Trustwave SpiderLabs Security Advisory TWSL2021-011: Privacy Issues in Telegram Self-Destruct Feature on macOS Published: 08/05/2021 Version: 1.0 Vendor: Telegram (https://telegram.org/) Product: Telegram for macOS Version affected: 7.6 Product description: Telegram is a messaging app with a focus on speed and security. Finding 1: *****Credit: Reegun Richard Jayapaul of Trustwave Any shared location, audio, video, or documents that are sent in Telegram for macOS are stored with the prefix “secret-file-xxxxxx” in the Telegram cache directory: /Users/Admin/Library/Group Containers/XXXXXXX.ru.keepcoder.Telegram/appstore/account-1271742300XXXXXX/postbox/media Media files sent with Secret-Chats using the Self-Destruct feature will delete the media in the application but leave cache copies in the directory above available for recovery or duplication even after deletion in the application. Finding 2: *****Credit: Reegun Richard Jayapaul of Trustwave Any shared location, audio, video, or documents that are sent in Telegram for macOS are stored with the prefix “secret-file-xxxxxx” in the Telegram cache directory: /Users/Admin/Library/Group Containers/XXXXXXX.ru.keepcoder.Telegram/appstore/account-1271742300XXXXXX/postbox/media Media files sent with Secret-Chats using the Self-Destruct feature will be available in the cache directory for recovery or duplication without having to access the media in the application where it will be deleted after opening. Remediation Steps: Upgrade to Telegram for macOS 7.8.1 or later to address Finding 1. No patch or workaround is provided fro Finding 2. Revision History: 03/16/2021 - Vulnerability disclosed to vendor 04/20/2021 - Vendor provided beta version 7.7 to test patch 04/28/2021 - Vendor releases Telegram 7.7 05/04/2021 - Patch found to be incomplete 05/17/2021 - Vendor confirmation that patch for Finding 1 is incomplete. Does not plan on fixing Finding 2. Vendor offers bug bounty with contract 06/14/2021 - Vendor updates bug bounty contract but no ETA for a final fix 07/01/2021 - Vendor confirms that the bug bounty contract precludes publication 07/02/2021 - Vendor provides beta version 7.8.1 to test 07/15/2021 - Vendor releases Telegram 7.8.1 08/05/2021 - Advisory released References 1. https://macos.telegram.org/ About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.