Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ...
by lucb1e on Wednesday March 15, 2017 @01:11PM
(#13877775)
That is my understanding as well. It's written like a media prop -- I mean, look at this:
> bypass Telegram’s upload policy and upload a malicious HTML document with a mime type of a video file “video/mp4”. Then, they were able to send it to the victim side in an encrypted channel through telegram servers.
It's only missing the words "cyber" and "darknet" to make it complete, but they just upload html with javascript (malicious or not) and it happens to be over https.
So it's a bit obfuscated, but yeah it seems to only affect the web clients.
> bypass Telegram’s upload policy and upload a malicious HTML document with a mime type of a video file “video/mp4”. Then, they were able to send it to the victim side in an encrypted channel through telegram servers.
It's only missing the words "cyber" and "darknet" to make it complete, but they just upload html with javascript (malicious or not) and it happens to be over https.
So it's a bit obfuscated, but yeah it seems to only affect the web clients.