Security researchers have found a vulnerability that may allow attackers to send massive messages on Telegram
Security researchers have devised a method to send massive messages on Telegram. Experts have found a flaw that allows them to send messages of any size, as demonstrated in the proof-of-concept provided by the researchers.
Iranian researcher Sad Ghaf who discovered the issue explained that the vulnerability is the result of a coding error. He added that over 20 million Iranians use the popular Telegram instant messaging app.
In order to prevent abuses, Telegram implemented a limitation in the request rate to prevent users from sending massive text messages in a short period of time. Such features and end-to-end encryption made Telegram a privileged tool for terrorist propaganda.
“Telegram limits request rate to bar malicious users from sending a lot of messages in a short period of time. We noticed that there is also a limitation for minimum and maximum size of the text messages. The minimum limit is 1 character (1 byte) and the maximum limit is 4096,” wrote Ghaf. “Due to a programming error in the implementation of this section, sender can get control on the size of messages and send them with arbitrary length. On the other side victim would receive all incoming messages even if they are too long,” wrote Ghaf.
Ghaf explained he did not pinpoint the flaw in a bid to prevent others exploiting it, and says he could not find a way to report the flaw to Telegram.
Ghaf and his team were able to send a message with 30000 bytes, much more than the permitted 4096 bytes.
You can see the PoC messages in the Telegram channel: @poc_sadghaf that includes the 30000 bytes long text.
Experts explained that the vulnerability is critical because an attacker can send multi-million-character long strings to victims causing bandwidth consumption and, in some cases, crashing the recipient’s device.
“Assuming that each ASCII character is one byte long, an attacker can send multi-million-character long strings to victims (or just a null message to be funny!) and the victim would receive the message without taking a scratch!? It’s like downloading a large file without accepting to receive it (Like being an actual server)!” Ghaf explained.
“During the test process we noticed two alarming outcomes:
1-A lot of bandwidth was being taken.
Considering that by default Telegram uses mobile data (If other networks are not being used) it can be really harmful for the receiver.
2-The device crashes or just stop working due to lack of space (or memory).”
(Security Affairs – Telegram, Hacking)
Share On
