A Telegram bug that disclose phone numbers of any users in public groups
1–10 of 63 posts
Re: A Telegram bug that disclose phone numbers of any users in public groups
#2Re: A Telegram bug that disclose phone numbers of any users in public groups
#3It could be argued you already had the phone number of your victim.
If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.
Re: A Telegram bug that disclose phone numbers of any users in public groups
#4It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.
It could be argued you already had the phone number of your victim.
But you have no correlation between it and Telegram user. This bug is about this correlation.
Re: A Telegram bug that disclose phone numbers of any users in public groups
#5It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.
The impact is specifically related to Hong Kong, where the protesters are using telegram to coordinate, and where, according to the bug report, the telephone number range is limited.
Re: A Telegram bug that disclose phone numbers of any users in public groups
#6It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.
It could be argued you already had the phone number of your victim. But you have no correlation between it and Telegram user. This bug is about this correlation.
Right, the key trick here is that Telegram is easily used as an Oracle.
Telegram has essentially agreed to tell you whether any phone number is correct, so you can just guess all the phone numbers. Never allow this unless the thing an adversary has to guess is both _completely random_ and from a _very large keyspace_ (128-bits is where you can start to feel safe). If you find you're cornered into doing this (e.g. typical email + password login) aggressively rate limit it, so the adversary has to work harder/ longer to take advantage and maybe they'll give up.
Phone numbers are neither random nor from a large key space, it's maybe 10^12 worldwide or something? Much too small.
Re: A Telegram bug that disclose phone numbers of any users in public groups
#7f*ck no wonder I get so many robo calls
Re: A Telegram bug that disclose phone numbers of any users in public groups
#8It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.
they say that they managed to add 0.1 million people at once. If you're after a group of people and getting only one of them is enough, the limits look pretty feasible to me, even more possible especially in small communities.
Re: A Telegram bug that disclose phone numbers of any users in public groups
#9Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof).
What's worse is there seems to be no way to opt-out of this behavior. I can deny Signal access to my contacts, thereby not knowing which of my contacts are on Signal, but that doesn't stop the other party from knowing if I am on Signal if they have given Signal access to their contacts.
It's not farfetched to consider a world where an oppressive regime may outlaw the use of something like Signal, Telegram or even WhatsApp and they'd be able to easily determine if you're using such a service through passive techniques such as these.
As far as I know, Wickr is a bit more privacy focused, but it doesn't tick the open source box for me (although the supposed source code is published[1] for public review).
Re: A Telegram bug that disclose phone numbers of any users in public groups
#10f*ck no wonder I get so many robo calls
Nah man, you can thank the FCC for that.