UPDATED 22:57 EDT / OCTOBER 01 2018

INFRA

Telegram desktop apps discovered to be leaking user IP addresses

Messaging app Telegram has long been favored for its security, including encryption deployed as standard. But a recently discovered flaw in desktop versions of Telegram has been found to be exposing IP addresses.

Discovered by security researcher Dhiraj Mishra, the flaw in the Windows app and Telegram Desktop app exposes and records the IP address of a user taking a call, with the data stored in the Telegram console logs. The problem is that by default Telegram forces users to both use peer-to-peer for calls and for recording the IP address of each connection.

“Telegram is supposedly a secure messaging application, but it forces clients to only use P2P connection while initiating a call, however, this setting can also be changed from ‘Settings > Privacy and security > Calls > peer-to-peer’ to other available options,” Mishra said in a blog post Saturday. “The tdesktop and Telegram for Windows breaks this trust by leaking public/private IP address of end user and there was no such option available yet for setting ‘P2P > nobody’ in tdesktop and Telegram for Windows.”

Where the so-called feature becomes confusing is not that Telegram records the IP address but the Windows and Desktop apps do so without the ability to turn the feature off. Other versions of the Telegram clients such as those on macOS, iOS and Android also record the IP address but support the ability to turn the feature off.

Telegram responded quickly, not only rewarding Mishra a payment for discovering the bug but also pushing out a new version of the apps. Users who are concerned about privacy are encouraged to download the new version and also opt to disable P2P calling so as to avoid exposure of their IP address.

Image: Dhiraj Mishra

A message from John Furrier, co-founder of SiliconANGLE:

Support our open free content by sharing and engaging with our content and community.

Join theCUBE Alumni Trust Network

Where Technology Leaders Connect, Share Intelligence & Create Opportunities

11.4k+  
CUBE Alumni Network
C-level and Technical
Domain Experts
15M+ 
theCUBE
Viewers
Connect with 11,413+ industry leaders from our network of tech and business leaders forming a unique trusted network effect.

SiliconANGLE Media is a recognized leader in digital media innovation serving innovative audiences and brands, bringing together cutting-edge technology, influential content, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — such as those established in Silicon Valley and the New York Stock Exchange (NYSE) — SiliconANGLE Media operates at the intersection of media, technology, and AI. .

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a powerful ecosystem of industry-leading digital media brands, with a reach of 15+ million elite tech professionals. The company’s new, proprietary theCUBE AI Video cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.