8 ms·

> Telegram has a RCE 0day Can you provide more context about this, or somewhere I can read about this please? Very curious.

DyslexicAtheist 8y ago
can't sorry, and there are no public discussions on this (for now)
- AnaniasAnanas 8y ago
  Please consider disclosing the issue responsibly by releasing it to the public. Keeping it secret and only telling a select few gives the ability to the said few (which may include Telegram itself) to use the vulnerability maliciously. In addition even if you have disclosed the issue to the Telegram team and Telegram has fixed said vulnerability the same may not be said for any forks of it whose maintainers are not aware of the issue.
  - DyslexicAtheist 8y ago
    > and only telling a select few gives the ability If more than 1 person knows something it's no longer a secret. Likewise if 2 people know about the existence of a 0day it's no longer a 0day. ... Why should I burn a 0day? Who will pay me for it? I'm not stupid and I don't participate in the responsible disclosure circle jerk. TG is snakeoil: If you use it for anything more serious than hiding an affair from your spouse high chance you get burnt. Especially wanna be terrorists ought to stay clear. TG is one giant weird machine: You'll notice quickly if you play with it. There very likely many 0days in TG and for sure LE has access to it too. So finding something isn't even a statistical outlier. People who think that responsible disclosure must be practiced are just parroting the corporate bullshit. Bug bounties hunters are the Uber drivers of InfoSec. Poor fuckers that are pressed into a system that only benefits the corporate overlords. How about starting with responsible QA instead of moving fast & breaking things?
    - dijit 8y ago
      Sorry to call you out, we should always assume good faith from HN commenters but I must say that this is childish behaviour. Either it's pertinent information to be entered into the public record as part of your comment, or it's not. If it's pertinent information you don't get to say "trust me", you have the responsibility to provide information. If you cannot do that, then do not say it. You will not convince me with mealy mouthed weasel words. -- On a more personal note: this comment sounds like the kind of thing I would see on skiddie hacker forums 15 years ago. Please conduct yourself better.
      - DyslexicAtheist 8y ago
        Engage much in SJW'ism Jane? Enjoy telling others what to do? Seriously, you are free to ignore what I say here. My comments aren't meant as statements for future generations. I'm not that important and you shouldn't take yourself as that important either. I couldn't care less what people think is my responsibility. It's my view and I don't give a fuck if it's a shared view or not. In fact in these days if society shares my view readily high chances I'm probably doing something wrong. Please speak for yourself Jane, and don't impress your small minded personal world view on others.
        dijit 8y ago
        My goodness. You’re so intimidating. Perhaps you should go back to school instead of impressing upon other for how cool you are “doxxing” them. FWIW you didn’t dig deep enough. I am not a Jane.
        DyslexicAtheist 8y ago
        sorry you feel this way. it's hardly doxxing though if you have your name in your profile is it? you're the one using veiled insults and calling me a mealy weasel mouth. And using language like "sorry for calling you out" ... Don't say "sorry" and then launch your veiled attack in the same paragraph. > Perhaps you should go back to school is that where you got your world view from?
- dijit 8y ago
  Given that it was mentioned off-hand and you’re unable (or unwilling) to give more information, why would I consider this anything other than FUD? Please substantiate your claim or don’t make it.
  - DyslexicAtheist 8y ago
    it's really not my job to take into account what you consider ... take it or leave it. I couldn't care. Feel free to call it FUD too. Your expectation is of no value to me. Also you sound pretty fucking entitled. I know it's a general problem with your generation so I won't blame you for it. for the record a 0day is an undisclosed vuln and if you exercise google just a little bit you'd know that there are plenty. how else would you explain the many arrests being made by wanna-be terrorists on that platform?
- hau 8y ago
  You can't use some claim as an argument and then deny any discussion of it. Especially when your claim is extraordinary.
  - DyslexicAtheist 8y ago
    my claim is hardly extraordinary, sorry. I don't deny any discussion, how could I ... I'm not a fascist. Feel free to discuss till you're blue by all means. but don't expect me to participate in the responsible disclosure circle-jerk.
- sschueller 8y ago
  Who are you and why are you spreading this fud? Everytime instant messaging gets talked about here someone has to bring up how unsecure telegram is. Like someone doesn't want people to use telegram... Unless you can show me a proof of concept, stop already.
  - DyslexicAtheist 8y ago
    > why are you spreading this fud? a bit rich from a dweeb that retweets Wikileaks conspiracy theories don't you think?
    - krageon 8y ago
      This is against the guidelines of HN: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
igoose1 8y ago
I'm not about not RCE 0day but here's some information about Telegram's security problems: https://gitlab.com/edu4rdshl/blog/raw/master/why-telegram-is-insecure.md https://gitlab.com/edu4rdshl/blog/raw/master/why-telegram-is...
- gsich 8y ago
  That seems like old Mtproto.
- eps 8y ago
  That's from several years ago.
  - DyslexicAtheist 8y ago
    May 2017 isn't that long ago. "However, our survey shows that Telegram has had serious and simple issues in the protocol (e.g. modified buggy Diffie-Hellman key exchange) that any knowledgeable security expert could penetrate. By using the command line interface of Telegram we have been able to snoop on some of our friends and detect the times when they were conversing to each other. We believe that this is a serious privacy issue, because it can be exploited to detect relationships in classroom for example." see https://courses.csail.mit.edu/6.857/2017/project/19.pdf https://courses.csail.mit.edu/6.857/2017/project/19.pdf
    - eps 8y ago
      You are switching the subject. This has nothing to do with the security of the protocol.

DyslexicAtheist 8y ago

can't sorry, and there are no public discussions on this (for now)

AnaniasAnanas 8y ago
Please consider disclosing the issue responsibly by releasing it to the public. Keeping it secret and only telling a select few gives the ability to the said few (which may include Telegram itself) to use the vulnerability maliciously. In addition even if you have disclosed the issue to the Telegram team and Telegram has fixed said vulnerability the same may not be said for any forks of it whose maintainers are not aware of the issue.
- DyslexicAtheist 8y ago
  > and only telling a select few gives the ability If more than 1 person knows something it's no longer a secret. Likewise if 2 people know about the existence of a 0day it's no longer a 0day. ... Why should I burn a 0day? Who will pay me for it? I'm not stupid and I don't participate in the responsible disclosure circle jerk. TG is snakeoil: If you use it for anything more serious than hiding an affair from your spouse high chance you get burnt. Especially wanna be terrorists ought to stay clear. TG is one giant weird machine: You'll notice quickly if you play with it. There very likely many 0days in TG and for sure LE has access to it too. So finding something isn't even a statistical outlier. People who think that responsible disclosure must be practiced are just parroting the corporate bullshit. Bug bounties hunters are the Uber drivers of InfoSec. Poor fuckers that are pressed into a system that only benefits the corporate overlords. How about starting with responsible QA instead of moving fast & breaking things?
  - dijit 8y ago
    Sorry to call you out, we should always assume good faith from HN commenters but I must say that this is childish behaviour. Either it's pertinent information to be entered into the public record as part of your comment, or it's not. If it's pertinent information you don't get to say "trust me", you have the responsibility to provide information. If you cannot do that, then do not say it. You will not convince me with mealy mouthed weasel words. -- On a more personal note: this comment sounds like the kind of thing I would see on skiddie hacker forums 15 years ago. Please conduct yourself better.
    - DyslexicAtheist 8y ago
      Engage much in SJW'ism Jane? Enjoy telling others what to do? Seriously, you are free to ignore what I say here. My comments aren't meant as statements for future generations. I'm not that important and you shouldn't take yourself as that important either. I couldn't care less what people think is my responsibility. It's my view and I don't give a fuck if it's a shared view or not. In fact in these days if society shares my view readily high chances I'm probably doing something wrong. Please speak for yourself Jane, and don't impress your small minded personal world view on others.
      - dijit 8y ago
        My goodness. You’re so intimidating. Perhaps you should go back to school instead of impressing upon other for how cool you are “doxxing” them. FWIW you didn’t dig deep enough. I am not a Jane.
        DyslexicAtheist 8y ago
        sorry you feel this way. it's hardly doxxing though if you have your name in your profile is it? you're the one using veiled insults and calling me a mealy weasel mouth. And using language like "sorry for calling you out" ... Don't say "sorry" and then launch your veiled attack in the same paragraph. > Perhaps you should go back to school is that where you got your world view from?
dijit 8y ago
Given that it was mentioned off-hand and you’re unable (or unwilling) to give more information, why would I consider this anything other than FUD? Please substantiate your claim or don’t make it.
- DyslexicAtheist 8y ago
  it's really not my job to take into account what you consider ... take it or leave it. I couldn't care. Feel free to call it FUD too. Your expectation is of no value to me. Also you sound pretty fucking entitled. I know it's a general problem with your generation so I won't blame you for it. for the record a 0day is an undisclosed vuln and if you exercise google just a little bit you'd know that there are plenty. how else would you explain the many arrests being made by wanna-be terrorists on that platform?
hau 8y ago
You can't use some claim as an argument and then deny any discussion of it. Especially when your claim is extraordinary.
- DyslexicAtheist 8y ago
  my claim is hardly extraordinary, sorry. I don't deny any discussion, how could I ... I'm not a fascist. Feel free to discuss till you're blue by all means. but don't expect me to participate in the responsible disclosure circle-jerk.
sschueller 8y ago
Who are you and why are you spreading this fud? Everytime instant messaging gets talked about here someone has to bring up how unsecure telegram is. Like someone doesn't want people to use telegram... Unless you can show me a proof of concept, stop already.
- DyslexicAtheist 8y ago
  > why are you spreading this fud? a bit rich from a dweeb that retweets Wikileaks conspiracy theories don't you think?
  - krageon 8y ago
    This is against the guidelines of HN: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

igoose1 8y ago

I'm not about not RCE 0day but here's some information about Telegram's security problems: https://gitlab.com/edu4rdshl/blog/raw/master/why-telegram-is-insecure.md https://gitlab.com/edu4rdshl/blog/raw/master/why-telegram-is...

gsich 8y ago
That seems like old Mtproto.
eps 8y ago
That's from several years ago.
- DyslexicAtheist 8y ago
  May 2017 isn't that long ago. "However, our survey shows that Telegram has had serious and simple issues in the protocol (e.g. modified buggy Diffie-Hellman key exchange) that any knowledgeable security expert could penetrate. By using the command line interface of Telegram we have been able to snoop on some of our friends and detect the times when they were conversing to each other. We believe that this is a serious privacy issue, because it can be exploited to detect relationships in classroom for example." see https://courses.csail.mit.edu/6.857/2017/project/19.pdf https://courses.csail.mit.edu/6.857/2017/project/19.pdf
  - eps 8y ago
    You are switching the subject. This has nothing to do with the security of the protocol.