Response on incidents related to phone number sharing on Telegram

Since late March 2021, the (Unofficial) Telegram Support Group of Hong Kong have received over 20 reports, indicating their phone number registered with Telegram applications, are shared upon configuring the other user to become a Telegram contact of the complainant.

Upon investigation, the Support Group has discovered:

User A - The complainant involved in the investigation
User B - Friend of the complainant

1）Regardless the use of official Telegram applications, upon User A configuring User B as contact, with or without the option to explicitly sharing phone number, there is a chance that Telegram servers will automatically put User B into the exception list of sharing phone number, eventually User B can always read the phone number of User A until removing the exception.

2）Even after cleaning the exception list, there is a small chance (i.e. 6 accounts of all the reported cases) that your account will persist the sharing of phone number to that specific "contact".

After multiple follow-up, most of the affected Telegram accounts have rectified the situation by taking the following steps:

1）Deleting all contacts in Telegram

2）Inspect and removing all configured exceptions in Privacy settings

Last but not least, the Support Group wishes everyone that lives in the chaotic world, to stay alert and keep learning about latest news and techniques of information security. If you and/or your organisation recognising a need of infosec training/workshop, you may contact our volunteers for a referral.

Telegram (非官方)香港支援頻道

Response on incidents related to phone number sharing on Telegram

Since late March 2021, the (Unofficial) Telegram Support Group of Hong Kong have received over 20 reports, indicating their phone number registered with Telegram applications, are shared upon configuring the other user to become a Telegram contact of the complainant.

Upon investigation, the Support Group has discovered:

User A - The complainant involved in the investigation
User B - Friend of the complainant

1）Regardless the use of official Telegram applications, upon User A configuring User B as contact, with or without the option to explicitly sharing phone number, there is a chance that Telegram servers will automatically put User B into the exception list of sharing phone number, eventually User B can always read the phone number of User A until removing the exception.

2）Even after cleaning the exception list, there is a small chance (i.e. 6 accounts of all the reported cases) that your account will persist the sharing of phone number to that specific "contact".

After multiple follow-up, most of the affected Telegram accounts have rectified the situation by taking the following steps:

1）Deleting all contacts in Telegram

2）Inspect and removing all configured exceptions in Privacy settings

Last but not least, the Support Group wishes everyone that lives in the chaotic world, to stay alert and keep learning about latest news and techniques of information security. If you and/or your organisation recognising a need of infosec training/workshop, you may contact our volunteers for a referral.

hottg.com/tlgrmHK_ch/46

1.9K viewsApr 30, 2021 at 11:15