Using bad generator in ElGamal Encryption
The attacker can distinguish $\langle C_1, C_2 \rangle$ from a random pair if the attacker knows a value $q &lt; p-1$ such that $g^q = 1 \mod p$.

Here's how the distinguisher would work: he simply computes $C_1 ^ q$ and checks to see if that value is 1.  If this $C_1$ corresponds to a valid ciphertext, then that value will always be 1.  If this $C_1$ is part of a random pair, then the value will be 1 with probability $q/(p-1) \le 1/2$ (remember, $q$ will always be a divisor of $p-1$).

On the other hand, just because we show distinguishability against a particular random source doesn't mean that we have shown that it is insecure.  In this case, that would depend on what is the order of $g$ (and whether it is "smooth", that is, has no large prime factors).  If the order of $g$ is smooth, then solving the discrete log problem is easy, and hence the system is insecure.  On the other hand, if the order of $g$ has a large prime factor $q$, I believe that it is still safe.