Telegram Bot Getting Spammed?

Configuration
1

I’ve noticed some warning messages like this one in my logs recently:

Message with unknown data received: {'update_id': 818573149, 'channel_post': {'message_id': 223, 'date': 1582529481, 'chat': {'id': -XXXXXXX, 'type': 'channel', 'title': 'Допомога Дітям (HELPING CHILDREN)', 'username': 'dopomogaditam'}, 'forward_from_chat': {'id': -XXXXXX, 'type': 'channel', 'title': 'ТИ НЕ ОДИН', 'username': 'helpingua'}, 'forward_date': 1582529468, 'entities': [], 'caption_entities': [], 'photo': [{'file_id': 'AgACAgIAAx0CVtSgZAAD315Te8kvncBmrIvWlw6dFKc7fHrlAAIurDEbUJKhSrG_7cg7dcqYIwABUZEuAAMBAAMCAANtAAOxfQACGAQ', 'width': 224, 'height': 320, 'file_size': 30537}, {'file_id': 'AgACAgIAAx0CVtSgZAAD315Te8kvncBmrIvWlw6dFKc7fHrlAAIurDEbUJKhSrG_7cg7dcqYIwABUZEuAAMBAAMCAAN4AAOyfQACGAQ', 'width': 552, 'height': 790, 'file_size': 113005}], 'new_chat_members': [], 'new_chat_photo': [], 'delete_chat_photo': False, 'group_chat_created': False, 'supergroup_chat_created': False, 'channel_chat_created': False, 'forward_from_message_id': 43, 'media_group_id': 'XXXXXX'}}

Basically, it seems to be a lot of nonsense. I removed the chat ID but it is not in the list of allowed chat ID’s from my configuration.yaml, so it appears someone got the name of my bot and is sending spam messages. From what I can tell, the Telegram API doesn’t allow for any kind of blocking or blacklisting, so these types of messages can still get through but will be stopped by the integration. I guess I’m just surprised that they’d even reach a point where they’d hit the log, since the chat ID is not in the allowed list in my configuration.

Has anyone else seen this type of issue? Is there any other mitigation strategy I am not aware of? Like I said, it seems to be more of an annoyance than a security risk or anything like that, I just want to be sure I’m not missing anything.

2

This is the one downside of telegram bot. Anyone can search for any bots on telegram and try to interact with it.

Of course they cannot action anything as they are not using an authorised chat_id, but it still gives an uncomfortable sensation when a warning comes.

I still use telegram in spite of this at the moment, but will eventually be looking at a self hosted solution I think. (or possibly, eventually, consolidation of this and location with the homeassistant app if it ends up with the same in/out message functionality as telegram and is as reliable as owntracks for location).

1 Like
3

Thanks for confirming! Good to know that it’s nothing to really get too concerned about, but it is annoying for sure.

1 Like