# Unveiling Messenger Weaknesses: Understanding How Hackers Can Infiltrate and Compromise Your Device

By [Officer's Blog](https://paragraph.com/@officercia) · 2024-02-23

---

Big thanks to [my TG](https://t.me/officer_cia) channel [follower](https://t.me/CyberScoutszametki/481) for bringing up this crucial subject, researchers have recently observed a marked rise in account hijackings, particularly with Telegram. It is important to mention that phishing and social engineering are often used in tandem in the majority of cases.

However, I want to talk about instances today where accounts are compromised due to messenger [vulnerabilities](https://securityaffairs.com/57166/hacking/whatsapp-and-telegram-hack.html) rather than phishing attacks (**_which, thankfully, are usually quickly fixed_**):

1.  [CVE-2022–36934](https://nvd.nist.gov/vuln/detail/CVE-2022-36934) (critical vulnerability in WhatsApp) — allowed to execute RCE via buffer overflow while performing a video call;
    
2.  [CVE-2022–27492](https://nvd.nist.gov/vuln/detail/CVE-2022-27492) (vulnerability in WhatsApp) — allowed to execute RCE by sending a pre-created video file;
    
3.  In 2017, there were many [news](https://thehackernews.com/2017/03/hack-whatsapp-telegram-account.html) pieces about the possibility of hijacking Telegram and WhatsApp account by sending (just) an image file. And you didn’t necessarily need to [download](https://www.indiatoday.in/technology/news/story/whatsapp-security-issue-attacked-by-hackers-965881-2017-03-16) it to your phone to get [infected](https://www.theverge.com/2017/3/15/14933048/whatsapp-telegram-hack-malware-image-checkpoint) with a malware. However, I have not found any confirmation of this CVE so far.
    

**What conclusions can be drawn here?** Aside from 2FA, mail binding, and other features, the best thing to do in messengers is turn off file auto-downloading.

To disable [auto-downloading](https://www.techbloat.com/stop-auto-download-on-telegram-methods-android-ios-desktop.html) on Telegram, go to “**_Privacy & Security → Data Settings_**”. This applies to _both wifi and cellular connections_. You never know what will be [sent](https://www.indiatimes.com/technology/news/whatsapp-telegram-can-expose-your-saved-photos-to-hackers-here-s-how-to-fix-the-bug-371349.html) to you, and what 0-day was released just yesterday, so always remember that **forewarned is forearmed**, and take all necessary security precautions ahead of time before it is too late.

[

Crypto-OpSec-SelfGuard-RoadMap/README.md at main · OffcierCia/Crypto-OpSec-SelfGuard-RoadMap
--------------------------------------------------------------------------------------------

Here we collect and discuss the best DeFi, Blockchain and crypto-related OpSec researches and data terminals - contributions are welcome. - Crypto-OpSec-SelfGuard-RoadMap/README.md at main · OffcierCia/Crypto-OpSec-SelfGuard-RoadMap

https://github.com

![](https://storage.googleapis.com/papyrus_images/96bddd94c6028a561d8969bbd8763216bd3e4ef0911f4a251f0ace245194d311.png)

](https://github.com/OffcierCia/Crypto-OpSec-SelfGuard-RoadMap/blob/main/README.md)

Naturally, you should always keep in mind that unless you learn to be a little more cautious about what and where you enter, send, and open, no antivirus software or two-factor authentication will be of any use!

### **Private or Anonymous?**

In today’s interconnected digital landscape, the importance of securing our online accounts cannot be overstated. As individuals increasingly rely on instant messaging platforms for communication, the necessity to protect our privacy and personal [information](https://www.reddit.com/r/privacy/comments/y39yno/how_do_i_make_a_fully_anonymous_telegram_account/) has become paramount. Particularly, when it comes to Telegram — an app renowned for its privacy features and encryption — it is essential to understand the criticality of securing our accounts in order to fortify our digital [presence](https://osintteam.blog/telegram-security-best-practices-1b33eb10be05) against potential threats from malicious actors.

Telegram’s extensive user base and emphasis on privacy have made it an appealing choice for [individuals](https://www.quora.com/What-are-some-privacy-tips-for-Telegram) and organizations seeking a secure means of communication. However, while Telegram offers robust security features, it is imperative for users to take [proactive](https://moonlock.com/telegram-hacked) measures to safeguard their accounts and protect their sensitive information.

In essence, the need to secure your Telegram account transcends individual benefit — it extends to [fostering](https://www.securitymagazine.com/articles/98092-telegram-the-preferred-method-of-anonymous-communication-among-cybercriminals) a more secure and privacy-conscious digital community. By prioritizing account security and [implementing](https://telegramea.com/post/how-can-i-make-my-telegram-completely-anonymous/) robust measures to fortify your presence on the platform, you not only safeguard your own privacy and information but also contribute to elevating the overall security posture of the Telegram network.

Speaking seriously, human freedom is predicated on privacy; without it, decisions can be easily swayed by [everything](https://osintteam.blog/telegram-security-best-practices-1b33eb10be05) from criminal prosecutions to public censure to coercive measures. I feel that there **should be no** [**exceptions**](https://www.youtube.com/watch?v=rtRQKQkvUfE) to the rule that [privacy](https://nordvpn.com/ru/blog/is-telegram-safe/) must be protected. Your data belongs to you and **only** to you, not to any third parties like corporations, hackers, or special services.

With all said, it is imperative to differentiate between [anonymity](https://anonymousplanet.org/) and privacy. Privacy [means](https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/edit?usp=drivesdk) that people can clearly tell who you are, but they don’t know what you would do. Being anonymous [suggests](https://github.com/OffcierCia/Crypto-OpSec-SelfGuard-RoadMap/blob/main/README.md) that, despite what you do being known, people are unaware of your identity.

For most people, [anonymity](https://anonymousplanet.org/) is desirable but not necessary. You need anonymity if you’re concerned about anyone seeing your data. But… how “much” security? Well, depending on your threat model, which includes your actions, the identity of your [possible](https://github.com/OffcierCia/Crypto-OpSec-SelfGuard-RoadMap/blob/main/README.md) attacker, and other [factors](https://officercia.mirror.xyz/G4782jMUpA_kkIpwakphbd6djX85cxRGS-pjBipc8Yk). Online security, privacy, and anonymity are much safer when [combined](https://zpmirov.medium.com/telegram-is-no-longer-anonymous-dc20729e5dce) with personal security. While privacy is essential, not everyone requires personal security or anonymity.

[

Unfolding Ancient Wisdom: How Ancient Stories Teach Modern Humans about Security and OpSec
------------------------------------------------------------------------------------------

Unfolding Ancient Wisdom: How Ancient Stories Teach Modern Humans about Security and OpSec In today's digital age, concerns surrounding security and OpSec (Operational Security) are paramount. As ...

https://medium.com

![](https://storage.googleapis.com/papyrus_images/d9f45c4c1310c3ad6722474bb008ffc8f10992aae22cb931099198dea6671342.jpg)

](https://medium.com/illumination/unfolding-ancient-wisdom-how-ancient-stories-teach-modern-humans-about-security-and-opsec-909c5e1101f3?source=post_page-----c6c569cf8b87--------------------------------)

As law enforcement and “big tech” corporations are the first to be interested in your data, protect yourself rather than depending on others. Avoid asking yourself if you have anything to conceal. Do you have anything that you would like to keep safe? Numerous instances of “harmless surveillance” that are defended have serious repercussions.

**Think twice about this.** Securing our digital presence is **becoming more and more important** as technology develops, which emphasizes the need for a strong commitment to account security across all digital platforms!

* * *

**Telegram: Settings Checklist**
================================

The lightweight chat client Telegram is one of the most common methods of [communication in crypto](https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2), and there’s a good reason for that. This app is also frequently used for work and [communication](https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/edit?usp=drivesdk), so it stands to reason that scammers and hackers would also look for victims there.

> _This article initially_ [_written for immunefi.com_](https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2) _(_**_my ex-job_**_) by myself._

**_Let’s figure out how not to be a victim! Let’s get started!_**

Beware of [impersonators](https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2) (_carefully check out Telegram bio as the scammer may insert any nickname to his bio and leave his own nickname blank_), fake [notifications](https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2) about logging into Telegram ([_check_](https://hacken.io/discover/top-7-social-engineering-frauds-in-crypto/) _out them carefully, they should come into the official_ [_telegram_](https://www.androidpolice.com/top-tips-using-telegram-safely-securely/) _news & tips channel_) with a phishing link, fake bots (_yep, bots —_ **_not_** _user accounts —_ **_may DM first_**) [and so on](https://twitter.com/officer_cia/status/1569951983271907328?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1569951983271907328%7Ctwgr%5Eb80f078d6f5711b3dd78b8429b80fc0a99e98d68%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fofficercia.mirror.xyz%2Fdlf6ZEXq3FLE21ZY2jeJ0cBDyuZu8XIF9DEJAQ07nk8)!

> **_NONE of the telegram chats are E2E encrypted not 1:1, not groups — only TLS. Only the_** [**_secret chat_**](https://www.androidpolice.com/top-tips-using-telegram-safely-securely/) **_one iirc._**

*   _Phone Number → Who can see my phone number — Nobody;_
    
*   _Data and Storage → Auto Download Media → Toggle off;_
    
*   _Phone Number → Who can find me by my number — My Contacts;_
    
*   _Last Seen & Online → Who can see my timestamp — Nobody;_
    
*   _Profile photo → Who can see my profile photo — My Contacts;_
    
*   _Calls → Who can call me — My Contacts (or Nobody, if you prefer);_
    
*   _Calls→ Peer-to-peer — My contacts (or Nobody, if you prefer not to share your IP address with chat partners);_
    
*   _When you start the call, you will see four emojis at the top right corner — ask the person you are calling to name them and compare them to yours (they should be the same as yours). This is protection from MitM;_
    
*   _Forwarded Messages → Who can add a link to my account when forwarding my messages — My Contacts;_
    
*   _Never add contacts to Telegram (if there are any — erase them), and always use_ [_VPN_](http://officercia.mirror.xyz/x91hTIDFrAL0lgqICRgWU7fLouuCMgvopQ9ZRvRXCLg)_;_
    
*   _Groups & Channels → Who can add me — My Contacts;_
    
*   _Set up a 2FA (cloud password);_
    
*   _Set up a cloud_ [_email_](https://mirror.xyz/0xdc519466f1cda17e8ae6735bB8652F47c0533CBe/n9utNq5mnJ14hscmONhOzBTsTcuWfWMXExummuLti8k) _2FA!;_
    
*   _More about 2FA_ [_core.telegram.org/api/srp#email-verification_](http://core.telegram.org/api/srp#email-verification) _&_ [_this_](https://telegram.org/faq#q-how-does-2-step-verification-work)_;_
    
*   _Disable sticker loop animation! Animated Stickers = danger;_
    
*   _Disable auto-_[_downloading_](https://www.techbloat.com/stop-auto-download-on-telegram-methods-android-ios-desktop.html) _(_**_both wi-fi and cellular_**_): Privacy & Security → Data Settings;_
    
*   _Disable P2P calls for everyone as it may expose your_ [_IP_](https://n0a.pw/telegram-get-remote-ip/)_!_ **_Same with secret chats!_** _End-to-End encryption means thats your_ [_IP_](https://www.securitylab.ru/news/541831.php) _will become known the person you’re chatting with._ [_And vice versa_](https://mothership.sg/2023/01/circles-life-esim-swap-fraud/)_;_
    
*   _Disable link & image previews in secret chats (scroll down in a Privacy and Security section;_
    
*   [_Disable autoplay GIFs_](https://www.csa.gov.sg/singcert/Advisories/ad-2022-013)_!_
    
*   _You can now buy Telegram Premium subscriptions (also —_ [_numbers_](https://fragment.com/numbers) _&_ [_usernames_](https://fragment.com/)_) with TON:_ [_fragment.com/premium_](https://fragment.com/premium)_;_
    
*   [_Dutch Police Can Access Hidden Telegram Numbers — Use a burner number!_](https://cyberwarzone.com/dutch-police-can-access-hidden-telegram-numbers/)
    
*   _Never activate (via_ **_/start_**_) any_ [_telegram_](https://www.cqcore.uk/telegram-osint-vm-part-2/) _bot! Do not even touch telegram bots (only public chat bots are considered safe, you can operate them in a public chat via commands), never DM a Telegram bot! (any button can contain a SQLi vulnerability or even worse);_
    
*   _If you have to open PDF (CV for example), use_ [_dangerzone.rocks_](https://dangerzone.rocks/) _or google drive preview regime (ask to upload);_
    
*   _Watch out active session!_ [_Terminate inactive sessions!_](https://innovation-village.com/ncc-warns-a-new-malware-steals-telegram-users-data-without-two-factor-authentication/) _Watch out_ [_session stealers_](https://www.zdnet.com/article/telegrab-malware-hijacks-telegram-chat-sessions/)_;_
    
*   _If you receive a message about logging into your account —_ **_check that it is on a legitimate_** [**_telegram_**](https://www.cqcore.uk/telegram-osint-vm-part-2/) **_notification & news channel._** _Scammers can impersonate this notification channel to force you to give them the OTR code from the SMS;_
    
*   _Check out_ [_Telegram FAQ_](https://telegram.org/faq)_;_
    
*   [_To sign in to Telegram, use a different_](https://securitypilgrim.com/7-tips-to-make-your-telegram-account-secure/) _phone number — or even a virtual phone number — rather than your actual mobile number. However, if you use a one-time number, someone else may_ [_obtain_](https://www.androidpolice.com/top-tips-using-telegram-safely-securely/) _access to your account. To_ [_conceal_](https://securitypilgrim.com/7-tips-to-make-your-telegram-account-secure/) _your IP address, use a_ [_VPN_](https://securitypilgrim.com/what-is-a-vpn-and-advantages-of-a-vpn/) _(which Telegram can provide, for example, at the_ [_request_](https://securitypilgrim.com/7-tips-to-make-your-telegram-account-secure/) _of law enforcement officials);_
    
*   [_Check out this list_](https://telegra.ph/How-to-configure-Telegram-security-and-privacy-07-21) _& follow_ [_Telegram Tips_](https://t.me/TelegramTips)_;_
    
*   _It is necessary to have a separate secure device with an account-logged in application;_
    
*   _It is necessary to regularly check the work of the application logged in to the account and the chat with service notifications. At least once every five days;_
    
*   _The more devices logged into the account — the higher the risk of account compromise. Also, a logged-in device is a tool in ensuring the security of a_ [_Telegram_](https://osintteam.blog/telegram-security-best-practices-1b33eb10be05) _account;_
    
*   [_This project describes Telegram limitations!_](https://github.com/tginfo/Telegram-Limits) _|_ [_Link 2_](https://crowdin.com/project/telegram-limits)_;_
    
*   [_More security tips by SamCZSun_](https://securityalliance.notion.site/Telegram-Security-Self-Audit-863507aa2ea84360be8e6f30c61e6b0d)_;_
    
*   [_My old article written for Immunefi._](https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2)
    
*   _Anyone can become a victim of mass-abusing. You should send a letter to_ [_abuse@telegram.org_](http://mailto:abuse@telegram.org/) _/ contact support agent_ **_+42470_** _(add this phone to contacts);_
    
*   _But also you_ [_should_](https://www.alphr.com/telegram-why-is-my-number-banned/#:~:text=Contact%20Telegram%20Support%20via%20the,you'd%20like%20to%20use.) _contact_ [_support_](http://t.me/notoscam) _which is located in your telegram settings — “_**_Ask a Question_**_”;_
    
*   _Next, fill this form_ [_telegram.org/support_](https://telegram.org/support)_;_
    
*   _Automatically_ [_detect changes made_](https://t.me/tgcrawl) _to official Telegram sites, clients, etc.;_
    
*   _If you’ve been_ [_restricted_](https://gotechug.com/telegram-your-phone-was-banned/)_, then visit_ [_@SpamBot_](https://t.me/SpamBot) _a click it through;_
    
*   [_Join my TG channel_](https://t.me/officer_cia)_._
    

* * *

**Final Remarks**
=================

The need to keep our online accounts safe is constant as we make our way through the complexity of the digital world. Making a deliberate effort to strengthen your Telegram account is a proactive measure to preserve the integrity of secure communication, protect personal data, and protect your privacy.

**If you want to support my work, please, consider donating me:**

*   [**0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A**](https://etherscan.io/address/0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A) or [officercia.eth](https://etherscan.io/enslookup-search?search=officercia.eth) — ETH
    
*   [**17Ydx9m7vrhnx4XjZPuGPMqrhw3sDviNTU**](https://blockchair.com/bitcoin/address/17Ydx9m7vrhnx4XjZPuGPMqrhw3sDviNTU) — BTC
    
*   **4AhpUrDtfVSWZMJcRMJkZoPwDSdVG6puYBE3ajQABQo6T533cVvx5vJRc5fX7sktJe67mXu1CcDmr7orn1CrGrqsT3ptfds — Monero XMR**
    
*   More addresses: [github.com/OffcierCia/support](http://github.com/OffcierCia/support).
    

To sum up, protecting your Telegram account is essential and involves a larger commitment to security, privacy, and good digital citizenship. We actively contribute to the development of a more secure and safe virtual environment that upholds **integrity, privacy, and trust** by strengthening our accounts.

### **Thank you! Stay Safe!**

---

*Originally published on [Officer's Blog](https://paragraph.com/@officercia/unveiling-messenger-weaknesses-understanding-how-hackers-can-infiltrate-and-compromise-your-device)*
