oss-sec mailing list archives

tdesktop leaks user IP address


From: Dhiraj Mishra <mishra.dhiraj95 () gmail com>
Date: Tue, 11 Sep 2018 17:25:47 +0530

This is still not fix in telegram desktop  team says their is nothing to
fix here and this is working has intended.

tdesktop: https://github.com/telegramdesktop/tdesktop

*Steps to reproduce:*
1. ./Telegram
2. Call end user
3. The access log on CLI reveals the end user public IP address.

By default in tdesktop p2p is enable, which open a direct communication
when calling to the other user, potentially seeing his/her IP. Telegram is
supposedly is a secure messaging application but while calling another user
leaks his/her public IP address in access log. However, by navigating to
Settings and Privacy  > Calls > and set P2P to `nobody` in telegram apps in
(iOS and android) will not allow others to view public IP of end user, but
this option is still not available in tdesktop, which makes tdesktop
vulnerable to this issue.


Thank you

-- 
Regards

*Dhiraj Mishra.*GPG ID :  51720F56   |  Finger Print : 1F6A FC7B 05AA CF29
8C1C  ED65 3233 4D18 5172 0F56

Current thread: