Live data from Hacker News

Telegram zero-day for Android allowed malicious files to masquerade as videos

therecord.media

11–15 of 15 posts

Re: Telegram zero-day for Android allowed malicious files to masquerade as videos

#11
This isn’t a zero day nor does it really seem like Telegram’s fault, this is just how android itself works by design and this would likely affect any app that didn’t have specialized logic to recognize a malformed apk file. If an app tells android “open this file” it’s going to search for something that can read it, in the case of something with an apk manifest that becomes the system installer.

It’s still very unlikely to happen since android will warn you and you have to go through several dialogs to enable installing the apk.

This will be an unpopular opinion, and I’m not saying their argument is correct, or that the good doesn’t outweigh the risk - but this is exactly what Apple was talking about when they explained why they don’t want side loading.

Re: Telegram zero-day for Android allowed malicious files to masquerade as videos

#14

Earlier quoted context omitted.

Hold on, does Android not require the application to include something in its manifest in order to be granted APK installation permission? Like how for every other permission request an app has to declare upfront that it requires/may request that permission?

It's not really Telegram that's installing the APK. It's just trying to open the file with your default APK file handler. Which is the system, and by default doesn't allow arbitrary APK installation. Think using a browser to download an installer. You download the installer, then open the installer file, it's not the browser that's installing the software it's you opening the installer file. Telegram shouldn't assume…

Telegram should not be tricked into downloading an apk as a video.

I assume you can send a normal apk to your friends and Telegram correctly warns the recipient when that happens.

But when it's a "video"...

Re: Telegram zero-day for Android allowed malicious files to masquerade as videos

#15

Earlier quoted context omitted.

Hold on, does Android not require the application to include something in its manifest in order to be granted APK installation permission? Like how for every other permission request an app has to declare upfront that it requires/may request that permission?

It's not really Telegram that's installing the APK. It's just trying to open the file with your default APK file handler. Which is the system, and by default doesn't allow arbitrary APK installation. Think using a browser to download an installer. You download the installer, then open the installer file, it's not the browser that's installing the software it's you opening the installer file. Telegram shouldn't assume…

So the way it works is: an app initiates an Open intent with the apk, the system handles this as an install, then the installer checks to see if the app initiating the intent has the "install unknown applications" permission. The problem is that the user can grant any application that special permission. It shouldn't work like that; an app should have to list that permission as one it accepts, which would avoid scenarios like this without interfering with user freedom (you can download the apk sent on Telegram, then open it in your file browser or something which allows itself to be given app installation permission).
Post reply on HN