Most people have sent a message or photo to the wrong person at some point. Many apps, like Telegram, offer users the ability to unsend the message. This will delete the message from the recipient's device.
However, a security researcher, Dhiraj Mishra, discovered that a vulnerability in Telegram did not allow users to remotely delete a message. In fact, users could delete a text message but the photos and videos were saved on the device recipient's
The sender thought he was deleting the photo, as it stopped appearing in the chat window, but the recipient could see it if they went into the Telegram Images folder.
As we mentioned above, other services, such as WhatsApp, also allow you to delete messages. However, in WhatsApp, the image is deleted from the storage space and not just from the communication window, as is the case in Telegram.
In private conversations, this vulnerability may not cause a serious problem. However, in the case of a "supergroup", which can contain thousands of active members, sending a personal image or video and not being able to remove it can cause serious problems for the sender.
The worst thing is that the sender thinks the message has been deleted and that the recipients do not have access to it.
Mishra confirmed the existence of the bug in Telegram on Android version 5.10.0 (1684).
The researcher notified Telegram of the existence of the vulnerability, and the app quickly released a fix, which is included in the latest update , 5.11.
The messaging app rewarded Mishra with €2,500 for his discovery.
Vulnerabilities in such applications are common. In August, Check Point revealed bugs in the messaging app WhatsApp that allowed hackers to monitor and manipulate users' messages. Facebook said it has already fixed one of the three bugs and is working on the other two.
