April

Update April 9, 2:40 pm UTC: Telegram denied the existence of RCE vulnerability for Telegram clients, while some security experts claimed it's been a known issue.
A major vulnerability on Telegram messenger is exposing users to malicious attacks, according to a new report released by the blockchain security firm CertiK.
CertiK Alert took to the social media platform X on April 9 to <a href="https://x.com/CertiKAlert/status/1777632812700713254" target="_blank" rel="noopener nofollow">warn</a> the public against a “high-risk vulnerability in the wild,” potentially allowing hackers to deploy a remote code execution (RCE) attack through Telegram’s media processing.
According to the post, CertiK’s team has discovered a “possible RCE” attack in Telegram’s media processing on Telegram Desktop application.
“This issue exposes users to malicious attacks through specially crafted media files, such as images or videos,” CertiK wrote.
A spokesperson for&nbsp;CertiK told Cointelegraph that the vulnerability is exclusive to the desktop Telegram application because mobile "does not directly execute executable programs like desktops, which generally require signatures." The representative noted that&nbsp;the news on the issue came from the security community.
To avoid the vulnerability, users should check their Telegram Desktop configuration and disable the auto-download feature. The feature can be disabled by going to “Settings” and then tapping on “Advanced.”
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-04/5b334363-6990-4ffe-aefb-8103359fd9fe.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/CertiKAlert/status/1777633778359267736" target="_blank" rel="noopener nofollow">CertiK</a>
 </figcaption>
</figure>
“Under the ‘Automatic Media Download’ section, disable auto-download for ‘Photos’, ‘Videos’, and ‘Files’ across all chat types (Private chats, groups, and channels),” CertiK noted.
A spokesperson for Telegram told Cointelegraph that the company "can't confirm the existence of such a vulnerability in Telegram clients."
According crypto enthusiast and grey hat SEO Yannick Eckl, the problem with automatic downloads of media files and RCE attacks in Telegram is not new. "It is a known issue in many, but obviously not all, IT-security circles," Eckl told Cointelegraph.
Telegram is a major cryptocurrency-friendly messenger that allows users to communicate and exchange files and transact cryptocurrencies like Bitcoin (<a href="https://cointelegraph.com/bitcoin-price">BTC</a>) and Toncoin (TON) using its <a href="https://cointelegraph.com/news/telegram-wallet-avoided-self-custody">custodial wallet solution called, simply, Wallet</a>. 
The “custodial” part means that Wallet doesn’t give users the private key by default but rather puts the assets in its own custody to help industry newcomers avoid self-custody&nbsp;responsibilities.
Related: <a href="https://cointelegraph.com/news/telegram-channels-50-ad-revenue">Telegram channels eligible for 50% ad revenue, but there’s a catch</a>
The newly discovered vulnerability on Telegram isn’t its first. In 2023, Google engineer Dan Reva found a significant bug that could allow attackers to activate the camera and microphone on laptops running macOS.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-04/587ea2a0-46f9-4d75-a248-e2fd3f678970.png">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/danrevah/status/1658050807026143235" target="_blank" rel="noopener nofollow">Dan Rehah</a>
 </figcaption>
</figure>
In 2021, a security researcher from Shielder discovered a similar media-related issue on Telegram, which reportedly <a href="https://www.bitdefender.com/blog/hotforsecurity/telegram-vulnerabilities-could-let-attackers-send-malicious-animated-stickers-research-finds/" target="_blank" rel="noopener nofollow">allowed</a> attackers to send modified animated stickers, which could have exposed the victims’ data.
Telegram has been actively addressing potential vulnerabilities on its app, though. Telegram’s bug bounty program has been active since 2014, <a href="https://core.telegram.org/bug-bounty" target="_blank" rel="noopener nofollow">offering</a> developers and the security research community the opportunity to submit their reports and be eligible for bounties&nbsp;ranging from $100 to $100,000 or more, depending on the severity of the issue.
Magazine: <a href="https://cointelegraph.com/magazine/base-meme-coins-scams-vulnerabilities-honeypot/">1 in 6 new Base meme coins are scams, 91% have vulnerabilities</a>

‘High-risk’ Telegram vulnerability exposes users to attacks — CertiK

Cointelegraph

Other articles published on Apr 9, 2024

The New VR/AR Metaverse Gaming Project Hits $4.5 in Presale – Could $5SCAPE Dominate the Crypto M...

Seeking the Biggest Gainers of the Year? Look No Further Than $RECQ Presale for Prospects Outshin...

Donk.Meme Set To Conclude $DONKM Token Presale: Here’s Your Chance To Become An Early Contributor...

El Salvador Offers Free Passports to Boost Bitcoin Economy

Best Meme Coins to Add to Your Portfolio Now Tuesday April 9 – dogwifhat, Pepe, SonicWifHat, eTukTuk

AI may Increase Global Copper Demand by 1 Million Tons

Join our free newsletter for daily crypto updates!