The vulnerability affected Telegram’s for , Mac, and Linux OS.

Telegram, a popular privacy-focused instant messaging application, reportedly contained a bug that can leak the addresses of . Known for providing end-to-end encryption, Telegram’s desktop app has been discovered to be leaking not just public but private IP addresses of its users by-default during voice calls and users cannot turn off the feature.

This , anyone and everyone attempting to make a voice call will be vulnerable to cyber-attacks. Telegram has, however, fixed the bug in one of the and the security researcher who identified the bug has been awarded EUR 2,000 by the .

See: Snowden Explains Why Telegram Messenger App is Unsafe

The bug was identified by security researcher Dhiraj Mishra. According to Mishra, the desktop version of the Telegram app was leaking IP addresses during voice calls made via a peer-to-peer framework. Smartphone users can turn off P2P calls by modifying the settings: Settings > Privacy and security > Calls > Peer-To-Peer but desktop users of Telegram aren’t offered this option.

Telegram leaked IP addresses of its desktop app users  - telegram leaked ip addresses of its desktop app users 2 - Telegram leaked IP addresses of its desktop app users

It is worth noting that Telegram uses P2P framework to establish a direct connection between the two users when a voice call is to be initiated, and due to the bug the IP addresses of both the participants were being exposed.

Telegram offers two unique features namely Secret Chat and Nobody. Through Secret Chat, users can enable end-to-end encrypted calls/chats while with Nobody option users can prevent their IP addresses from being exposed during voice calls. When someone enabled Nobody option, the voice calls are routed through Telegram’s servers. Mishra identified that Nobody option isn’t available for desktop users, which means the location of every desktop app user will be vulnerable to exposure and all an attacker needs to do to obtain someone’s IP address is to make a call. As soon as the call is picked, the IP address gets revealed.

Patch issued

When Mishra reported his findings to the company, the issue was patched immediately in 1.3.17 beta and 1.4.0 versions of Telegram for Desktop. With this patch, the desktop version of the Telegram app will now be offering the Nobody feature too. You can enable it by clicking on this option: “P2P to Nobody/My Contacts via Settings → Private and Security → Voice Calls → Peer-To-Peer to Never or Nobody.

Telegram boasts of a worldwide fan following with a whopping 200million active users as of March 2018 and it is touted to be an ultra-secure messaging app that lets users make secure voice calls over the internet. But the discovery of a vulnerability in the most hyped feature of the app in its official desktop version does raise concerns. Classified as CVE-2018-17780, the vulnerability affected Telegram’s desktop app for Windows, Mac, and Linux OS.



Source link
Based Blockchain Network

LEAVE A REPLY

Please enter your comment!
Please enter your name here