Post by @rysiek@mstdn.social

If you use #Telegram or know someone who does – there seems to be a remote code execution vulnerability in Telegram:
https://nitter.catsarch.com/v12sec/status/2120471754166415821

It is apparently being actively exploited.

The vulnerability is *bad*, it can lead to account take over or worse as it apparently provides the attacker with a way to run code directly on the device, outside of the sandbox.

Apparently it has now been patched, so install updates as soon as possible!

It relates to the new "widgets".

#InfoSec

#telegram #infosec

1 Boost

0 Likes

Anthk

@anthk@neopaquita.es 13 min. ago

nicole

@mkljczk@twojstary.gay 14 min. ago

@rysiek@mstdn.social a good moment to remind that there is literally no reason to have telegram installed as a desktop app. its webapp has pretty much full feature parity and much lower attack surface (it's one of the few good things about telegram)

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 12 min. ago

@mkljczk I'd argue there is no reason to use Telegram at all. And plenty, in fact, to not use it.

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 23 min. ago

"Widgets" is a new functionality that Telegram added a few days ago:
https://nitter.catsarch.com/durov/status/2120148866469376463

I don't have Telegram to test it, but be very careful – apparently the exploit works without any user interaction. Update ASAP.

Or ideally, ditch Telegram already. It has never been safe to use.

#Telegram #InfoSec

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 21 min. ago

Durov, of course, denied any issue exists:
https://nitter.catsarch.com/durov/status/2121274027285307903

This fits a pattern with Telegram: when serious issues are raised, Durov denies them and attacks the researchers, while the issues are quietly fixed.

This was the story, for example, with MTproto (the old version of Telegram's protocol). Researchers were attacked by Durov, and then quietly MTproto v2 got rolled out.

Telegram is not trustworthy.

#Telegram #InfoSec

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 17 min. ago

This is also a good moment to remind everyone that Telegram is indistinguishable from an FSB honeypot:
https://rys.io/en/179.html

And that it makes misleading claims about its encryption:
https://rys.io/en/171.html

Best thing anyone can do is to ditch Telegram entirely today. Next best thing is to stop promoting it yourself (for example by publishing on it), going read-only if you must.

#InfoSec #Telegram

Songs on the Security of Networks

Telegram is neither "secure" nor "encrypted"

Telegram is a popular – especially in the East – internet messenger. It bills itself as “encrypted”, “private”, and “secure”. One of its creators (and the CEO of the company that operates the service)

⁂

More from

Michał "rysiek" Woźniak · 🇺🇦

Greylord :sm64_w: :sm64_i: :sm64_z: :sm64_z: :sm64_a: :catte: :asexual_flag:

@cyberquixote@infosec.exchange 6 min. ago

@rysiek now do a teardown of Signal

1 more reply

Filip Lachert he/him

@filiplachert@mastodon.social 18 min. ago

@rysiek nothing is trustworthy. But at least they patched it.

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 14 min. ago

@filiplachert I don't subscribe to this kind of nihilistic view. I think, frankly, that's not just BS, but actively harmful and puts people in danger.

There is a world of difference between, say, Signal and Telegram, even if Signal is not perfect.

Signal does not deny serious issues when they arise, and does in fact improve (finally there is a way to register accounts without a phone number, for example).

Telegram denies issues, and purposefully misinforms its user base about its safety.

1 more reply

flere-imsaho 🇺🇦

@mawhrin@circumstances.run 16 min. ago

@filiplachert @rysiek nah, that's pure nihilism, and there are obviously better tools than telegram.

Filip Lachert he/him

@filiplachert@mastodon.social 13 min. ago

@mawhrin there probably are, but I have not found anything that has a similar score on my usability chart @rysiek

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 11 min. ago

@filiplachert @mawhrin "it actively misleads people about its own safety, is likely to be an FSB honeypot, and attacks researchers that point out security issues – but hey at least it's convenient!"

Sure, you do you. 🤷‍♀️

Filip Lachert he/him

@filiplachert@mastodon.social 9 min. ago

@rysiek nvidia actively misleads about anything it does. Meta lies all the time about its products, google isnt trustworthy either.

It's a bad world we live in @mawhrin

Michał "rysiek" Woźniak · 🇺🇦

@rysiek@mstdn.social 7 min. ago

@filiplachert @mawhrin and I have neither Nvidia products nor use any Meta services.

We can make these choices you know. But of course nihilism is easier. And makes you feel so good about yourself, so superior to these silly people who think our actions matter!

But here's the thing: if nothing matters, if our actions have no bearing, why are you arguing with me? Why waste your time, if none of this matters? Don't you have literally anything better to do?

2+ more replies

Discussion

Discussion