Despite the good reputation of the instant messaging application Telegram, the National Cryptologic Center (CCN-CERT) has warned of the risks of using this app, which it considers to be in the crosshairs of cyberattackers as a tool for obtaining users' personal data.
According to the state body detailed in a report, this application presents security shortcomings, such as in the case of the MTProto protocol and the encryption of messages in Cloud Chat.
Cloud Chat is one of the two backup tools through message encryption present in the app –the second stores secret chats with a key that only the participants handle– and it appears enabled by default. The CCN-CERT has recommended disabling this option, “since it exposes data historically in case of a compromise, and not only during its duration”. “An attacker could deceive a user with social engineering techniques or have access to the victim's phone for a short period to obtain conversations and files”, the report on Telegram states.
MTProto is another major reason for concern according to experts. Although its encryption has never been publicly broken –the app even offered a reward of 300.000 dollars to whoever broke it–, el escepticismo subyace en el hecho de que haya sido creado por la propia desarrolladora homónima de Telegram, lo que rompe lo que desde el CNN-CERT se identifica como “la primera regla de la criptografía: no inventes tu propia criptografía”. Este sistema ‘casero’ es considerado “más propenso a errores, y probablemente no ha sido examinado o evaluado por investigadores en el exterior”. A ambos riesgos de la ciberseguridad de Telegram se suman otros factores como la obligación de dar a la aplicación el número de teléfono personal como parte del proceso de registro, la recopilación de metadatos por parte de sus servidores, la monitorización de usuarios, the downloading of unofficial app services or possible account hijackings taking advantage of network failures or through SMS or calls.
If you want to see the full report, you can do so through the following link:
Fountain: 20 minutes