Telegram Zero-day Bug Exploited for Mining Cryptos
Hackers have exploited zero-day vulnerability in Telegram Messenger’s Windows app, which was came to light in last October 2017. Cyber crooks have exploited this zero-day from 2017, but now this has been patched. Kaspersky have notified about this zero-day and published all the technical details about the about bug on security list.
The exploit involved classic right-to-left override (RLO) attack when a file is sent using a messenger. The bug exploited how Telegram handles the special nonprinting RLO character (U+202E), which is used to switch between RTL to LTR text display. Attackers discovered that they could leverage the character to trick users by hiding an executable file, since the filename would appear partially or completely in reverse.
The attacks have also been used to steal Telegram directories from victims that may contain information about their personal communications and transfered files. The backdoor enabled attackers to carry out varied malicious operations, including extracting web history archives and launching and deleting files.