A vulnerability was found in Telegram that allowed third-party applications to be launched via messages. Could it have caused a wave of account hacks, even with two-factor authentication?

Experts from V12 have published a video showing how to force an Android smartphone to launch a third-party application via Telegram. In the video, the user opens a chat with a bot and presses the Start Bot button. After that, an interactive message with a countdown appears. When the time runs out, a calculator opens on the phone.

So this feature allowed you to run code on other people's devices. After the demonstration was published, the Telegram team responded .

"This issue in Telegram for Android was fixed yesterday, and today the fix was rolled out to all users," the developers said.

On November 9, Telegram introduced Bot API 10.4, which allowed developers to turn regular messages into small interactive applications. So now bots can send, for example, a small game, an interactive poll, or a product card.

To prevent third-party code from gaining access to other programs and the smartphone system, it is run in an isolated environment — the so-called “sandbox.” It seems that it is in this protection that the problem was found.

How exactly could the vulnerability work?

Telegram's open repository on GitHub describes a fix for a bug in QuickJS, the engine that executes JavaScript code for new interactive messages. The problem was related to memory management. Under certain conditions, the program could access a memory location after the function to which it belonged had completed its work.

Such a bug could breach the sandbox isolation and allow an app to execute commands that it normally wouldn't be allowed to execute, such as running third-party apps on a smartphone, as researchers demonstrated with a calculator.

Could this be the reason why accounts were stolen even with two-factor protection?

Previously, dev.ua wrote about numerous complaints from Ukrainians about Telegram hacks.

In Threads, users reported being suddenly logged out of Messenger on all devices, and some accounts that people had used for years disappeared altogether. Additionally, some victims claimed that they did not open suspicious links and even had two-factor protection enabled.

Theoretically, if attackers were able to exploit the vulnerability to execute code with the privileges of Telegram itself, they could potentially gain access to the data that the messenger uses to maintain an authorized session.

The fact is that after logging in, Telegram uses special cryptographic keys to confirm requests on behalf of the user. If an attacker can steal the necessary credentials of the authorized session and use them, he will not have to go through the usual login procedure with a confirmation code and an additional password.

So even having two-factor authentication enabled wouldn't necessarily save an account from such a scenario. After all, it protects new logins, not prevents an already authorized session from being hijacked.

However, there is currently no evidence that the vulnerability demonstrated by V12 was used for actual account hacks or that it is related to user complaints.

"This is not a crooked spam. This is a well-thought-out scheme." Marketer warns of Telegram phishing targeting birthday people

On the topic

"This is not a crooked spam. This is a well-thought-out scheme." Marketer warns of Telegram phishing targeting birthday people

Fake petitions: a new phishing scheme targeting Telegram users has been detected in Ukraine

On the topic

Fake petitions: a new phishing scheme targeting Telegram users has been detected in Ukraine

Read the country's main IT news in our Telegram

On the topic

Read the country's main IT news in our Telegram