Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • It's great that this writeup was published, but unfortunately the text is full of claudisms and made me close the tab pretty quickly.
    by Narushia
  • It's not strictly-speaking a Telegram-specific vulnerability. It's a vulnerability of all modern desktop operating systems allowing any user process to read/write any user file. Ideally all programs should be isolated from the underlying filesystem and be able to read only their own files and files from per-program data directory (like downloads for a browser or Telegram-client).
    by Panzerschrek
  • I don't use Telegram Desktop or Windows. But that's exactly the reason why I run Firefox in a firejail sandbox on Linux. The browser has only access to my Downloads folder. I know that it's considered untrusted and don't keep any files there for a long time.
    by usr1106
  • I think it is one of the reasons why I am always hesitant to install any software on my windows pc. Web versions are often more than good enough.
    by SpacePortKnight
  • One of the challenges with Telegram is - they regularly re-enable settings inside the app/account that you had specifically disabled. So at any point you don't know what is happening and what is not. Meaning, even if you didn't see a thing, a malicious file might be sitting all warm and fuzzy on your computer - among possible other things. I used to like the snappiness of this app (and it is still snappier than almost all other IM apps combined, by a margin), but after a while I realised it was a ticking time-bomb (to keep it installed on the desktop) and possibly a scammer safe haven, nothing else.
    by crossroadsguy
  • This link has already been posted with https://news.ycombinator.com/item?id=50019667 , but that post's title ("Telegram Desktop: one-click account takeover") doesn't say that the vulnerability allowed also any user-accessible file on the disk to be stolen.

    This aspect is also not highlighted much in the article, which weirdly mostly focuses on the account takeover.

    To me it seems something remarkable enough to warrant reposting the link with a different title.

    Somewhat astonishingly, the core of the vulnerability comes from an internal url scheme added to Telegram to... help them publish their releases on their channel.

    The Telegram developers saw no better way to do that than adding an internal tool which uploads any file it's told to.

    Everyone else publishing their app on Telegram is able to do that with a script, but they had to do it that way.

    It's true that it was exploitable only in a somewhat convoluted way, but still, it's an obviously dangerous feature.

    Anyhow, yes, clicking on a link in Telegram Desktop was enough to have any user's file exfiltrated and to access or take over their account.

    by g-b-r
  • Related: could we please stop, by default, allowing software to:

      a) access all your files, and
  b) roam the internet at will.
    That was somewhat OK in the 80s, but it hasn't been since.
    by bita_nidir
  • I once read The Bugs We Have to Kill: https://www.usenix.org/publications/login/aug15/bratus and one particular thing that has stuck with me forever:

    “Any sufficiently complex input format is indistinguishable from bytecode; the code receiving it is indistinguishable from a vir- tual machine.”

    by farhanhubble

Explore Birbla archives