Telegram users who specifically utilize the application for its anonymity features are advised to update their desktop clients as soon as possible to patch a bug that will leak their IP address in some scenarios.
The bug was found by Dhiraj Mishra, a bug hunter from Mumbai, India, and was patched by Telegram with the releases of Telegram for Desktop v1.4.0 and v1.3.17 beta.
Mishra told ZDNet that he discovered that the Telegram desktop clients for Windows, Mac, and Linux would reveal users' IP addresses. The leak, Mishra said, happened only during voice calls.
Under normal circumstances, Telegram's voice calling feature works by establishing a direct IP-to-IP (or peer-to-peer) connection between the two users, and exchanging data packets between the two directly.
A peer-to-peer connection is not private by design, as it directly exposes the IP addresses of the two participants.
The default option for voice calls is to use a peer-to-peer connection for all a users' contacts, for performance's sake. This means that Telegram will always leak your IP address to people you already added to your contacts list.
But since Telegram made a name for itself by running an anonymous instant messaging client, the company also added a mechanism to mask users' IP addresses when calling each other --in the form of the "Nobody" option which tells the Telegram app to never initiate a peer-to-peer connection during voice calls.
Mishra said this option was only present in the mobile app and not Telegram's desktop client, meaning all calls initiated from the desktop version would leak users' IPs.
Also: How to install and use the PassFF Firefox password manager TechRepublic
This is a dangerous bug, especially for users who utilize Telegram for its privacy and anonymity feature, such as journalists, political dissidents, or human rights fighters.
In the summer of 2016, it was reported that an Iranian state-sponsored hacking group abused a vulnerability in the Telegram app to identify the telephone numbers of over 15 million Iranians who registered an account on the platform, effectively tying their Telegram usernames to their phone numbers and their real-life persona.
An IP leak can have similar privacy-busting consequences.
This is the second time an IP leak was found in the Telegram desktop client this year after a similar one was discovered and patched in late July.
Telegram fixed the issue by adding the Nobody option in its desktop client settings and awarded Mishra a reward of €2,000 for his report. The IP leak received the CVE-2018-17780 vulnerability identifier.
Users can visit the " Settings > Privacy and security > Calls > Peer-to-Peer" section and set the option to Nobody to ensure their privacy is respected.
Article updated with clarification from Telegram devs regarding Nobody option.
Previous and related coverage:
Cyber attacks and malware are one of the biggest threats on the internet. Learn about the different types of malware - and how to avoid falling victim to attacks.
This simple advice will help to protect you against hackers and government surveillance.
Whether you're in the office or on the road, a VPN is still one of the best ways to protect yourself on the big, bad internet.
Fruitfly malware author used port scanning with weak or no passwords to identify potential victims.
The evolving IoT botnet is able to compromise an impressive array of architectures.
The self-proclaimed Apple fan stole roughly 90GB of confidential data from the iPad and iPhone maker.
- Android spyware in development plunders WhatsApp data, private conversations
- New Linux 'Mutagen Astronomy' security flaw impacts Red Hat and CentOS distros
- French cyber-security agency open-sources CLIP OS, a security hardened OS
- Cisco: Linux kernel FragmentSmack bug now affects 88 of our products
- Firefox bug crashes your browser and sometimes your PC