TRUST HACKING ©

A few days ago, Telegram briefly disappeared from Apple's App Store.

The stated reason was the presence of CSAM (Child Sexual Abuse Material) on Telegram — something Apple obviously treats with the highest level of sensitivity. A few hours later, Telegram was back on the App Store.

If the story ended there, it wouldn't be particularly complicated.

A user posted illegal content, the platform removed it, and the problem was over.

But Pavel Durov later published his own explanation of what happened. And from a security perspective, it makes the story a lot more interesting.

According to Durov, this wasn't simply a case of a user posting illegal content. Behind it, he says, was something he describes as takedown extortion.

And if we look at that scenario from a security engineer's perspective, a more interesting question comes up:

Do you actually need to hack a platform to hurt it?

So, why did this happen?

According to Durov, the attacker was using a form of extortion aimed at taking down an online community or service.

The idea is pretty simple:

«Pay me, or I'll target your community.»

In more traditional forms of cyber extortion, we'd probably expect the attacker to move toward ransomware, DDoS, data theft, or something along those lines.

But this case is a little different.

The attacker doesn't necessarily need to take the system down themselves.

Instead, they try to make another system take the decision for them.

According to Durov's account, that other system was Apple.

And that small change makes the whole attack model much more interesting.

How could the attacker pull this off?

This is where things get technical.

If an attacker simply posts illegal content in a public group, there's a good chance that users will see it and report it, or that moderation systems will detect and remove it.

So, according to Durov, the attacker used a different approach:

editing an old message.

Imagine that a normal message was posted in a group at 10 AM:

Message #48192 Created: 10:00

"Hey, is anyone here?"

A few hours later, that same message gets edited:

Message #48192 Created: 10:00 Edited: 14:00

[illegal content]

From a user's perspective, it's just an edited message.

But inside a large system, things are rarely that simple.

Telegram isn't just what we see on our phones.

A single message can pass through several different services:

Client ↓ Message Service ↓ Storage / Database ↓ Cache ↓ Search ↓ Moderation ↓ Reporting

And this raises an interesting security question:

When an old message is edited, do all the systems that are supposed to inspect its content process it again?

If one part of that chain doesn't, the system can end up with different views of the same piece of content.

According to Durov, that kind of mismatch was exactly what the attacker took advantage of.

The content was apparently inserted into an old message in a way that made it effectively invisible to the group's members, meaning they couldn't simply see it and report it.

But the same content could still be used to create a report against Telegram.

In its simplest form:

User: "I didn't see anything."

Reported Content: "But there is illegal content here."

Apple: "This content is associated with Telegram."

And this is where what looks like ordinary content abuse starts to become something more interesting:

Trust Abuse.

One important point: Telegram wasn't hacked

At least based on the information that has been made public, this wasn't an RCE, a stolen password, a server compromise, or access to Telegram's database.

The attacker appears to have used features that already existed on the platform:

Message Editing + Automated Accounts + Reporting

And then used the result outside of Telegram.

The attack path, in very simple terms, looks something like this:

Attacker ↓ Telegram ↓ Manipulated Content ↓ Report ↓ Apple ↓ App Store Decision

The attacker didn't directly hack Apple either.

What happened, according to this account, was an attempt to abuse the trust between two systems.

And that's where the title of this piece starts to make sense: Trust Hacking

But did Apple get tricked?

This is where I'd be a little careful.

The temporary removal of Telegram and the CSAM-related reason were acknowledged by Apple, and Telegram returned to the App Store after the content was removed and the user was banned.

But the technical details of the scenario described by Durov — the old-message edit, the content being effectively hidden from users, and the use of the reporting system to target Telegram — mainly come from Telegram's own account of what happened.

So I wouldn't say:

"Apple was hacked."

And I wouldn't confidently say:

"The attacker tricked Apple."

A more accurate way to put it would be:

«According to Telegram's account, the attacker tried to abuse the reporting process and the trust between platforms to create a real-world consequence for Telegram.»

That distinction matters from a security perspective.

How is this similar to ransomware?

In a traditional ransomware attack, the attacker goes directly after the victim's systems:

Compromise ↓ Encrypt ↓ Demand Ransom

Takedown extortion follows a different path:

Manipulate ↓ Report ↓ Trigger External Enforcement ↓ Community gets damaged ↓ Demand Ransom

In one case, the attacker says:

"I'll break your system."

In the other:

"I'll make someone else break it for me."

And that difference matters because the Attack Surface is no longer limited to servers, APIs, or databases.

So, where does AI fit into this?

According to Durov, the content used by the attacker was AI-modified.

But there's an important distinction here.

AI wasn't necessarily the tool used to break into Telegram.

In this story, it looks more like a catalyst — something that can make content generation and modification faster and easier to scale.

Now combine that with automation.

An attacker doesn't necessarily have to do everything manually anymore:

AI ↓ Content Modification ↓ Automation ↓ Multiple Accounts ↓ Multiple Communities ↓ Multiple Reports

So maybe AI didn't invent the attack technique.

But it can lower the cost and time required to carry it out.

And honestly, that part is more interesting to me than the word "AI" itself.

Because once a technique becomes cheap and easy to automate, the scale of the threat can change with it.

So this isn't really just about Telegram

If we look at this only as a Telegram incident, there probably isn't much to take away from it.

But step back for a moment, and a bigger question appears:

Does a platform only need to protect itself?

Or does it also need to think about the systems it trusts?

Because the Attack Surface of modern services is no longer just:

Server, API, Database, Client

It can also include:

Users, Bots, Reports, Moderation Systems AI, App Stores, External Review Systems Third-Party Platforms

Each of these can become part of a Trust Chain.

And if an attacker can manipulate one link in that chain, they may not need to attack the main system directly.

Trust Hacking

When we hear the word "hacking", we usually imagine an attacker trying to get inside a system.

But you don't always have to get inside.

Sometimes, it may be enough to give a system the right information to make the wrong decision on its own.

If the scenario described by Durov actually happened this way, the attacker didn't hack Telegram.

They didn't hack Apple either.

They tried to turn the trust between the two systems into an Attack Surface.

And maybe that's one of the things we need to think about more seriously in modern Threat Modeling:

Sometimes, securing a system isn't enough to keep it secure.

A few questions worth thinking about

• Is securing a platform enough to keep the platform secure?
• Has AI actually created a new generation of attacks and vulnerabilities, or are humans still discovering new attack techniques while AI simply makes them more powerful?
• And if AI becomes a catalyst for new types of attacks, can it become equally capable of detecting and stopping them?

Reference : https://t.me/durov/538