A cyber-security researcher has showcased it is super easy to access the IP address of any account on the encrypted messaging app Telegram with a simple tool.
Denis Simonov, also known as n0a, recently highlighted the issue and wrote a simple tool to exploit it.
TechCrunch verified his findings by adding him to the contacts of a newly created Telegram account.
Simonov then called the account, and shortly after revealed the IP address of the computer where the experiment was being carried out.
Telegram has allegedly been leaking IP addresses to people in your contacts during a voice call for years.
This time, “an unprepared person can easily reveal his IP address to his interlocutor if he does not know about them,” Simonov was quoted as saying in the report.
Telegram, which has more than 700 million users, utilizes a peer-to-peer connection between callers “for better quality and reduced latency,” a Telegram spokesperson said in a statement.
“The downside of this is that it necessitates that both sides know the IP address of the other (since it is a direct connection). Unlike on other messengers, calls from those who are not on your contact list will be routed through Telegram’s servers to obscure that,” the spokesperson added.
Simonov wrote in a post that recently, he was faced with the task of determining the IP address of his interlocutor in the Telegram messenger.
“For this purpose, I used the network traffic analysis tool Wireshark, where I detected STUN protocol traffic,” he mentioned.
STUN (Session Traversal Utilities for NAT) is a standardized protocol designed to help devices behind NAT (Network Address Translation) determine their external IP address and the type of NAT that is used on their gateway.
“After spending a little time, I decided to automate the process of obtaining the IP of my counterpart in Telegram using the console version of Wireshark – tshark,” the researcher added.
To avoid leaking your IP address, you have to go to Telegram’s settings, privacy and security, calls, and then select “Never” in the Peer-to-Peer menu.
Bijay Pokharel
Related posts
Recent Posts
Subscribe
Cybersecurity Newsletter
You have Successfully Subscribed!
Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox. You are also consenting to our Privacy Policy and Terms of Use.