WhatsApp rivals Signal, Telegram can be hacked too
Experts say these apps add more privacy features than security features. Telegram, too, provides a similar feature through Secret Chats, which allows users to encrypt messages. Secret chats can only take place between two people, not in a group.
Although awareness about these alternatives have been low among users — with only the tech-savvy ones making use of the messaging services — their popularity is growing, largely through word–of-mouth. However, “hackers can always find a backdoor entry through smartphones,” said Rahul Tyagi, cofounder of cybersecurity firm Lucideus. On any Zero-Day — which means a ‘vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability’ — these apps can be attacked, he said.
In June, four suspects were arrested in Brazil for hacking into more than 1,000 Telegram accounts, including President Jair Bolsonaro’s. Later in August, Telegram reportedly leaked the numbers of users during anti-government protests in Hong-Kong, allowing the city administration to track the agitators. The leak disclosed phone numbers of users regardless of privacy settings.
Experts say these apps add more privacy features to chats, not necessarily more security features.
For instance, open-source Signal allows you to configure certain messages or threads to destroy themselves after a set interval. “So, if you think that a message should be in your recipient’s inbox for only five minutes, you can make that happen, and the message will be automatically deleted. There’s nothing the recipient can do about it,” said Gautam Kumawat, a cybersecurity expert.
Telegram, too, provides a similar feature through Secret Chats, which allows users to encrypt messages. Secret chats can only take place between two people, not in a group.
“The back-end services of Telegram aren’t open-sourced. So, we can’t really tell what’s happening to our messages once they reach Telegram’s servers. It is also true that we can’t assume the messages are stored in plain text on their servers, but there is a possibility that Telegram, if need be, can actually go through our messages,” Kumawat said.
Experts also said the user base for both Telegram and Signal has been relatively low, a crucial reason why it has remained away from the eyes of hackers and the government.
“For Signal, to be completely sure about your data, you will have to go through each line of source code in these messaging apps, download the source code, compile and build it yourself, and use those executable files on your devices. Nearly no one does that. The only thing we can do is read their terms and conditions and other literature,” Kumawat said.
Telegram and Signal did not respond to ET’s queries on platform security till press time on Thursday.
ET reported earlier that data from industry tracker App Annie show Signal and Telegram jumped positions in the Google Play and iOS App store in India. According to App Annie, WhatsApp Messenger dropped from its existing rank on Google Play, trailing behind UC browser, Facebook Messenger and Truecaller.
Yet, with about 400 million users, India remains WhatsApp’s largest market.
“Users who are concerned about data privacy may be joining Telegram or Signal today, but the larger user base will be hooked on to WhatsApp because that is where they remain connected with friends and family,” said Sanchit Vir Gogia, chief executive of Greyhound Research.