Security Firm CertiK Warns Telegram Harbors High-Risk Vulnerability to Attacks
Blockchain security firm CertiK Alert disclosed that Telegram has a high vulnerability risk, exposing messenger users to potential attacks. The security firm revealed the vulnerability in the Tuesday, April 9 publication urging avoidance by turning off automatic downloads on the Telegram Desktop.
The blockchain security specialist argued via the April 9 publication on X (formerly Twitter) that the vulnerability exposes users to exploitation by hackers. The firm indicated that hackers could initiate a remote code execution (RCE) using Telegram’s media processing.
CertiK Discovers Vulnerability in Telegram Desktop Application
The post indicates that the CertiK team discovered an avenue for launching possible RCE attacks on the Telegram Desktop application. The team stated that the issue leaves the users vulnerable to attackers who could potentially craft exploits via the videos and images. The
The CertiK spokesperson clarified that the vulnerability is an exclusive weakness of the desktop Telegram application. The executive added that the mobile version lacks direct executable programs that require signatures. A representative from the blockchain analyst firm attributes the issues emerging from the security community. The CertiK team urges users to turn off the auto-download feature accessible from the Settings and Advanced tabs.
CertiK Urges Messenger Users to Disable Automatic Downloads
CertiK urged the users to turn off the automatic download feature for the media, whether files, videos, or photos. Users should turn off the feature across all chats, whether channels, groups, or private.
The revelation of the vulnerability is yet to be confirmed whether such a vulnerability exists and exposes Telegram clients to attacks.
Crypto enthusiast and specialist in search optimization Yannick Eckl ruled out the challenges of automatic media downloads harboring vulnerability to RCE attacks as a discovery. Eckl indicated that the issue is well known, though not apparent to all users.
The discovery of users’ susceptibility to RCE attacks raises concerns among Telegram users. Concerns arise from the increased usage of crypto-friendly messengers that allow users to communicate.
The Telegram messenger has seen increased utilization in exchanging files and executing crypto transactions for Bitcoin and Toncoin (TON). Users leverage the custodial wallet solution identified as Wallet.
The custodial services via the Wallet hardly give users access to private keys. The absence of default access places the assets within their custody to save industry newcomers from shouldering the self-custody responsibilities.
Telegram Bounty to Combat Vulnerabilities
CertiK did not link the vulnerability to any attack on the Telegram messenger. Nonetheless, the discovery is not the first, as Google Engineering specialist Dan Reva highlighted such weakness last year. He discovered a bug allowing attackers to activate microphones and cameras for the laptops running MacOS.
Security researcher Shielder reported a similar media-related vulnerability three years ago on Telegram. The researcher indicated that the vulnerability allowed the attackers to issue modified animated stickers that ultimately exposed the users’ data.
Telegram has yet to issue an official response relating to the vulnerabilities. Nonetheless, Telegram is actively committed to addressing potential vulnerabilities in the application using the bug bounty program unveiled in 2014.
The bug bounty allows the developers to collaborate with the security research community to offer discoveries regarding Telegram’s vulnerability. The submissions are assessed for their eligibility for bounties ranging from $100 to $100,000 relative to the severity.
Editorial credit: rafapress / Shutterstock.com
