Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers accessed Telegram messaging accounts in Iran – researchers

reuters.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#41

Post by djiwie »

spoiler wrote: post #37
MichaelGG wrote: post #34

Earlier quoted context omitted.

Signal notifies you on key changes. Whatsapp has an option (I think) to do so. Anyways the simple fix that might work somewhat is "alert the user". Telegram could tell the old user they have added a device. Or even require some time period where they wait for a response from the existing device, perhaps calibrated to their usage. After registering a new device, a warning can be displayed to contacts for the first few…

When you add a device, you do get notified a new device was added, and if you have an existing telegram device, all future devices won't use SMS as the authorisation channel. I think the problem here is that the attackers added a device before the "original" person did. However, allowing for a reverse-lookup of a phone numbers through its API is a privacy—and security—problem Telegram is directly responsible for, IMH…

And the brute forcing of Telegram's API shouldn't have gone unnoticed (and apparently it was, I mean, 15 million telephone numbers brute forced?)

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#42

Post by Aoyagi »

>The researchers said they also found evidence that the hackers took advantage of a programing interface built into Telegram to identify at least 15 million Iranian phone numbers with Telegram accounts registered to them, as well as the associated user IDs.

Me thinks that's more important than someone intercepting an SMS - at least in terms specific to Telegram. Is there more information on this? What evidence is it?

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#44

Post by lmm »

megalomaniac443 wrote: post #19
tomc1985 wrote: post #14

Earlier quoted context omitted.

If Telegram relies on SMS for its authentication system, wouldn't the SMS network be part of its infrastructure, if indirectly?

Facebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS. Are we going to say that all of those have been breached too?

Yes. Duh. If you don't offer users a way to confirm key fingerprints directly with each other (or at least require signatures from a verification service that does actual verification), you don't offer an encryption system.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#45

Post by 0xFFC »

Iranian here, as programmer and software security hobbyist, I always warned my friends against telegram. Sadly the local news is government used that bug and clone 15M person chat record/contacts/public data and etc.

This is pretty huge, this can put many lives in danger, I know people who are gay and use telegram. If you are any kind of person who government does not agree with you , from now on , government has your personal communication record. For example when you applying for regular job(which 90% of jobs in Iran is related to government , because of state controlled economy)then you have absolute no chance, even if you are much better candidate than some stupid person who spend their lives defending government stupid ideas.

P.S. Replace all "government" with "regime". Government in Iran is actually good (in compare to regime) and Rouhani is our only hope. The problem is Revolutionary Guard.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#46

Post by pibefision »

megalomaniac443 wrote: post #19
tomc1985 wrote: post #14

Earlier quoted context omitted.

If Telegram relies on SMS for its authentication system, wouldn't the SMS network be part of its infrastructure, if indirectly?

Facebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS. Are we going to say that all of those have been breached too?

Facebook does not relays in SMS anymore. They implemented a code generator in the mobile app. See: https://www.facebook.com/help/270942386330392

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#49

Post by angry_octet »

berns wrote: post #7

"Telegram breached", "Hackers break into Telegram", "Iranian Hackers Just Cracked Telegram". I didn't think any of these nonsense titles would reach the first page of Hacker News.

How about: "Iranian citizens pay the price for Telegram's weak security".

"Telegram's exaggerated security claims gave Iranian users false sense of security, now Iranian secret police have read their messages." isn't quite concise enough.

Post reply on HN