4 ms·
Stealing your Telegram account in 10 seconds flat
- deleted 3y ago[deleted]
- beeboobaa3 3y ago[flagged]
- rebane2001 3y agoI'm not using custom webfonts, just whatever your system has! The primary font stack is currently: `Charter, 'Bitstream Charter', 'Sitka Text', Cambria, serif;` I'd love to hear which font from the stack your browser is currently using, what it looks like for you at the moment, and if there's any Linux-specific fonts I should throw onto the stack for a better experience :)
- beeboobaa3 3y agoAccording to firefox it is using Bitstream Charter, on chrome it's using Sikta Text. Looks like this: https://imgur.com/a/rYi4tRZ https://imgur.com/a/rYi4tRZ Shame the HNers decided to flag my post so you'll probably never see this.
- user_7832 3y agoFor anyone wondering: the attacker needs physical access to your unlocked device, and replaces the telegram.org URL with a telegramz.org URL. The authentication part is stored in a string after the domain name... and the attack server gets it. Author's video demo here: https://vimeo.com/941755175 https://vimeo.com/941755175
- xcdzvyn 3y agoI don't want to spoil the surprise, but this is worth the read just for the "twist" at the end.
- fsdfsadoiasjl 3y agoThank you for this comment! I blurted out "Wait, what? How do you do that?" when I read that bit.
- rebane2001 3y agoThank you! Getting to read comments like this really makes all the extra effort worth it :)
- Suppafly 3y agowhich part was the 'twist' ?
- sunaookami 3y agoCaveat: This will also send a notification to the target that they logged into a new device on all their devices and the mobile app will show a prominent banner that someone else has access to their chats.
- sinuhe69 3y agoI don't get it. How could the author change the URL on my iPhone, even if it was unlocked? Manipulate the Wifi connections (like in any public place) could swap the URLs, but what about the secure handshake and certificates? Telegram doesn't use a secure connection, no end-to-end encryption or what?
- rebane2001 3y agoThis is a physical attack, the attacker edits the URL (as can be seen in the demo video).