Vulnerabilities found in Telegram’s cloud chats, platform says issues fixed

E2EE offers users protection from man-in-the-middle attacks, where an attacker places themselves between the sender or receiver of a message and the cloud server that routes that message. Notably, E2EE ensures that even a service provider like WhatsApp or Telegram won’t be able to read messages that users send, which also means that they cannot provide the content of those messages to governments, law enforcement agencies and more.

On the other hand, Telegram uses a protocol called MTProto to secure its cloud chats, which is the company’s own version of Transport Layer Security (TLS), a popular cryptographic standard meant to ensure security of data in transit. Notably, while TLS also protects against MITM attacks to an extent, it doesn’t stop the servers held by companies like Telegram etc. from reading these texts when needed. In comparison, E2EE ensures that only the sender and receiver of a message can read it.

According to the researchers, Telegram’s cloud chats have a flaw where an “adversary on the network” can “reorder” messages. For instance, if a user sends messages saying ‘I say yes to’, ‘all the pizza’; and ‘I say no to’, ‘all of the crimes’, the attacker can reorder them to say I say yes to crime and I say no to all the pizza. While the researchers said they didn’t know of examples where this vulnerability was exploited, they noted that it can be used by an attacker to manipulate Telegram bots. Cloud chats on the platform are also used to control several automated bots, and such reordering can allow attackers to manipulate how these bots work.

Further, the researchers found code in the Android, iOS and desktop versions of Telegram, which could allow attackers to extract plaintext from encrypted messages. While they warned that such an attack can be devastating for the platform and its users, it would also require a significant amount of work from the attacker. That simply means that such an attack will be carried out by a significantly motivated attacker, like nation-state backed hacker groups.

This, along with two other flaws, have all been fixed by Telegram, the platform said in a blog post on July 16. “The latest versions of official Telegram apps already contain the changes that make the four observations made by the researchers no longer relevant,” the platform wrote. The researchers had communicated the vulnerabilities to the platform before publishing the paper, allowing Telegram to fix the issues.

Interestingly, while Telegram claimed that the vulnerabilities didn’t allow attackers to decipher text messages, that may not be completely true. The researchers noted that one of the flaws allowed an MITM attack which would allow an attacker to “impersonate” Telegram’s servers and hence “break both the confidentiality and integrity of communication.