Post B4miiVv7Mdd0upkboG by buherator@infosec.place
(DIR) More posts by buherator@infosec.place
(DIR) Post #B4mhmuXveCFmUoRAO0 by wolf480pl@mstdn.io
0 likes, 0 repeats
EDIT: this was a bit misleading, see: https://mstdn.io/@wolf480pl/116318471815623940Looks like there's a bit more info on the zero-click Telegram RCE and holy shit this looks bad:> This vulnerability allows an attacker to execute arbitrary code on a victim's device simply by sending a specially crafted animated sticker or media file. No user interaction is required> A Telegram spokesperson denied the vulnerability's existence, claiming the research was incorrect. https://github.com/gameworkerkim/Telegram-0-Click-RCE-SECURITY-VULNERABILITY-ANALYSIS-REPORT/blob/main/Telegram%200-Click%20RCE_ENG.md#telegram #security
(DIR) Post #B4miiVv7Mdd0upkboG by buherator@infosec.place
0 likes, 0 repeats
@wolf480pl This report looks pure AI slop, but @thezdi does have a matching candidate listed (meaning ZDI accepted the submission as a valid vuln):https://www.zerodayinitiative.com/advisories/upcoming/Since that vuln was reported just 4 days ago my educated guess is that 1) the reporter wasn't dumb to trash their ZDI bounty by posting details online 2) someone saw the candidate and generated a slop report about it without any technical ground.
(DIR) Post #B4miiWCUK3WTmhsTsu by wolf480pl@mstdn.io
0 likes, 0 repeats
@buherator it's possible, but it does link to the italian govt cybersecurity agency, which is something I didn't know from the initial ZDI candidate.https://www.acn.gov.it/portale/w/telegram-rilevata-presunta-vulnerabilita-0-click
(DIR) Post #B4mjTEBZ7RXNWTidVo by wolf480pl@mstdn.io
0 likes, 0 repeats
Looks like it poorly (possibly with AI) aggregates information from other places and I panicked / got fooled by my confirmation biasSorryEg. if you look at the Italian govt websitehttps://www.acn.gov.it/portale/w/telegram-rilevata-presunta-vulnerabilita-0-clickthe "Telegram's response" part seems to say that Telegram claims to validate the stickers on its servers before sending them to any client appsWhich the article didn't mention.But also I don't know Italian and used machine translation so I don't know for sure if that's what it says :/
(DIR) Post #B4mjf5x9YLKLSudWEK by poni@ak.kawen.space
0 likes, 0 repeats
@wolf480pl lol
(DIR) Post #B4mjf67Qw7YBynRjFo by poni@ak.kawen.space
0 likes, 0 repeats
@wolf480pl though that report feels like an llm slop?
(DIR) Post #B4mjf6FET7myMz5xPU by wolf480pl@mstdn.io
0 likes, 0 repeats
@poni fuck, I got high on confirmation bias. It totally does look like slop.Sorry for spreading it.
(DIR) Post #B4v3f9aTaqvp5J0woi by wolf480pl@mstdn.io
0 likes, 0 repeats
@avuko AFAIU that validation is when uploading a new sticker, not when using an already-defined one.> everything you say or send on Telegram goes trough their servers in plain textwhere did they say that?Also AFAIK they only ever claimed that the special "secret chat" mode that nobody uses is end-to-end encrypted, the regular chats were never claimed to be end-to-end encrypted, so obviously the server had access to it...But that's neither news nor RCE.
(DIR) Post #B4v4jzfO0R9RiZBNnk by wolf480pl@mstdn.io
0 likes, 0 repeats
@avuko what I'm more concnerned about is anyone with (bought or enforced) access to Telegram servers bypassing the sticker verification and using the alleged RCE...
(DIR) Post #B4vAkrBxbDvNRtDJWC by wolf480pl@mstdn.io
0 likes, 0 repeats
@avukoSandbox escape on Android is one possibility, but the RCE also affects native Telegram client for desktop Linux, which isn't always sandboxed.Plus, if someone was using the special e2e encrypted chats, and if there weren't already vulns in that protocol that the server could exploit, compromising the client would give the attacker access to those.
(DIR) Post #B4vAtnkrkP1TOZo0q8 by wolf480pl@mstdn.io
0 likes, 0 repeats
@avukooh, also you could use an RCE in a sandboxed app still lets you make outbound network connections in whatever network the victim has access to, right?