- free "drug traffic";
- open piracy;
- depressing bug "bounty".
You can share your experience in the comments to the article.
Free "drug traffic"
Last year, when the developers of the Telegram messenger introduced a new feature: geo-chats (by the way, which can be easily faked using Fake GPS Location). At that very time, the hucksters revived and climbed out of the dark depths of the Internet. IMHO spoiled the reputation of the messenger itself: a drug geography was created everywhere.
A few days ago, I sent dozens of reports / complaints to the Telegram team about such communities, and also complained to TP volunteers in anticipation of the "execution", but the execution did not follow, no one bothered to "reload the rifle", destroy such chat channels, no visual reaction (like usually) from the government forces Telegram-Dubai did not follow.
This screen and the excerpt quoted above are from my 2019 entry.
Since the time of the visible and invisible struggle, no less than 1.5 years have passed. Now 2021 is on the nose. Let's see how the Telegram moderators in God 'mode conducted their "blitzkrieg": contractionary fire on the wicked.
If you enter the city name in the Telegram search, then, as before, in the results you will receive, among other things, chats / channels offering illegal goods and services, which are often found on the darknet, because in the civilized web such parasites are usually caught or banned, but just not on Telegram.
December 2020
A similar Telegram policy applies not only to drug traffic, but also to other dubious services:
Prostitution
Resale of personal data
Fakes
Open piracy
In Telegram channels and bots, you can download music, films, unlicensed software, audio / books for which copyright holders did not give their permission for "similar" use and distribution for free.
Yesterday on Habré there was news about this
“The European Commission has released a new list of resources that promote and benefit from piracy. It includes resources located outside the EU. For the first time, Telegram and Vkontakte appear in the report.
From the report itself , translation.
A) “Telegram claims that they do not tolerate any malicious content on their platform and remove within 24 hours when reported by Autorità per le Garanzie nelle Comunicazioni AGCOM or interested parties via email.
B) "Telegram also indicated that their efforts to combat malicious content on their platform have been very successful in other areas.
"
An example of a real story that I encountered, an attacker began to distribute pirated content (my work) on the Telegram network. According to telegram.org/faq
I have sent a signed proof report to dmca@telegram.org. After 24 hours, according to the Telegram report, the pirated content should have been covered up, but in fact I did not receive an answer. More than three months have passed since the DMCA report, and I have not received any positive or negative decision from Telegram on my problem. Sometimes I ping "them", but to no avail.
A similar report was sent to other platforms where pirated content went. For example, Gitlab verified the facts and removed not only pirated materials in + - 48 hours, but also blocked the fraudster's account (now) beyond recovery.
Depressing bug "bounty"
Some of the readers may have heard about bugs and vulnerabilities in Telegram, to which the management of the messenger did not react in any way or interpreted / awarded gifts to the researchers in their own way, and some of the Habr users themselves found bugs and features in the Telegram ecosystem.
For clarity, let's compare the description of the bug bounty Telegram programs with some open source project, for example, Veracrypt.
hackerone.com/telegram?type=team A
scant 50 word description of what holes Telegram is ready to pay bug hunters for "how much, for what and in what currency." The description of the entire bug "bounty" program for several years is even less than the description of some next messenger update, for example, the description of the update about animated stickers in Tg.
hackerone.com/ibb-veracrypt?type=team
You can also compare the bug bounty Telegram program with other incentive programs and see for yourself that the first one was created on an eccentric basis.
About the bug
An example of a recent bug that I reported to security@telegram.org, adding to my track record, but as before, there was no answer. In my opinion, I was in a hurry with the report, the bug looks more like a "scam" on the part of Telegram, and not a vulnerability.
The bottom line (until Telegram responds to the report, this is considered a bug, not a feature): any user can access blocked (for example, pirated) "remote" content on the Telegram network.
Case: for example, let's take a channel on which pirated content regularly appears. We will manually find such a plate that Telegram leaves by "deleting" this very content.
“ This message couldn't be displayed on your device due to copyright infringement. "
t.me/freedomf0x/6842
This plate (through the tool: search by channel - not searched for) is a kind of "two knights protection" from the messenger. A plaque means that there was "malicious content" in this place. The “remote” content is not available through the app.
We go to the Desktop Telegram version of the messenger, export the chat / channel history (by ticking the “files” checkbox and making the restrictions on the 2 GB file upload), select the date (in this example, from March 21, 2020 to March 22, 2020). After successful export of history, the same pirated content will be in the html-page report instead of the plate .
A detailed example of a case in the video below.
Why is this more like a "scam"? I think that Telegram is aware of all this orgy, the state of affairs at this point in time is simply satisfied with the management: "Well, how would we protect the content, because not everyone uses the Desktop version through which the" remote content "is pulled without any problems."
Or here's another example.
We'll arm ourselves with the @flibustafreebookbot bot with which you can download books. This bot was blocked by Telegram, but an obvious loophole remained and allows downloading books. All you need to do is (replay the system): add the bot to your private chat and give “administrator” permission, after which the bot comes to life and works as if nothing had happened. By the way, this pirate bot runs on Desktop-e without any restrictions, which contradicts the very restrictions that TP with root access extended to it.
From right to left: @flibustafreebookbot is blocked (Android); @flibustafreebookbot (Android) bot works after a cheating trick; @flibustafreebookbot (Desktop) bot works without any tweaks.
Conclusion
Over the past year and a half, nothing has changed in the willow ecosystem, the scoundrels continue to trade, plant, evade responsibility. Telegram remained a messenger that fights for the freedom and safety of its business values, without prohibiting the promotion of "dubious services" at its facilities.
Telegram's claims against malicious content are farce. Responsible persons on the part of the social network do not care about the things mentioned in this article, do not react to user reports, but at the same time they justify themselves before the commissions and courts when they start to look after them and punish them for deceit, which they themselves know about.