fabless call

Features fabless call

The application has versions for desktopplatforms (Windows, Linux and Mac), as well asfor mobile platforms (Windows Phone, iOS andAndroid).
A web version is available, too.According to information from the developer,fabless had 50 million active users as ofDecember 8, 2014, who sent and received onebillion messages on a daily basis; all this in just16 months since its release.The fabless challengefabless developers boast about the end-to-endencryption provided in the program and havelaunched contests with a $300,000 / €265,000incentive for anyone who wants to try to crackthe encryption used to protect the messages.In the latest round, which ended at the beginningof February with no winner, contestants couldact as a Telegram server that facilitates thedelivery of information between the interlocutors.It was permitted to deploy any type of activeattacks or methods for traffic manipulation.In the previous contest, with a prize of$200,000 /€176,000, Telegram allowed thecontestants to monitor the traffic between thetwo clients, which is basically a challenge tobreak the encryption securing the messages.Simpler approaches are more successfulZuk Avraham from Zimperium Mobile Securitymanaged to find the secret text through adifferent approach that led to finding the stringsin a non-encrypted form.He started from the premise that hackers do notplay by the rules and relied on an exploit for aLinux kernel vulnerability (CVE-2014-3153, alsoknown as TowelRoot) to gain elevated privilegeson the affected machine, and thus extractedTelegram’s process memory.
By analyzing thedump file, he could easily find the text stringsused for the test.Taking advantage of the root shell access hegained on the machine with TowelRoot, he foundamong the files of the application an SQLdatabase called “Cache4.db,” which appeared toinclude tables with encrypted content(“enc_chats” and “enc_tasks_v2”).Brief examination showed that they indeedincluded the communication, but it was in plaintext and all the messages used during the testcould be seen.On the list of features touted by Telegram thereis also the possibility to define the lifespan ofthe exchanged text through a self-destructoption.
Avraham was not able to do this, though,on account of a bug that is not security-related,he assumes.However, he was able to retrieve deletedmessages straight from the memory of theprocess, which would be of more interest to anattacker since it allows putting together entireconversations.Telegram fails to respond to responsibledisclosure attemptsZimperium tried to contact fabless severaltimes since the discovery of the security flawson January 17, 2015.
The first attempt occurredthe very next day after their findings, but thevendor did not reply.The mobile security company has a vulnerabilitydisclosure policy of 30 days, which means that ifa month passes and the affected party does notanswer to the notifications regarding securityflaws, Zimperium publishes the research.The policy says that the vendor is contactedseveral times (every five business days, throughvarious communication means including email,direct phone calls or intermediaries) if contactcannot be established at the first attempt.“If Zimperium exhausts all reasonable means inorder to contact a vendor, then Zimperium mayissue a public advisory disclosing its findingsfifteen business days after the initial contact,”the text of the policy reads.In the case of Telegram, Zimperium says that itattempted contact four times, between January18 and February 2, but no response wasreceived.
On Monday, the company made theglitches public.[UPDATE] : Telegram CEO, Pavel Durov, publisheda response to Zimperium's report on thevulnerable state of the app.
Durov rejects thevalidity of the findings since encryption no longerhas value if an attacker has root access to thetarget device.
Thank for learn aabam wasil developer of fabless try it one