Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘I will show you how safe Telegram is’

twitter.com

Post reply on HN
Print view View original

1–10 of 206 posts

Re: ‘I will show you how safe Telegram is’

#2

Post by T3OU-736 »

So, the twitter post alludes to SS7, but it is not clear how it is (ab)used to do the Telegram-related exploitation.

Presumably, SS7's design flaws are being used intercept Telegram's registration verification messages, placing the resulting Telegram accounts under control of the bad actors while appearing to be real, independent users (and so aiding in establishing their credibility, which leads to other things), but that is a bit... handwave-y.

Re: ‘I will show you how safe Telegram is’

#5

Post by super256 »

T3OU-736 wrote: post #2

So, the twitter post alludes to SS7, but it is not clear how it is (ab)used to do the Telegram-related exploitation. Presumably, SS7's design flaws are being used intercept Telegram's registration verification messages, placing the resulting Telegram accounts under control of the bad actors while appearing to be real, independent users (and so aiding in establishing their credibility, which leads to other things), bu…

Telegram allows logins per SMS code (they will be rolling out changes in two days). So as long as you knew the number of your victim and have the ability to re-route SMS, you were able to login to other people’s accounts.

Of course this can be easily mitigated by setting a “cloud password”, but I guess most people don’t do that.

Re: ‘I will show you how safe Telegram is’

#6

Post by baybal2 »

T3OU-736 wrote: post #2

So, the twitter post alludes to SS7, but it is not clear how it is (ab)used to do the Telegram-related exploitation. Presumably, SS7's design flaws are being used intercept Telegram's registration verification messages, placing the resulting Telegram accounts under control of the bad actors while appearing to be real, independent users (and so aiding in establishing their credibility, which leads to other things), bu…

[dead]

Re: ‘I will show you how safe Telegram is’

#9

Post by guitarlimeo »

lallysingh wrote: post #8
brink wrote: post #3

You can put a password on your telegram account.

.. can you reset that password? Using a text message?

You actually can't, if you forget the password, the account will remain indefinitely locked (and deleted after 6 months of inactivity if you haven't changed the default time).
Post reply on HN