Telegram could expose your passwords and deleted files — what to do now

News
By published

Fortunately, you can easily fix these flaws

The Telegram logo on an iPhone.
(Image credit: NurPhoto / Getty Images)

A hidden flaw in the Telegram secure-messaging service could expose user passwords, a researcher found. The service may also expose media files from self-destructing messages.

Dhiraj Mishra, a security consultant working in Dubai, revealed in a blog post yesterday (Feb. 11) that the Mac desktop client for Telegram indefinitely preserved audio and video files from self-destructing messages. 

He did some more poking around and found that the Mac Telegram client also stored user passwords in plain text. Neither of these security lapses is a good thing. Malware or a crafty intruder could have found both sets of files.

"Telegram fails again in terms of handling the user's data," Mishra wrote in his blog post, sarcastically titled "The 'P' in Telegram Stands for Privacy."

The Mac client appropriately deleted self-destructing messages, Mishra wrote. But if any video or audio files were attached to those messages, those files could still be found buried deep in the Mac's filesystem. Anyone, or anything, that knew where to look could find them.

Passwords were written in plain text in the user's Telegram metadata, where it also could have been found by attackers.

Mishra told Bleeping Computer that he reported the flaws to Telegram in December and received a 3,000-euro bug bounty for his trouble.

Telegram fixed both flaws with the 7.4 update in late January. If you're using Telegram on a Mac, make sure your client software is up-to-date.

Telegram has seen a spike in new users recently, after a privacy-permissions change at WhatsApp prompted an exodus from the Facebook-owned service. 

Many security professionals aren't convinced that Telegram is very safe to use for highly sensitive communications. They instead recommend the Signal service, which uses the same encryption as WhatsApp.

Mishra ended his blog with a clear indication of where he stands on the issue, embedding Elon Musk's now-famous tweet to "Use Signal." (Here's how.)

TOPICS
Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.