(Draft - will be edited shortly)
Backstory:
First of all, yes, this is starting due to this almost slanderous thread, whereas one of the admins seems to think telegram is insecure due to 'personal beliefs' and 'trust'. Nothing against Derp, I just find it a little bit silly. This is the article in question. As one can see, it's pretty stupid in a sense of some special snowflake professors, who for the record should be teaching kids about cryptography, is condemning people from writing their own crypto algorithms, or even implementations, (this part is unclear)(*1). Although, what is clear is that none of those clowns have actually looked into the source and algorithms before commenting, which lead gizmodo on to slandering telegram on the bases of their quotes and 'omg online presences are public info'. Whilst nobody's denying there may or may not be issues that existed when that article was first published, it's almost a year old, and I've found pretty much nothing that seems to be a sensible issue back then. That said, let's ignore ignorant professors who haven't looked at it, and do something noteworthy for the r4p3 community in this year of 2017.
Deprecated research:
Most of these claims and documents are vastly out of date (over a year old deprecated), and as telegram is an actively developed application, they SHOULD have moved on and fixed said issues. Empathizes on 'should' as I don't want any of y'all to be getting upset when you find that an old issue is still a critical occurrence that remains to date.
The goal:
Let's take a look at what telegram is, it's an 'encrypted' instant messaging platform, so let's find something that hurts such claim. Either obtain something that shouldn't be in the public eye within the protocol OR break the encryption algorithms in place, authentication flow, or otherwise to get plain text messages. Let's not mindlessly slander a platform we can't break
Ideal (and no so ideal) POCs:
> MITMS (don't worry about how traffic flows to them yet. once a virus or w/e get's on someones machine/network, that isn't an issue)
> Nothing that requires user interaction
> Nothing that requires (physical or not) access to the computer that has the telegram target client
> Something small that can lay on someones network without being detected
F$ck you, wheres teamspeak stuff?
I'll post a traffic decrypter that gives you raw waves, commands, and crypto keys later this week.
*1: https://reece.sx/goCvUnouihBnPuF Granted, he does say considerable experience, but I doubt any student of his falls in that category, and you've gotta start somewhere. Whilst you will be laughed at for pushing rubbish into production, there's zero reason for him to condemn such academic behaviors.
Legal note: sending malicious payloads may be illegal. blah blah blah. the fbi party van might be outside
Some sources that may be of help: https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/, TODO
Misc notes: this post is subject to change. it's more or less a draft with a fair few grammatical errors
Backstory:
First of all, yes, this is starting due to this almost slanderous thread, whereas one of the admins seems to think telegram is insecure due to 'personal beliefs' and 'trust'. Nothing against Derp, I just find it a little bit silly. This is the article in question. As one can see, it's pretty stupid in a sense of some special snowflake professors, who for the record should be teaching kids about cryptography, is condemning people from writing their own crypto algorithms, or even implementations, (this part is unclear)(*1). Although, what is clear is that none of those clowns have actually looked into the source and algorithms before commenting, which lead gizmodo on to slandering telegram on the bases of their quotes and 'omg online presences are public info'. Whilst nobody's denying there may or may not be issues that existed when that article was first published, it's almost a year old, and I've found pretty much nothing that seems to be a sensible issue back then. That said, let's ignore ignorant professors who haven't looked at it, and do something noteworthy for the r4p3 community in this year of 2017.
Deprecated research:
Most of these claims and documents are vastly out of date (over a year old deprecated), and as telegram is an actively developed application, they SHOULD have moved on and fixed said issues. Empathizes on 'should' as I don't want any of y'all to be getting upset when you find that an old issue is still a critical occurrence that remains to date.
The goal:
Let's take a look at what telegram is, it's an 'encrypted' instant messaging platform, so let's find something that hurts such claim. Either obtain something that shouldn't be in the public eye within the protocol OR break the encryption algorithms in place, authentication flow, or otherwise to get plain text messages. Let's not mindlessly slander a platform we can't break
Ideal (and no so ideal) POCs:
> MITMS (don't worry about how traffic flows to them yet. once a virus or w/e get's on someones machine/network, that isn't an issue)
> Nothing that requires user interaction
> Nothing that requires (physical or not) access to the computer that has the telegram target client
> Something small that can lay on someones network without being detected
F$ck you, wheres teamspeak stuff?
I'll post a traffic decrypter that gives you raw waves, commands, and crypto keys later this week.
*1: https://reece.sx/goCvUnouihBnPuF Granted, he does say considerable experience, but I doubt any student of his falls in that category, and you've gotta start somewhere. Whilst you will be laughed at for pushing rubbish into production, there's zero reason for him to condemn such academic behaviors.
Legal note: sending malicious payloads may be illegal. blah blah blah. the fbi party van might be outside
Some sources that may be of help: https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/, TODO
Misc notes: this post is subject to change. it's more or less a draft with a fair few grammatical errors
