This article was written a few years ago when the blocking of the Telegram messenger was actively discussed by the community and contains my thoughts on the matter. Although this topic is almost forgotten today, I hope it may still be interesting to someone.
This text emerged from my reflections on digital security, and I hesitated for a long time about whether to publish it. Fortunately, there is a wealth of specialists who rightly understand the issues, and I have nothing new to share with them. However, besides them, there are also many journalists and other bloggers who not only mislead themselves but also create a multitude of myths with their articles.
It is no secret that in recent times, intense passions have erupted on the digital battlefield. Of course, we are referring to one of the most discussed topics in modern Russia, namely the blocking of the Telegram messenger.
Opponents of the blocking present it as a confrontation between the individual and the state, freedom of speech and total control over the person. Supporters, on the other hand, are guided by considerations of public safety and the fight against criminal and terrorist organizations.
To begin with, let's imagine how the Telegram messenger actually works. We can visit their main page and read about how they position themselves. One of the main advantages of using this solution is its uncompromising focus on the security of the end user. But what exactly does this imply?
As with many other public services, your data is transmitted in encrypted form, but only to the central servers servers, where it is stored in plain sight and any admin, if they really want to, can easily access all your correspondence. Doubtful? Then consider how the synchronization function works between devices. If the data is confidential, how does it reach a third device? After all, you do not provide any special client keys for decryption.
For example, as done in the email service ProtonMail, where you need to provide a key stored on your local machine to work with the service, which the browser uses to decrypt messages in your inbox.
But it’s not that simple. In addition to regular chats, there are also secret ones. Here, communication truly happens only between two devices, and there is no talk of synchronization. This feature is only available on mobile clients, with chat screenshots blocked at the app level, and chats self-destruct after a set time. From a technical standpoint, the data stream still goes through central servers, but it is not stored there. Moreover, saving it is pointless, as only the clients possess the decryption keys, and the encrypted traffic holds no particular value.
This scheme will work as long as clients and the server implement it honestly and there are no various programs on the device secretly sending screenshots to third parties without your knowledge. So, could the reason for law enforcement's disdain for Telegram be found in the secret chats? I believe that this misunderstanding is at the root of the confusion for most people. We will not fully understand the cause of this misunderstanding until we comprehend what encryption is and whom it is meant to protect your data from.
Let’s imagine that a certain attacker wants to send a secret message to their friends. It is so important that they are willing to put in the effort and take precautions. Is Telegram really a good choice from the perspective of an information security specialist? No, it is not. I assert that using any of the popular messengers for this purpose is the worst option one could choose.
The main problem is the use of messaging systems where your correspondence will primarily be searched for. And even if it is well protected, the mere existence of it can compromise you. Remember that client connections still occur through central servers, and at the very least, the fact that a message was sent between two users can still be proven. Therefore, using email, social networks, and any other public services is pointless.
So how can we organize correspondence that meets all security requirements? In this review, we will deliberately discard all illegal or controversial methods to show that the task can be solved solely within the framework of the law. There will be no need for any spying, hacking, or difficult-to-access software.
Almost all tools are included in the standard utility set provided with any GNU/Linux operating system, and banning them would mean banning computers as such.
The Internet is like a vast web of servers, generally running the GNU/Linux operating system and with rules for routing packets between these servers. Most of these servers are not accessible for direct connection; however, there are also millions of servers with publicly accessible addresses that serve all of us, handling immense amounts of traffic. Your correspondence among this chaos will not be searched for by anyone, especially if it does not stand out in any particular way.
Those who wish to organize a secret communication channel will simply purchase a VPS (virtual machine in the cloud) from one of the hundreds of players in the market. The cost, as you can easily see, is just a few dollars a month. Of course, it won't be possible to do it anonymously, and in any case, this virtual machine will be tied to your payment method, and thus to your identity. However, most hosts don't care what you run on their hardware as long as you don't exceed their basic limits, such as the amount of outbound traffic or connections on port 23.
While such a possibility exists, it is simply not profitable for him to spend the few dollars he earned from you to monitor you.
And even if he wants or is forced to do so, he must first understand what kind of software is specifically used by you and, based on this knowledge, create a monitoring infrastructure. Doing this manually is not complicated, but automating the process will be extremely challenging. For the same reason, saving all the traffic passing through your server will not be economically viable unless you have already caught the attention of the relevant authorities who want to do so.
The next step will be to create a secure channel using one of the many existing methods.
- The simplest method would be to establish a secure SSH connection with the server. Several clients connect via OpenSSH and communicate, for example, using the wall command. Cheap and effective.
- Launching VPN the server and connecting several clients through a central server. Alternatively, look for any chat program for local networks and go ahead.
- Simple FreeBSD NetCat unexpectedly has built-in functionality for primitive anonymous chat. It supports encryption via certificates and much more.
It goes without saying that in the same way, besides simple text messages, any files can also be transmitted. Any of these methods can be implemented in 5-10 minutes and is not technically difficult. Messages will appear as simple encrypted traffic, which constitutes the majority of internet traffic.
This approach is called steganography — hiding messages where they wouldn't be thought to be searched for. While this does not guarantee the security of correspondence, it reduces the likelihood of its detection to zero. Moreover, if your server is located in another country, the data extraction process may also be impossible for other reasons. And even if someone does gain access to it, your correspondence will likely remain uncompromised up to that point, as it is, unlike public services, not stored locally anywhere (of course, this depends on the communication method you choose).
However, one might argue that I am looking in the wrong place, as global intelligence has long planned for everything, and there are vulnerabilities in all encryption protocols for internal use. This is a quite valid statement, considering the history of the issue. So what should be done in this case?
All encryption systems that form the basis of modern cryptography have a certain property — cryptographic strength. It is assumed that any cipher can be broken; it is merely a matter of time and resources. Ideally, it is necessary to achieve a situation where this process is simply not cost-effective for the hacker, regardless of the importance of the data. Or it should take so long that by the time the break occurs, the data has already lost its significance.
This statement is not entirely correct. It holds true when we talk about the most common encryption protocols used today. However, among the variety of ciphers, there is one that is absolutely resistant to hacking and at the same time very simple to understand. It is theoretically impossible to break if all conditions are met.
The idea behind the Vernam Cipher is very simple — sequences of random keys are generated in advance, which will be used to encrypt messages. Each key is used only once for encrypting and decrypting a single message. In the simplest case, we create a long string of random bytes, and each byte of the message is transformed through the XOR operation with the corresponding byte in the key and sent further through an unencrypted channel. It is easy to notice that the cipher is symmetric and the key for encryption and decryption is the same.
This method has its drawbacks and is quite rarely used; however, the advantage achieved is that if the two parties agree on a key in advance and that key is not compromised, then it can be ensured that the data will not be read.
How does it work? The key is generated in advance and transferred among all participants via an alternative channel. It can be handed over in person on neutral ground, if possible, to completely eliminate the possibility of interception, or simply sent by mail on a USB flash drive. We still live in a world where there is no technical capability to inspect all information carriers crossing borders, including all hard drives and phones.
After all participants in the correspondence have received the key, quite a bit of time may pass before the actual communication session occurs, which further complicates counteracting this system.
One byte in the key is used only once to encrypt one symbol of the secret message and decrypt it by other participants. The used keys can be automatically destroyed by all participants of the correspondence after the data has been transmitted. Once secret keys have been exchanged, messages can be sent with a total volume equal to their length. This fact is often cited as a drawback of this cipher; it is much more pleasant when the key has a limited length and does not depend on the size of the message. However, these people forget about progress, and while it was a problem during the Cold War, it is not a problem today. Considering that the capacity of modern carriers is practically limitless, and in the most modest case we are talking about gigabytes, a secure communication channel can operate indefinitely.
Historically, the Vernam Cipher, or encryption using one-time pads, was widely used during the Cold War for transmitting secret messages. Although there are known instances where different messages were erroneously encrypted with the same keys, violating the encryption procedure and allowing them to be decrypted.
Is it difficult to use this method in practice? Rather trivially, and automating this process with modern computers is within the reach of a beginner enthusiast.
Is the goal of the ban to harm the specific messaging app Telegram? If so, that's misguided. The Telegram client natively supports proxy servers and the SOCKS5 protocol, allowing users to operate through external servers with unblocked IP addresses. Finding a public SOCKS5 server for a short session isn't difficult, and setting one up on your own VPS is even easier.
Although the ecosystem of the messaging app will still suffer a blow, as these restrictions will create insurmountable barriers for most users, decreasing its popularity among the population.
So, let's summarize. All the fuss around Telegram is just hype and nothing more. Blocking it for public safety reasons is technically illiterate and pointless. Any organizations vital to secure communication can set up their own channel by using several complementary techniques, and interestingly enough, it's quite simple to do as long as there is some access to the network.
The front of information security today is not focused on messaging apps, but rather on ordinary internet users, even if they are unaware of it. The modern internet is a reality that must be reckoned with, where laws that seemed unshakeable just recently no longer apply. Blocking Telegram is yet another example of the wars for the information market—not the first, and certainly not the last.
A few decades ago, before the widespread development of the internet, the main issue facing various intelligence networks was establishing a secure communication channel both among themselves and coordinating their operations with headquarters. Strict control over private radio stations during World War II in all participating countries (registration is still required today), numbered stations of the Cold War (some are still operational today), mini tape recorders hidden in shoe soles—these now seem almost laughable in light of the new developments in civilization. As does the inertia of thought that compels governmental bodies to rigidly block any phenomenon not under their control. This is why blocking IP addresses should not be seen as an acceptable solution, as it merely reflects the incompetence of those who make such decisions.
The primary problem of today is not the storage or analysis of personal correspondence data by third parties (this is a very real reality we live in), but rather the fact that people are willingly providing this data themselves. Every time you go online through your favorite browser, dozens of scripts are watching you closely, recording how and where you click and which pages you visit. When installing another app on your smartphone, most people perceive the permission request window as a pesky barrier to using it. They overlook the fact that what seems like a harmless app is delving into your contacts and wants to read all your messages. Security and privacy are often sacrificed for convenience. People frequently and voluntarily part with their personal information, and thus their freedom, thereby filling databases of global private and governmental organizations with invaluable insights into their lives. Undoubtedly, these entities will use this information for their own purposes. In their quest for profit, they will also resell this data to anyone interested, disregarding any moral or ethical standards.
I hope the information presented in the article will allow you to view the issue of information security from a new perspective and perhaps change some of your habits while working online. Meanwhile, specialists will smirk and move on.
Peace to your home.
Source: habr.com
