The Telegram flaw produces cryptocurrency
Arturo Di Corinto
Z as zero day. A “zero day” is a type of software vulnerability unknown to the producers themselves that, if exploited, is able to offer on a silver plate to criminals the control of computers, tablets and smartphones of unsuspecting victims.
This time it was up to Telegram. The researchers of Kaspersky Lab, a Russian security company, have discovered one of these flaws, the so-called zero day, within the messaging program created by the Russian brothers Durov, too. Telegram is a software for confidential communications that allows communications encrypted by the issuer to the recipient (the famous end to end encryption), but also to send heavy files, video and text, with a good level of protection, which is why it was often used by ISIS terrorists to exchange instructions and disseminate propaganda videos. Telegram, born as libertarian software and anti-spy in the authoritarian Russia as an act of rebellion and pro-privacy manifesto, has become for some years one of the most popular chat and messaging apps in the world, for a volume of 15 billion daily messages , thanks to the robustness of its cryptographic software. And for this reason in many common mortals use it by being safe from wiretapping and spying. But the discovery of this flaw shows that even Telegram can have problems.
It is not the first time that happens with these messaging apps that instead of hiding them, reveal the secrets that are entrusted. A few days ago the same Kaspersky had identified malware, a malicious Trojan, able to steal messages from WhatsApp, named SkyGoFree.
The vulnerability identified in Telegram by researchers, however, this time does something different: it allows you to remotely control the computer on which the desktop version of the software is installed to “mine” cryptocurrency, like Bitcoin. Using the computing power of the computers on which the buggy software is installed and, unbeknownst to the owner, solve complex mathematical algorithms whose solution is remunerated in digital coins to be spent as such or to be changed into sound coin.
The most famous digital currency affected by the Telegram flaw is called Monero, a cryptocurrency already involved in the story of Wannacry, the ransomware that last summer blocked access to 300 thousand computers worldwide.
The flaw, reported by researchers has already been corrected. And yet, if we can still trust all these apps to communicate privately from smartphones and PCs, because based on cryptography, we must remember that the app itself must be constantly updated, but if the computer or mobile phone is already compromised, with a spyware, for example, that is, because of a spy software installed by a jealous husband, a secret agent or a thief of trade secrets, they are useless.
The recommendation is always to open messages and attachments of people we trust and have an antivirus on their device that can intercept malicious content. The habit of sending video files or .pdf on the phone via the app is in fact becoming a real scourge as more and more often contain malicious code able to take possession of the phone and acquire remote control of the microphone, cameras and, icing on cake, steal our messages and contact address book.
