Telegram fixes bug that failed to delete ‘unsent’ photos and videos

NelsonG · September 9, 2019

Mobile messaging app Telegram has fixed a bug allowing users to recover photos and videos ‘unsent’ by other people.

Telegram, which has more than 100 million users, has an ephemeral messaging feature that allows users to “unsend” sent messages from other people’s inboxes, such as when a message is sent by mistake.

But one security researcher Dhiraj Mishra, who found the privacy issue and shared his findings exclusively with TechCrunch, said although Telegram was removing the messages from a user’s device, any sent photos or video would still be stored on the user’s phone.

The researcher found other messaging apps, like WhatsApp, had the same ephemeral “unsend” feature but when tested deleted both message and content.

Mishra said the Android version of Telegram would permanently store photos and videos in the device’s internal storage.

“This works perfectly in groups as well,” he told TechCrunch. “If you have a Telegram group of 100,000 members and you send a media message by mistake and you delete it, it only gets deleted from the chat but will remain in media storage of all 100,000 members,” he said.

It’s not known if Telegram users have been affected by the privacy issue. But recently we reported several cases of visa holders who have been denied entry to the U.S. for content on their phones sent by other people.

After TechCrunch reached out, Telegram fixed the vulnerability. Mishra received €2,500 from the bug bounty for discovering and disclosing the vulnerability.

A spokesperson for Telegram confirmed the bug fix had rolled on September 5.