Skip to main content
NewsPublished

Telegram & how unwanted people can adb your device (since 3 feb 2023)

Source Reddit Cybersecurity

0

Discussion

A configuration in the Telegram Android app allows app data to be backed up via Android's backup system, potentially exposing sensitive tokens and settings. This backup capability, controlled by the android:allowBackup attribute, can be exploited via adb backup commands if the device is accessible. The exposed data includes authentication tokens and user preferences, which could allow an attacker to hijack sessions without needing email or SMS verification if two-factor authentication is not enabled. The app stores salted and hashed PINs, which could be brute-forced offline. This issue was observed in the app's manifest as of February 3, 2023, and relates to the use of Android's BackupAgentHelper mechanism.

r/cybersecurity (opens in a new tab)u/nikitasius0 points0 comments

Hi folks!

Here's 4 feb 2014: https://github.com/DrKLO/Telegram/blame/9aeb8be8938e6083376142a782166a15edf46743/TMessagesProj/src/main/AndroidManifest.xml#L58

Old days, probably default config.

Here's 28 feb 2014: https://github.com/DrKLO/Telegram/blame/2628a581478f1a30197ed0fc37165b17a3c97c98/TMessagesProj/src/main/AndroidManifest.xml#L87

true -> false 24 days after. Guess to fix it.

Here is today https://github.com/DrKLO/Telegram/blame/2628a581478f1a30197ed0fc37165b17a3c97c98/TMessagesProj/src/main/AndroidManifest.xml#L99-L101 - 3 feb 2023 it was modified.

What does this mean?

android:allowBackup="true" allows the app's data to be included in Android's backup system (cloud backup via Google and, under the right conditions via adb backup or bmgr backupnow), need fullBackupOnly afaik to work w/o agent.

Here is the agent:

BackupAgent extends BackupAgentHelper :

https://github.com/DrKLO/Telegram/blob/b7561f0c641b521df0000bda2704664d792d6a1a/TMessagesProj/src/main/java/org/telegram/messenger/BackupAgent.java#L13-L14 (12.9.2 release - latest)

There are:
saved_tokens, saved_tokens_login, prefs

Here are your tokens, your settings (shared prefs).
So, via adb get tokens & settings (shared prefs)

Sure, they could dump your chats anyway or run your account anywhere cause it have a "central server". But enabling such "backups" for me it's kinda yelling "it's not us it's they/them/🐷".

Android backup refs:

Folks you're welcome to comment 🍻

Links cited in the discussion

References

Community reviews

Loading reviews…