DDoS attack against Telegram messaging app came from China Watch Now

Special feature Cyberwar and the Future of Cybersecurity Today's security threats have expanded in scope and seriousness. There can now be millions -- or even billions -- of dollars at risk when information security isn't handled properly. Read More

Telegram Messenger has recovered from a distributed denial of service (DDoS) attack that hit its platform on Wednesday, telling its 200 million-plus users that for the moment, things seem to have stabilised.

Telegram initially took to Twitter to tell users that it was suffering a "powerful" DDoS attack.

"We're currently experiencing a powerful DDoS attack, Telegram users in the Americas and some users from other countries may experience connection issues," it tweeted, comparing the attack to ordering multiple fast-food meals at once.

"A DDoS is a 'Distributed Denial of Service attack': your servers get GADZILLIONS of garbage requests which stop them from processing legitimate requests. Imagine that an army of lemmings just jumped the queue at McDonald's in front of you – and each is ordering a whopper."

Telegram eventually confirmed user data was safe.

"There's a bright side: All of these lemmings are there just to overload the servers with extra work – they can't take away your BigMac and coke. Your data is safe," the company posted.

See also: Telegram's description of DDoS attack is the best (CNET)

Jokes aside, the company's founder and CEO Pavel Durov has pointed the origin of the attacks as being "mostly" from China.

"IP addresses coming mostly from China. Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram). This case was not an exception," Durov wrote.

Protesters on Wednesday massed outside government headquarters in Hong Kong to oppose a government plan that would allow extraditions to China. The protests forced the delay of a legislative debate over the Bill that would allow criminal suspects in Hong Kong to be sent for trial in mainland China.

The protests were largely organised on messaging apps, such as WhatsApp and Signal in addition to Telegram, and as reported by the South China Morning Post, the role of the platforms in the protests was highlighted when the administrator of a Telegram group was arrested for conspiracy to commit public nuisance, after police turned up at his home on Tuesday night.

Telegram offers users the ability to create groups for up to 200,000 people or channels for broadcasting to unlimited audiences. It allows for encrypted messages to be sent and is thought of by many as a secure way to communicate and avoid China's strict surveillance regime rather than just a method for organising a large-scale protest.

According to the South China Morning Post report, it is alleged the man arrested managed a conversation involving 30,000 members where he plotted with others to charge the Legislative Council Complex and block neighbouring roads.

The government pushed ahead with plans to present the amendments to the legislature on Wednesday despite a weekend protest by hundreds of thousands of people that was at the time the territory's largest political demonstration in more than a decade.

Despite the violence, the state-backed China Daily reported that the protests were in fact activities in support of the Bill.

"By midnight more than 800,000 people had pledged support in a city-wide signature campaign online and at street stands, organized by a local alliance of prominent political, business and legal figures, countering a protest by about 240,000 people on Sunday to oppose the revised extradition bill, according to the police," the Beijing mouthpiece wrote.

LATEST SECURITY NEWS