- ESET researchers discovered a zero-day exploit targeting Telegram for Android.
- The exploit, dubbed EvilVideo, disguises malware as multimedia files.
- Telegram patched the vulnerability in its July 11 update.
Telegram is a popular messaging app known for its privacy features and security. However, even the most secure apps can have vulnerabilities. Recently, a significant security flaw was discovered in the Telegram app for Android, which raised concerns among users and security experts alike. This flaw, named EvilVideo, allowed attackers to send malicious payloads disguised as video files through Telegram channels, groups, and chats.
The vulnerability was first detected by ESET researchers, who found the exploit being advertised for sale on an underground forum. They reported that the exploit could target Telegram versions 10.14.4 and older. This exploit works by manipulating the Telegram API to upload specially crafted multimedia files that appear as 30-second videos in chats. When users open these videos, they unknowingly download and install malicious apps.
Telegram Android Vulnerability
The EvilVideo exploit poses a serious threat to Telegram users. By default, Telegram automatically downloads media files, which means users with this setting enabled would automatically download the malicious payload once they opened the conversation containing the exploit. If a user tries to play the “video,” Telegram displays a message saying it is unable to play the video and suggests using an external player. When the user taps the Open button, they are prompted to install a malicious app disguised as the external player.
The severity of this vulnerability is underscored by its potential for widespread impact. With Telegram’s large user base, the malicious payload could easily spread to a vast number of users, especially in large public groups where such exploits could be planted. This vulnerability highlights the importance of timely updates and the need for users to be cautious about the media files they open.
Telegram Vulnerability EvilVideo
ESET researchers played a crucial role in identifying and analyzing the EvilVideo exploit. Upon discovering the vulnerability on June 26, 2024, they followed a coordinated disclosure policy and reported it to Telegram. Initially, there was no response from Telegram, but after a follow-up report on July 4, Telegram confirmed that its team was investigating the issue. By July 11, Telegram had patched the vulnerability, releasing version 10.14.5, which addressed the issue and ensured that users were protected from this exploit.
Telegram Latest Version (Google Play Store)
The discovery of the EvilVideo exploit serves as a reminder of the ongoing battle between cybersecurity experts and malicious actors. While Telegram has taken steps to patch this vulnerability, it is crucial for users to keep their apps updated and be vigilant about the files they receive.
Conclusion
The Telegram Android Vulnerability, particularly the EvilVideo exploit, highlights the ever-present risks in the digital world. Users must stay informed and proactive in updating their apps to mitigate such threats. Telegram’s quick response and patching of the vulnerability demonstrate the importance of collaboration between cybersecurity firms and app developers.
FAQ
What is the EvilVideo exploit in Telegram?
The EvilVideo exploit is a vulnerability that allows attackers to send malicious payloads disguised as video files through Telegram.
How does the EvilVideo exploit work?
The exploit uses the Telegram API to upload specially crafted multimedia files that appear as videos in chats. When users open these files, they download and install malicious apps.
Which versions of Telegram are affected by the EvilVideo exploit?
Telegram versions 10.14.4 and older are affected by the EvilVideo exploit.
How can users protect themselves from the EvilVideo exploit?
Users should update Telegram to the latest version (10.14.5 or later) and be cautious about opening media files from unknown sources.
What was the response from Telegram regarding the EvilVideo exploit?
Telegram patched the vulnerability on July 11, 2024, after being notified by ESET researchers.
