Forwarded from Laoself
Telegram新更新：
• Poll新增描述文字，描述、Quiz答案解釋及選項中支援插入圖片及影片
• Poll邏輯重構，允許多選、允許撤回重投、設定正確答案、設定時限變成相互獨立的選項，新增面向用戶打亂選項順序功能
• 支援傳送Live Photo消息，或將Live Photo作為往復播放/循環播放的GIF傳送
• 新增AI文字編輯器，支援使用LLM潤飾文字、轉為特定風格、添加Emoji等功能
• 若干音樂相關優化，如全局檢索支援搜尋Track、新增Shared Audio板塊以及一次傳送多條audio
• Bot API將支援接管用戶授權創建的Bot
• 官方客戶端會在使用第三方Telegram客戶端的user profile添加警告資訊
https://telegram.org/blog/ai-editor-mighty-polls-and-more
• Poll新增描述文字，描述、Quiz答案解釋及選項中支援插入圖片及影片
• Poll邏輯重構，允許多選、允許撤回重投、設定正確答案、設定時限變成相互獨立的選項，新增面向用戶打亂選項順序功能
• 支援傳送Live Photo消息，或將Live Photo作為往復播放/循環播放的GIF傳送
• 新增AI文字編輯器，支援使用LLM潤飾文字、轉為特定風格、添加Emoji等功能
• 若干音樂相關優化，如全局檢索支援搜尋Track、新增Shared Audio板塊以及一次傳送多條audio
• Bot API將支援接管用戶授權創建的Bot
• 官方客戶端會在使用第三方Telegram客戶端的user profile添加警告資訊
https://telegram.org/blog/ai-editor-mighty-polls-and-more
Telegram
AI Editor, Mighty Polls, Live Photos, Bots Managed by Bots, and More
In today's update we introduce an AI Editor that can translate, transform, or fix your text in just two taps, new features for Polls like attaching media and suggesting new responses for active polls, support for Live and Motion Photos in all apps, bots that…
Forwarded from Tech & Leaks Zone
BREAKING: Nekogram is secretly transmitting your telegram account phone number to the developer
According to SOTA,
"The backdoor is hidden in the http://Extra.java file, which differs from the template uploaded to the repository. The obfuscated code sends data as an inline request to the @nekonotificationbot, leaving no trace. The same file implements account 'doxing' via several bots; it is possible that the leaked data is used to populate their databases."
Additionally, the creator of the Nekogram client, (presumably a Chinese national) was previously known for conducting DDoS attacks and unethical online behavior (including death threats against acquaintances).
Apparently, in the early versions of the client, de-anonymization was applied only to Chinese phone numbers, which could have been used for political surveillance;. However, it is now applied to all users.
Follow @TechLeaksZone
According to SOTA,
"The backdoor is hidden in the http://Extra.java file, which differs from the template uploaded to the repository. The obfuscated code sends data as an inline request to the @nekonotificationbot, leaving no trace. The same file implements account 'doxing' via several bots; it is possible that the leaked data is used to populate their databases."
Additionally, the creator of the Nekogram client, (presumably a Chinese national) was previously known for conducting DDoS attacks and unethical online behavior (including death threats against acquaintances).
Apparently, in the early versions of the client, de-anonymization was applied only to Chinese phone numbers, which could have been used for political surveillance;. However, it is now applied to all users.
Follow @TechLeaksZone
Forwarded from Tech & Leaks Zone
EXPOSED: Source Code Evidence of Nekogram Phone Number Harvesting
1. Exfiltration Logic: The function uo5.g() (reconstructed as logNumberPhones) silently collects the UserID and Phone Number of every account logged into the app (up to 8 accounts).
2. Transmission: Data is sent via Inline Queries to the bot @nekonotificationbot. This is done programmatically, so no message appears in your "Sent" history.
3. Target Bots: Three bots embedded in the client's obfuscated code:
@nekonotificationbot: Receives the automated phone number uploads.
@tgdb_search_bot and @usinfobot: : An OSINT bot mentioned in the obfuscated classes.
4. Security Token: The app uses a hardcoded secret key 741ad28818eab17668bc2c70bd419fc25ff56481758a4ac87e7ca164fb6ae1b1 as a prefix for the stolen data, likely to authenticate with the bot's backend.
5. The image shows that Nekogram always wants to get the "reg date".
Unfortunately the Google Play Store version is also affected!!!
Follow @TechLeaksZone
1. Exfiltration Logic: The function uo5.g() (reconstructed as logNumberPhones) silently collects the UserID and Phone Number of every account logged into the app (up to 8 accounts).
2. Transmission: Data is sent via Inline Queries to the bot @nekonotificationbot. This is done programmatically, so no message appears in your "Sent" history.
3. Target Bots: Three bots embedded in the client's obfuscated code:
@nekonotificationbot: Receives the automated phone number uploads.
@tgdb_search_bot and @usinfobot: : An OSINT bot mentioned in the obfuscated classes.
4. Security Token: The app uses a hardcoded secret key 741ad28818eab17668bc2c70bd419fc25ff56481758a4ac87e7ca164fb6ae1b1 as a prefix for the stolen data, likely to authenticate with the bot's backend.
5. The image shows that Nekogram always wants to get the "reg date".
Unfortunately the Google Play Store version is also affected!!!
Follow @TechLeaksZone
Forwarded from TgDB News (TelegramDB)
Nekogram appears to be using the TgDB Search Bot in an automated manner (without our knowledge; this is not a partnership), likely to search for usernames.
However, this is unrelated to their obfuscated scraping of phone numbers; we do not receive any data from Nekogram and are in no way affiliated with them.
However, this is unrelated to their obfuscated scraping of phone numbers; we do not receive any data from Nekogram and are in no way affiliated with them.
Forwarded from rvalue的生草日常
用 Nekogram 的有福了
https://thebadinteger.github.io/nekogram-phone-exfiltration/
https://thebadinteger.github.io/nekogram-phone-exfiltration/
😇1
Forwarded from Nicole ニコール
The telegram scene for the next week is gonna be like "yeah so our slopgram doesn't steal data like goygram, we are a secure fork of ligmagram and have been vetted 69 times by the devs of cringegram which is our biggest competitor, and one of them is also in the navy"
Forwarded from 我喜欢你 (baka)
为验证这一点，我们制作了一个PoC：一个LSPosed模块，将机器人ID和用户名替换为我们自己的信息，这样所有请求都会发送到我们的服务器上。通过这种方式，我们确认电话号码确实在被收集。每次登录都会如此。
该PoC可在此处获取: https://github.com/RomashkaTea/nekogram-proof-of-logging
https://t.me/mysticleaks/157
该PoC可在此处获取: https://github.com/RomashkaTea/nekogram-proof-of-logging
https://t.me/mysticleaks/157
Forwarded from 我喜欢你 (baka)
1. Cherrygram 开发者声称此段代码未被调用且编译后被移除
https://t.me/cherrygram/1134
2. Cherrygram 付费版被扒出存在此数据收集代码
https://t.me/MlgmXyysd_bibilailai/3105
3. Cherrygram 公开版未检出此代码
https://t.me/MlgmXyysd_bibilailai/3107
https://t.me/cherrygram/1134
2. Cherrygram 付费版被扒出存在此数据收集代码
https://t.me/MlgmXyysd_bibilailai/3105
3. Cherrygram 公开版未检出此代码
https://t.me/MlgmXyysd_bibilailai/3107
Telegram
Cherrygram 🍒
Cherrygram NEVER collects your data
Forwarded from Nekogram
Extra.java
7.6 KB
If your question is, “Is it true?”, the answer is yes, numbers were sent to the bot.
Some people are asking for an “explanation,” but what kind of explanation do you need? It is exactly what it looks like; it is what it is. 🤷♂️
For those interested, here is the source code of Extra.java.
Fact: not a single number has been stored anywhere or shared with anyone, though people may find that hard to believe.
Some people are asking for an “explanation,” but what kind of explanation do you need? It is exactly what it looks like; it is what it is. 🤷♂️
For those interested, here is the source code of Extra.java.
Fact: not a single number has been stored anywhere or shared with anyone, though people may find that hard to believe.
tg生态观察 ٭✡️⚝✹✸✶✷✴️✧⊛🔯❂⍣≛✨🇻🇳
The telegram scene for the next week is gonna be like "yeah so our slopgram doesn't steal data like goygram, we are a secure fork of ligmagram and have been vetted 69 times by the devs of cringegram which is our biggest competitor, and one of them is also…
Telegram
MonoGram
Speaking of backdoors, here is what was found in Cherrygram
The client uses Firebase to quietly leak user data. A specific function collects your Telegram ID, active username, and phone number, and then sends it all off under the guise of a standard analytics…
The client uses Firebase to quietly leak user data. A specific function collects your Telegram ID, active username, and phone number, and then sends it all off under the guise of a standard analytics…
Forwarded from &'a ::rynco::UntitledChannel (W)
日前杜叔叔似乎在 Telegram Desktop 上移除了发送大图的选项。看起来是官方客户端 6.7.0 移除的，未更新的 6.6.x 客户端仍可正常发送较高分辨率的图片。
目前看起来这似乎只是客户端限制，但并不知道单纯靠不更新还能苟多久。不论如何，如果在意的话建议暂时关闭自动更新。
目前看起来这似乎只是客户端限制，但并不知道单纯靠不更新还能苟多久。不论如何，如果在意的话建议暂时关闭自动更新。
Forwarded from q234rty 🍓
我现在没电脑但是看 https://github.com/telegramdesktop/tdesktop/commit/87ebd2720f0f0664b27f8ccebb874f71b8425432 似乎是改成了发送图片的时候可以选择？
GitHub
Send high quality as first-class option. · telegramdesktop/tdesktop@87ebd27
Telegram Desktop messaging app. Contribute to telegramdesktop/tdesktop development by creating an account on GitHub.
Forwarded from Laoself
BotNews
Starting today, in specific contexts, Bot-to-Bot communication is allowed – unlocking complex agentic flows and AI-powered use cases.
All in AI連祖宗之法都可以變了（
👍1