8 ms·
Hackers accessed Telegram messaging accounts in Iran – researchers
- grx 10y agoClickbait title. The correct title would be 'Exclusive: Hackers accessed Telegram messaging accounts in Iran - researchers' which itself already hides the fact that the problem lies not with Telegram infrastructure, but the interception of SMS by state telcos.
- tomc1985 10y agoIf Telegram relies on SMS for its authentication system, wouldn't the SMS network be part of its infrastructure, if indirectly?
- megalomaniac443 10y agoFacebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS. Are we going to say that all of those have been breached too?
- tomc1985 10y agoPotentially. Of course, you won't see it too often in the headlines..
- megalomaniac443 10y agoI know that some people here are suspicious of Telegram because they use their own encryption mechanism, but it's like there's an active campaign against it by the media. In my country the media has been calling it the "ISIS chatting app".
- tomc1985 10y agoNothing to do with that. Authentication is an essential pillar of a security app, and the ability to effectively authenticate is an important component of opsec. If SMS is compromised (and it is not hard to imagine given how protective govt is about SMS exploits/sigint) then the authentication aspect of any app that relies on SMS is also potentially compromised. Weakest link and all that...
- emsy 10y agoIMO you're unjustifiably downvoted. As a previous reply already said, other services rely on sms auth as well. So why is only Telegram critizised? You can see from previous HN top stories that the mistrust in this service seems especially high.
- TeMPOraL 10y agoIt's just media doing the thing it always does. Inducing outrage in any way possible. It's too late to call Facebook Messenger an "ISIS chatting app", but consider that e.g. whenever Facebook adds any kind of even remotely useful feature to their service, they're immediately portrayed as stalker paradise by the media.
- johnchristopher 10y agoAh, yes. Then let's add the cardiovascular system since humans rely on it to press screens or keys to use telegram. What else has been potentially hacked ? The moon ?
- dbrgn 10y agoThreema does not rely on SMS for login, the identities are not phone number based and trust can be ensured by manually scanning the public key QR of the peer, leading to a clear visual trust level indicator. Applications should not rely on SMS for authentication or login, or on the phone number for identity. (Disclaimer: Threema dev)
- kentt 10y agoYes, thank you. I strongly agree. I have a couple SIM cards since I live on the US/Canada border. WhatsApp and Telegram won't let me send messages when I switch SIMs and there is no other way to verify my identity.
- MichaelGG 10y agoSignal notifies you on key changes. Whatsapp has an option (I think) to do so. Anyways the simple fix that might work somewhat is "alert the user". Telegram could tell the old user they have added a device. Or even require some time period where they wait for a response from the existing device, perhaps calibrated to their usage. After registering a new device, a warning can be displayed to contacts for the first few messages. Maybe old messages are not accessible or something. There are ways to limit the impact of an SMS hijack.
- spoiler 10y agoWhen you add a device, you do get notified a new device was added, and if you have an existing telegram device, all future devices won't use SMS as the authorisation channel. I think the problem here is that the attackers added a device before the "original" person did. However, allowing for a reverse-lookup of a phone numbers through its API is a privacy—and security—problem Telegram is directly responsible for, IMHO.
- MichaelGG 10y agoYeah didn't Signal spend a bit of work trying to avoid exposing users? If you have an existing Telegram device (registered before target registered), then how do they register? And wouldn't both devices get notified? Also how would they know which numbers to register? Just fundamentally seems like the software can notify you of how many devices have access, and make that visible on any change and when installing on a device. Perhaps even offering to kill existing devices.
- djiwie 10y agoAnd the brute forcing of Telegram's API shouldn't have gone unnoticed (and apparently it was, I mean, 15 million telephone numbers brute forced?)
- lmm 10y agoYes. Duh. If you don't offer users a way to confirm key fingerprints directly with each other (or at least require signatures from a verification service that does actual verification), you don't offer an encryption system.
- pibefision 10y agoFacebook does not relays in SMS anymore. They implemented a code generator in the mobile app. See: https://www.facebook.com/help/270942386330392 https://www.facebook.com/help/270942386330392
- scosman 10y agoThey didn't break SMS wholesale; they got access to one telco's network. Saying they were hacked is like saying Slack/Netflix/etc were hacked whenever a single email provider is hacked. That said, SMS isn't a very secure channel for one-time passwords. Enable 2 factor auth.
- dang 10y agoWe changed the title from "Telegram breached" back to the title of the article.
- slizard 10y agoIf they rely to a great extent on an unsafe protocol which ultimately leads to the theft of sensitive data, that does represent a problem _within_ Telegram, doesn't it?
- dmix 10y agoAuthentication via SMS considered harmful.
- revelation 10y agoSince 1994, before any of these schemes even existed: https://events.ccc.de/congress/2009/Fahrplan/attachments/1519_26C3.Karsten.Nohl.GSM.pdf https://events.ccc.de/congress/2009/Fahrplan/attachments/151...
- yeukhon 10y agoWell, a lot of MFA is done through SMS. I believe sides like Tumblr and Twitter do that? At least I am asked to do SMS authentication for those sites. Maybe it's a setting I checked off.
- RockyMcNuts 10y agoNIST says SMS is not secure enough for 2FA http://www.cnet.com/news/nist-set-to-ban-sms-based-two-factor-authentication/?part=propeller&subj=news&tag=link http://www.cnet.com/news/nist-set-to-ban-sms-based-two-facto...
- yeukhon 10y agoThanks. This is a good reference I can share with folks internally.
- superuser2 10y agoAnd yet it is the only kind of 2FA offered by any of the "serious" institutions I do business with. TOTP is only available on toys, other than AWS. Sigh.
- korayal 10y agoI wonder why Telegram (and Twitter) doesn't allow the use of third party MFA providers just like LastPass. https://helpdesk.lastpass.com/multifactor-authentication-options/ https://helpdesk.lastpass.com/multifactor-authentication-opt...
- abstractbeliefs 10y agoStrictly, this isn't a breach in Telegram, as it relies on the adversary being able to own the cell network you're on, but that may not bring much comfort to many of the people who feel they might need to use Telegram. What other systems would people suggest to do this initial setup?
- deleted 10y ago[deleted]
- angry_octet 10y agoThis is precisely a breach of Telegram, they are essentially sending auth keys to the adversary when the adversary asks them too. New devices should only be authorised with the use of an authentication token from an existing client device; one needs to decide if the new device should have access to old messages. Ideally it would be clear to all parties as to which devices and identities have joined a chat.
- hoppa_liza 10y ago> widely used in the Middle East, including by the Islamic State militant group I understand the risk associated with rogue people using such a service, but is not the ability to determine who exactly is using the service counter productive? I.e. for journalists and personas non grata under oppressive regimes.
- derefr 10y agoAre you sure it's being "determined", in a SIGINT sense? Perhaps ISIS have made public mention somewhere of their usage of the service. Or perhaps others (e.g. opposing forces) have just shoulder-surfed some ISIS members using it, or looked through their phones.
- hoppa_liza 10y agoYou are right, it totally skipped me. It is very possible that some of their personnel/phones were captured leading directly to this information.
- berns 10y ago"Telegram breached", "Hackers break into Telegram", "Iranian Hackers Just Cracked Telegram". I didn't think any of these nonsense titles would reach the first page of Hacker News.
- angry_octet 10y agoHow about: "Iranian citizens pay the price for Telegram's weak security". "Telegram's exaggerated security claims gave Iranian users false sense of security, now Iranian secret police have read their messages." isn't quite concise enough.
- angry_octet 10y agoAlternatively: "News of Telegram hack contrary to user's strongly held beliefs, #offended by suggestion of problems with Telegram."
- slizard 10y agoOne might argue that it's clickbait, but the original title does not claim anything that's particularly nonsensical. All that it claimed was that a data-breach affecting Telegram users (considerable number of) has been identified.
- a_wang 10y agotwo step verification would be guard of this Achilles' heel
- sekasi 10y agoYou mean Two Factor yeah? Because telegram already relies on two step.
- lucastx 10y agoSMS is the first factor in the case of Telegram. The 2-step authentication Telegram provides is through email.
- pietroalbini 10y agoNope, the second factor is a password you must type in after inserting the sms code.
- oldgun 10y agohttps://telegram.org/blog/15million-reuters https://telegram.org/blog/15million-reuters Stay calm and turn on 2-step verification.
- oceaniity 10y agoOne might suppose that because login relies on the cellular network it's implicitly part of the app's infrastructure. In that sense the technical failing of Telegram was relying on one method of authentication (when multi-factor should be the default). I think it far-fetched to extrapolate that into 'Telegram got hacked', though. I understand the want to share the article, but a concerted effort to amend the original title to reflect the actual content would have been appropriate here, methinks. Edit: fixed some speling.
- wtbob 10y agoOnce again proving a) the security of a system, like a chain is only as strong as its weakest link and b) if something is theoretically broken now it will be actually broken tomorrow.
- aussieguy123 10y agoThis is as bad as a breach
- walrus01 10y agoAnything that involves SMS, SS7 and the legacy PSTN phone network cannot be relied upon for anything crypto related... Sending auth keys/codes by SMS, really? I understand it was a decision made to have the system be easy to use, but it's foolish in my opinion.
- api 10y agoIf the crypto is solid the transport is irrelevant. This points to deeper vulnerabilities. IP networks are no safer than SMS.
- walrus01 10y agoI realize this was a use of sending short authentication codes by SMS, but at 160 characters the crypto can't be solid, if somebody decided to implement proper public/private key over it. So the transport is definitely a problem.
- angry_octet 10y agoSignal was originally TextSecure, there was no problem with its message security. Plenty of meta data problems though. If you still need to send secure SMS there is a fork at https://silence.im https://silence.im.
- t3ra 10y agoTelegram has had 2FA since years!
- pmontra 10y agoIs there a way to know how many devices are linked to an account and which devices they are? That would let people check if they've been eavesdropped and possibly cut off the hacker by removing the extra device. Then add a password.
- spoiler 10y agoYes. It's in the settings screen. You can remove any or all devices (bar the current one), too.
- camillomiller 10y agoWell, the problem lies more with the de-anonymization of ~15 million users in Iran, though, which Telegram didn't deny.
- Aoyagi 10y ago>The researchers said they also found evidence that the hackers took advantage of a programing interface built into Telegram to identify at least 15 million Iranian phone numbers with Telegram accounts registered to them, as well as the associated user IDs. Me thinks that's more important than someone intercepting an SMS - at least in terms specific to Telegram. Is there more information on this? What evidence is it?
- codezero 10y agoThey acknowledge this in their blog post: https://telegram.org/blog/15million-reuters https://telegram.org/blog/15million-reuters It's part of their contacts API, where you submit the numbers you have in your contacts list and they let you know which numbers already have a telegram account. They have since added rate limiting to prevent brute forcing it, but it sounds like the API itself is still available.
- Aoyagi 10y agoAh, I see, thanks.
- 6127qz17 10y agoNewb question: why Telegram does not use Google Authenticator ? Why so few app use it ? Is it more secure or completely useless ?
- mercora 10y agoI do not know why not more services use it but i want to point out that the Google Authenticator app is just an implementation of [0]HOTP and [1]TOTP. There is also a free implementation of the same feature set available called [2]FreeOTP. [0] https://tools.ietf.org/html/rfc4226 https://tools.ietf.org/html/rfc4226 [1] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238 [2] https://fedorahosted.org/freeotp/ https://fedorahosted.org/freeotp/
- 0xFFC 10y agoIranian here, as programmer and software security hobbyist, I always warned my friends against telegram. Sadly the local news is government used that bug and clone 15M person chat record/contacts/public data and etc. This is pretty huge, this can put many lives in danger, I know people who are gay and use telegram. If you are any kind of person who government does not agree with you , from now on , government has your personal communication record. For example when you applying for regular job(which 90% of jobs in Iran is related to government , because of state controlled economy)then you have absolute no chance, even if you are much better candidate than some stupid person who spend their lives defending government stupid ideas. P.S. Replace all "government" with "regime". Government in Iran is actually good (in compare to regime) and Rouhani is our only hope. The problem is Revolutionary Guard.
- NotSammyHagar 10y agoDoes SSL access to hacker news protect your identity in Iran? And do you think encrypted messages with telegram with 2 factor auth protects people? I think not, since they just have to get the messages of the people you chat with, the weaker link is the other side.
- hsivonen 10y agoHow does migration to a new phone work with Signal?
- jlund 10y agoWhen an adversary intercepts a Telegram SMS authentication code, this gives them pretty much complete access to a user's entire Telegram messaging history. This is true because messages are not end-to-end encrypted by default. The Telegram servers will happily return perennially stored transcripts to any client that is even temporarily considered valid. This is _not_ true for messaging applications that are end-to-end encrypted by default and that do not store plaintext on their servers. This isn't a subtle difference. Lots of comparisons in this thread fall victim to a sort of implied false equivocation. Using SMS as a form of authentication may be a quality that Telegram shares with other popular messaging applications, but it is uniquely susceptible to all of the associated pitfalls.
- mehdix 10y agoOnly public phone numbers are collected, no account is compromised, according to Telegram: https://telegram.org/blog/15million-reuters https://telegram.org/blog/15million-reuters
- Sami_Lehtinen 10y agoYet in this case all the encrypted secret chats are still kept private. Because even gaining access to the user account, doesn't allow you to read messages from secret chats.