Telegram zero-day for Android allowed malicious files to masquerade as videos
1–10 of 15 posts
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#2Based on the description of the exploit:
> The exploit takes advantage of Telegram’s default setting to automatically download media files. The option can be disabled manually, but in that case, the payload could still be installed on the device if a user tapped the download button in the top left corner of the shared file.
I don't see why this exploit could not be exploited on iOS.
> If the user tried to play the “video,” Telegram displayed a message that it was unable to play it and suggested using an external player. The hackers disguised a malicious app as this external player.
However, it seems a disguised way to invite the user to install an external application... Is it from the Google Play Store? Or an external APK that the user has to download from a website, and install himself?
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#3More discussion: https://news.ycombinator.com/item?id=41040445
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#4Based on the description of the exploit: > The exploit takes advantage of Telegram’s default setting to automatically download media files. The option can be disabled manually, but in that case, the payload could still be installed on the device if a user tapped the download button in the top left corner of the shared file. I don't see why this exploit could not be exploited on iOS. > If the user tried to play the “v…
The exploit is that the video is actually an APK. So tapping the video -> "Telegram cannot play this. Open in an external app?" -> Afterwards prompts the user to install the APK.
As such, the user must give Telegram rights to install unknown APKs for it to work. The user will be prompted to enable this setting, but I guess they might think it's Telegram recommending a video player and actually go through with it.
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#5[dead]
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#6Yeah this is not a zero day.
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#7Based on the description of the exploit: > The exploit takes advantage of Telegram’s default setting to automatically download media files. The option can be disabled manually, but in that case, the payload could still be installed on the device if a user tapped the download button in the top left corner of the shared file. I don't see why this exploit could not be exploited on iOS. > If the user tried to play the “v…
The exploit is that the video is actually an APK. So tapping the video -> "Telegram cannot play this. Open in an external app?" -> Afterwards prompts the user to install the APK. As such, the user must give Telegram rights to install unknown APKs for it to work. The user will be prompted to enable this setting, but I guess they might think it's Telegram recommending a video player and actually go through with it.
Unless the user has a habit of installing APKs from Telegram, the workflow will probably be: tapping the video -> "Telegram cannot play this. Open in an external app?" -> "APK installation is restricted for this app (click 'settings')" -> "Install unknown apps (click 'allow from this source')" -> Go back -> Open the video again -> "Do you want to install this application?"
If you call the app "video player required for this movie" you may be able to convince users to give all of these permissions, but this isn't like the type confusion exploits on Windows where you can go from application to executing a program in one click.
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#8Based on the description of the exploit: > The exploit takes advantage of Telegram’s default setting to automatically download media files. The option can be disabled manually, but in that case, the payload could still be installed on the device if a user tapped the download button in the top left corner of the shared file. I don't see why this exploit could not be exploited on iOS. > If the user tried to play the “v…
The exploit is that the video is actually an APK. So tapping the video -> "Telegram cannot play this. Open in an external app?" -> Afterwards prompts the user to install the APK. As such, the user must give Telegram rights to install unknown APKs for it to work. The user will be prompted to enable this setting, but I guess they might think it's Telegram recommending a video player and actually go through with it.
This is absolutely a failure I Telegram for not recognising APK as malicious.
But Telegram does not have permission to install apps. For this to work the user must perform not one but two stupid things.
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#9Based on the description of the exploit: > The exploit takes advantage of Telegram’s default setting to automatically download media files. The option can be disabled manually, but in that case, the payload could still be installed on the device if a user tapped the download button in the top left corner of the shared file. I don't see why this exploit could not be exploited on iOS. > If the user tried to play the “v…
The exploit is that the video is actually an APK. So tapping the video -> "Telegram cannot play this. Open in an external app?" -> Afterwards prompts the user to install the APK. As such, the user must give Telegram rights to install unknown APKs for it to work. The user will be prompted to enable this setting, but I guess they might think it's Telegram recommending a video player and actually go through with it.
Hold on, does Android not require the application to include something in its manifest in order to be granted APK installation permission? Like how for every other permission request an app has to declare upfront that it requires/may request that permission?
Re: Telegram zero-day for Android allowed malicious files to masquerade as videos
#10Earlier quoted context omitted.
The exploit is that the video is actually an APK. So tapping the video -> "Telegram cannot play this. Open in an external app?" -> Afterwards prompts the user to install the APK. As such, the user must give Telegram rights to install unknown APKs for it to work. The user will be prompted to enable this setting, but I guess they might think it's Telegram recommending a video player and actually go through with it.
Hold on, does Android not require the application to include something in its manifest in order to be granted APK installation permission? Like how for every other permission request an app has to declare upfront that it requires/may request that permission?
It's not really Telegram that's installing the APK. It's just trying to open the file with your default APK file handler. Which is the system, and by default doesn't allow arbitrary APK installation.
Think using a browser to download an installer. You download the installer, then open the installer file, it's not the browser that's installing the software it's you opening the installer file.
Telegram shouldn't assume it's a video file because that makes it confusing for the user, but tbh if I want to send a friend an APK and they want to install it shouldn't that be allowed? Software freedom, control over your own device and all?