Telegram Mobile Apps May Expose IP Address via Quick Proxy Setup Links
A security researcher discovered that Telegram's mobile apps do not warn users about potential IP exposure when clicking quick proxy setup links. While not a major danger for average users, this is undesirable for those concerned about being surveilled.
The Core Issue
Typically, clicking an external link or unsafe file triggers a warning pop-up. However, clicking a quick proxy setup link is handled differently: the app immediately attempts to connect to the server to check its availability, bypassing the warning entirely.
An attacker can disguise such a link as a username or another hyperlink. The moment it is clicked, the app sends a request to the server controlled by the attacker, thereby revealing the user's IP address.
• The issue affects only Android and iOS clients.
• The @tginfo team independently confirmed that Telegram Desktop, macOS, Telegram X, and Web versions handle these links safely and do not automatically connect to proxy servers.
The Risk is Low
It is important to note that for most users, this problem is not critical. An IP address usually only reveals an approximate location (city level), and many users have dynamic IPs.
Similar flaws, such as EvilLoader, have been fixed by the Telegram team in the past. We believe developers may disable the automatic check for proxies opened from formatted links in upcoming updates.
For those whom IP privacy is critical, we recommend using a system-wide VPN. This is the only reliable way to prevent IP leaks across apps.
#security
A security researcher discovered that Telegram's mobile apps do not warn users about potential IP exposure when clicking quick proxy setup links. While not a major danger for average users, this is undesirable for those concerned about being surveilled.
The Core Issue
Typically, clicking an external link or unsafe file triggers a warning pop-up. However, clicking a quick proxy setup link is handled differently: the app immediately attempts to connect to the server to check its availability, bypassing the warning entirely.
An attacker can disguise such a link as a username or another hyperlink. The moment it is clicked, the app sends a request to the server controlled by the attacker, thereby revealing the user's IP address.
• The issue affects only Android and iOS clients.
• The @tginfo team independently confirmed that Telegram Desktop, macOS, Telegram X, and Web versions handle these links safely and do not automatically connect to proxy servers.
The Risk is Low
It is important to note that for most users, this problem is not critical. An IP address usually only reveals an approximate location (city level), and many users have dynamic IPs.
Similar flaws, such as EvilLoader, have been fixed by the Telegram team in the past. We believe developers may disable the automatic check for proxies opened from formatted links in upcoming updates.
For those whom IP privacy is critical, we recommend using a system-wide VPN. This is the only reliable way to prevent IP leaks across apps.
#security
👍47😡21❤13🤡13🌚4💔4😱3🤯2🐳2👎1
Telegram Is Working on Experimental WEB-Proxy
A new experimental proxy type titled “WEB” was found in Telegram Desktop's code. The discovery was publicized by teleLakel.
The server code for the WEB-proxy is still under development, and Telegram hasn't endorsed any implementations yet, so there is no good way to try the technology at the moment.
Why is this necessary, and why not just use MTProxy?
The already existing MTProxy can also mask to appear as HTTPS traffic using the FakeTLS extension. However, modern Deep Packet Inspection systems (DPI) can already tell such connections apart, since FakeTLS still has some differences from real HTTPS traffic that can be seen from the outside.
The new WEB transport makes detection much harder: to talk to the server, the messenger uses the built-in browser (WebView). It establishes a real TLS/HTTPS connection using standard browser cryptography, which makes Telegram traffic less different from regular web surfing.
The independent Telemt community is working on detection-resistant protocols. Earlier, thanks to the community's research into Russian DPIs, Telegram developers updated the MTProxy in their clients to adapt them to new detection methods.
The community notes that the messenger should spend more time developing new censorship-resistance methods. If the messenger doesn't keep improving the new WEB proxy, it might stop working in the future — typical Telegram traffic may have uniquely identifying properties even inside a real TLS connection if additional masking methods are not used on it.
#Desktop #proxy #bans
A new experimental proxy type titled “WEB” was found in Telegram Desktop's code. The discovery was publicized by teleLakel.
The server code for the WEB-proxy is still under development, and Telegram hasn't endorsed any implementations yet, so there is no good way to try the technology at the moment.
Why is this necessary, and why not just use MTProxy?
The already existing MTProxy can also mask to appear as HTTPS traffic using the FakeTLS extension. However, modern Deep Packet Inspection systems (DPI) can already tell such connections apart, since FakeTLS still has some differences from real HTTPS traffic that can be seen from the outside.
The new WEB transport makes detection much harder: to talk to the server, the messenger uses the built-in browser (WebView). It establishes a real TLS/HTTPS connection using standard browser cryptography, which makes Telegram traffic less different from regular web surfing.
How does it work
• The messenger opens a special page on the proxy server domain using a hidden browser
• This domain can also continue to work as a regular website. The hidden Telegram channel only activates if the request contains the correct secret key.
• Inside the unitary web channel, the encrypted MTProxy traffic is enveloped into WEB-proxy frames and sent to the proxy server. Currently, this is done using WebSocket.
• HTTP/WebSocket traffic is repackaged and relayed to the MTProxy server without being decrypted.
Currently, the feature is under active development, so by the time it gets released, the protocol may change.
The independent Telemt community is working on detection-resistant protocols. Earlier, thanks to the community's research into Russian DPIs, Telegram developers updated the MTProxy in their clients to adapt them to new detection methods.
The community notes that the messenger should spend more time developing new censorship-resistance methods. If the messenger doesn't keep improving the new WEB proxy, it might stop working in the future — typical Telegram traffic may have uniquely identifying properties even inside a real TLS connection if additional masking methods are not used on it.
#Desktop #proxy #bans
❤41👍20🤡4