Telegram Bots

Context: Reports surfaced stating that a Telegram bot was able to retrieve and display identification numbers from vaccination documents, including Aadhaar. Similarly, in 2021, a bot on the platform was discovered selling phone numbers extracted from Facebook. According to security researchers, a network of deep fake bots was identified on the platform, generating nonconsensual images using images of individuals submitted by users.

What are Bots?

• A bot refers to a computer program designed to carry out tasks automatically.
• Its primary purpose is to gather information from the internet or execute repetitive tasks at a much faster pace. 

Applications of Bots

Ranging from malicious bots that carry viruses to search engine spiders. 

• Chatbots are capable of engaging in conversations with users to accomplish specific objectives. Example: Hi Poncho chatbot available in Facebook Messenger tells you the weather around you.
• Web spidering, where an automated script fetches, analyzes, and organizes data from web servers at a speed far exceeding human capability.
• Automated tasks such as setting alarms, providing weather updates, or conducting online searches. Examples: Siri and Cortana; Microsoft's Clippy.
• One app with multiple bots can help with different tasks, like ordering food or checking sports scores.
• Artificial intelligence-based bots are increasingly being used by organizations and entities to provide customer care, and sales and marketing services.

Two sides to bots

• Beneficial purposes: information gathering, automated interaction through instant messaging or web interfaces, and dynamic engagement with websites.
• However, Norton defines malicious bots as self-propagating malware that infects a host and establishes connections with central servers.
• Can perform actions such as collecting passwords, logging keystrokes, acquiring financial information, distributing spam, and exploiting vulnerabilities created by viruses and worms.
• Bots associated with automated accounts on Twitter and Facebook, spread misinformation on these platforms.

Use of Bots for malicious purposes

Bot attacks have impacted over 94.2% of websites. These attacks involve various types of malicious bots and botnets, including:

• Spambots that harvest email addresses from contact
• Downloader programs that suck bandwidth by downloading entire websites
• Viruses and worms
• DDoS attacks: distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network 
• Bots are used to increase traffic counts on analytics reporting to extract money from advertisers. 
• Internet trolls: Bots may be used on Internet forums to automatically post inflammatory or nonsensical posts to disrupt the forum and anger users.  

What is Telegram?

• Telegram, introduced in 2013, is a messaging platform service that provides an API for developers to create their applications and utilize the free API to develop specialized tools like bots, enabling seamless integration of services.
• It ranks among the top 10 most downloaded apps globally and is recognized for its capacity to facilitate file sharing of up to 2GB.
• It ensures the privacy of conversations by safeguarding them against unauthorized access from entities such as officials, marketers, and advertisers.
• It does not handle any requests related to group chats or private conversations among participants.

Telegram bots 

• Telegram bots possess the capability to host complete web applications, enabling the provision of a wide range of services, from online stores to arcade games.
• Some bots have the potential to collect user data, including personal information and chat history.
• They can be specifically designed to facilitate convenient access to information stored in extensive databases that they are connected to.

Security concerns regarding telegram bots

• Certain bots may possess security vulnerabilities that can be exploited by threat actors, compromising the security of users.
• Threat actors can create malicious bots that contain harmful content, such as links to phishing websites or malware.
• These threat actors may distribute bots with the intention of scamming users, enticing them with promises of rewards or discounts to trick them into divulging their personal information. 
• Introducing a bot into a secure Telegram chat may potentially weaken the level of encryption.
• Wired reported that some bots do not employ Telegram's encryption protocol, which scrambles and renders messages illegible during transit. 

Precautions and remedies 

• Anti-bot technique: Use of CAPTCHA, which is a form of Turing test used to distinguish between a human user and a less-sophisticated AI-powered bot, by the use of graphically-encoded human-readable text. However, Captchas are not foolproof in preventing bots as they can often be circumvented by computer character recognition and security holes.
• Anti-malware software: All software should be updated and system updates should not be ignored.
• To understand how individual bots handle user data, it is advisable for users to carefully review the terms of service and privacy policy associated with each bot.