A study has been published claiming that Telega, an alternative Telegram client, contains modifications that enable a man-in-the-middle attack and disable key elements of Telegram's cryptographic protection. The Telega client uses the original code. Android- a Telegram client distributed under the GPLv2 license, but does not disclose the changes it makes, contrary to license requirements.
The conclusion regarding the possibility of intercepting user traffic is based on several technical findings discovered after decompiling the APK package, analyzing libraries, and studying network calls:
- The Telegram client redirects traffic through its own infrastructure: upon startup, it accesses api.telega.info/v1/dc-proxy and receives a JSON list of "data centers" that are substituted for Telegram's official addresses. This effectively forces the client to establish connections to non-original addresses. servers, but through a Telegram proxy. This behavior can be explained by an attempt to bypass blocks on direct access to Telegram servers. When using Telegram's official public keys, proxies can only redirect encrypted traffic to servers Telegram, but they cannot access the content without the private keys used on official Telegram servers.
- An additional public RSA key was detected in the build, which is not present in official Telegram clients. When establishing encrypted sessions with its servers, Telegram may use its own public key, for which the corresponding private key is known.
- Address substitution combined with the use of one's own public key makes it possible to carry out a man-in-the-middle attack, which allows one to read all incoming and outgoing chat messages, view the conversation history, change the content of messages, and perform any actions on a user's account without their participation.
- PFS (Perfect Forward Secrecy) mechanisms and support for secret E2E chats in the client are either disabled by default or controlled by a remote configuration accessible through the same dc-proxy (the client ignores secret chats and hides the UI elements for creating them).
- The code contains deleted filters/blacklists (requests to api.telega.info/v1/api/blacklist/filter), which allow hiding channels, profiles and chats on the client side by decision Server.
Telega is positioned as a “Telegram client based on the open source code of the messenger” that can be used without VPN, and the project's page states that "all information is securely protected by Telegram's end-to-end encryption." The Telegram channel Telega, with over 5 million subscribers, was previously verified, but at the time of writing, the verification mark was missing. The Telega authorization bot has over 6 million monthly users.
Source: opennet.ru
