![Fixxx](https://img-cc.com/data/avatars/m/50/50473.jpg?1724250746"){kind=avatar}
Fixxx
Moder
- Joined
- 20.08.24
- Messages
- 1,096
- Reaction score
- 4,259
- Points
- 113
There is an opinion that Telegram is one of the most secure messengers...
However, hackers have long learned to hack and steal accounts, gain access to personal messages and chat content.
We'll explain - how it happens, why someone would want to hack your Telegram account and how to protect yourself.
How accounts are stolen?
To hack Telegram hackers can use a variety of methods: from social engineering to intercepting SMS codes and infecting with viruses. They come up with new schemes to deceive, extract passwords, exploit vulnerabilities in the application and take advantage of people's lack of knowledge about basic internet safety rules. Below I will examine these methods in more detail.
Phishing:
One of the simplest methods is phishing. Hackers send messages of various contents - for example, it may contain a "gift" in the form of a subscription to Telegram Premium. The recipient clicks the button to receive the gift and a verification code is sent to them supposedly to activate the subscription. After entering the numbers the scammers gain access to their account and send messages to the contact list on their behalf.
The most common type of Telegram account theft is not the interception of SMS codes but simple phishing. The victim receives a message, usually from a fake familiar account, with content like: "Please follow the link and vote for my niece in the kindergarten drawing contest https://.....". The victim clicks the link and is asked to log into Telegram supposedly to protect against fraudulent votes. The naive user enters their number, SMS code and cloud password. Using this information the fraudster restores the session and compromises the account. Typically, fraudsters promptly extract all data from the Telegram account (chats, files, media, etc). There have been cases where compromised accounts were used for further distribution to the victim's contacts. In such cases the phishing message has a higher level of trust as the account isn't fake.
To achieve better results scammers use a more personalized approach to the victim rather than mass-sending the same text. Hackers pre-study available information about the person on the internet and use it during the conversation. Some use neural networks to create voice messages in the voice of the hacked account owner. Scammers also create chatbots that purportedly represent official brands, marketplaces or the Telegram administration.
The most recent case involved a scammer who knowing the full name and position of a company's manager created a fake Telegram account posing as the company's director then messaged an alleged employee and asked them to follow phishing links. If the person followed the link they would be instructed to perform actions that would result in losing access to their account or Telegram channel permanently.
In the summer 2023 phishing emails were received more frequently by teachers and healthcare workers. Scammers registered an account subscribed using the name of the hospital's chief physician or school director and set their photo as the avatar. They then messaged organization employees, claiming that a curator from the relevant Ministry or law enforcement officer would contact them with questions. In most of cases the scammers were interested in the user's money rather than their accounts.
SMS Interception:
In 2019 the computer forensics laboratory Group-IB reported a series of Telegram hacks. The incidents occurred on iOS and Android devices regardless of the victim's mobile operator. In all cases the only authentication factor was SMS. Initially, the user received a message from the official Telegram channel with the login code. Then an SMS with the activation code arrived along with a notification of a successful login on a new device. Group-IB reported that hackers used mobile internet (possibly disposable SIM cards) to access the victim's account.
To intercept the SMS code a hacker connects to the SS7 network of any foreign operator. By sending the SRI4SM service command over the network channel (specifying the victim's number as a parameter) the hacker receives a response with technical information from the subscriber's home network allowing them to know what services and subscriptions the victim has. Next with this data the hacker only needs to register the victim's number in a fake VLR simulating that the subscriber is in roaming and has registered with a new network. After that the hacker can receive SMS messages sent to this subscriber.
Hackers can carry out such attacks by gaining access to special equipment for intercepting SMS or using insider information from mobile operator employees. When hackers intercept the SMS code they use a fake cellular point and must physically be near the victim to force their device into a less secure 2G mode. Then encryption is disabled and the SMS code is intercepted. If your account is valuable to you it's advisable to register it only on the SIM card you physically have and prohibit the operator from reissuing the SIM card without your physical presence and a written statement.
Malware:
In a message a scammer can send a link, archive or file containing a hacking program. The victim clicks on the link or file and the login data is transmitted to the scammer. Additional challenges arise because many users use the automatic content download feature from received messages.
Vulnerabilities in the Application:
In the spring of 2022 several Telegram channels including thematic publics and media were hacked. Messages of the same content appeared in them. The media reported that the reason was the inclusion of Telegram bots, Crosser Bot and Controller Bot to which the hackers gained access. This isn't so much about Telegram vulnerabilities as it's about third-party services particularly those used by community administrators. While Telegram has its own bug bounty program and security team such services usually don't exist.
Why hackers want access to accounts?
Hacking a Telegram account allows access to chats, channels and all media files in chats. There can be several reasons:
- Extorting money from the victim for the return of the account. If a hacker gains access to the account, kicks you out and changes the password they can blackmail by threatening to disclose confidential data.
- Gaining access to a large channel. By hacking an administrator's account of a large channel hackers can post any content, insert virus links or sell the channel.
- Obtaining confidential commercial or personal information for personal gain.
- Accessing contacts. This allows sending spam advertisements or emails on behalf of the victim requesting money transfers.
Last edited:
