{"id":167268,"date":"2026-04-03T11:12:02","date_gmt":"2026-04-03T09:12:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/neoficzialnyj-telegram-klient-nekogram-otpravlyal-nomera-telefonov-botu-razrabotchika"},"modified":"2026-04-03T11:12:02","modified_gmt":"2026-04-03T09:12:03","slug":"neoficzialnyj-telegram-klient-nekogram-otpravlyal-nomera-telefonov-botu-razrabotchika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/neoficzialnyj-telegram-klient-nekogram-otpravlyal-nomera-telefonov-botu-razrabotchika","title":{"rendered":"Il client Telegram non ufficiale Nekogram inviava numeri di telefono a un bot dello sviluppatore.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u0412 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c Telegram-\u043a\u043b\u0438\u0435\u043d\u0442\u0435 Nekogram \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434, \u0441\u043a\u0440\u044b\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0431\u043e\u0442\u0443 «@nekonotificationbot» \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u043e\u0448\u0435\u0434\u0448\u0438\u0445 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0438\u043d\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u043d\u043e\u043c\u0435\u0440\u043e\u0432 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 APK-\u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 Google Play, GitHub \u0438 Telegram-\u043a\u0430\u043d\u0430\u043b \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0412 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 GitHub \u0438 \u0432 APK-\u043f\u0430\u043a\u0435\u043d\u0442\u0435 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 F Droid \u0441\u043e\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0435 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442. <\/p>\n

\u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0444\u0430\u0439\u043b\u0435 Extra.java. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u0430\u0441\u044c \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 Nekogram 11.2.3, \u043f\u0435\u0440\u0432\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u043c\u0438 \u043d\u043e\u043c\u0435\u0440\u0430\u043c\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0445. \u0412 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c osint-\u0431\u043e\u0442\u044b «@tgdb_search_bot» \u0438 «@usinfobot» \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0438\u0445 ID, \u043d\u043e \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u0438\u043c \u043d\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c. \"Il <\/p>\n

I ricercatori hanno preparato un hook java e un bot che permettono a chiunque di verificare se il proprio numero di telefono \u00e8 stato inviato dalla propria versione dell'app. \"Il <\/p>\n

Secondo i ricercatori che hanno individuato il problema, gli autori del programma avrebbero potuto utilizzare le informazioni ottenute per creare un database da vendere successivamente agli sviluppatori di bot OSINT. Il nascondere intenzionalmente tale attivit\u00e0 \u00e8 testimoniato dalla offuscamento delle modifiche e dall'uso di query inline per inviare dati. Dopo la rivelazione del problema nel sistema di tracciamento degli errori del progetto, l'autore di Nekogram ha ammesso di aver inviato numeri di telefono al proprio bot, senza spiegare il motivo di tale attivit\u00e0, ma menzionando che i numeri inviati non venivano salvati n\u00e9 inviati a terzi. <\/p>\n

Inoltre, \u00e8 possibile segnalare la scoperta di una vulnerabilit\u00e0 nell'app ufficiale di Telegram. Il progetto Zero Day Initiative (ZDI), che offre ricompense in denaro per la segnalazione di vulnerabilit\u00e0 non corrette, ha pubblicato dati preliminari sulla vulnerabilit\u00e0 ZDI-CAN-30207 in Telegram, attribuendole un livello di pericolo critico (9.8 su 10) e indicandola come attacco remoto, che non richiede alcun intervento da parte dell'utente. I dettagli saranno resi pubblici il 24 luglio, dando tempo agli sviluppatori di Telegram per portare la correzione agli utenti. <\/p>\n

\u00c8 emersa un'informazione secondo cui la vulnerabilit\u00e0 si manifesta aprendo in Telegram sticker animati appositamente formattati e pu\u00f2 portare all'esecuzione di codice malevolo senza alcuna azione da parte dell'utente. A quanto pare, la vulnerabilit\u00e0 \u00e8 causata da un errore nel codice della libreria rlottie, che gestisce l'anteprima. <\/p>\n

I rappresentanti di Telegram hanno dichiarato che non considerano il problema rilevato una vulnerabilit\u00e0 pericolosa, poich\u00e9 tutti gli sticker caricati vengono preventivamente controllati su server<\/a> Telegram e tale verifica impedirebbe la visualizzazione di sticker dannosi per gli utenti. Dopo la dichiarazione di Telegram, il livello di pericolo della vulnerabilit\u00e0 \u00e8 stato ridotto da 9.8 a 7.0.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c Telegram-\u043a\u043b\u0438\u0435\u043d\u0442\u0435 Nekogram \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434, \u0441\u043a\u0440\u044b\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0431\u043e\u0442\u0443 «@nekonotificationbot» \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u043e\u0448\u0435\u0434\u0448\u0438\u0445 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0438\u043d\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u043d\u043e\u043c\u0435\u0440\u043e\u0432 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 APK-\u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 Google Play, GitHub \u0438 Telegram-\u043a\u0430\u043d\u0430\u043b \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0412 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 GitHub \u0438 \u0432 APK-\u043f\u0430\u043a\u0435\u043d\u0442\u0435 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 F Droid \u0441\u043e\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0435 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":167269,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-167268","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Il client Telegram non ufficiale Nekogram ha inviato i numeri di telefono al bot dello sviluppatore | ProHoster","description":"Nel client Telegram non ufficiale Nekogram \u00e8 stato scoperto del codice offuscato che invia in modo nascosto i numeri di telefono degli utenti che accedono all'app al bot \"@nekonotificationbot\", legandoli all'identificativo utente. La modifica per raccogliere i numeri di telefono \u00e8 presente solo nei pacchetti APK gi\u00e0 pronti, distribuiti tramite Google Play, GitHub e il canale Telegram del progetto. Nel codice sorgente su GitHub e nel pacchetto APK del catalogo F-Droid non \u00e8 presente la modifica di raccolta dei telefoni.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/neoficzialnyj-telegram-klient-nekogram-otpravlyal-nomera-telefonov-botu-razrabotchika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 Telegram-\u043a\u043b\u0438\u0435\u043d\u0442 Nekogram \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u0431\u043e\u0442\u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 | ProHoster","og:description":"\u0412 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c Telegram-\u043a\u043b\u0438\u0435\u043d\u0442\u0435 Nekogram \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434, \u0441\u043a\u0440\u044b\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0431\u043e\u0442\u0443 "@nekonotificationbot" \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u043e\u0448\u0435\u0434\u0448\u0438\u0445 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0432 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0435 \u043a \u0438\u043d\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u043d\u043e\u043c\u0435\u0440\u043e\u0432 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0433\u043e\u0442\u043e\u0432\u044b\u0445 APK-\u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 Google Play, GitHub \u0438 Telegram-\u043a\u0430\u043d\u0430\u043b \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0412 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 GitHub \u0438 \u0432 APK-\u043f\u0430\u043a\u0435\u043d\u0442\u0435 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 F Droid \u0441\u043e\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0435 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/neoficzialnyj-telegram-klient-nekogram-otpravlyal-nomera-telefonov-botu-razrabotchika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-03T09:12:03+00:00","article:modified_time":"2026-04-03T09:12:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/167268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=167268"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/167268\/revisions"}],"predecessor-version":[{"id":168103,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/167268\/revisions\/168103"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/167269"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=167268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=167268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=167268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}