Telegram tackles camera exploit, points to Apple macOS security clearances

Messaging application Telegram has downplayed the severity of a discovered exploit that allowed researchers to access camera systems on Apple macOS devices.

Software engineer Dan Revah flagged the exploit in a blog post on May 15, outlining the method by which he was able to get local privilege escalation to access a macOS user’s camera through permissions previously granted to an installed Telegram application.

By injecting a dynamic library into a user’s system, the exploit would allow recording of the device’s camera and the ability to save the file. Revah also claims that the attack allows an attacker to bypass the terminal sandbox using a launch agent. An attacker can also gain more privileges on the system by accessing areas with privacy restrictions.

Related: TON Telegram Integration Highlights Blockchain Community Synergy

Cointelegraph contacted Telegram to confirm whether its team had addressed Revah’s concerns and to determine the severity of the identified exploit. Telegram spokesperson Remi Vaughn said Telegram users are not at risk by default, as the exploit requires malware to be installed on their systems:

“This situation has more to do with Apple’s permission security than with Telegram and can therefore potentially affect any macOS app. The real problem is that it seems possible to get around Apple’s sandbox restrictions, which are specifically designed to prevent such abuse from third-party apps.”

Vaughn said Telegram made changes that received approval from the Apple App Store on May 16. He also added that users who downloaded the Telegram app directly from the messaging application’s website were not at risk.

Cointelegraph has reached out to Apple for official comment on the exploit.

Telegram released an update in December 2022, allowing users to create accounts using blockchain-based anonymous numbers to increase privacy and security.

The feature requires users to purchase blockchain-powered anonymous numbers from the decentralized auction platform Fragment. Usernames and anonymous numbers sold on the platform are only compatible with Telegram and are bought and sold using the app’s own The Open Network (TON) tokens.

In November 2022, Telegram founder Pavel Durov indicated that the platform would build a host of decentralized tools and services following the collapse of Sam Bankman-Fried’s FTX cryptocurrency exchange.

Magazine: Ordinals turned Bitcoin into a worse version of Ethereum: Can we fix it?