Read on Twitter
🚨 A new vulnerability found in Telegram that can grant access to your camera and microphone.
Found by an engineer at Google, reported to Telegram and they haven't addressed it.
So now we get a detailed public disclosure!
How this works and what it means for your privacy 👇
Found by an engineer at Google, reported to Telegram and they haven't addressed it.
So now we get a detailed public disclosure!
How this works and what it means for your privacy 👇
Even macOS Root users can't access the microphone or screen recording unless the app has direct user consent or manually granted permissions.
But this newly discovered weakness in Telegram's macOS application can sidestep that security measure.
But this newly discovered weakness in Telegram's macOS application can sidestep that security measure.
The weakness was discovered in February, and despite attempts to alert Telegram's security team, the issue remains unresolved.
The vulnerability was publicly disclosed today after the grace period with VINCE expired.
The vulnerability was publicly disclosed today after the grace period with VINCE expired.
The weakness involves macOS's Transparency, Consent, and Control (TCC) mechanism.
This mechanism manages access to "privacy-protected" areas in macOS, which Telegram's vulnerability can exploit.
This mechanism manages access to "privacy-protected" areas in macOS, which Telegram's vulnerability can exploit.
What makes an application like Telegram susceptible to this? It comes down to Entitlements and Hardened Runtime.
Entitlements are permissions given to a binary to obtain certain privileges like accessing the microphone. Hardened Runtime prevents certain types of exploits.
Entitlements are permissions given to a binary to obtain certain privileges like accessing the microphone. Hardened Runtime prevents certain types of exploits.
iOS requires an app to be signed with Hardened Runtime entitlement to be uploaded to the App Store
macOS doesn't have this requirement
This loophole can potentially leave macOS apps more vulnerable.
macOS doesn't have this requirement
This loophole can potentially leave macOS apps more vulnerable.
DYLD_INSERT_LIBRARIES, an environment variable, is instrumental here.
It contains a list of libraries that load before an application starts up
In Telegram's case, it allowed a dylib injection because it was not defined as "Hardened Runtime"
It contains a list of libraries that load before an application starts up
In Telegram's case, it allowed a dylib injection because it was not defined as "Hardened Runtime"
To demonstrate, the researchers created a dylib in Objective-C that captures video from the camera and saves the recording to a file
It was successfully loaded into the Telegram app, bypassing the hardened runtime restrictions
It was successfully loaded into the Telegram app, bypassing the hardened runtime restrictions
However, when trying to inject the dylib into Telegram, the Terminal app tried to access the video instead of Telegram due to Sandbox restrictions
The researchers had to bypass the Terminal's Sandbox using LaunchAgents to successfully load the dylib into Telegram
The researchers had to bypass the Terminal's Sandbox using LaunchAgents to successfully load the dylib into Telegram
The result? A successful Dylib injection that was able to use the permissions granted to Telegram to record the user.
This effectively bypasses Apple's privacy mechanisms, raising security concerns.
This effectively bypasses Apple's privacy mechanisms, raising security concerns.
Thanks @danrevah for the awesome research and write up.
To read the whole thing check out Dan's blog:
danrevah.github.io/2023/05/15/CVE…
Stay safe out there!
To read the whole thing check out Dan's blog:
danrevah.github.io/2023/05/15/CVE…
Stay safe out there!
• • •
Missing some Tweet in this thread? You can try to
force a refresh
