amalthyareader comments 35
Share this story

A bug in the Telegram Messager app logged anything its users pasted into their chats in its syslog on macOS, even if they had opted for the end-to-end encrypted “secret” mode.
The vulnerability was spotted earlier this month by Russian infosec operative Kirill Firsov, who directly and publicly challenged Telegram’s flamboyant founder and chief Pavel Durov about the app’s latest security flaw.

Official #Telegram for MacOS logs every pasted message to syslog, even in secret chats. @durov what’s going on? pic.twitter.com/MvbWguAkT0
— Kirill Firsov (@k_firsov) July 23, 2016

In an angry reply, Durov admitted that the vuln existed, but insisted it “applies only to texts that were copy-pasted from clipboard, and such texts are open to all other Mac apps anyway.”
He continued: “AppStore apps can NOT access syslog (starting 10.12 also true for unsigned apps).

But ANY app can read your clipboard.”
Durov—in response to Firsov’s tweet—promised to fix the logging issue, which doesn’t affect either Telegram’s Android or desktop apps. He said: “So while copy-paste can not be secure anyway, I see such logging in the stable release redundant and will see it gone.”

@k_firsov (3)…

AppStore apps are sandboxed and can only WRITE to syslog, not READ it: https://t.co/vjoU8QVtza pic.twitter.com/1tgPMDBfak
— Pavel Durov (@durov) July 24, 2016

He added: “Although this turned out to be a minor bug phrased to look big, we fixed it within minutes after learning about it.”
Telegram has previously boasted to be more secure than WhatsApp, though some infosec experts have cautioned against such claims.

The service uses the MTProto protocol developed by its Russian-born founder Durov, a privacy absolutist, who says that the app’s so-called secret chats use end-to-end encryption and aren’t backed up in the cloud.
The app has attracted unwanted attention over the past year, however, after it was found to be the most popular way for terrorist organisations to stay in touch with each other and the outside world.

A recent study from security firm Trend Micro found that 34 percent of the groups it surveyed listed Telegram as their contact information.
In late 2015—following bad publicity about the app—Berlin-based Telegram said it had blocked 78 “public channels” related to the Isis terrorist organisation, adding “we were disturbed to learn that Telegram’s public channels were being used by ISIS to spread their propaganda.”
In its FAQ, the app says: “While we do block terrorist (e.g.
ISIS-related) bots and channels, we will not block anybody who peacefully expresses alternative opinions.”
This post originated on Ars Technica UK

Leave a Reply