How I Hacked Telegram’s “Encryption”
blog.zimperium.com
How I Hacked Telegram’s “Encryption”
1–10 of 18 posts
Re: How I Hacked Telegram’s “Encryption”
#2I find it hard to believe that Telegram did not respond to the author. How can one company simultaneously host a $200k security contest, yet not respond to a simple email disclosing a vulnerability?
Re: How I Hacked Telegram’s “Encryption”
#3tldr; End-to-end encryption does nothing when an adversary controls one of the ends.
I'd say this guy is trying a little too hard to promote his "Zimperim Mobile Security" brand here...
Re: How I Hacked Telegram’s “Encryption”
#4TL;DR - the author claims to have hacked their encryption by reading the messages in phone memory.
I don't understand how this is a valid exploit/vulnerability? How would any device, Android or not, render the actual picture of the message on the GPU without having the unencrypted string in memory? It's not possible. If you have local memory/code execution, you will ALWAYS have access to the messages any client application is rendering/using.
Re: How I Hacked Telegram’s “Encryption”
#5This is clickbait unfortunately, his attacks require root access on the device.
Re: How I Hacked Telegram’s “Encryption”
#6TL;DR - the author claims to have hacked their encryption by reading the messages in phone memory. I don't understand how this is a valid exploit/vulnerability? How would any device, Android or not, render the actual picture of the message on the GPU without having the unencrypted string in memory? It's not possible. If you have local memory/code execution, you will ALWAYS have access to the messages any client appli…
Yeah, the memory thing didn't impress me. More concerning though is that apparently messages are stored in plain text on disk in that cache4.db file. It's not clear to me whether they are deleted when the app quits or what.
Re: How I Hacked Telegram’s “Encryption”
#7TL;DR - the author claims to have hacked their encryption by reading the messages in phone memory. I don't understand how this is a valid exploit/vulnerability? How would any device, Android or not, render the actual picture of the message on the GPU without having the unencrypted string in memory? It's not possible. If you have local memory/code execution, you will ALWAYS have access to the messages any client appli…
Yeah, the memory thing didn't impress me. More concerning though is that apparently messages are stored in plain text on disk in that cache4.db file. It's not clear to me whether they are deleted when the app quits or what.
Yeah, I'm feeling like the quotes should be around "Hacked", and not "Encryption"
Re: How I Hacked Telegram’s “Encryption”
#8I find it hard to believe that Telegram did not respond to the author. How can one company simultaneously host a $200k security contest, yet not respond to a simple email disclosing a vulnerability?
Because this isn't really a vulnerability. It's "if you completely control the device that is sending/receiving encrypted messages, you can read the messages."
There's literally no way to defend against this attack. About the best they could do is show a warning like "Warning: The version of Android you are using contains vulnerabilities attackers could use to take control of your phone. Please update your softw... buy a new phone to get the latest version of Android."
Re: How I Hacked Telegram’s “Encryption”
#9I am not even a security novice, but isn't getting root on the devices basically a game over? The suggestions the author hard to encrypt the stuff in memory and on disk would just add a extra step for the attacker to find the key? If they key had to be entered by the user every time the attack can just wait until the user does so? If thats too hard... just monitor the user.
With root you can just wait and take screen shots... (as the author shows) which would work for any thing the user does ever and is simpler?
Re: How I Hacked Telegram’s “Encryption”
#10Also neat that you really can recompose the entire conversation, as the timestamps are clearly available in the DB.
Offset 0056e1c, 0x54ba8a1d is unixepoch 1421511197 - which is January 17th, at 16:13:17GMT - which, given that the author is in Tel Aviv (GMT+2), corresponds with the 6:13PM timestamp for 'Shlookiedo' seen in the photos.