A study has been published claiming that Telega, an alternative Telegram client, contains modifications that allow for MITM attacks and disable key elements of Telegram's encryption. The Telega client uses the code of the original Android Telegram client, distributed under the GPLv2 license, but fails to disclose the modifications made, contrary to the license requirements.
The conclusion about the possibility of intercepting user traffic is based on several technical findings revealed after decompiling the APK package, analyzing libraries, and studying network calls:
- The Telega client redirects traffic through its own infrastructure: at startup, it requests the address api.telega.info/v1/dc-proxy and receives a JSON list of "data centers," which replace the official Telegram addresses. In effect, this forces the client to establish connections not with the original servers, but through the Telega proxy. Such behavior can be explained as an attempt to bypass blocks on direct access to Telegram servers. When using the official Telegram public keys, the proxies can only redirect encrypted traffic to servers Telegram, but cannot access the content without the private keys used on the official Telegram servers.
- The build contains an additional public RSA key that is not found in the official Telegram clients. When establishing encrypted sessions with its servers, Telega can use its own public key, for which a corresponding private key is known.
- The address substitution combined with the use of the proprietary public key allows for a MITM attack, enabling the reading of all incoming and outgoing messages in the chat and viewing the message history, substituting the content of messages, and performing any actions with the user's account without their involvement.
- The PFS (Perfect Forward Secrecy) mechanisms and support for secret E2E chats in the client are either disabled by default or managed through a remote configuration accessible via the same dc-proxy (the client ignores secret chats and hides UI elements for their creation).
- The code reveals remote filters/blacklists (requests to api.telega.info/v1/api/blacklist/filter) that allow for hiding channels, profiles, and chats on the client side by decision. server.
Telega is positioned as a "Telegram client built on the open-source code of the messenger," which can be used without VPN, and the project page states that "all information is securely protected by Telegram's end-to-end encryption. Previously, the Telega Telegram channel with more than 5 million subscribers was verified, but at the time of writing, the verification badge is missing. The Telega authorization bot has over 6 million monthly users.
Source: opennet.ru
