submitted 3 months ago* (last edited 3 months ago) by to c/youshouldknow@lemmy.world
 

cross-posted from: https://piefed.world/c/tech/p/1146502/telegram-apk-from-apkpure-is-a-spyware

On analyzing the APK with jadx, it contains a class DataCollector, which does not exist in the .apk file downloaded from the official Telegram website.

This class collects a lot of your data, including:

  • Your photos, videos, and files
  • Your contacts
  • Your messages
  • Your GPS Coordinates
  • Your SIM card information
  • Your Telegram profile

This data is monitored and uploaded continuously. All the data is uploaded to a server with IP Address 38.190.225.166

💬 Initial discovery by Eric Parker

🔗 APK Analysis: Part 1 | Part 2.

Source on Telegram.

YSK: Telegram APK from APKPure is a spyware

all 28 comments

sorted by: hot top controversial new old
[–] 43 points 3 months ago (2 children)

So APKPure is not trustworthy? Do they not have any verification of APKs?

  • source
  • hideshow 2 child comments
  • [–] 6 points 3 months ago (1 child)

    maybe there were before, but now something has changed, I would recommend looking at alternatives to this site, for example in fmhy(.)net or in alternative net, but I would download the application from official sources, like the play market or open source programs in f-droid

  • source
  • parent
  • hideshow 1 child comment
  • [–] 15 points 3 months ago

    I know that APKMirror supposedly verifies the APK files' hashes against official sources, so APKs you get there should be fine, unless the developer was compromised at some point, or unless APKMirror itself is lying, but it is run by the people behind Android Police, as far as I know.

  • source
  • parent
  • [–] 42 points 3 months ago (2 children)

    apk download sites seem pretty sketchy in general

  • source
  • hideshow 2 child comments
  • [–] 40 points 3 months ago

    Who downloads Telegram's apks from third party sources if they're freely available on Telegram's official website?

    It's literally the first result when you search for "telegram apk" (DuckDuckGo). Followed by apkpure.

  • source
  • [–] 19 points 3 months ago

    Anything outside the official F-Droid repo is sketch as fuck

  • source
  • [–] 15 points 3 months ago (3 children)

    YSK: Telegram APK from APKPure is a spyware

  • source
  • hideshow 3 child comments
  • [–] 14 points 3 months ago (2 children)

    Nice. I wonder how clean Forkgram is

  • source
  • hideshow 2 child comments
  • [–] 8 points 3 months ago (1 child)

    They can't do that, pure is right in the name!

  • source
  • hideshow 1 child comment
  • [–] 8 points 3 months ago (3 children)

    This is why it really sucks that app developers offering their APKs directly isn't more common, forces people to turn to sites like this. I've installed apps from apkmirror just because I want to avoid Google Play. I don't really understand why there isn't some third party app store that helps lift the hosting+verification burden from developers but still doesn't rely on randos uploading apks from gplay.

    What a great world it would be if every time you went to some software's website with an app, they had that "download from google play" button right next to a "download from " button so you know its their real account, and a "download apk" button, because why not put some faith in users?

  • source
  • hideshow 3 child comments
  • [–] 6 points 3 months ago* (last edited 3 months ago)

    YSK: as a mass noun, 'spyware' doesn't need the indefinite article. We don't say "a happy", for instance, and we heckle those who say "a software".

  • source
  • [–] 4 points 3 months ago (1 child)

    This is the thing that worries me. I'm currently Degoogling and relying on sources like F-Droid, but these sneaky tricks seem unavoidable

  • source
  • hideshow 1 child comment
  • [–] 4 points 3 months ago

    That's why I'm extremely strict about permission I allow on my apps. My Telegram is official but still has no permission on contacts, camera or images/files.

  • source
  • [+] -9 points 3 months ago (2 children)

    Maybe some developer verification would be useful 😜?

  • source
  • hideshow 2 child comments
  • [–] 9 points 3 months ago

    What? There were so many ways to not download this, from using a certificate provided by telegram to... Well just downloading it from telegram directly.

    This is not something that would need such drastic actions as blocking everything thats not from one authority, and even with that I'll remind you that google as an authority has in no way better standards in many ways.

    Also, feddit.UK, so show me your I'd.

  • source
  • parent