full-disclosure - [FD] What the hell am I reading? (was: Telegram authentication bypass)

Open Source and information security mailing list archives

Message-ID: <535EA6BB.4050505@riseup.net>
Date: Mon, 28 Apr 2014 21:06:35 +0200
From: Munchausen <munchausen@...eup.net>
To: fulldisclosure@...lists.org
Subject: [FD] What the hell am I reading? (was: Telegram authentication
	bypass)

You folks didn't happen to hire a guy named Nicholas Lemonias, by any
chance, did you?

> Telegram authentication mechanism may be circumvented, since there is
> no way to verify the legitimacy of Telegram’s public keys and thus if
> the client is communicating with a legitimate server.

You don't seem to understand the difference between authentication
bypass and man-in-the-middle scenarios.

> This may allow an attacker leveraging this issue (e.g. by
> distributing a slightly modified client) to obtain almost full
> control of the victim's account. Further, the behavior of the
> victim’s client is exactly the same than the behavior of a legitimate
> client.

Why, yes, of course if you can install a trojanized client it can
connect to a different server that you own. It can also connect to the
proper server and forward all messages in the background. Or collect all
credit card numbers and send them by email. It's a trojan, you can do
anything. How is this a vulnerability in Telegram?

> 2014.03.07 - Initial contact with Telegram security team.
> 2014.03.10 - Telegram response informing that this issue is out of their
> security model.
> 2014.03.11 - Submission of PoC to Telegram security team.
> 2014.04.28 - Publication of research results.

*FACEPALM*

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives