Re:A Telegram bug that disclose phone numbers of any users i...
by nyxxie on Sunday September 01, 2019 @11:27PM
(#20856560)
All this to get an app to make "do any of my contacts also use signal" requests? You could probably just figure out what endpoint the mobile client calls and imitate them yourself to avoid all the overhead of setting up the mobile devices. If you have to register to make the request, just provision a bunch of VOIP numbers and go to town.
Point being, if "who is using signal" is a question you want answered, it's far more trivial than having to acquire actual devices. Your oppressive regime could go from zero to black bag list in an afternoon.
If you're a state actor probably pretty easy. Get a couple thousand rooted remote controllable android devices (which you probably already have for other projects) and have them automatically add 10k phones numbers each. Then have them join public telegraph lists and check for matches. Now you have gone through 10 million phone numbers. Run it in a loop 10 times and you have 100 million. Might take a few days to setup and run.
I don't see why this is infeasible in any way to do if you have a moderate budget (ie: state actor).
edit: And if your target is in your jurisdiction then you probably have a good mapping of names to phone numbers already.