I have the Telegram application on my phone and I've been struggling to find out how it's able to send and receive chat messages (NOT SMS) without Internet data.

So, in order for me to browse or do anything on the internet, I need to buy internet data. When I'm out of it, I can't do anything as my provider completely cuts it off, since that's their business model.

Enter Telegram.

I am able to send and receive multimedia messages without the so called data. Some people I know where I'm at and others around the world have reported this as well.

I have looked around and it's not a zero-rated service like https://internet.org.

So, I was left to think that maybe they use DNS tunneling or other data exfiltration/infiltration techniques, which could have explained the tardiness when downloading images so I fired up Wireshark and saw nothing of the sort. Just normal DNS queries. It's really troubling my mind.

I have verified that my service provider blocks DNS, ICMP, NTP, and pretty much all UDP and TCP connections if I haven't purchased internet data.

My WiFi, Bluetooth radios are off so there's no way they could be using mesh network.

How could they be doing this?

  • Your provider is probably leaky, or you're picking up intermittent WiFi or something. Pretty sure Telegram isn't doing anything magical...
    – jjlin
    Jul 18 '19 at 23:50
  • @jjlin You mentioned leaky. Would you happen know of any pentesting tools I can use? You don't have to answer that question if it makes you uncomfortable seeing as this is not SecurityExchange. Also, I have scanned for WiFi signals and nothing. I highly doubt it.
    – chx101
    Jul 18 '19 at 23:59
  • By leaky, I just mean your provider probably isn't doing a perfect job of blocking data access you didn't pay for. You might try installing a data manager app that can do finer-grained data usage tracking. Presumably if it reports mobile data usage during times you haven't paid for data, then you're just getting free data sometimes.
    – jjlin
    Jul 19 '19 at 8:38
  • So I used some networking apps to perform some forensics. I captured some traffic (TCP) for a certain server on port 5222, which is the standard port for XMPP protocol. However this seemed to be encrypted RAW TCP traffic. Some of the connections hung at SYN/ACK and took minutes to get response. There's also port 8888 open on the server. Still trying to find out why though. I'm planning on running a telnet echo server on a private VPS on port 5222 to see if I can make my way out to it.
    – chx101
    Jul 19 '19 at 11:31
  • Up ! Did you find something ? A friend of mine have a subscription without any internet data, and we found her on Telegram... we are wondering if it is normal or not :(
    – JR Utily
    Aug 4 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.