Telegram has no plans to fix a security vulnerability that makes it easy for hackers to get your precise location. The problem arrives from a feature called People Nearby on Telegram. The People Nearby feature can be gotten by clicking on the hamburger menu, then click Contacts which will show you find people nearby.
The people nearby feature is disabled by default, but allows users who are geographically close to you to connect according to Ars Technica report
Independent researcher Ahmed Hassan, however, has shown how the feature can be abused to divulge exactly where you are. Using readily available software and a rooted Android device, he’s able to spoof the location his device reports to Telegram servers. By using just three different locations and measuring the corresponding distance reported by People Nearby, he is able to pinpoint a user’s precise location. Telegram lets users create local groups within a geographical area. Hassan said that scammers often spoof their location to crash such groups and then peddle fake bitcoin investments, hacking tools, stolen social security numbers, and other scams.
Telegram lets users create local groups within a geographical area. Hassan said that scammers often spoof their location to crash such groups and then peddle fake bitcoin investments, hacking tools, stolen social security numbers, and other scams. A proof-of-concept video the researcher sent to Telegram showed how he could discern the address of a People Nearby user when he used a free GPS spoofing app to make his phone report just three different locations. He then drew a circle around each of the three locations with a radius of the distance reported by Telegram. The user’s precise location was where all three intersected.
In a blog post, Hassan included an email from Telegram in response to the report he had sent them. It noted that People Nearby isn’t enabled by default and that “it’s expected that determining the exact location is possible under certain conditions.” People Nearby poses the biggest threat to people using Android devices, since they report a user’s location with enough granularity to make Hassan’s attack work. The recently released iOS 14, by contrast, allows users to divulge only a rough approximation of their location. People who use this feature aren’t as exposed. Fixing the problem – or at least making it much harder to exploit it – wouldn’t be hard from a technical perspective. Rounding locations to the nearest mile and adding some random bits generally suffices. When the Tinder app had a similar disclosure vulnerability, developers used this kind of technique to fix it.
