Michał "rysiek" Woźniak · 🇺🇦

Remarkable investigation into Telegram by IStories (in Russian):
https://www.istories.media/stories/2025/06/10/kak-telegram-svyazan-s-fsb/

English version by OCCRP:
http://www.occrp.org/en/investigation/telegram-the-fsb-and-the-man-in-the-middle

tl;dr:

👉 Telegram uses a single company with ties to the Russian FSB as their sole infrastructure provider, globally.

👉 Combined with a cleartext device identifier Telegram's protocol requires to be prepended to all encrypted messages, this allows for global surveillance of Telegram users.

I am quoted in this story.

#Telegram #InfoSec #Privacy

Как «Телеграм» связан с ФСБ

За инфраструктуру мессенджера отвечают те, кто обслуживает секретные комплексы российских спецслужб, используемые для слежки за гражданами

Jun 10, 2025 at 7:20amWeb
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

As part of the investigation, I have looked closely at Telegram's protocol and analyzed packet captures provided by IStories.

I have also done some packet captures of my own.

I dive into the nitty-gritty technical details of what I found and how I found it on my blog:

Telegram is indistinguishable from an FSB honeypot
https://rys.io/en/179.html

Yes, my packet captures and a small Python library I wrote in the process are all published along.

#Telegram #InfoSec #Privacy #Surveillance #Russia

Telegram is indistinguishable from an FSB honeypot

Many people who focus on information security, including myself, have long considered Telegram suspicious and untrustworthy. Now, based on findings published by the investigative journalism outlet ISt

Songs on the Security of Networks
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

Telegram has responded to IStories' piece:

> All Telegram servers are Telegram’s property maintained by Telegram employees. Unauthorized access is not possible. Telegram has neither employees nor servers in Russia. In the entire history of Telegram, it has never handed over private messages to third parties, and its encryption has never been hacked
https://vot-tak.tv/87198696/fsb-chitaet-telegram

This answers exactly zero of the crucial points raised by the story.  

Let's dissect it! 🔍

🧵

#Telegram #FSB

Telegram может быть небезопасен для пользователей по всему миру. «Важные истории» выяснили, как мессенджер Павла Дурова связан с ФСБ

Российские спецслужбы имеют доступ к переписке сотен миллионов пользователей Telegram — как в России, так и за рубежом. Об этом говорится в расследовании «Важных историй». Журналисты выяснили, что за инфраструктуру мессенджера отвечают компании, обслуживающие секретные комплексы силовиков, которые используются для слежки за гражданами. Как отмечает «Первый отдел», благодаря возможности читать переписку пользователей ФСБ начала возбуждать дела о госизмене против россиян, пишущих в украинские телеграм-боты. В Telegram в ответ на запрос «Вот Так» заявили, что ни один из поставщиков услуг для мессенджера никогда не имел доступа к конфиденциальным данным, а сама компания ни разу не передавала личные сообщения третьим лицам. 

Telewizja Polska S.A
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

> All Telegram servers are Telegram’s property maintained by Telegram employees.

👉 First: the story is not about the servers, it's about whose infrastructure the traffic flows through.

👉 Secondly: Vedeneev, the Russian owner of the infrastructure provider GNM used by Telegram, had signed documents as Telegram's CFO (would that qualify as "employee"?), and presented himself in Florida court as the person authorized to handle Telegram's servers.

🧵

#Telegram #FSB

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

> Unauthorized access is not possible.

Unauthorized access to… what exactly? To the servers, which the story is not about? To data on the servers, which again, the story is not about?

Or do they mean the traffic? Because if they mean the traffic here, then GNM's access to it, as the networking provider, would be totally authorized after all.

So, either they are talking about something irrelevant (servers), or they make a statement that looks good but does not actually contradict the story.

🧵

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

> Telegram has neither employees nor servers in Russia.

There we go with the servers again!

Regarding employees – okay, so was Vedeneev a contractor? In the story he himself says that that the arrangement was "informal".

Telegram tries to pull a "Schrödinger's Vedeneev" here. He's an "employee" when handling the hardware in Florida, but not an "employee" in Russia? I guess?

Regardless, all that is beside the point, which is: traffic analysis and cleartext device identifier.

🧵

#Telegram

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

> In the entire history of Telegram, it has never handed over private messages to third parties

🚨 Sneaky use of "private messages"!

Remember, Telegram has end-to-end encrypted "Secret Chats", which almost nobody uses; and then it has "Cloud Chats" for everything else.

They decided to add "private" here, as if "less private" non-Secret-Chat messages had been provided to third parties? ..  

Yes, there are indications of just that if you're wondering:
https://www.wired.com/story/the-kremlin-has-entered-the-chat/

🧵

The Kremlin Has Entered Your Telegram Chat

Russian antiwar activists placed their faith in Telegram, a supposedly secure messaging app. How does Putin’s regime seem to know their every move?

WIRED
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

> and its encryption has never been hacked

Ignoring dumb use of the h-word (🙄), Telegram encryption – specifically, the v1 of their homegrown MTProto protocol – had been shown to contain "a most backdoor-looking bug" some people have ever seen:
https://words.filippo.io/dispatches/telegram-ecdh/

This has since been fixed, and MTProto 2 has been rolled out. But it still smells funny to a lot of cryptographers.

More importantly though: the story is not about breaking Telegram's encryption

Another red herring!

🧵

The Most Backdoor-Looking Bug I’ve Ever Seen

This is the story of a bug that was discovered and fixed in Telegram's self-rolled cryptographic protocol about seven years ago. The bug didn't get any press, and no one seems to know about it, probably because it was only published in Russian. To this day, it's the most backdoor-looking

Filippo Valsorda
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

And finally, here are some questions that are ✨actually relevant✨ to the story, but have not at all been answered (or even touched upon) by Telegram's statement:

👉 Does GNM have access to the networking equipment handling Telegram's traffic?

👉 Does all Telegram traffic flow through GNM's infrastructure?

👉 Does GNM have links to FSB as described in the piece?

👉 Does Telegram protocol require cleartext device identifiers visible on the wire?

🧵/end

Show threadgimJun 11, 2025
@rysiek Even if there's no backdoor, I can bet my money, they are likely sending some kind of master key to their servers...
Show threadwallabra 🇧🇷Jun 11, 2025
@rysiek It's so funny that they say this, because Telegram was so exploitable, literally just having someone else's phone number was all you needed to leak their messages. This became front and central e.g. in leaking secret documents regarding corruption in Brazil: https://en.wikipedia.org/wiki/Vaza_Jato
Vaza Jato - Wikipedia

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 11, 2025
@wallabra hah, good one!
Show threadReed MidekeJun 10, 2025
@rysiek Leaving everything else aside, a non-employee with an "informal" agreement (and power of attorney) to act as CFO might be OK for a garage startup with handful of employees but seems like a red flag for billion-plus user social media platform
Show threadElectroFetishJun 10, 2025
@rysiek This has nothing to do with a single country. Capitalism uses any tool to control the masses.
Show threadJonathan Kamens 86 47Jun 10, 2025
@ElectroFetish ok, comrade @rysiek
Show threadflere-imsaho 🇺🇦Jun 10, 2025
@ElectroFetish @rysiek thank you for your very valuable opinion.
Show threadflere-imsaho 🇺🇦Jun 10, 2025
@ElectroFetish @rysiek (though i'd think that a russian-speaking person might find confirmation of a fact that telegram has links to russian state security, you know… interesting, if not a bit worrying. ah well.)
Show threadElectroFetishJun 11, 2025

@mawhrin @rysiek It is a mistake to think that only a single country collects big data... this is a very wrong opinion, which makes one country an outcast, and another - a paradise for life.

Capitalism has levers of pressure on society through power structures.

Show threadMarcos DioneJun 10, 2025

@rysiek You say: "That “authorization key”, used to encrypt messages between a client and a server, is negotiated once on each device [...] got assigned to at registration time, pretty much for the lifetime of the client on that device."

I wonder what happens with the web client, specially if you somehow get rid of T's data on the browser. I use it daily and TBH for some stuff it's better than Linux and Android native client.

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

@mdione in the web client all traffic goes through HTTPS, presumably using websockets.

I would assume an authorization key is still generated, and the web client still puts MTProto 2 encrypted messages in that HTTPS tunnel. That authorization key is probably kept in the browser, or perhaps valid only for the session. But I am pretty sure it's there.

But the fact that it goes through HTTPS means it is not visible cleartext on the wire.

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

@mdione which might not mean all that much. Telegram's choices of infrastructure provider and of protocol design, and the way these facilitate surveillance in case of the mobile client, would make me very wary of any other choices and decisions they might have made with relation to the web client that would have a similar effect.

Question: do you have to log in every time into the web client? Or does your browser keep the session for, say, a few days or weeks, even when traveling?

Show threadMarcos DioneJun 10, 2025
@rysiek it seems permanent. I just open the tab again and nothing's lost, no login, nothing. The client is linked to the Android one via a QR code just like WA (and Signal?).
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

@mdione right, interesting. I would like to see if it generates any kind of traffic to/from the mobile app, or if it for example requires mobile app to be online within the last X days or some such.

In other words, if it forces the user to use the (auth_key_id-leaking) mobile app every now and then. 👀

Show threadAndrey {.ru account};Jun 11, 2025

@rysiek
No, it's like any other full-featured standalone Telegram client. Not like WA Web. Login via QR is only for convenience there.

@mdione

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 11, 2025
@darkcat09 @mdione can you set up a completely new account through it without having the mobile app?
Show threadAndrey {.ru account};Jun 11, 2025

@rysiek
Recently Telegram restricted registration for all clients except official apps for Android and iOS. So, to sign up, you need a mobile app (opensource btw).

@mdione

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 11, 2025

@darkcat09 so it is not a full-featured stand-alone Telegram client then.

@mdione

Show threadF4GRX SébastienJun 10, 2025
@rysiek my unsurprised face.
Show threadAral BalkanJun 10, 2025
@f4grx @rysiek And mine.
Show threadF4GRX SébastienJun 10, 2025
@rysiek pfs that regenerates identifiers every 24h? wtf?
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025
@f4grx there are so, so many weird things there.
Show threadpixelschubsiJun 10, 2025
@rysiek I was wondering what you think about Signal's registration_id. It seems to be a longterm device id that is attached to some(?) messages?
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025
@pixelschubsi but you cannot see it in cleartext on the wire, now can you?
Show threadpixelschubsiJun 11, 2025
@rysiek Signal uses TLS, so you don't see it on the wire. The TLS is terminated at a service provider linked to the NSA, meaning it's cleartext to that service provider and the NSA (which is arguably better than the FSB).
AFAIK, at least the Telegram Web Client also uses TLS (either via secure WebSockets or regular HTTPS requests). Some clients use non-TLS transports though, so I agree that makes things worse in Telegram.
Show threadTom 🇨🇦Jun 10, 2025

@rysiek

TL;DR Don't use Telegram unless you're comfortable giving Russian authorities and intelligence operatives access to all your activity on that platform.

Show threadVysogotaJun 10, 2025
@misterscience @rysiek my guy, you are giving russian services access to your entire device, let alone the shit platform with notoriously backdoored crypto
Show threadzetabetaJun 10, 2025

@rysiek
i have said this for some other big tech companies.

as i need another reason to boycott telegram, too any strikes already.

Show threadOrca 🌻 | 🎀 | 🪁 | 🏴🏳️‍⚧️Jun 10, 2025
@rysiek
I tried getting people off Telegram a few times.
Every f- time their answer is "but everyone I chat with is on Telegram!" even when I said it once had a "very backdoor looking bug".
...... 😬
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025
@Orca yeah. It's not great.
Show threadChris SimpsonJun 10, 2025

@rysiek @Orca I know I should get myself, my family and my friends off Telegram, but I'm the one who got them on to it after refusing to use Facebook, Whatsapp and Twitter due to their surveillance and toxicity

The thought of getting my eighty year old parents to learn to use signal doesn't fill me with joy

Show threadDavid =?🏴‍☠️Jun 10, 2025
@rysiek даже по первому предложению статью не читая всю статью могу сказать что информация верная. Людям стоит перестать воспринимать этот сервис как приватный и конфиденциальный если хотят приватности. Уважаю автора.
Show threadPavel SeleznevJun 10, 2025

@rysiek we definitely need more articles like this.
Thank you for posting.

When you think about it Telegram has so many red flags for an app that is supposed to be secure.

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

@rtlc thank you for reading it.

Yes, absolutely, Telegram has always been extremely sus. I am hoping that this investigation will help some people move elsewhere.

That said, network effects are extremely strong and people will find excuses to continue using it. Which is why every single person that decides to leave it is so very important.

Everyone on Telegram is a reason for someone else to be there. Anyone who leaves is that one reason less for someone.

Show threadLisPiJun 10, 2025
@rysiek @rtlc It's a proprietary platform that doesn't allow Free Software clients (though the underlying service is compromised in such a way that such clients couldn't mitigate its issues) and collects user information (similarly to spyware, a type of malware).

Of course it's sus.
Show threadHugo 雨果Jun 10, 2025
@rysiek This has been well-known for many years. The thing is, people will flock to whatever is most convenient, and don't really care much about these things. Telegram has a far more polished UX and is easier to use than Signal, and even more so than XMPP or any user-centric or privacy-respecting protocol.
Show thread@ᴊᴀᴇ@ʙꜱᴅ.ᴄᴀꜰᴇ[ᴍᴏᴠᴇᴅ]™Jun 10, 2025
@rysiek how is this a problem? it's free service. expect nothing but becoming the (l)user
Show threadRVJun 10, 2025
@rysiek Does the article state that all Telegram comms get routed through infrastructure physical located in Russia?
Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 10, 2025

@RaulV no. It states that all Telegram comms get routed through a company that has links to the Russian FSB.

You might want to read the story. That's by far the best way to learn what the story says. 

Show threadRVJun 11, 2025
@rysiek So many stories to keep up with. Every day something else comes out. Ain't nobody got time to read all the stories all the time. Thanks for the highlight.
Show threadПротест и сопротивлениеJun 10, 2025

@rysiek I've always been calling it FSBgram.

Durov has banned exactly zero pro-Kremlin propagandist channels, no matter how notorious and hateful.

Meanwhile, there were many cases where the owners of the supposedly anonymous opposition channels were somehow suddenly "identified" and persecuted by the regime. It happens less often now because almost all the remaining opposition is either in jail or in exile, but ~5 years ago it was a very common occurrence.

Show threadPontiff Fractal TiamJun 11, 2025

@rysiek I posted your blog entry in our company's slack yesterday and got a very sloppy response: "Durov cannot be cooperating with FSB, otherwise he wouldn't have lost his billion $ company and home and moved to another country".

Although I don't agree with that statement, it would also be interesting to follow the money here as well. I can imagine that Durov is still being paid by shady entities all over the world.

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 11, 2025

@pft what proof does anyone have he did "lose" his company, and not got bought out?

He did have the money to start Telegram afterwards.

Show threadPontiff Fractal TiamJun 11, 2025

@rysiek in the meanwhile I read other reports about his regular visits to Russia as well as traces of his businesses with companies with tight ties to the Russian government/FSB.

I all seems pretty clear to me. But I'm not going to discuss further. I think the colleague is Russian and he was somehow offended 😅

Show threadMichał "rysiek" Woźniak · 🇺🇦Jun 11, 2025
@pft yeah, that happens. Send them the Russian IStories link. There are some really juicy quotes from Durov at the very end. Maybe that'd work:
https://istories.media/stories/2025/06/10/kak-telegram-svyazan-s-fsb/
Как «Телеграм» связан с ФСБ

За инфраструктуру мессенджера отвечают те, кто обслуживает секретные комплексы российских спецслужб, используемые для слежки за гражданами

Show threadPontiff Fractal TiamJun 11, 2025
@rysiek I was about to. But honestly am afraid that is gonna escalate to HR. I read the translation of iStories and it was really shocking!
Show threadOrca 🌻 | 🎀 | 🪁 | 🏴🏳️‍⚧️Jun 11, 2025
@rysiek That said, I did a brief lookup on Hurricane Electric's BGP toolkit and it seems none of the BGP AS Telegram ("Telegram Messenger Inc") owned have peered with any BGP AS owned by GNM ("Global Network Management Inc") so it's unlikely GNM is doing the routing for Telegram... 🤔

Update: Also HE looking glass reported it's the BGP neighbor of Telegram Messenger 🤔
Looking Glass - Hurricane Electric (AS6939)

Hurricane Electric (AS6939) Network Looking Glass

Show threadFellwing🇪🇺Jun 11, 2025
@rysiek I properly defenestrated Telegram for good after this. 11 years old account now gone for good.