This is not a security vulnerability its a privacy issue. As I understand Telegram a messaging app focuses on privacy which has over 10,00,00,000+ downloads in
Technical analysis: I found this bug when I was researching about Telegram and MTProto protocol. To demonstrate this bug let’s assume two people here, Bob and Alice.
Assume a scenario where Bob sends a message which is a
The highlighted issue is valid when we talk about Telegram “supergroups” as well, assume a case wherein you’re a part of a group with 2,000,00 members and you accidentally share a media file not meant to be shared in that particular group and proceed to delete, by checking “delete for all members” present in the group. You’re relying on a functionality that is broken since your file would still be present in storage for all users.
Aside from this, I found that since Telegram takes `read/write/modify` permission of the USB storage which technically means the confidential photo should have been deleted from Alice’s device or storage.
Comparison: A compete, app for Telegram which is WhatsApp also has the same feature to “Delete for everyone“. If you perform the following steps mentioned above in WhatsApp it deletes the confidential photo from Alice’s `/Whatsapp/Whatsapp Media/Whatsapp Images/` folder and maintains the privacy however Telegram fails. WhatsApp takes the same permission when it comes to storage which is `read/write/modify`.
This issue could have a bigger impact and I am not sure how far this was in place; the word privacy of Telegram fails here again, and users trust against the Telegram is at risk.
Affected version: I have tried this with the latest stable version (5.10.0 (1684)) of Telegram for Android. I haven’t tried this with Telegram for iOS and Telegram for Windows but assuming this issue would exist on other these platforms.
Responsible disclosure: I submitted this to Telegram sec-team via security[at]telegram[dot]org and a fix was pushed for same also €2,500 was awarded by Telegram.
Other Workaround: The alternative solution would be to utilize the feature of “New Secret Chat” in Telegram where no such traces are left.
About the Author: Security Researcher Dhiraj Mishra (@mishradhiraj)
Original post at:
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.