Stealing your Telegram account in 10 seconds flat

{
  "by": "marban",
  "descendants": 10,
  "id": 40238949,
  "kids": [
    40239209,
    40240312,
    40240250,
    40239218,
    40239162,
    40239192
  ],
  "score": 24,
  "time": 1714671137,
  "title": "Stealing your Telegram account in 10 seconds flat",
  "type": "story",
  "url": "https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/"
}

{
  "author": null,
  "date": "2024-05-01T21:00:00.000Z",
  "description": "Say you handed me your phone, what’s the worst I could do in 10 seconds?",
  "image": null,
  "logo": null,
  "publisher": "lyra's epic blog",
  "title": "Stealing your Telegram account in 10 seconds flat",
  "url": "https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/"
}

{
  "url": "https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/",
  "title": "Stealing your Telegram account in 10 seconds flat",
  "description": "Say you handed me your phone, what’s the worst I could do in 10 seconds? \r \tClick that link and your browser will be logged into telegram without passwords\r \r The other day I received an interesting message...",
  "links": [
    "https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/"
  ],
  "image": "",
  "content": "<div>\n  <p>Say you handed me your phone, what’s the worst I could do in 10 seconds?</p>\n<div>\r\n\t<p><span>Click that link and your browser will be logged into telegram without passwords</span></p>\r\n</div>\r\n<p>The other day I received an interesting message with a link to <a target=\"_blank\" href=\"https://web.telegram.org/\">Telegram’s web client</a>. Upon clicking on the link, I found myself already logged in. Curious, I logged out, sent myself a message with the same link, clicked, and was logged in once again. There wasn’t anything special about the link I had been sent, this is just Telegram’s default behavior.</p>\n<p>I wanted to look into how this works. The first step was to figure out how the Telegram client was passing the session to the browser. As I clicked on the link, I noticed something flash on the URL bar for just a split second:</p>\n<div><p><span><span>web.telegram.org</span>/#tgWebAuthToken=dGhpcyB0b2tlbiBpcyByYW5kb20gYW5kIDEwMjQgYml0cyBsb25nLCBidXQgaW4gdGhlIGJsb2cgcG9zdCBpIHJlcGxhY2VkIGl0IHdpdGggdGhpcyBmdW4gZWFzdGVyIGVnZyBmb3IgdGhvc2Ugd2l0aCBhIGtlZW4gZXllIQ&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</span></p></div>\r\n<p>It seems like Telegram just opens up a URL with your account’s token appended to it. The token gets put in a hash fragment, and quickly disappears once the web client loads up and realizes there’s a token there. Although very convenient, this feature is pretty concerning because it can be used to quickly gain access to your account even if you use 2FA and a locked-down device (eg a <em>non-rooted/jailbroken</em> phone).</p>\n<p>So where does this URL and its session come from? I searched tdesktop<sup><a target=\"_blank\" href=\"https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/#fn:1\">1</a></sup>’s code for various keywords such as “web.telegram.org” and “tgWebAuthToken”, but oddly enough I didn’t get any hits. After staring at the code and not finding anything related to this feature for a while, I decided to build the app for real and attach a debugger to it.</p>\n<p>A couple hours of compiling later, I had my very own build of tdesktop up and running. I set up a few breakpoints, clicked on some test links, and stepped through the code looking for the relevant bits. And eventually, I got here:</p>\n<div>\r\n\t<p><span>ui_integration.cpp<svg></svg></span><span>base_integration.cpp</span><span>url_auth_box.cpp</span><span>scheme.h</span><span>local_url_handlers.cpp</span><span>basic_click_handlers.cpp</span></p>\r\n\t<div>\r\n\t<p><span></span><span><span>   79     </span>\r\n<span>   80     </span><span>[[<span>nodiscard</span>]] </span><span>bool </span><span>BotAutoLogin</span><span>(</span>\r\n<span>   81     </span>        <span>const </span><span>QString </span><span>&amp;<span>url</span>,</span>\r\n<span>   82     </span>        <span>const </span><span>QString </span><span>&amp;<span>domain</span>,</span>\r\n<span>   83     </span>        <span>QVariant </span><span>context</span><span>) </span><span>{</span>\r\n<span>   84     </span>    <span>auto </span><span>&amp;<span>account </span>= </span><span>Core</span><span>::<span>App</span>().</span><span>activeAccount</span><span>();</span>\r\n<span>   85     </span>    <span>const auto </span><span>&amp;<span>config </span>= </span><span>account</span><span>.<span>appConfig</span>();</span>\r\n<span>   86     </span>    <span>const auto </span><span>domains <span>= </span>config</span><span>.<span>get</span>&lt;</span><span>std</span><span>::<span>vector</span>&lt;</span><span>QString</span><span>&gt;&gt;(</span>\r\n<span>   87     </span>        <span>\"<span>url_auth_domains</span>\"</span><span>,</span>\r\n<span>   88     </span>        <span>{});</span>\r\n<span>   89     </span>    <span>if </span><span>(!<span>account</span>.</span><span>sessionExists</span><span>()</span>\r\n<span>   90     </span>        <span>|| <span>domain</span>.</span><span>isEmpty</span><span>()</span>\r\n<span>   91     </span>        <span>|| </span><span>!<span>ranges</span>::</span><span>contains</span><span>(<span>domains</span>, </span><span>domain</span><span>)) {</span>\r\n<span>   92     </span>        <span>return </span><span>false</span><span>;</span>\r\n<span>   93     </span>    <span>}</span>\r\n<span>   94     </span>    <span>const auto </span><span>good </span><span>= <span>url</span>.</span><span>startsWith</span><span>(<span>kBadPrefix</span>, </span><span>Qt</span><span>::<span>CaseInsensitive</span>)</span> \r\n<span>   95     </span>        <span>? </span><span>(<span>kGoodPrefix </span>+ </span><span>url</span><span>.<span>mid</span>(</span><span>kBadPrefix</span><span>.<span>size</span>()))</span>\r\n<span>   96     </span>        <span>: <span>url</span>;</span>\r\n<span>   97     </span>    <span>UrlAuthBox</span><span>::<span>Activate</span>(&amp;</span><span>account</span><span>.<span>session</span>(), </span><span>good</span><span>, <span>context</span>);</span>\r\n<span>   98     </span>    <span>return </span><span>true</span><span>;</span>\r\n<span>   99     </span><span>}</span>\r\n<span>  100     </span> </span>\r\n</p>\r\n\t</div>\n<div>\r\n<p>Locals</p>\r\n<div>\r\n\t<table>\r\n\t\t<thead>\r\n\t\t\t<tr>\r\n\t\t\t\t<th>Name</th>\r\n\t\t\t\t<th>Value</th>\r\n\t\t\t\t<th>Type</th>\r\n\t\t\t</tr>\r\n\t\t</thead>\r\n\t\t<tbody>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>Main::AppConfig::get&lt;std::vector&lt;QString,std::allocator&lt;QString&gt; &gt; &gt; returned</td>\r\n\t<td>{ size=5 }</td>\r\n\t<td>std::vector&lt;QString,std::allocator&lt;QString&gt;&gt; &amp;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>account</td>\r\n\t<td>{_domain={ptr_=0x000001b3822c5990 {_dataName={...} _local={...} _accounts={...} ...} } _local=unique_ptr {_owner={ptr_=0x000001b3887a6dd0 {_domain={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={ptr_=0x000001b3822c5990 {_dataName=data _local=unique_ptr {_owner={...} _dataName=data _localKey=shared_ptr  [2 strong refs] [] ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} ...} } ...} } ...} ...}</td>\r\n\t<td>Main::Account &amp;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>config</td>\r\n\t<td>{_account={ptr_=0x000001b3887a6dd0 {_domain={...} _local={...} _mtp={...} ...} } _api={_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr {_instance={ptr_=0x000001b3886a1b40 {_private=unique_ptr } } _mode=Normal (0) _config=unique_ptr {_dcOptions={...} _fields={...} _updates={...} } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} } } ...} ...}</td>\r\n\t<td>const Main::AppConfig &amp;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>context</td>\r\n\t<td>{...}</td>\r\n\t<td>QVariant</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>domain</td>\r\n\t<td>web.telegram.org</td>\r\n\t<td>const QString &amp;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>domains</td>\r\n\t<td>{ size=5 }</td>\r\n\t<td>std::vector&lt;QString,std::allocator&lt;QString&gt;&gt;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[capacity]</td>\r\n\t<td>5</td>\r\n\t<td>unsigned __int64</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[allocator]</td>\r\n\t<td>allocator</td>\r\n\t<td>std::_Compressed_pair&lt;std::allocator&lt;QString&gt;,std::_Vector_val&lt;std::_Simple_types&lt;QString&gt;&gt;,1&gt;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[0]</td>\r\n\t<td>web.telegram.org</td>\r\n\t<td>QString</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[1]</td>\r\n\t<td>web.t.me</td>\r\n\t<td>QString</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[2]</td>\r\n\t<td>k.t.me</td>\r\n\t<td>QString</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[3]</td>\r\n\t<td>z.t.me</td>\r\n\t<td>QString</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[4]</td>\r\n\t<td>a.t.me</td>\r\n\t<td>QString</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>[Raw View]</td>\r\n\t<td>{_Mypair=allocator }</td>\r\n\t<td>std::vector&lt;QString,std::allocator&lt;QString&gt;&gt;</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>good</td>\r\n\t<td>???</td>\r\n\t<td>QString</td>\r\n</tr>\r\n<tr>\r\n\t<td><svg></svg><svg></svg>url</td>\r\n\t<td>https://web.telegram.org</td>\r\n\t<td>const QString &amp;</td>\r\n</tr>\r\n\t\t</tbody>\r\n\t</table>\r\n</div>\r\n</div>\r\n</div>\r\n<p>So that’s why I couldn’t find the keywords earlier! The list of domains this trick works with is sent to you by the Telegram server and stored in the config under the <code>url_auth_domains</code><sup><a target=\"_blank\" href=\"https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/#fn:2\">2</a></sup> key. You can see the list of domains currently provided in the locals above.</p>\n<p>Once you click on a link with a matching domain, your client will send it to Telegram’s servers and if everything looks alright you’ll get back a cute little temporary URL with the tokens and everything appended. For those playing along at home, we send a <code>messages_requestUrlAuth</code> with just the <code>url</code> set<sup><a target=\"_blank\" href=\"https://lyra.horse/blog/2024/05/stealing-your-telegram-account-in-10-seconds-flat/#fn:3\">3</a></sup>, and hope to get back a <code>urlAuthResultAccepted</code> with the new <code>url</code> inside.</p>\n<p>Having figured out how the thing works, and armed with a list of domains, I began looking for a way to break it. It seems like the entire initial URL gets preserved, including the path, query parameters, and the hash fragment, with the exception of the scheme being forced to https.</p>\n<p>For example:</p>\n<ul>\n<li><code>http://web.​telegram.org/</code> becomes <code>https://web.​telegram.org/​#tgWebAuthToken=...</code></li>\n<li><code>https://z.t.me/​pony</code> becomes <code>https://z.t.me/pony​?tgWebAuth=1​#tgWebAuthToken=...</code></li>\n<li><code>https://k.t.me/​#po=ny</code> becomes <code>https://k.t.me/​?tgWebAuth=1​#po=ny​&amp;tgWebAuthToken=...</code></li>\n</ul>\n<details><summary>(a lot) more examples</summary>\r\n<table>\r\n  <thead>\r\n    <tr>\r\n      <th>Original URL</th>\r\n      <th>URL with token</th>\r\n    </tr>\r\n  </thead>\r\n  <tbody>\r\n<tr><td>https://z.t.me/</td><td>https://z.t.me/?tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/pony</td><td>https://z.t.me/pony?tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/#pony</td><td>https://z.t.me/?tgWebAuth=1#pony?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/#bon=bon</td><td>https://z.t.me/?tgWebAuth=1#bon=bon&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/#?bon</td><td>https://z.t.me/?tgWebAuth=1#?bon&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/?#bon</td><td>https://z.t.me/?tgWebAuth=1#bon?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/?bon=bon</td><td>https://z.t.me/?bon=bon&amp;tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/?bon=bon#bon</td><td>https://z.t.me/?bon=bon&amp;tgWebAuth=1#bon?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/#=</td><td>https://z.t.me/?tgWebAuth=1#=&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/?tgWebAuth=🐴</td><td>https://z.t.me/?tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset</td><td>https://z.t.me/?tgWebAuth=1#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://z.t.me/?tgWebAuth=🐴#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset</td><td>https://z.t.me/?tgWebAuth=1#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/pony</td><td>https://k.t.me/pony?tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/#pony</td><td>https://k.t.me/?tgWebAuth=1#pony?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/#bon=bon</td><td>https://k.t.me/?tgWebAuth=1#bon=bon&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/#?bon</td><td>https://k.t.me/?tgWebAuth=1#?bon&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/?#bon</td><td>https://k.t.me/?tgWebAuth=1#bon?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/?bon=bon</td><td>https://k.t.me/?bon=bon&amp;tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/?bon=bon#bon</td><td>https://k.t.me/?bon=bon&amp;tgWebAuth=1#bon?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/#=</td><td>https://k.t.me/?tgWebAuth=1#=&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/?tgWebAuth=🐴</td><td>https://k.t.me/?tgWebAuth=1#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset</td><td>https://k.t.me/?tgWebAuth=1#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://k.t.me/?tgWebAuth=🐴#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset</td><td>https://k.t.me/?tgWebAuth=1#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/pony</td><td>https://web.telegram.org/pony#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/#pony</td><td>https://web.telegram.org/#pony?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/#bon=bon</td><td>https://web.telegram.org/#bon=bon&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/#?bon</td><td>https://web.telegram.org/#?bon&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/?#bon</td><td>https://web.telegram.org/?#bon?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/?bon=bon</td><td>https://web.telegram.org/?bon=bon#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/?bon=bon#bon</td><td>https://web.telegram.org/?bon=bon#bon?tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/#=</td><td>https://web.telegram.org/#=&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/?tgWebAuth=🐴</td><td>https://web.telegram.org/?tgWebAuth=🐴#tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset</td><td>https://web.telegram.org/#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n<tr><td>https://web.telegram.org/?tgWebAuth=🐴#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset</td><td>https://web.telegram.org/?tgWebAuth=🐴#tgWebAuthToken=trixie&amp;tgWebAuthUserId=starlight&amp;tgWebAuthDcId=sunset&amp;tgWebAuthToken=...&amp;tgWebAuthUserId=420493337&amp;tgWebAuthDcId=4</td></tr>\r\n  </tbody>\r\n</table>\r\n</details>\r\n<p>All of the domains apart from the web.telegram.org one are sort-of built for the <a target=\"_blank\" href=\"https://core.telegram.org/api/links\">t.me deep links</a>. Going on any of them without a path will just bring you to the telegram.org homepage. Going on one with a compatible path, such as <a target=\"_blank\" href=\"https://z.t.me/share?url=lyra.horse\">z.t.me/share?url=lyra.horse</a>, will open up the respective client with a hash fragment, eg:<br />\n<a target=\"_blank\" href=\"https://web.telegram.org/a/#?tgaddr=tg%3A%2F%2Fmsg_url%3Furl%3Dlyra.horse\">https://web.telegram.org/a/#?​tgaddr=​tg%3A%2F%2Fmsg_url%3F​url%3Dlyra.horse</a></p>\n<p>This is usually performed with a HTTP 301 redirect, but if the <code>tgWebAuth</code> parameter is set and the deep link is valid, you’ll get to run this fun javascript instead:</p>\n<div>\r\n<div><p><span>view-source:https://<span>z.t.me</span>/share?url=lyra.horse&amp;tgWebAuth=1</span></p></div>\r\n<table><tbody><tr><td></td><td><span>&lt;html&gt;</span></td></tr><tr><td></td><td><span>&lt;head&gt;</span></td></tr><tr><td></td><td><span>&lt;meta <span>name</span>=\"<span>robots</span>\" <span>content</span>=\"<span>noindex, nofollow</span>\"&gt;</span></td></tr><tr><td></td><td><span>&lt;noscript&gt;</span>&lt;meta http-equiv=\"refresh\" content=\"0;url='https://web.telegram.org/a/#?tgaddr=tg%3A%2F%2Fmsg_url%3Furl%3Dlyra.horse'\"&gt;<span>&lt;/noscript&gt;</span></td></tr><tr><td></td><td><span>&lt;script&gt;</span></td></tr><tr><td></td><td>try {</td></tr><tr><td></td><td>var url = \"https:\\/\\/web.telegram.org\\/a\\/#?tgaddr=tg%3A%2F%2Fmsg_url%3Furl%3Dlyra.horse\";</td></tr><tr><td></td><td>var hash = location.hash.toString();</td></tr><tr><td></td><td>if (hash.substr(0, 1) == '#') {</td></tr><tr><td></td><td>  hash = hash.substr(1);</td></tr><tr><td></td><td>}</td></tr><tr><td></td><td>location.replace(hash ? urlAppendHashParams(url, hash) : url);</td></tr><tr><td></td><td>} catch (e) { location.href=url; }</td></tr><tr><td></td><td><br /></td></tr><tr><td></td><td>function urlAppendHashParams(url, addHash) {</td></tr><tr><td></td><td>  var ind = url.indexOf('#');</td></tr><tr><td></td><td>  if (ind &lt; 0) {</td></tr><tr><td></td><td>    return url + '#' + addHash;</td></tr><tr><td></td><td>  }</td></tr><tr><td></td><td>  var curHash = url.substr(ind + 1);</td></tr><tr><td></td><td>  if (curHash.indexOf('=') &gt;= 0 || curHash.indexOf('?') &gt;= 0) {</td></tr><tr><td></td><td>    return url + '&amp;' + addHash;</td></tr><tr><td></td><td>  }</td></tr><tr><td></td><td>  if (curHash.length &gt; 0) {</td></tr><tr><td></td><td>    return url + '?' + addHash;</td></tr><tr><td></td><td>  }</td></tr><tr><td></td><td>  return url + addHash;</td></tr><tr><td></td><td>}</td></tr><tr><td></td><td><span>&lt;/script&gt;</span></td></tr><tr><td></td><td><span>&lt;/head&gt;</span></td></tr><tr><td></td><td><span>&lt;/html&gt;</span></td></tr><tr><td></td><td><span>&lt;!-- page generated in 4.3ms --&gt;</span></td></tr><tr><td></td><td><span></span></td></tr></tbody></table>\r\n</div>\r\n<p>I was a bit puzzled at first, but eventually realized that this is all just a simple hack to deal with URL hash fragments. The <a target=\"_blank\" href=\"https://en.wikipedia.org/wiki/URI_fragment\">hash fragment</a> part of the URL never gets sent to the server, so the server cannot know <em>where</em> to redirect you <em>if</em> it also wants to add its own hash fragment. In this specific case, we have <code>#tgWebAuthToken=...</code> in the URL already, and we want to combine it with <code>#?tgaddr=...</code> as we redirect to the web client (so in the end we get <code>#?tgaddr=...&amp;tgWeb​AuthToken=...</code>).</p>\n<p>For the rest of the night I played around with Telegram’s various web clients. A little-known fact is that the <a target=\"_blank\" href=\"https://github.com/zhukov/webogram\">legacy Telegram web client</a> can still be accessed to this day by going to <a target=\"_blank\" href=\"https://web.telegram.org/?legacy=1\">web.telegram.org/?legacy=1</a>. What’s more, the session is shared between the web clients, so an exploit in the old web client might still be useful even if the target uses a modern web client.</p>\n<p>I couldn’t find anything too interesting in <a target=\"_blank\" href=\"https://github.com/morethanwords/tweb\">WebK</a>, but both <a target=\"_blank\" href=\"https://github.com/Ajaxy/telegram-tt\">WebZ</a> and the legacy client provided some promising leads in messing with the <code>tgaddr</code> in the URL. It ended up being a dead end for my research though, as I couldn’t figure out a way to get rid of or bypass the ampersand in the <code>&amp;tgWebAuthToken=...</code> part of the URL. I even messed around with unicode to see if that’d somehow let me “erase” the ampersand, but it seems like UTF-8 has been designed to withstand this.</p>\n<p>I then looked into the mobile apps. Both the <a target=\"_blank\" href=\"https://github.com/TelegramMessenger/Telegram-iOS\">iOS</a> and <a target=\"_blank\" href=\"https://github.com/DrKLO/Telegram\">Android</a> clients support the link authentication thing, which makes the whole situation a tad more worrying considering it’s generally a lot harder to just copy a session token off a mobile device. On Android I messed around with intents, but ended up at another dead end as intents for web links have been <a target=\"_blank\" href=\"https://developer.android.com/about/versions/12/behavior-changes-12#android-app-links-verification-changes\">locked down since Android 12</a> and require domain verification to work. I also messed around with protocol intents, but the way the app has been written prevents the token from being appended in those cases.</p>\n<p><em>So, no exploit?</em></p>\n<p>In my research I was unable to come up with a successful remote exploit. I won’t be getting a bug bounty, but that doesn’t mean it was all in vain. Combining all the research so far, and adding a little cherry on top, we can create a scenario where we can steal someone’s Telegram session in just a few seconds of physical access to their device, no matter if it’s their computer, phone, or tablet.</p>\n<p>We start off by sending “z.t.me” in their Telegram app and tapping on the link. This will redirect their browser to <code>telegram.org/​#tgWebAuthToken=...</code>. From here we edit the domain in the browser to <code>telegramz.org</code> - a domain I own - and hit/tap enter. The javascript on my domain will take it from here, logging one of <em>my own</em> devices in with the token.</p>\n<p><strong>Here’s a demo of me pulling off the entire attack in less than 10 seconds on an Android phone and a laptop:</strong></p>\n<div>\r\n<a href=\"https://vimeo.com/941755175\" target=\"_blank\"></a>\r\n<p><a href=\"https://www.youtube.com/MLGaeming\" target=\"_blank\"><span><span>m</span><span>l</span><span>g</span></span></a><span>Stealing your Telegram account in 10 seconds flat</span></p>\r\n<svg height=\"13%\"></svg>\r\n<p><span>Watch on YouTube</span></p>\r\n</div>\r\n<p><em>Note: YouTube has removed <a target=\"_blank\" href=\"https://www.youtube.com/watch?v=5DQrPEr1gGk\">my video</a> for a community guidelines violation. Educational content like this is allowed, but I believe their review team confused my video with a hacking tutorial (probably due to livesplit splits looking too much like a step-by-step instruction). They’ve also refused my appeal. You can watch a <a target=\"_blank\" href=\"https://cdn.hobune.stream/tg_video_1080p.mp4\">plain mp4</a>, <a target=\"_blank\" href=\"https://vimeo.com/941755175\">a Vimeo upload</a>, or <a target=\"_blank\" href=\"https://twitter.com/rebane2001/status/1785791628533195209\">this twitter post</a> instead.</em></p>\n<p>This attack is incredibly easy to pull off even for a low-skill attacker. Assuming some higher forces have already set up a custom domain for you, all you need to know is how to tap on a link and add a letter onto the URL bar. You don’t need any specialized tools, you don’t need to know anything about the target, you don’t even need a phone.</p>\n<p>So what should Telegram do about this?</p>\n<div>\n<p>Log in to Telegram by QR Code</p>\r\n<ol><li><span>Open Telegram on your phone</span></li><li><span>Go to Settings &gt; Devices &gt; Link Desktop Device</span></li><li><span>Point your phone at this screen to confirm login</span></li></ol>\r\n</div>\r\n<p>The same thing they did with the QR code logins! If you attempt to log onto a new device by scanning a login QR code, you’ll still have to enter your 2FA password - and I think the same mitigation could be implemented for these instant login web client URLs.</p>\n<p><strong>Discuss this post on:</strong> <a target=\"_blank\" href=\"https://twitter.com/rebane2001/status/1785779094656868406\">twitter</a>, <a target=\"_blank\" href=\"https://infosec.exchange/@rebane2001/112367887114044823\">mastodon</a>, <a target=\"_blank\" href=\"https://news.ycombinator.com/item?id=40229482\">hackernews</a>, <a target=\"_blank\" href=\"https://cohost.org/rebane2001/post/5798626-i-just-made-a-new-bl\">cohost</a></p>\n<hr />\n<p>thank you for reading my first blog post!!</p>\n<p>i decided to take on the challenge of using no images on the page, and no javascript either. i don’t think this’ll be a sustainable way of doing things going forward, but it does mean you get fast load times (everything here is ~20kB gzipped!), pretty vector graphics on hidpi screens (try zooming in!), and responsive “screenshots” for mobile devices (try resizing the window and see how neatly things change to accommodate!). also if you’re someone using assistive technologies, please let me know how this post felt to read and if there’s anything to be improved or done differently in the future.</p>\n<p>note: the graphics in this blog post are not fully compatible with <a target=\"_blank\" href=\"https://en.wikipedia.org/wiki/Netscape_Navigator\">netscape navigator</a>, please switch to a modern alternative such as <a target=\"_blank\" href=\"https://ladybird.dev/\">ladybird</a></p>\n  </div>",
  "author": "",
  "favicon": "",
  "source": "lyra.horse",
  "published": "2024-05-01T21:00:00Z",
  "ttr": 412,
  "type": "article"
}