CIA exposed to potential intelligence interception due to X's URL bug

An ethical hacker has exploited a bug successful nan measurement X truncates URLs to return complete a CIA Telegram transmission utilized to person intelligence.

Kevin McSheehan, who uses nan online grip "Pad," spotted nan rumor aft hovering complete nan nexus to nan CIA's Telegram transmission displayed connected its X societal media profile.

After nan CIA updated its floor plan astatine immoderate constituent aft September 27, nan Telegram nexus shortened, cutting disconnected portion of nan afloat username, allowing McSheehan to registry nan new, unregistered handle.

The correct Telegram URL should person been displayed arsenic https://t.me/securelycontactingcia but X shortened it to https://t.me/securelycont – astatine nan clip an unregistered relationship name. 

McSheehan told nan BBC, which first reported nan story, that he registered nan relationship sanction upon realizing it was disposable to mitigate immoderate imaginable interceptions of intelligence.

Instead of conscionable shortening nan URL successful nan X profile, X shortened it successful a measurement that wholly changed nan link's path, which could person near nan CIA susceptible to espionage campaigns.

The fearfulness was that a dispute federation could person spotted nan aforesaid rumor and exploited it to person Western intelligence.

• X marks nan bot: Musk thinks spammers won't salary $1 a year
• Signal shoots down zero-day rumors, finds 'no evidence' of instrumentality takeover
• Australia threatens X pinch fine, warns Google, for nonaccomplishment to comply pinch kid maltreatment handling study regs
• EU threatens X pinch DSA penalties complete dispersed of Israel-Hamas disinformation

This could person made it imaginable to create a clone CIA relationship connected X, utilizing nan aforesaid imagery and public-facing floor plan information, and paying for verification to summation nan perceived legitimacy of nan account.

The Telegram URL successful nan clone floor plan would besides person appeared successful nan aforesaid measurement arsenic it would connected nan genuine CIA X floor plan owed to nan measurement X truncates URLs.

"It was a cleanable large wind for thing beautiful bad to hap – and perchance successful an undetected measurement for rather immoderate clip assuming a cleanable replica of nan CIA transmission was produced," McSheehan said successful an X post.

"I deliberation this could person been a sustained onslaught tally by an guidance adjacent close for nan intent of intercepting delicate accusation meant to onshore successful nan CIA's inbox. The onslaught scenarios are dreadful."

After registering nan relationship name, McSheehan posted a azygous connection to nan Telegram transmission explicitly discouraging those who arrived connected it from sharing immoderate delicate information.

He besides explained nan afloat communicative down really he was capable to presume power of a transmission advertised by nan CIA's charismatic X account, nan imaginable consequences if he hadn't sewage to it first, and that he was fresh to manus complete nan transmission to nan US government.

The CIA has since changed its floor plan to show nan correct Telegram URL, which publishes messages successful English and Russian, pointing individuals to accusation connected really to securely interaction nan agency.

The agency did not respond to The Register's petition for comment, and X's property agency auto-replied pinch "Busy now, please cheque backmost later." It thumps nan poop emoji, we suppose. ®