How Telegram Users Are De-Anonymized (unemployed edition)

Added: 2026-05-26

[00:00:00]Welcome back to another episode of Bro opens Wireshark for slop. Again, I made a comment in a previous video about how Telegram is basically a giant honeypot and it looks like it's gotten far worse than that. Turns out in addition to giving your phone number and IP history to whichever agency asks nicely enough, anyone observing network traffic, be it a network administrator, your ISP, or just some random guy on your network, can de-anonymize you when you use Telegram. Let me start up a packet capture real quick and we'll take a look at the article. So, this is an article by Roman Amin. Sorry if I mispronounce your name. And the whole situation is insane. Last year his publication IStories ran an experiment and asked readers to send each other messages on Telegram while running packet captures like I'm doing right here. They then sent the pcaps to a group of cybersecurity analysts who discovered that during data transmission, Telegram sends an unencrypted header that contains a unique device identifier. And with this identifier, anyone on the network can track Telegram users. Well, just now, another cybersecurity firm called Symbolic Software also corroborated this. And this is where things get really interesting because this firm was actually commissioned by none other than the CFO of Telegram to debunk the results of IStories experiment. And now they're corroborating as well, saying, "Nope, they're right. Device identifiers are transmitted over unencrypted TCP packets." So, currently the now former CFO of Telegram is suing Roman.

[00:01:21]Definitely not because he just got mocked in 4K by two different security audits, but apparently because IStories made the claim he had deep connections to the FSB. It's a whole thing. I'll leave the article down below. I'll go ahead and stop the pcaps and upload them to my PC and we're going to see if we can use Wireshark to identify my device.

[00:01:38]All right, so these are supposed to be unencrypted packets. So, anything going over port 443 is out of the question because 443 is the port for HTTPS and HTTPS is TLS encrypted. Remember, that'll be on the quiz. No, seriously, every certification test I ever took and all the exams I took for networking in college, I think asked me a collective thousand times what port 443 was.

[00:01:59]Anyway, so let's look at any of these other packets that don't have traffic involving port 443. So, I can click on this one and here we have the TCP payload and supposedly there's a device identifier somewhere in here that is trivially obfuscated. [music] But, since we're on the subject of IT careers and school like YouTube wants me to be, I'm going to show you what I would do if I was at work. I'm going to turn this into a JSON, upload it to Cloud and prompt it to find anything that is trivially obfuscated. And immediately it figured out what kind of encoding it was using, the cipher, and has revealed my device identifier. So, now that I didn't actually do anything, I met my token quota and my boss is happy. Just kidding, he's not happy. He got fired, too. No, but seriously, it was really that easy to get the off key ID that uniquely identifies my device across networks and supposedly doesn't change even though after multiple security audits, the CFO still says it does. And all this really is is just another reason not to use Telegram unless you're making a YouTube video about it.

[00:02:56]Thank you guys so much for watching, subscribing, and thanks to my based enjoyers for supporting the channel directly. It really does mean a lot. I hope you got something out of this video and I'll catch you guys in the next one.

[00:03:06][music]