Hackers accessed Telegram messaging accounts in Iran – researchers • Hacker News Board

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#61

Post by angry_octet » Wed, Aug 03, 2016, 3:42 PM UTC

angry_octet wrote: post #49

berns wrote: post #7

"Telegram breached", "Hackers break into Telegram", "Iranian Hackers Just Cracked Telegram". I didn't think any of these nonsense titles would reach the first page of Hacker News.

How about: "Iranian citizens pay the price for Telegram's weak security". "Telegram's exaggerated security claims gave Iranian users false sense of security, now Iranian secret police have read their messages." isn't quite concise enough.

Alternatively: "News of Telegram hack contrary to user's strongly held beliefs, #offended by suggestion of problems with Telegram."

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#62

Post by kentt » Wed, Aug 03, 2016, 11:38 PM UTC

dbrgn wrote: post #31

megalomaniac443 wrote: post #19

Earlier quoted context omitted.

Facebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS. Are we going to say that all of those have been breached too?

Threema does not rely on SMS for login, the identities are not phone number based and trust can be ensured by manually scanning the public key QR of the peer, leading to a clear visual trust level indicator. Applications should not rely on SMS for authentication or login, or on the phone number for identity. (Disclaimer: Threema dev)

Yes, thank you. I strongly agree.

I have a couple SIM cards since I live on the US/Canada border. WhatsApp and Telegram won't let me send messages when I switch SIMs and there is no other way to verify my identity.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#63

Post by hoppa_liza » Thu, Aug 04, 2016, 12:21 AM UTC

derefr wrote: post #13

hoppa_liza wrote: post #6

> widely used in the Middle East, including by the Islamic State militant group I understand the risk associated with rogue people using such a service, but is not the ability to determine who exactly is using the service counter productive? I.e. for journalists and personas non grata under oppressive regimes.

Are you sure it's being "determined", in a SIGINT sense? Perhaps ISIS have made public mention somewhere of their usage of the service. Or perhaps others (e.g. opposing forces) have just shoulder-surfed some ISIS members using it, or looked through their phones.

You are right, it totally skipped me. It is very possible that some of their personnel/phones were captured leading directly to this information.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#64

Post by Aoyagi » Thu, Aug 04, 2016, 10:18 AM UTC

codezero wrote: post #60

Aoyagi wrote: post #42

>The researchers said they also found evidence that the hackers took advantage of a programing interface built into Telegram to identify at least 15 million Iranian phone numbers with Telegram accounts registered to them, as well as the associated user IDs. Me thinks that's more important than someone intercepting an SMS - at least in terms specific to Telegram. Is there more information on this? What evidence is it?

They acknowledge this in their blog post: https://telegram.org/blog/15million-reuters It's part of their contacts API, where you submit the numbers you have in your contacts list and they let you know which numbers already have a telegram account. They have since added rate limiting to prevent brute forcing it, but it sounds like the API itself is still available.

Ah, I see, thanks.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#65

Post by Sami_Lehtinen » Fri, Aug 05, 2016, 8:49 AM UTC

Yet in this case all the encrypted secret chats are still kept private. Because even gaining access to the user account, doesn't allow you to read messages from secret chats.

Re: Hackers accessed Telegram messaging accounts in Iran – researchers

#66

Post by NotSammyHagar » Sat, Aug 06, 2016, 6:18 PM UTC

0xFFC wrote: post #45

Iranian here, as programmer and software security hobbyist, I always warned my friends against telegram. Sadly the local news is government used that bug and clone 15M person chat record/contacts/public data and etc. This is pretty huge , this can put many lives in danger, I know people who are gay and use telegram. If you are any kind of person who government does not agree with you , from now on , government has yo…

Does SSL access to hacker news protect your identity in Iran? And do you think encrypted messages with telegram with 2 factor auth protects people? I think not, since they just have to get the messages of the people you chat with, the weaker link is the other side.