SUV bomb scare case: Did Mumbai cops really crack Telegram, ask experts

Even as the NIA investigates the report by a private cyber firm which traced the origin of unknown organisation JaishUlHindrsquos Telegram messages taking responsibility for the Ambani bomb scare incident and later denying it cyber experts midday spoke to point to several loopholes The most important question is how did the firm get the IP address of the terror outfitrsquos group on Telegram which runs on an anonymous server experts saidA screenshot of text on JaishUlHindrsquos Telegram channel which was shared with the private firm after it went viralOnly the messenger can provide the IP address but the report didnrsquot say the cyber firm had officially secured it from Telegram the experts said The cyber experts midday spoke to have been helping different investigation agencies including the Mumbai cyber cell on multiple investigationsFormer Mumbai police commissioner Param Bir Singh had consulted with the private cyber agency after screenshots of messages on a Telegram channel of JaishUlHind an unknown terror organisation went viral The firm in its report submitted to Mumbai police in the second week of March mentioned that the channel was created at or near Tihar jail ldquoAs per the investigation and analysis through various exploits and tools it was found that the group was operating through Tor Proxyrdquo the report had statedHowever an expert of a leading cyber firm on condition of anonymity told midday ldquoMy first question is how do you know that the suspect was using TOR Did you have access to his mobile or computerrdquoThe spot where the explosivesladen car was found outside industrialist Mukesh Ambanis residence Antilia on February 25 PicAshish RajeThe report had also stated ldquoUpon further exploitation of the phone it was found that virtual number apps along with other anonymous communication apps were being used by the target identity upon access and analysis of IP address fetched on February 26 at 1528 hours and at 1951 hours 751pm it appeared that he was using Airtel SIM card to run internet on the device on which the Telegram channel jaishulhind was being used After tracking the location of the number it is suspected that the number is used nearinside Tihar JailrdquoQuestioning this particular claim an expert asked ldquoWas he hacker with the private cyber firm part of that group or was the group active so that he was able to penetrate the phone How can the hacker come to know anyonersquos mobile number on the basis of just one IP addressrdquoAccording to sources JaishUlHindrsquos channel was created on February 27 and had 49 subscribers The first messages was sent at 420 am on February 28 and seen by 684 people The message was ldquoAssalam o Alekum Warahmatullah Wabarkathurdquo means peace be upon you a standard salutation among Muslims The second message was at 422 am and seen by 691 people The threat letter claiming responsibility for placing explosives near industrialist Mukesh Ambanirsquos residence was posted at 431 am and seen by 851 people Sources said the group disappeared 30 minutes after posting this letterldquoSeems that this was an open channel Hence few subscribers and more views Why would someone keep this group open Looks like some existing channel with thousands of subscribers was renamed to jaishulhindrdquo said a cyber expertWhat caught the NIArsquos attention was a line written in Roman Hindi Nita Bhabhi aur Mkesh bhyya aur femi The similar line in the same format was used in the threat letter found inside the explosivesladen Scorpio near Antilia on February 25 ldquoEverything related to the case is in our ambit of investigation The accused and the suspect in the case will be questioned about JaishUlHindrsquos messages as wellrdquo a senior officer from the NIA told midday The officer refused to comment on the question about suspended cop Sachin Wazersquos role in thisAnother cyber expert said ldquoThere is no vulnerability in Telegram The one which was noted two years ago was fixed within a few hours My only question is how the person got the IP address of a Telegram channel How accurate is the IP mentioned in the report Are there any possibilities that the attacker would have used VPN virtual private network What if Telegram is used in parallel space with VPNrdquoWhen the messages claiming the conspiracy came on February 28 senior officers of Mumbai police department called them fake But the same night they shared a screenshot of a letter from JaishUlHind denying any involvement in the bomb scare but did not say where it was posted or how they got itRitesh Bhatia Cybercrime Investigator and Founder V4WEB Cybersecurity said ldquoIt is simply not possible to get the IP address of most of the popular chat messengers like Telegram unless the user is tricked to click on a link that may reveal his IP address Such IP addresses can only be provided by Telegram and that too only if the LEAs and other agencies write to them seeking all the detailsrdquoThe Telegram privacy policy states ldquoIf Telegram receives a court order that confirms yoursquore a terror suspect we may disclose your IP address and phone number to the relevant authorities So far this has never happened When it does we will include it in a semiannual transparency reportrdquo