9

A quote from Checkpoint Research

Migration to Telegram

Telegram, an encrypted instant-messaging application first introduced in 2013, experienced a meteoric rise in subscribers (five million new users in just 24 hours) following a server crash on the WhatsApp messaging platform. Similar to WhatsApp, Telegram users can chat to individuals as well as groups. What sets it apart, among other features, however, is the pride it places on its enhanced security capabilities. As a result, some of its hosted chat groups have become a useful alternative to the secretive forums on the Dark Web.

Telegram’s hosted chat groups, known as ‘channels’, can be used to broadcast messages to an unlimited number of subscribers, and, while their entire messaging history can be viewed, any response to the public messages is held privately. The discretion these channels thus provide goes a long way to help disguise their malice. Any threat actor with a shady offer or conversation to start, can enjoy private and end-to-end encrypted chats instead of the exposed threads that are seen in online forums. If in the past several steps were required to ensure an anonymous connection to TOR, today any Telegram user can easily and quickly join channels with a single tap on their phone and start to receive notifications of clandestine conversations and offers directly to their smartphone, all while keeping their identity completely hidden.

I don't do any illegal activity, but I don't feel comfortable (privacy-wise) registering my mobile phone number for Telegram and similar services (such as Discord). Those services are also closed source. In most American countries you need an official ID to register for SIM card.

I see the same pattern with erotic content: some weeks ago Anon-IB (you could post as Anonymous) was shut down and people moved to Discord groups.

My claim is that Discord/Telegram is way less private than a Tor-based forum or even an anonymous forum on the clearnet. Am I wrong? What do you think about this Checkpoint Research report?

  • 1
    Discord does not require a phone number. And its chat feature works in Tor Browser. So it's not a good example – CodesInChaos Nov 7 '18 at 10:37
7

The need for anonymity

The main issue with moving off of an anonymity network to Discord or Telegram is that they are not designed for anonymity. The Tor network is designed specifically to hide the origin of the communications. There is no single centralized entity which can be forced into disclosing logs, because no single Tor relay simultaneously knows both the contents of the messages and their origin. For things like Discord or Telegram, the mere participation in a criminal chat room can be incriminating even if the contents of the conversations themselves are kept private.

A criminal network requires a few things to continue to exist. If you assume that infiltration is a risk (e.g. that members of the group may be coerced into turning into a narc), then a requirement is that the pseudonyms of users cannot be tied to their real-life identity using any technical means. A service not designed with anonymity in mind will be vulnerable to infiltration. The only way to avoid this would be to access the chat service through an anonymity network like Tor anyway and register using an anonymous identity, e.g. with a throwaway online phone number. This requires consistently good opsec, and a single slip-up or misunderstanding can spell disaster.

Issues with Discord and Telegram

There are some specific problems with using Discord or Telegram, other than requiring a mobile number. Discord is not end-to-end encrypted, so the server itself can keep logs of both IP addresses and message contents along with the regular metadata. And Telegram, while it makes attempts to be secure, has been heavily criticized for providing very poor and amateur encryption. It would be possible to create real-time chat services that do not have these problems (such as IRC private messages using end-to-end encrypted OTR), but this on its own will not provide anonymity, which is necessary for a group (criminal or otherwise) trying to exist in an adversarial environment.

When using a non-anonymous service like this, an adversary can do many things. They can:

  • Learn a user's pseudonymous identity.

  • Learn a user's real identity.

  • Monitor the user's communications.

  • Detect access to the service at the level of the ISP.

All this is possible as soon as they know the group exists. If the service being used is designed correctly to be anonymous and uses properly-implemented end-to-end encryption, they can only:

  • Learn a user's pseudonymous identity, if they infiltrate the group.

  • Monitor the user's communications, if they infiltrate the group.

In this latter case, the only way things could go wrong is if one of the users made a fatal opsec mistake, giving away personal information which can be used to identify them. A lot of opsec is required for a criminal (or otherwise targeted) group to exist, and even when following sophisticated rules, a single mistake can bring down the group and reveal the identities of many individual members. A famous case is the Yardbird group, where the leader would require that everyone maintain high-quality opsec. Eventually the group's existence was revealed when one of the members was arrested on other charges. This allowed the group to be infiltrated, and in the end, the only people who are still free are the people who used Tor. Every VPN user was caught.

Why people do stupid things

People sometimes leave anonymity networks because they are, by necessity, rather slow. For someone used to high-speed internet, the latency caused by Tor may be an inconvenience. This can drive them to move to alternatives, even if these alternatives are less secure for their purposes. Fundamentally, there is no security downside to using a Tor-based messaging platform (whether a real-time chat system or a regular forum) compared to a non-Tor-based platform.

Consistent good opsec is among the biggest hurdles for any group existing in an adversarial environment. It is so easy for people to get fed up with a less convenient but secure solution such as Tor and break their opsec. For example, a Tor user who is the target of a criminal investigation could be linked to a honeypot site with content that they would find interesting. If the honeypot blocks Tor, a surprising amount of people will turn off Tor to visit it "just once", revealing their IP. The Snowden leaks also revealed the existence of NSA programs which would attempt a DoS attack (via TCP hijacking to inject an RST) against targeted Tor users, preventing them from using the service in hopes that they would get frustrated and move to a less-anonymous alternative.

  • Forest, chrome is upset with me trying to open up that Yardbird link, is that link still valid/safe? – Will Barnwell Nov 7 '18 at 0:08
  • Yes, the link is still valid and safe. It's just plain text. – forest Apr 15 at 10:04
4

There are some realities that you might not be aware of:

  • Telegram has a web portal
  • You could use one of the many "free temporary" phone number services to register to
  • some of Telegram's code is open, so it's not totally closed

So, with a VPN and a temporary SMS number, you can use Telegram with sufficient anonymity from services and end users.

  • 2
    "You could use one of the many "free temporary" phone number services to register to" Not sure on Telegram, but Discord blocks most VOIP/free phone numbers. – Adonalsium May 10 '18 at 12:47
  • @Adonalsium until you find the service with numbers that are not blocked ... – schroeder May 10 '18 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.