oss-sec mailing list archives
Telegram privacy fails again.
From: Dhiraj Mishra <mishra.dhiraj95 () gmail com>
Date: Mon, 9 Sep 2019 23:16:37 +0400
TL; DR This is not a security vulnerability it’s a privacy issue. As I understand Telegram a messaging app focuses on privacy which has over 10,00,00,000+ downloads in Playstore. In this case, we are abusing a well-known feature of deleting messages, which allows users to delete messages sent by mistake or genuinely to any recipient. It was observed that once the message (image) is sent to the recipient, it still remains in the internal storage of the user which is located at `/Telegram/Telegram Images/`path. I found this bug when I was researching about Telegram and MTProto protocol. To demonstrate this bug let's assume two people here, Bob and Alice. Assume a scenario where Bob sends a message which is a confidential image and was mistakenly sent to Alice, Bob proceeds to utilize a feature of Telegram known as "*Also delete for Alice*" which would essentially delete the message for Alice. Apparently, this feature does not work as intended, as Alice would still be able to see the image stored under `*/Telegram/Telegram Images/` *folder, concluding that the feature only deletes the image from the chat window. The highlighted issue is valid when we talk about Telegram "supergroups" as well, assume a case wherein you're a part of a group with 2,000,00 members and you accidentally share a media file not meant to be shared in that particular group and proceed to delete, by checking "delete for all members" present in the group. You're relying on a functionality that is broken since your file would still be present in storage for all users. Aside from this, I found that since Telegram takes `read/write/modify` permission of the USB storage which technically means the confidential photo should have been deleted from Alice's device or storage. A compete, app for Telegram which is WhatsApp also has the same feature to "*Delete for everyone*". If you perform the following steps mentioned above in WhatsApp it deletes the confidential photo from Alice's `*/Whatsapp/Whatsapp Media/Whatsapp Images/*` folder and maintains the privacy however Telegram fails. WhatsApp takes the same permission when it comes to storage which is `read/write/modify`. I submitted this to Telegram sec-team via security[at]telegram[dot]org and a fix was pushed for same. Blog: https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html
Current thread:
- Telegram privacy fails again. Dhiraj Mishra (Sep 09)
- Re: Telegram privacy fails again. Ilya Matveychikov (Sep 10)
- Re: Telegram privacy fails again. Solar Designer (Sep 12)
- Re: Telegram privacy fails again. Ben Tasker (Sep 12)
- Re: Telegram privacy fails again. notspam (Sep 13)
- Re: Telegram privacy fails again. Stuart Henderson (Sep 13)
- Re: Telegram privacy fails again. Jiri 'Ghormoon' Novak (Sep 16)
- Re: Telegram privacy fails again. notspam (Sep 16)
- Re: Telegram privacy fails again. Ben Tasker (Sep 12)