full-disclosure

Open Source and information security mailing list archives

Message-ID: <1398712321.12426.3.camel@smaug>
Date: Mon, 28 Apr 2014 21:12:01 +0200
From: Dominik Schürmann <dominik@...inikschuermann.de>
To: fulldisclosure@...lists.org
Subject: Re: [FD] Telegram authentication bypass

Hello,

like Telegram said, this is definitely out of normal security models!
You assume that the client app has been compromised, e.g. by downloading
an unofficial one.
If you assume that, every crypto protocol out there is broken! What
about downloading a forked Firefox version? Maybe it includes some MitM
certificates...
Nothing protects you against your attack...

Regards from a suprised
Dominik

On Mon, 2014-04-28 at 11:17 +0200, jdiaz@...t.inteco.es wrote:
> Hello,
> 
> A security issue affecting Telegram instant messaging service has been
> made public by INTECO-CERT. Further details follow.
> 
> ----------------------------------
> Affected products and services:
> ----------------------------------
> 
> Telegram instant messaging service.
> 
> 
> ----------------------------------
> Overview:
> ----------------------------------
> 
> Telegram authentication mechanism may be circumvented, since there is no
> way to verify the legitimacy of Telegrams public keys and thus if the
> client is communicating with a legitimate server. This may allow an
> attacker leveraging this issue (e.g. by distributing a slightly modified
> client) to obtain almost full control of the victim's account. Further,
> the behavior of the victims client is exactly the same than the behavior
> of a legitimate client.
> 
> For a detailed analysis, including a PoC, visit:
> http://www.inteco.es/blogs/post/Seguridad/BlogSeguridad/Articulo_y_comentarios/telegram_authentication
> (blog post with extended abstract) or
> http://cert.inteco.es/extfrontinteco/img/File/intecocert/EstudiosInformes/INT_Telegram_EN.pdf
> (detailed research results).
> 
> ----------------------------------
> Timeline:
> ----------------------------------
> 
> 2014.03.07 - Initial contact with Telegram security team.
> 2014.03.10 - Telegram response informing that this issue is out of their
> security model.
> 2014.03.11 - Submission of PoC to Telegram security team.
> 2014.04.28 - Publication of research results.
> 
> 
> Sincerely,
> 
> Jesus Diaz
> 
> 
> 
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives