TENET: Telegram Mini App (in)security

In the digital world, many people rely on messaging apps not just to talk, but to manage their money. These apps have evolved into ecosystems where small, specialized programs live inside the main application, allowing users to trade cryptocurrencies, play games, or manage investments without ever leaving the chat interface. These programs, known as Mini Apps, function like tiny websites that run directly inside the messaging software. While this integration offers great convenience, it also creates a complex security challenge. Just as a physical wallet needs a lock to keep cash safe, digital wallets need strong encryption to protect the secret codes that grant access to funds. If these codes are stored in a way that is easy to read or copy, the security of the entire system is compromised. The question researchers ask is whether these convenient, integrated tools are actually keeping user money safe, or if they are leaving the keys to the vault lying on the front porch.

A team of researchers from King Abdullah University of Science and Technology and a Swiss company called Artificialy set out to investigate this exact problem within the Telegram messaging platform. Telegram, which boasts over 450 million daily active users, has become a major hub for these Mini Apps. The researchers focused on how these applications store sensitive information on a user's device. They were particularly concerned with financial data, such as the secret phrases used to recover cryptocurrency wallets and the digital tokens that keep a user logged in. Their investigation revealed a widespread and dangerous pattern: many of these applications were saving critical security secrets in plain text, meaning the data was stored exactly as it was written, without any protective encryption. This practice leaves the information vulnerable to anyone who can access the user's device, whether through a stolen laptop, a malicious software program, or even a temporary handover of the phone.

To uncover the extent of this issue, the researchers developed a specialized auditing tool called TENET. This tool was designed to scan the local storage of a device, looking for specific patterns that indicate the presence of secrets like passwords, digital keys, or session tokens. The tool was built with a deep understanding of how these secrets are structured, allowing it to distinguish between harmless text and dangerous data. The researchers used TENET to examine a large sample of Mini Apps, selecting them based on their popularity and their focus on financial activities. They screened 61 different applications, ranging from games to complex financial tools, and successfully analyzed 37 of them. The results were stark: 30 of the 37 apps they analyzed contained significant security flaws.

The flaws fell into three distinct categories of severity. The most critical issues involved apps that stored secret recovery phrases or private keys in plain text. In these cases, an attacker who gained access to the device could simply copy the file and immediately have full control over the user's cryptocurrency assets. A second category involved apps that did use encryption, but stored the keys needed to unlock that encryption right alongside the locked data. This is akin to locking a safe but leaving the combination written on the door; the protection is an illusion because the key is readily available. The third category involved apps that stored session tokens, which are digital badges that prove a user is logged in. If an attacker stole these tokens, they could impersonate the user and take over their account, even without knowing their password.

Perhaps the most alarming discovery was that even Telegram's own official Wallet application, which is used by over 100 million people, was found to be storing a critical recovery phrase in plain text. This meant that a user's entire financial identity could be compromised simply by accessing their device's storage files. The researchers demonstrated that this vulnerability could be exploited in realistic scenarios. For instance, common malware that steals data from computers can easily grab these unencrypted files. They also showed that a malicious document, such as a spreadsheet sent via email, could trick a user into running code that silently copies the entire storage folder and sends it to a remote server, all without the user ever knowing.

The researchers did not just identify the problems; they also demonstrated how they could be fixed. After responsibly reporting their findings to Telegram and the developers of the affected apps, the platform responded by introducing two new security features. These new tools allow developers to store sensitive data in a way that is encrypted by the operating system itself, making it inaccessible to unauthorized programs. The researchers verified that Telegram's official Wallet had been updated to use these new secure methods, and the recovery phrase was no longer stored in a way that could be easily read. This confirmed that the vulnerability was real and that a practical solution existed.

The study highlights a critical gap in the security of modern messaging ecosystems. While the messaging platform itself may be secure, the applications running inside it often rely on developers to implement their own safety measures, and many have failed to do so. The researchers found that the majority of the vulnerable apps they tested were related to cryptocurrency, a sector where financial loss is permanent and irreversible. Unlike a bank account where a stolen credit card can be canceled, a stolen cryptocurrency wallet often means the funds are gone forever. The work serves as a clear warning that convenience should not come at the cost of security, and that the tools used to manage digital wealth must be held to the highest standards of protection. By exposing these weaknesses and providing a path to fix them, the researchers have helped secure the digital assets of millions of users who rely on these integrated applications every day.