My personal blog
Some pages of the Telegram messenger’s bug reports are published (They are all fully patched).
Third page
Fourth page
Fifth page
Seventh page
Proof of concept (Including video and code)
See also:
The Telegram bounty for some of the advisroies
The first story about security checks on the messenger
We have just received 3000$ from Telegram and decided to donate all of the money to the Mahak charity’s representative in Germany.
It was mentioned to the Telegram team, that the amount of money they paid was almost nothing comparing to the severity of the bugs.
The full documentation about the bugs would be published as soon as the patches take effect.
http://www.theregister.co.uk/2016/06/14/telegram_crammed_hackers_find_way_to_send_massive_messages/
***Update***
Some of the bugs have been patched:
A few days ago, we told a friend about privacy issues that can be caused by instant messaging softwares like “Telegram”. His answer was usual and expected : “I have nothing secret”. But his quote inspired us to seek for other types of difficulties that such applications are prone to make. In this post, We’re going to write about a vulnerability that we’ve recently discovered in Telegram.
Undoubtedly, Telegram holds the position of the most popular instant messaging tool in Iran. According to unofficial sources: 20 million Iranians use Telegram to send/receive various types of data, including: Plain text, audio and video file.
In order to not put any obstacles in the way of the Telegram users and since at the time of writing this report the bug still exists (Has not been fixed), we’re not going to publicly pinpoint the vulnerability.
General definition of the bug:
Telegram limits request rate to bar malicious users from sending a lot of messages in a short period of time. We noticed that there is also a limitation for minimum and maximum size of the text messages. The minimum limit is 1 character (1 byte) and the maximum limit is 4096. Due to a programming error in the implementation of this section, sender can get control on the size of messages and send them with arbitrary length. On the other side victim would receive all incoming messages even if they are too long.
A picture from Telegram website
Proof of concept:
In the following Telegram channel: @poc_sadghaf , You can see there are two posts that we’ve sent: the first one is 30000 bytes long (much longer than 4096 limit) and the other one is empty.
Why it is a critical security issue?
Assuming that each ASCII character is one byte long, attacker can send multi-million-character long strings to victims (or just a null message to be funny!) and the victim would receive the message without taking a scratch!? It’s like downloading a large file without accepting to receive it (Like being an actual server)!
During the test process we noticed two alarming outcomes:
1-A lot of bandwidth was being taken.
Considering that by default Telegram uses mobile data (If other networks are not being used) it can be really harmful for the receiver.
2-The device crashes or just stop working due to lack of space (or memory).
Summing up what we’ve said, It’s possible to get up unusually late (perhaps because your phone has crashed and the alarm didn’t work :D) and see that your phone faced with insomnia last night, because it has downloaded tens of gigabytes of data (text messages). And the worse part is yet to come: Due to the Telegram policy, It’s not necessary to have a user in your contact list in order to receive a message from him. So an attacker can use an anonymous phone line to carry out the attack.
We hope we have had a small role in the process of informing people (especially in our country) about damaging consequences of using such applications. Which is like to play role of a server while having resources of an ordinary client.
I’m Sadegh Ahmadzadegan. One of the seven Iranians who have been indicted all of a sudden, accused of participation in cyber-attacks against financial institutions and banks in the US. A thoroughly false accusation which has had a profound impact on my personal life. In order to confront with this phenomenon, I gave many ways a try. Actually, it’s one of the prodigious things in the nature of our species to run faster when we get lost!
One of those plans, was to open a small personal blog. As usual I was the first person who laughed at this idea because really don’t know consequences surrounding this thought. In spite of the fact that there is a quote by Sun Tzu “Victorious warriors win first and then go to war, while defeated warriors go to war first and then seek to win”, I’m really fond of this notion that it’s not the falling that threatens our lives, but the landing!
In this blog, firstly I would like to answer the questions that I’m being asked frequently. Secondly, I want to write about my researches and studies in various fields, including but not limited to computer science.
Like what Roberto Bolano said in one of his works : “If you’re going to say what you want to say, you’re going to hear what you don’t want to hear”. Honestly, it took me almost 2 months to make myself ready to listen to what I don’t want!