Pierluigi Paganini June 14, 2016

Security researchers have found a vulnerability that could allow attackers to send massive messages on Telegram bypassing its limitations.

Security researchers have devised a method to send massive messages on Telegram. The experts have found a flaw that allows them so send messages of any size as showed in the proof-of-concept provided by the researchers.

The Iranian researcher Sad Ghaf who discovered the issue explained that it is the result of a coding error. The expert also added that over 20 million Iranians use the popular Telegram instant messaging app.

In order to prevent abuses, Telegram implemented a limitation in the request rate to prevent from sending massive text messages in a short period of time. Such kind of features and end-to-end encryption made Telegram a privileged tool for terrorist propaganda.

“Telegram limits request rate to bar malicious users from sending a lot of messages in a short period of time. We noticed that there is also a limitation for minimum and maximum size of the text messages. The minimum limit is 1 character (1 byte) and the maximum limit is 4096.”wrote Ghaf. “Due to a programming error in the implementation of this section, sender can get control on the size of messages and send them with arbitrary length. On the other side victim would receive all incoming messages even if they are too long.” wrote Ghaf.

Ghaf also explained did not pinpoint the flaw in a bid to prevent others exploiting it, and says he could not find a way to report the flaw to Telegram.

Ghaf and his team were able to send a message with 30000 bytes,much more than the permitted 4096 bytes.

You can see the PoC messages in the Telegram channel: @poc_sadghaf , that includes the 30000 bytes long text and a second one the is empty.

The experts also explained why the but is so critical, an attacker can send multi-million-character long strings to victims causing bandwidth consumption and in same cases the crashes of the recipient’s device.

“Assuming that each ASCII character is one byte long, an attacker can send multi-million-character long strings to victims (or just a null message to be funny!) and the victim would receive the message without taking a scratch!? It’s like downloading a large file without accepting to receive it (Like being an actual server)!” Ghaf explained.

“During the test process we noticed two alarming outcomes:

1-A lot of bandwidth was being taken.

Considering that by default Telegram uses mobile data (If other networks are not being used) it can be really harmful for the receiver.

2-The device crashes or just stop working due to lack of space (or memory).”

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Telegram, Hacking)