.

-1

Start moving over the members 1-by-1 over to a new group speaking to the individuals privately. Give slightly different info to the new group. There's your trap.

If the unauthorised Discord group starts changing to the new group's info, then the most recent members are your likely targets.

The added benefit is that you can re-vet your members.

  • 1
    If there are indeed several socks, the people leakingit will probably be at both channels. A telegram chat group is terrible for this. They should probably replace it with a custom app, which would give them the needed flexibility (plus receiving more metadata from when people receive it). – Ángel Jan 26 '18 at 0:30
  • @Ángel I know they might end up being in both channels. That's kind of the point. – schroeder Jan 26 '18 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.