CertiK 在平台关闭期间加倍打击 Telegram 漏洞

尽管 Telegram 平台最初被驳回，但区块链安全公司 CertiK Alert 仍坚持认为 Telegram 平台存在漏洞。 CertiK 敦促 Telegram 用户谨慎行事，直到问题得到完全解决。该漏洞被称为“远程执行代码”漏洞，允许攻击者通过与用户共享受损的媒体文件来执行恶意命令。

Blockchain Security Firm CertiK Doubles Down on Identified Telegram Vulnerability

区块链安全公司 CertiK 加倍努力修复已发现的 Telegram 漏洞

Washington, D.C. - April 14, 2024 - Blockchain security firm CertiK Alert has reiterated its concerns regarding a vulnerability within Telegram's social media platform, despite the platform's initial dismissal of the warning.

华盛顿特区 - 2024 年 4 月 14 日 - 区块链安全公司 CertiK Alert 重申了对 Telegram 社交媒体平台漏洞的担忧，尽管该平台最初驳回了这一警告。

CertiK, renowned for its comprehensive security analysis and threat detection capabilities, initially alerted the industry to the vulnerability on April 9, sparking a wave of concern. However, Telegram swiftly refuted the claims, alleging inaccuracies in CertiK's findings.

以其全面的安全分析和威胁检测能力而闻名的CertiK最初于4月9日向业界通报了该漏洞，引发了一波关注。然而，Telegram 很快驳斥了这一说法，声称 CertiK 的调查结果不准确。

Undeterred by Telegram's response, CertiK conducted a thorough reinvestigation, leading to the discovery of substantial evidence supporting the initial assessment. On April 12, the firm reaffirmed its stance, asserting that the Telegram threat remains a genuine concern.

CertiK 没有被 Telegram 的回应吓倒，进行了彻底的重新调查，发现了支持初步评估的大量证据。 4 月 12 日，该公司重申了其立场，声称 Telegram 威胁仍然是一个真正令人担忧的问题。

"Our investigation confirms the risk is real, and users should exercise caution until the issue is fully resolved," CertiK Alert tweeted.

CertiK Alert 在推特上写道：“我们的调查证实风险确实存在，用户应谨慎行事，直到问题得到完全解决。”

Telegram's dismissal of the vulnerability stems from its inability to corroborate CertiK's findings independently. Nonetheless, CertiK maintains its conviction, emphasizing the severe consequences that could arise from exploiting the flaw.

Telegram 对该漏洞的否认源于其无法独立证实 CertiK 的调查结果。尽管如此，CertiK 仍坚持其信念，强调利用该缺陷可能产生严重后果。

Details of the Telegram Vulnerability

Telegram 漏洞详情

The vulnerability lies within Telegram's automatic media download feature, which allows media files to be downloaded onto a user's device without requiring manual authentication. This feature provides convenience but also presents a potential avenue for attackers.

该漏洞存在于 Telegram 的自动媒体下载功能中，该功能允许将媒体文件下载到用户的设备上，而无需手动身份验证。此功能提供了便利，但也为攻击者提供了潜在的途径。

CertiK identified the vulnerability as a "Remote Code Execution" (RCE), a type of security flaw that enables unauthorized access to user accounts. By crafting malicious media files, such as compromised images, videos, or GIFs, attackers could exploit this vulnerability to execute arbitrary commands or run malicious programs remotely.

CertiK 将该漏洞识别为“远程代码执行”(RCE)，这是一种允许未经授权访问用户帐户的安全漏洞。通过制作恶意媒体文件（例如受损的图像、视频或 GIF），攻击者可以利用此漏洞执行任意命令或远程运行恶意程序。

This exploit primarily affects Telegram's desktop application, but users should exercise vigilance across all devices. To mitigate potential risks, it is advisable to disable the automatic download feature and implement additional security measures, such as two-factor authentication and strong passwords.

此漏洞主要影响 Telegram 的桌面应用程序，但用户应对所有设备保持警惕。为了降低潜在风险，建议禁用自动下载功能并实施额外的安全措施，例如双因素身份验证和强密码。

Importance of Cybersecurity in the Cryptocurrency Industry

网络安全在加密货币行业的重要性

The cryptocurrency industry has become increasingly vulnerable to cyber attacks and scams, resulting in significant financial losses. In March 2024 alone, the industry lost approximately $79 million to such malicious activities.

加密货币行业越来越容易受到网络攻击和诈骗，从而造成重大财务损失。仅 2024 年 3 月，该行业就因此类恶意活动损失了约 7900 万美元。

Telegram users have also been targeted by previous hacks and scams. In October 2023, a SHIB scam exploited the platform, resulting in the theft of user funds.

Telegram 用户也曾成为之前黑客和诈骗的目标。 2023年10月，SHIB诈骗利用该平台，导致用户资金被盗。

CertiK's reaffirmation of concerns regarding Telegram underscores the importance of cybersecurity practices for users. By understanding the risks associated with specific vulnerabilities, individuals can take proactive steps to protect their devices and assets.

CertiK 重申对 Telegram 的担忧，强调了网络安全实践对用户的重要性。通过了解与特定漏洞相关的风险，个人可以采取主动措施来保护其设备和资产。

Additional Security Measures

额外的安全措施

In addition to disabling the automatic download feature, users should consider implementing the following security measures:

除了禁用自动下载功能外，用户还应考虑实施以下安全措施：

• Use strong and unique passwords
• Enable two-factor authentication
• Install a reputable antivirus software
• Regularly update operating systems and applications
• Be cautious when opening links or downloading files from untrustworthy sources
• Report any suspicious activities to Telegram's support team

By adhering to these practices, users can significantly reduce their exposure to potential cyber attacks and protect their sensitive information.

使用强大而独特的密码启用双因素身份验证安装信誉良好的防病毒软件定期更新操作系统和应用程序打开链接或从不可信来源下载文件时要小心向 Telegram 的支持团队报告任何可疑活动通过遵守这些做法，用户可以显着减少遭受潜在网络攻击的风险并保护他们的敏感信息。

Conclusion

结论

CertiK's unwavering stance on the Telegram vulnerability highlights the importance of vigilance and proactive security measures. The cryptocurrency industry is constantly evolving, and it is essential that users remain informed about emerging threats and take appropriate steps to safeguard their devices and assets.

CertiK 对 Telegram 漏洞的坚定立场凸显了警惕和主动安全措施的重要性。加密货币行业在不断发展，用户必须随时了解新出现的威胁并采取适当措施保护其设备和资产。