The most absurd thing about crypto: everyone talks about decentralization, but their wallets, signal groups, trading bots, and airdrop tasks are all crammed into one Telegram.
At OffensiveCon Tokyo the other day, researcher Saifeldeen Aziz talked about a Telegram 0-click vulnerability. The issue is in the rlottie library, which renders animated stickers: combine a memory vulnerability with a validation bypass, he says, and you can achieve code execution on iOS. “0-click” means you don’t have to tap anything—just having the sticker land in the chat is enough.
Telegram’s position is that its servers validate stickers, so the attack can be stopped. The researcher was challenging that claim right there. The full details and patches aren’t all out yet, so I’m not going to take a side on exactly how far the attack can go.
But I don’t care who wins the argument. If you’ve got a bot wallet connected to TG on your phone, have imported your private key into some trading bot, and strangers are constantly dropping stickers in your groups, that setup is absurd to begin with. People don’t get robbed because a vulnerability is so sophisticated; it’s because they keep their entire net worth in an app where anyone can message them.
My approach is pretty basic: turn off automatic downloads in TG, turn off DMs from strangers, keep the app updated, and don’t use any TG bots with my main funds. Big money stays in cold storage; I use TG just to chat.
#Telegram #Security
At OffensiveCon Tokyo the other day, researcher Saifeldeen Aziz talked about a Telegram 0-click vulnerability. The issue is in the rlottie library, which renders animated stickers: combine a memory vulnerability with a validation bypass, he says, and you can achieve code execution on iOS. “0-click” means you don’t have to tap anything—just having the sticker land in the chat is enough.
Telegram’s position is that its servers validate stickers, so the attack can be stopped. The researcher was challenging that claim right there. The full details and patches aren’t all out yet, so I’m not going to take a side on exactly how far the attack can go.
But I don’t care who wins the argument. If you’ve got a bot wallet connected to TG on your phone, have imported your private key into some trading bot, and strangers are constantly dropping stickers in your groups, that setup is absurd to begin with. People don’t get robbed because a vulnerability is so sophisticated; it’s because they keep their entire net worth in an app where anyone can message them.
My approach is pretty basic: turn off automatic downloads in TG, turn off DMs from strangers, keep the app updated, and don’t use any TG bots with my main funds. Big money stays in cold storage; I use TG just to chat.
#Telegram #Security