December 04, 2019, 11:02 / Updated December 04, 2019, 23:16 / Technologies

Group-IB spoke about a method for intercepting correspondence in Telegram

Attackers gained access to messages and files using authorization via SMS Ekaterina Kinyakina

Andrey Gordeev / Vedomosti

Group-IB specialists reported a number of hacks into the personal accounts of users of the Telegram messenger in order to gain illegal access to correspondence. The cyberattacks were carried out on iOS and Android devices owned by several Russian entrepreneurs: on December 3, 10 people were affected by the cyberattack; by the evening of December 4th, their number increased to 13.

According to Group-IB, on the devices of all victims, the only authorization factor was SMS. Users received a message with a confirmation code from the official Telegram service channel. At the same time, victims received an SMS with an activation code. Then a notification about logging into an account from a new device appeared in the service channel, while the IP addresses of the attackers in most cases were located in Samara.

Group-IB believes that attackers were able to view and copy activation codes from SMS messages that Telegram sends when activated on a new device. Technically, the cyber attack could have been carried out using a vulnerability in the SS7 protocol, i.e. signaling traffic exchanged between networks, for example to find the called subscriber. However, attacks on SS7 are rare. “It is much more difficult to implement such an attack; it requires certain qualifications in the field of data transmission networks and their protocols,” explains Kaspersky Lab anti-virus expert Viktor Chebyshev.

You can intercept SMS in several ways: on the side of the cellular operator with the participation of its employees, using malware on the device itself and using the so-called fake base station, which intercepts the signal from the smartphone and becomes an intermediary between it and the mobile operator. “Also, do not forget that under the Yarovaya Law and the SORM Law, special services can have access to SMS,” reminds cybersecurity expert Alexey Lukatsky.

300 mln

users constitute the monthly audience of the Telegram messenger

It would be difficult to implement such an attack directly, through the networks of Russian operators, a representative of one of them believes. “When registering or reinstalling an application, instant messengers and social networks send the subscriber an SMS with one-time codes. In order for such an SMS to reach the subscriber, the messenger must enter into an agreement with an SMS aggregator that guarantees delivery. He may be located in Europe and not have a direct agreement with the Russian mobile operator,” he explains. The aggregators themselves are not telecom operators, and their equipment is not subject to certification. The aggregator enters into an agreement with a Russian company that transits SMS messages through its frequencies. Such a chain may consist of 2–3 intermediaries (sometimes up to 8–10), on whose side the leak most likely occurred.

The victims, according to Group-IB, are clients of different cellular operators. Representatives of MTS and Tele2 declined to comment. A Megafon representative excludes the possibility of third parties having access to the infrastructure through which SMS messages from its subscribers pass. A representative of VimpelCom ( Beeline brand ) said that no such complaints had been received from subscribers. Group-IB also did not contact the company with official information and numbers by which they recorded such cases, he added.

Intercepting SMS traffic to hack Telegram accounts is not a new method. In April 2016, the accounts of an employee of the investigation department of the Anti-Corruption Foundation (FBK) Georgy Alburov, director of the NGO “Image of the Future” Oleg Kozlovsky and press secretary of the head of the FBK Alexei Navalny Kira Yarmysh were hacked. Then, according to the victims, unknown persons gained access to their accounts, although they did not receive any authorization code, and IT specialist Vladislav Zadolnikov, who collaborated with FBK, claimed that the hacking took place through intercepted SMS. All victims were MTS subscribers. Employees of the operator's expert department then stated that the service for receiving and transmitting SMS was temporarily disabled for these users.

“The theft of one-time codes from SMS is a well-known practice; it has existed for several years and is used, for example, by banking Trojans,” explains Lukatsky. “The fact that they began to steal them to gain access to the messenger is also expected.”

“Telegram is consistently included in the list of applications targeted by cybercriminals in various espionage campaigns,” says Chebyshev. “Such an attack could allow attackers to gain access to the correspondence of specific people.”

Group-IB considers authorization via SMS an ineffective way to protect against cyber attacks: this way, attackers can gain access to other instant messengers, social networks, email, and even mobile banking applications. Company specialists recommend using two-factor verification.

Users usually turn it off, says a person close to Telegram. “It can be enabled by those who have something to hide, but no messenger will make it mandatory,” he explains. “Any additional action when logging into the application will stop the growth of the number of users.” A request sent to Telegram remained unanswered.