Info Nekogram (fork of telegram for android has been secretly send your phone numbers from a bot)

[MxchU666]

This isn't a free, but...

BREAKING: Nekogram is secretly sending your phone numbers to the developer

The backdoor is hidden in the

You must be registered for see links

file, which differs from the template uploaded to the repository. The obfuscated code sends data as an inline request to the @nekonotificationbot, leaving no trace.

More info about the backdoor:

You must be registered for see links

(locked by Nekogram devs)

To validate this, we made a PoC: an LSPosed module that replaces the bot ID and username to ours so all requests are going to it. That way, we confirmed that the phone numbers are being collected. Every. Login.

The PoC is available here:

You must be registered for see links

What should you do?

1. Report the app on Play Store:

You must be registered for see links

2. Report the repository on GitHub:

You must be registered for see links

3. Delete the app and stop using unofficial Telegram clients

Spoiler: they admit that!!!

in few minutes imma gonna delete the fork from the apks subforum if its possible

 

[calloc0x75]

Solid writeup, but I don't really see big consequences with this. If you're willingly giving the provider your phone number in the first place, you're the issue. I have never used "nekogram," but from when I used Telegram, I know you had to give them your phone number. So, I don't know if it's supposed to be different here or not, but the only real thing they could do with your phone number would be to sell them in bulk and have you receive a bunch of scam or spam SMS. I mean, the backdoor in itself is the big issue since what is a phone number today might be session tokens tomorrow and message contents the week after it. Lucky they only took phone numbers, but regardless of that, no trust for this provider whatsoever from now on. :0

 

[cwel1337]

i mean first of all, just like calloc said, you can't do shit with a phone number.
second of all, temp numbers for tg cost cents and nobody that has at least a bit of common sense will be using their actual phone number for telegram..