Scenario 1: Audio, Video, Attachments, Shared Location leaks even after self-destructing on both devicesīob sends a media message to Alice (again, whether voice recordings, video messages, images, or location sharing). Shared locations are stored as a picture. The Secret-Chat files are stored in this directory with the prefix “secret-file-xxxxxx” Root Cause:īy default, any media files, except attachments, sent to Telegram are downloaded to the above cache folder. Users/Admin/Library/Group Containers/.keepcoder.Telegram/appstore/account-1271742300XXXXXX/postbox/media Any shared location, audio, video, or documents that are sent in Telegram are stored in the Telegram cache in this path: The bug is present in macOS Telegram version 7.5. The findings are focused only on Secret-Chat with Self-Destruct Chat settings below is the POC video: One can retrieve audio, video messages, shared locations, and files even after the self-destruct feature works on both devices. I have identified the privacy flaws in Telegram's self-destruct chats. Self-Destruct Chats are timer-based the messages are automatically deleted after the timer is set up by any of the users, which means any chats, files will be deleted, leaving no traces behind on both devices this feature is highly focused on the privacy of the users This model can be extended using an additional feature included with the Secret-Chats called Self-Destruct Chats. The algorithm also allows for the circumstance where if person ‘A’ deletes the messages in a chat, then the messages will also be deleted from person ‘B’’s device. You can then compare this image with the one your friend has - if the two images are the same, you can be sure that the secret chat is secure, and no man-in-the-middle attack can succeed.”
After the secure end-to-end connection has been established, we generate a picture that visualizes the encryption key for your chat. “When a secret chat is created, the participating devices exchange encryption keys using the so-called Diffie-Hellman key exchange. The messages can be read only by sender and receiver, and not even Telegram administrators have the encryption keys necessary to read any chats.
Secret-Chats in Telegram use end-to-end encryption, which is meant for people who are concerned about the security and privacy of their chat history.
0 kommentar(er)
