2024

Bitcoin

when

April

<p>Blockchain security firm CertiK has released a new <a href="https://x.com/CertiKAlert/status/1777632812700713254" rel="noopener noreferrer nofollow" target="_blank">report</a> showing that there is a new vulnerability on Telegram Messenger that is exposing users to malicious attacks. In its post on X, the security firm mentioned the vulnerability that hackers could use to deploy a remote code execution (RCE) attack through Telegram’s media processing.</p>
<h2 class="wp-block-heading" id="certik-details-telegram-s-desktop-application-s-vulnerability">CertiK details Telegram’s desktop application’s vulnerability</h2>
<p>The post clarified that hackers could take advantage of media processing on Telegram’s desktop application, thereby deploying the RCE attack. CertiK noted that users could be exposed to these malicious attacks through specially made media files. “This issue exposes users to malicious attacks through specially crafted media files, such as images or videos,” CertiK said.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/CertiKInsight?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#CertiKInsight</a> ⚠️<br>We see a high-risk vulnerability in the wild,<br>Please check your telegram configurations to improve security!<br>👇👇👇👇👇<br>Possible RCE was detected in Telegram's media processing in Telegram Desktop application.<br>This issue expose users to malicious attacks through…</p>— CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/1777632812700713254?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">April 9, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>According to a CertiK spokesperson, the said vulnerability is limited to only the desktop application. He notes that the mobile application does not carry out executable programs directly unlike the desktop that requires signatures. The spokesperson also noted that it was the security community that discovered the issue. To avoid the vulnerability, CertiK urged users to disable the auto-download feature in the desktop configuration of their Telegram application.</p>
<p>Users can disable the auto-download feature by clicking on ‘Settings’ and then selecting ‘Advance’. After the automatic media download option pops up, they can toggle the disable button across all media files.</p>
<h2 class="wp-block-heading" id="response-and-measures-to-address-vulnerabilities">Response and measures to address vulnerabilities</h2>
<p>Telegram is a messenger application that has enjoyed quite a success since its launch. The crypto-friendly application allows users to exchange messages, pictures, videos, and digital assets like Bitcoin and Toncoin. It allows users to carry out these crypto-related activities through the use of its custodial wallet called Wallet. The <a href="https://www.cryptopolitan.com/telegrams-mini-apps-tip-blockchain-adoption/" data-type="post" data-id="503814" rel="noopener noreferrer nofollow">platform</a> holds a custodial wallet to help crypto newbies who are still green when it comes to self-custody.</p>
<p>Telegram swiftly replied to the update on X, noting that the said vulnerability is nonexistent. “We can’t confirm that such a vulnerability exists. This video is likely a hoax,” the messaging app said. <br></p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">We can't confirm that such a vulnerability exists. This video is likely a hoax.<br><br>Anyone can report potential vulnerabilities in our apps and get rewards: <a href="https://t.co/UkzPFSVigy" rel="noopener noreferrer nofollow" target="_blank">https://t.co/UkzPFSVigy</a></p>— Telegram Messenger (@telegram) <a href="https://twitter.com/telegram/status/1777677055837995151?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">April 9, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>However, it is not the first time that a vulnerability has been reported on the platform. In 2023, Google engineer Dan Reva discovered a bug that could aid hackers in activating the cameras and microphone on macOS laptops.</p>
<p>Telegram has also been working tirelessly to discover and address vulnerabilities on its platform. The messaging app has a bug bounty <a href="https://core.telegram.org/bug-bounty" rel="noopener noreferrer nofollow" target="_blank">program</a> that has been running since 2014 offering researchers and developers opportunities to earn rewards of up to $100,000 for discovering issues on the app. Moreover, the app has urged anyone who discovers issues on the app to report them. “Anyone can report potential vulnerabilities in our apps and get a reward,” Telegram said.</p>

CertiK discovers a high-risk vulnerability on Telegram

Table of Contents

Cryptopolitan_News

Other articles published on Apr 9, 2024

Victory For Do Kwon? Montenegro’s Latest Ruling Reverses Extradition To South Korea

MINA Protocol Anticipates Impactful Mainnet Upgrade with Berkeley

Bitcoin Price Set to Skyrocket Following Trend Indicator’s Bullish Signal

Significant Move in the Cryptocurrency Space by Ripple-Owned Firm Metaco

Tilray Brands, Inc (TLRY) Q3 Results: -$0.12 EPS, Misses Expectations by $0.07

Defiance ETFs Files With SEC To Launch Ethereum Futures ETF

Join our free newsletter for daily crypto updates!