Papa Carder
Professional
- Messages
- 516
- Reaction score
- 589
- Points
- 93
A copy of the messenger's response was discovered in criminal case materials published in the US. The letter was discovered by journalists from 404 Media and Court Watch, who reviewed recently published court documents. The letter was added to the case against Mahmoud Amin Ya'qub Al-Muhtadi, who is accused by US authorities of involvement in the October 7, 2023, attack on Israel. Along with Telegram's response, a service email address intended for US law enforcement inquiries was made publicly available.
*****
According to the service's official rules, in response to legitimate subpoenas, Telegram only discloses phone numbers, IP addresses, and account IDs of suspects. This does not include access to chats.
The ability to read messages depends on the chat type. As a reminder, Telegram offers cloud chats (regular conversations and groups stored on servers) and secret chats (end-to-end encrypted, stored only on devices).
1. If an attacker intercepts an SMS message and logs into an account on a new device, Telegram automatically downloads the entire cloud chat history from the servers. In this case, the history can only be protected by enabling two-factor authentication (2FA) — a cloud password requested after entering the SMS code. The encryption keys for secret chats are stored locally. Therefore, when logging in from an old device to a new device, they will not be transferred and cannot be read.
2. Telegram traffic from the app to the server is encrypted using the MTProto protocol (and additionally wrapped in TLS). Corporate DLP systems that intercept ISP packets will only see the connection to Telegram servers and the amount of data. However, if a corporate DLP agent is installed on a work computer, it can take screenshots or intercept keystrokes.
3. If the device is infected with advanced spyware, the type of chat encryption no longer matters. The virus runs within the operating system and intercepts information as it is displayed on the screen: it takes hidden screenshots, records keystrokes, or directly reads the memory of the legitimate Telegram application.
4. If the user is lured to a phishing site and enters the code from the SMS, the attacker authorizes their session (their "client"). Similarly, if a Trojan stealer is active, it steals so-called session files from the computer. After copying them to their PC, the hacker opens Telegram without any passwords or SMS, gaining full access to all cloud-based conversations and contacts. However, Telegram's architecture fundamentally prevents syncing secret chats between different sessions.
5. If an attacker is able to unlock a phone or computer, and Telegram doesn't have a local "Passcode" set. In this case, the conversations are read directly from the screen. If the device is locked and protected with a strong password, modern forensic analysis methods can still attempt to bypass the protection and create a memory dump, from which the Telegram database can then be extracted. Both cloud and secret chats can be recovered from such a dump, provided they haven't been deleted.
6. Using an unofficial (modified) or counterfeit Telegram app, attackers can gain complete and unfettered access to all your correspondence, including secret chats, as well as all your personal data. In this situation, the messenger's encryption becomes completely useless, as the data is intercepted within the app itself.
(с) verd.st
*****
According to the service's official rules, in response to legitimate subpoenas, Telegram only discloses phone numbers, IP addresses, and account IDs of suspects. This does not include access to chats.
The ability to read messages depends on the chat type. As a reminder, Telegram offers cloud chats (regular conversations and groups stored on servers) and secret chats (end-to-end encrypted, stored only on devices).
1. If an attacker intercepts an SMS message and logs into an account on a new device, Telegram automatically downloads the entire cloud chat history from the servers. In this case, the history can only be protected by enabling two-factor authentication (2FA) — a cloud password requested after entering the SMS code. The encryption keys for secret chats are stored locally. Therefore, when logging in from an old device to a new device, they will not be transferred and cannot be read.
2. Telegram traffic from the app to the server is encrypted using the MTProto protocol (and additionally wrapped in TLS). Corporate DLP systems that intercept ISP packets will only see the connection to Telegram servers and the amount of data. However, if a corporate DLP agent is installed on a work computer, it can take screenshots or intercept keystrokes.
3. If the device is infected with advanced spyware, the type of chat encryption no longer matters. The virus runs within the operating system and intercepts information as it is displayed on the screen: it takes hidden screenshots, records keystrokes, or directly reads the memory of the legitimate Telegram application.
4. If the user is lured to a phishing site and enters the code from the SMS, the attacker authorizes their session (their "client"). Similarly, if a Trojan stealer is active, it steals so-called session files from the computer. After copying them to their PC, the hacker opens Telegram without any passwords or SMS, gaining full access to all cloud-based conversations and contacts. However, Telegram's architecture fundamentally prevents syncing secret chats between different sessions.
5. If an attacker is able to unlock a phone or computer, and Telegram doesn't have a local "Passcode" set. In this case, the conversations are read directly from the screen. If the device is locked and protected with a strong password, modern forensic analysis methods can still attempt to bypass the protection and create a memory dump, from which the Telegram database can then be extracted. Both cloud and secret chats can be recovered from such a dump, provided they haven't been deleted.
6. Using an unofficial (modified) or counterfeit Telegram app, attackers can gain complete and unfettered access to all your correspondence, including secret chats, as well as all your personal data. In this situation, the messenger's encryption becomes completely useless, as the data is intercepted within the app itself.
(с) verd.st
