WASHINGTON - Telegram, a popular encrypted messaging app, will allow users to cloak their telephone numbers to safeguard Hong Kong protesters against monitoring by Chinese authorities, according to a person with direct knowledge of the effort.
The update to Telegram, planned for release over the next few days, will allow protesters to block Chinese authorities from discovering their identities in the app's large group chats.
Thousands of Hong Kong protesters take their cues from more than 100 groups on Telegram. Protesters use encrypted apps like Telegram to mobilize swiftly through multiple group chats, with less risk of police infiltration, Reuters found in a report published earlier this month.
The groups are used to post everything from news on upcoming protests to tips on dousing tear gas canisters fired by the police to the identities of suspected undercover police and the access codes to buildings in Hong Kong where protesters can hide.
Protesters have grown concerned that Chinese authorities could use the movement's reliance on Telegram to monitor and arrest organizers. Telegram chat groups used to organize public protests are often accessible to anyone and participants use pseudonyms.
But a feature in Telegram's design may have allowed Chinese authorities to learn the real identities of users, according to a group of Hong Kong engineers who posted their finding on a online forum earlier this month.
Telegram allows users to search for other users by uploading phone numbers. This function allows a new user to quickly learn whether those in her phone's contact book are already using the app, the group said.
Protesters believe Chinese security officials have exploited the function by uploading large quantities of phone numbers.
The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users' true identities.
Telegram has detected evidence that Chinese authorities may have uploaded numbers to identify protesters, said a person with direct knowledge of the situation. But it is unclear whether Chinese authorities have successfully used this tactic to locate protesters.
Government authorities in Hong Kong did not respond to a request for comment.
The fix Telegram is working on would allow users to disable matching by phone number. That option represents a balance between making it easy for users to find their contacts and the privacy needs of those who rely on the app for protection against state security agents.
Telegram hopes to help protect Hong Kong protesters with the update, the source said. But wide adoption of the optional security setting would make the app far harder to use for the vast majority of its more than 200 consumers who rely on uploading phone contacts to identify friends and family members on the app, the source said.
The move by Telegram comes as Hong Kong police arrested a number of prominent activists and 3 lawmakers on Friday. Nearly 900 people have been arrested since the demonstrations began three months ago.
With protesters and authorities at an impasse and Hong Kong facing its first recession in a decade, speculation has grown that the city government may impose emergency law, giving it extra powers over detentions, censorship and curfews.
The government would consider using “all laws” to prevent violence, Hong Kong leader Carrie Lam, who has become a lightning rod for protesters’ anger, said this week.
source: news.abs-cbn.com
WASHINGTON - Google security experts uncovered an "indiscriminate" hacking operation that targeted iPhones over a period of at least 2 years and used websites to implant malicious software to access photos, user locations and other data.
In a post Thursday on the blog of Google's Project Zero security taskforce, cyber experts did not name the hacked websites hosting the attacks, but estimated they received thousands of visitors a week.
"Simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant," said Project Zero's Ian Beer.
Once installed, the malicious software "primarily focused on stealing files and uploading live location data," Beer said, adding it had been able to access encrypted messenger apps like Telegram, WhatsApp and iMessage.
Google hangouts and Gmail had also been affected, he added in the post, which provided a detailed breakdown of how the malicious software targeted and exploited iPhone vulnerabilities.
Most of the vulnerabilities targeted were found in the iPhone's default Safari web browser, Beer said, adding that the Project Zero team had discovered them in almost every operating system from iOS 10 through to the current iOS 12 version.
Once embedded in a user's iPhone, the malicious software sent back stolen data, including live user location data back to a "command and control server" every 60 seconds.
Beer said Google had informed Apple of the attacks in February, and Apple subsequently released a security patch for the iOS 12.1.
Long the driver of Apple's money-making machine, iPhone revenue overall was down 12 percent from last year to $26 billion.
The tech giant sent out invitations on Thursday to a September event at its Silicon Valley campus where it is expected to unveil a new-generation iPhone.
source: news.abs-cbn.com
While Facebook’s big cryptocurrency plans have hit a wall with regulators, another big social network, Telegram, is charging ahead with its own crypto coin.
Telegram has told investors that it is planning to send out the first batches of its coin, the Gram, within the next two months, according to three investors who have spoken with Telegram recently.
Telegram is also planning to make Gram digital wallets available to the 200 million to 300 million global users of Telegram’s messaging application, said the investors, who spoke on the condition of anonymity because they had signed nondisclosure agreements.
Echoing Facebook’s hopes for its Libra token, which was unveiled this year, Telegram has said the Gram will become a new online currency and a way to move money anywhere in the world.
The scope of Telegram’s ambitions were evident in early 2018 when it raised $1.7 billion from big-name investors, including some of the largest venture capital firms in Silicon Valley.
Unlike Facebook, which released public plans for its digital money long before the first token was ready, Telegram has largely proceeded in secrecy. That opaqueness could amplify questions that it will face from government authorities when it makes its tokens public.
Regulators have grown increasingly concerned that coins like Gram and Libra could, like bitcoin before them, be useful to drug dealers and money launderers.
US authorities have already moved to shut down smaller cryptocurrency projects, citing them for violations of securities law.
“Anyone trying to build this type of token system has to be careful on any number of levels with regulators,” said Richard Levin, who specializes in cryptocurrencies law at the law firm Polsinelli. “I suspect that regulators will take a very close look at this offering.”
A spokesman for Telegram did not respond to multiple requests for comment.
Telegram has always operated with a degree of disregard for the opinions of government authorities.
The company was created by Pavel Durov, a self-described libertarian who fled Russia after clashing with the government and being forced to sell off his first successful social network, VKontakte. Durov now moves between offices in the Middle East and Europe.
The Telegram app makes it easy to send encrypted messages between phones. That has made it popular both with terrorists and with government dissidents and protesters, most recently in Hong Kong.
Those qualities have made it unpopular with governments in Iran and Russia, which have tried to shut it down.
In its sales pitch for the Gram, which was viewed by The New York Times, Telegram has said the new digital money will operate with a decentralized structure similar to bitcoin, which could make it easier to skirt government regulations.
Once Telegram releases the coins, it has said, the coins will be governed by a decentralized network of computers that will give Telegram no control over how and where the coins can move.
“A whole new economy saturated with goods and services sold for cryptocurrency will be born,” the company said in a document sent to potential investors in 2017.
The plans for Gram were met with significant skepticism in the cryptocurrency community. Many of the largest venture capital firms that have invested in cryptocurrencies passed on the chance to invest in it.
Security researchers also raised concerns about the coin because of security problems Telegram has had — issues that could have much more significant consequences if money is involved.
But that did not deter the prominent American venture capital firms Benchmark and Lightspeed Capital, along with many Russian investors, from contributing to the Gram fundraising round in 2018. Investors put up $1.7 billion in exchange for the promise of future Grams.
Telegram promised in legal documents that it would deliver Grams to investors by Oct. 31 or give back the money. The company is racing to get the coins out before that deadline.
Some people will immediately be able to sell their Grams on cryptocurrency exchanges, although the earliest investors agreed to a holding period, according to investor documents viewed by The Times.
Facebook’s Libra is meant to be backed up by traditional currencies held in bank accounts, in order to stabilize the value of the digital coin. The Gram, in contrast, will be backed by nothing and gain or lose its value, like bitcoin, by whatever someone is willing to pay for it.
Telegram has recently said that before the coins are sent out, a test version of the Gram network will be released within the next week or two, investors said.
The Grams are intended to make it possible to buy and sell other goods on Telegram.
The company also has big ambitions for its Telegram Open Network, which it hopes will host new kinds of digital applications. There could be new kinds of sites, for example, where users tip one another for good comments or make small bets on future events.
But before any of that happens, Telegram will have to deal with critics and skeptical regulators.
“I don’t see how on earth Telegram can possibly get something compliant with regulators in place by the end of October,” David Gerard, a cryptocurrency analyst and critic, recently wrote on his website.
2019 The New York Times Company
source: news.abs-cbn.com
BEIJING - Encrypted messaging service Telegram suffered a major cyber-attack that originated from China, the company's CEO said Thursday, linking it to the ongoing political unrest in Hong Kong.
Many protesters in the city have used Telegram to evade electronic surveillance and coordinate their demonstrations against a controversial Beijing-backed plan that would allow extraditions from the semi-autonomous territory to the mainland.
Demonstrations descended into violence Wednesday as police used tear gas and rubber bullets to disperse protesters who tried to storm the city's parliament -- the worst political crisis Hong Kong has seen since its 1997 handover from Britain to China.
Telegram announced Wednesday that it was suffering a "powerful" Distributed Denial of Service (DDoS) attack, which involves a hacker overwhelming a target's servers by making a massive number of junk requests.
It warned that users in many regions may face connection issues.
Pavel Durov, Telegram's CEO, said the junk requests came mostly from China.
"Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram)," he tweeted.
"This case was not an exception."
Telegram later announced on Twitter that its service had stabilised. It also posted a series of tweets explaining the nature of the attack.
"Imagine that an army of lemmings just jumped the queue at McDonald's in front of you -– and each is ordering a whopper," it said, referring to the flagship product of Burger King.
"The server is busy telling the whopper lemmings they came to the wrong place -– but there are so many of them that the server can't even see you to try and take your order."
Evading surveillance
When asked about Durov's claim the attack originated from China, foreign ministry spokesman Geng Shuang said he was not aware of the incident.
"What I can tell you here is that China has always opposed any form of cyber-attacks. China is also a victim of cyber-attacks," Geng said at a regular press briefing in Beijing.
China's cyberspace administration did not immediately respond to AFP's request for comment.
Telegram was launched in 2013, and allows users to exchange encrypted text messages, photos and videos, and also create "channels" for as many as 200,000 people. It also supports encrypted voice calls.
The firm announced last year that it had crossed 200 million monthly active users.
Encrypted messaging apps like Telegram and WhatsApp are preferred around the world by a wide variety of people trying to avoid surveillance by authorities -- from Islamic State jihadists and drug dealers to human rights activists and journalists.
Governments in recent years have devoted significant resources to try and breach or bypass the security features of these apps, according to tech firms and researchers. Some states have outright banned them.
Hong Kong is not behind China's Great Firewall, which heavily restricts internet access in the mainland -- where Telegram is blocked.
The city's special status under its handover agreement allows freedoms unseen in mainland China, but many fear they are under threat as Beijing exerts increasing influence on Hong Kong.
The current protests were sparked by fears the proposed law would allow extraditions to China and leave people exposed to the mainland's politicized and opaque justice system.
source: news.abs-cbn.com
Messaging service provider Telegram has been hit by a "powerful" distributed denial-of-service (DDoS) attack and users in the United States and other countries may experience connection issues, the company said in a tweet Wednesday.
Telegram did not immediately respond to a request for more details on the attack.
In DDoS attacks, hijacked or virus-infected computers are used to target websites.
source: news.abs-cbn.com
