Cybersecurity researchers are warning of a vulnerability in Telegram that allows attackers to obtain the real IP addresses of Android and iOS users, even when using a built-in proxy. The vulnerability can be triggered by just one click on what at first glance seems like a normal mention of a username in a chat.
Cybersecurity researchers are warning of a vulnerability in Telegram that allows attackers to obtain the real IP addresses of Android and iOS users, even when using a built-in proxy. The vulnerability can be triggered by just one click on what at first glance seems like a normal mention of a username in a chat.
Telegram has a built-in MTProxy tool that allows users to bypass internet censorship in countries where access to the messenger is restricted. This helps hide the user's IP address and also mask their traffic.
However, security researchers warn that hackers can abuse this feature themselves to leak users' IP addresses. Attackers can set up a fake Telegram MTProxy server and create a link to it, CyberNews writes .
If a user clicks on such a link shared in groups, channels or chats, the Telegram app will connect to a fake proxy using a real IP address. Researchers warn that attackers can make such links visually similar to regular usernames.
The problem is that Telegram first tries to test the proxy server and connects to it using the user's real internet connection.
The vulnerability was described in detail by a security researcher who goes by the name Saurabh on LinkedIn. The proof-of-concept code is now publicly available on GitHub .
"When a Telegram user clicks on a link like tg://proxy, the client attempts to establish a connection to the specified proxy server before any configured proxy settings are applied. This connection is initiated through the device's real network interface, which exposes the public IP address," the researcher explains.
