MacOS Flaw in Telegram Retrieves Deleted Messages

by | Aug 6, 2021 | News

telegram macos retrieve deleted messages

Post Views: 838

Reading Time: 1 Minute

A vulnerability in a high-level privacy feature of Telegram on macOS that sets up a “self-destruct” timer for messages on both the sender’s and recipient’s devices can allow someone to retrieve these messages even after they’ve been deleted, a researcher has found.

Reegun Richard Jayapaul, Trustwave SpiderLabs Lead Threat Architect, discovered the flaw in the Self-Destruct feature of Telegram MacOS, which is part of the Secret-Chats aspect of the messaging app that uses end-to-end encryption.

This encryption – the key to which even Telegram administrators do not have – “is meant for people who are concerned about the security and privacy of their chat history,” he said in a blog post about his findings published Thursday.

Indeed, Telegram in general is widely viewed as one of the more secure messaging apps; many users have opted to switch from Facebook’s WhatsApp to Telegram because they are concerned about their privacy.

Jayapaul worked with Telegram to patch the flaw, which can allow the privacy of users to be violated via two scenarios. In doing so, he said he learned of a caveat of the company’s vulnerability disclosure program that prevents researchers from disclosing a flaw if they agree to accept a bug bounty – something Jayapaul said he was not on board with.

In the first scenario, Shared Location, video and audio messages can leak even after the messages have been timed to self-destruct on both the sender’s and recipient’s device, he wrote. In the second scenario, these same messages can leak without a recipient even opening or deleting the message.

However, while Telegram fixed the issue creating the first scenario, the company declined to fix the second. Because of this, the Trustwave researcher declined the bug bounty from Telegram, as it “would have kept us from disclosing this research to the community,” Jayapaul wrote.

“We feel bug bounties that require permanent silence about a vulnerability do not help the broader community to improve their security practices and can serve to raise questions about what exactly the bug bounty is compensating the individual for – reporting a vulnerability to the bounty payer or their silence to the broader community,” he said. “This is especially serious in this case, where one of the issues reported went unaddressed.”

How It Can Be Exploited

Jayapaul discovered the flaw in macOS Telegram version 7.5, where any shared location, audio, video or documents sent via the app are stored in the Telegram cache in the following path: “/Users/Admin/Library/Group Containers/XXXXXXX.ru.keepcoder.Telegram/appstore/account-1271742300XXXXXX/postbox/media”.

Telegram stores the Secret-Chat in this directory with the prefix “secret-file-xxxxxx”. “By default, any media files, except attachments, sent to Telegram are downloaded to the above cache folder,” he explained in the post. “Shared locations are stored as a picture.”

In his disclosure, Jayapaul outlined in detail how the flaw can be exploited in the two scenarios – one that violates the privacy of both the sender and recipient of the messages or locations, the other in which just the sender is affected.

In the first scenario, someone sends a voice recording, video message or image, or shares his or her location, and then enables the “self-destruct” feature. Once the recipient reads the message, it does indeed get deleted according to how the feature works. “However, the files are still stored locally inside the cache folder available for recovery,” Jayapaul said.

The second scenario depends upon the recipient of the message going into the cache folder to grab the file that’s set to self-destruct, or deletes the messages without reading them within the Telegram app. Either way, the sender won’t know whether the message was read, and the recipient “will retain a permanent copy of the media,” according to the post.

Telegram’s Response and Disclosure

When Jayapaul contacted Telegram, the company quickly responded to fix the vulnerability in the first scenario, in which “any chats/media can be recovered from the cache even after they are supposedly self-deleted after opening the message in the app,” he wrote. While the initial fix didn’t apply to Shared Locations initially, the company eventually published a fix for this as well, he said.