Telegram Triangulation Pinpoints Users’ Exact Locations
Reading Time: 1 Minute
style=”display:block” data-ad-client=”ca-pub-6620833063853657″ data-ad-slot=”8337846400″ data-ad-format=”auto” data-full-width-responsive=”true”>
The feature lists exactly how far people are from one’s location (1.3 miles and so on). This isn’t an issue as long as that number remains a radius. But it’s possible to spoof one’s location for three different points, and then use the resulting three distances to precisely pinpoint where a target is, the researcher found.
Courtesy: Ahmed’s Notes.
To spoof a GPS location, an adversary has various options, but the easiest method, Hassan noted in a Monday blog, is to “just walk around the area, collect the GPS latitude and longitude of yourself, and how far the target person is from you (super easy).”
Another option is to use a GPS-spoofing app.
“There is an app in the [Google Play] store called GPS spoof; download it and install it,” he noted. “After [that]…spoof the location near the user within a seven-mile radius limit. That’s the limit Telegram has in place…then collect how far that person is from that point. Repeat three times.”
Armed with the three locations, an attacker can then open Google Earth Pro, plug in the spoofed locations, and use a ruler to find the middle point between the three.
See Also: Offensive Security Tools: FireEye Red Team Tool Countermeasures
style=”display:block” data-ad-client=”ca-pub-6620833063853657″ data-ad-slot=”8337846400″ data-ad-format=”auto” data-full-width-responsive=”true”>
“The intersection of the three circles is the location of the user,” Hassan explained. “To verify this, I added one of the users and asked them if they live near the point. I was able to get that user’s exact home address.”
For Telegram’s part, the company said it doesn’t regard the issue as a bug, and declined Hassan’s security report.
Triangulation. Courtesy: Ahmed’s Notes.
“Users in the People Nearby section intentionally share their location, and this feature is disabled by default,” was Telegram’s response, according to the researcher. “It’s expected that determining the exact location is possible under certain conditions. Unfortunately, this case is not covered by our bug-bounty program.”
style=”display:block” data-ad-client=”ca-pub-6620833063853657″ data-ad-slot=”8337846400″ data-ad-format=”auto” data-full-width-responsive=”true”>
See Also: Steganography – How images can hide secret messages in plain sight
To fix it, the company could round user locations to the nearest mile “and add a static random noise,” Hassan said. “Tinder had the same issue and they fixed it by creating buckets.”
Telegram did not immediately return a request for comment.
Source: threatpost.com
(Click Link)
Offensive Security & Ethical Hacking Course
Begin the learning curve of hacking now!
Information Security Solutions
Find out how Pentesting Services can help you.
