Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers accessed Telegram messaging accounts in Iran – researchers

reuters.com

Post reply on HN
Print view View original

51–60 of 66 posts

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#51

Post by angry_octet »

walrus01 wrote: post #28
api wrote: post #23

Earlier quoted context omitted.

If the crypto is solid the transport is irrelevant. This points to deeper vulnerabilities. IP networks are no safer than SMS.

I realize this was a use of sending short authentication codes by SMS, but at 160 characters the crypto can't be solid, if somebody decided to implement proper public/private key over it. So the transport is definitely a problem.

Signal was originally TextSecure, there was no problem with its message security. Plenty of meta data problems though. If you still need to send secure SMS there is a fork at https://silence.im.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#52

Post by angry_octet »

abstractbeliefs wrote: post #5

Strictly, this isn't a breach in Telegram, as it relies on the adversary being able to own the cell network you're on, but that may not bring much comfort to many of the people who feel they might need to use Telegram. What other systems would people suggest to do this initial setup?

This is precisely a breach of Telegram, they are essentially sending auth keys to the adversary when the adversary asks them too.

New devices should only be authorised with the use of an authentication token from an existing client device; one needs to decide if the new device should have access to old messages. Ideally it would be clear to all parties as to which devices and identities have joined a chat.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#53

Post by r3bl »

korayal wrote: post #48
dmix wrote: post #3

Authentication via SMS considered harmful.

I wonder why Telegram (and Twitter) doesn't allow the use of third party MFA providers just like LastPass. https://helpdesk.lastpass.com/multifactor-authentication-opt...

I'll never understand why LastPass requires you to be a premium user to use some forms of their 2FA (for example, I can't use my Yubikey if I don't pay for a premium, and I don't need a premium account for literally anything else).

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#54

Post by slizard »

grx wrote: post #2

Clickbait title. The correct title would be 'Exclusive: Hackers accessed Telegram messaging accounts in Iran - researchers' which itself already hides the fact that the problem lies not with Telegram infrastructure, but the interception of SMS by state telcos.

If they rely to a great extent on an unsafe protocol which ultimately leads to the theft of sensitive data, that does represent a problem _within_ Telegram, doesn't it?

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#55

Post by slizard »

berns wrote: post #7

"Telegram breached", "Hackers break into Telegram", "Iranian Hackers Just Cracked Telegram". I didn't think any of these nonsense titles would reach the first page of Hacker News.

One might argue that it's clickbait, but the original title does not claim anything that's particularly nonsensical. All that it claimed was that a data-breach affecting Telegram users (considerable number of) has been identified.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#56

Post by scosman »

tomc1985 wrote: post #14
grx wrote: post #2

Clickbait title. The correct title would be 'Exclusive: Hackers accessed Telegram messaging accounts in Iran - researchers' which itself already hides the fact that the problem lies not with Telegram infrastructure, but the interception of SMS by state telcos.

If Telegram relies on SMS for its authentication system, wouldn't the SMS network be part of its infrastructure, if indirectly?

They didn't break SMS wholesale; they got access to one telco's network. Saying they were hacked is like saying Slack/Netflix/etc were hacked whenever a single email provider is hacked.

That said, SMS isn't a very secure channel for one-time passwords. Enable 2 factor auth.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#57

Post by mercora »

6127qz17 wrote: post #43

Newb question: why Telegram does not use Google Authenticator ? Why so few app use it ? Is it more secure or completely useless ?

I do not know why not more services use it but i want to point out that the Google Authenticator app is just an implementation of [0]HOTP and [1]TOTP.

There is also a free implementation of the same feature set available called [2]FreeOTP.

[0] https://tools.ietf.org/html/rfc4226

[1] https://tools.ietf.org/html/rfc6238

[2] https://fedorahosted.org/freeotp/

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#58

Post by jlund »

When an adversary intercepts a Telegram SMS authentication code, this gives them pretty much complete access to a user's entire Telegram messaging history. This is true because messages are not end-to-end encrypted by default. The Telegram servers will happily return perennially stored transcripts to any client that is even temporarily considered valid.

This is _not_ true for messaging applications that are end-to-end encrypted by default and that do not store plaintext on their servers. This isn't a subtle difference. Lots of comparisons in this thread fall victim to a sort of implied false equivocation.

Using SMS as a form of authentication may be a quality that Telegram shares with other popular messaging applications, but it is uniquely susceptible to all of the associated pitfalls.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#60

Post by codezero »

Aoyagi wrote: post #42

>The researchers said they also found evidence that the hackers took advantage of a programing interface built into Telegram to identify at least 15 million Iranian phone numbers with Telegram accounts registered to them, as well as the associated user IDs. Me thinks that's more important than someone intercepting an SMS - at least in terms specific to Telegram. Is there more information on this? What evidence is it?

They acknowledge this in their blog post: https://telegram.org/blog/15million-reuters

It's part of their contacts API, where you submit the numbers you have in your contacts list and they let you know which numbers already have a telegram account.

They have since added rate limiting to prevent brute forcing it, but it sounds like the API itself is still available.

Post reply on HN