What the hell am I reading? (was: Telegram authentication bypass)

[Munchausen <munchausen () riseup net>]

You folks didn't happen to hire a guy named Nicholas Lemonias, by any
chance, did you?

> Telegram authentication mechanism may be circumvented, since there is
> no way to verify the legitimacy of Telegram’s public keys and thus if
> the client is communicating with a legitimate server.

You don't seem to understand the difference between authentication
bypass and man-in-the-middle scenarios.

> This may allow an attacker leveraging this issue (e.g. by
> distributing a slightly modified client) to obtain almost full
> control of the victim's account. Further, the behavior of the
> victim’s client is exactly the same than the behavior of a legitimate
> client.

Why, yes, of course if you can install a trojanized client it can
connect to a different server that you own. It can also connect to the
proper server and forward all messages in the background. Or collect all
credit card numbers and send them by email. It's a trojan, you can do
anything. How is this a vulnerability in Telegram?

> 2014.03.07 - Initial contact with Telegram security team.
> 2014.03.10 - Telegram response informing that this issue is out of their
> security model.
> 2014.03.11 - Submission of PoC to Telegram security team.
> 2014.04.28 - Publication of research results.

*FACEPALM*

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/