INFRA
INFRA
INFRA
Telegram desktop apps discovered to be leaking user IP addresses
Messaging app Telegram has long been favored for its security, including encryption deployed as standard. But a recently discovered flaw in desktop versions of Telegram has been found to be exposing IP addresses.
Discovered by security researcher Dhiraj Mishra, the flaw in the Windows app and Telegram Desktop app exposes and records the IP address of a user taking a call, with the data stored in the Telegram console logs. The problem is that by default Telegram forces users to both use peer-to-peer for calls and for recording the IP address of each connection.
“Telegram is supposedly a secure messaging application, but it forces clients to only use P2P connection while initiating a call, however, this setting can also be changed from ‘Settings > Privacy and security > Calls > peer-to-peer’ to other available options,” Mishra said in a blog post Saturday. “The tdesktop and Telegram for Windows breaks this trust by leaking public/private IP address of end user and there was no such option available yet for setting ‘P2P > nobody’ in tdesktop and Telegram for Windows.”
Where the so-called feature becomes confusing is not that Telegram records the IP address but the Windows and Desktop apps do so without the ability to turn the feature off. Other versions of the Telegram clients such as those on macOS, iOS and Android also record the IP address but support the ability to turn the feature off.
Telegram responded quickly, not only rewarding Mishra a payment for discovering the bug but also pushing out a new version of the apps. Users who are concerned about privacy are encouraged to download the new version and also opt to disable P2P calling so as to avoid exposure of their IP address.
Image: Dhiraj Mishra
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
