{"id":53591,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kak-zloumyshlenniki-mogut-chitat-vashu-perepisku-v-telegram-i-kak-im-v-etom-pomeshat"},"modified":"2020-02-18T14:01:31","modified_gmt":"2020-02-18T11:01:31","slug":"kak-zloumyshlenniki-mogut-chitat-vashu-perepisku-v-telegram-i-kak-im-v-etom-pomeshat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/kak-zloumyshlenniki-mogut-chitat-vashu-perepisku-v-telegram-i-kak-im-v-etom-pomeshat","title":{"rendered":"Hur angripare kan l\u00e4sa din chatt i Telegram. Och hur du kan hindra dem fr\u00e5n att g\u00f6ra det","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Hur<\/p>\n

I slutet av 2019 kontaktade flera ryska entrepren\u00f6rer avdelningen f\u00f6r cyberbrott fr\u00e5n Group-IB med ett problem som r\u00f6rde obeh\u00f6rig \u00e5tkomst till deras kommunikation i meddelandetj\u00e4nsten Telegram. Incidenterna intr\u00e4ffade p\u00e5 enheter med iOS och Android, oavsett vilken federala mobiloperat\u00f6r den drabbade kunden tillh\u00f6rde.<\/p>\n

Attacken inleddes med att anv\u00e4ndaren fick ett meddelande i meddelandetj\u00e4nsten Telegram fr\u00e5n Telegrams servicekanal (den officiella kanalen med bl\u00e5 verifieringsmarkering) som inneh\u00f6ll en bekr\u00e4ftelsekod som anv\u00e4ndaren inte hade beg\u00e4rt. D\u00e4refter skickades ett SMS med aktiveringskoden till offrets smartphone \u2014 och n\u00e4stan omedelbart kom en notifikation till servicekanalen i Telegram om att kontot hade loggats in fr\u00e5n en ny enhet.<\/a><\/noindex><\/p>\n

\"Hur <\/p>\n

I alla fall som \u00e4r k\u00e4nt f\u00f6r Group-IB loggade angriparna in p\u00e5 ett annat konto via mobilinternet (troligtvis anv\u00e4ndes eng\u00e5ngssimkort), och IP-adressen f\u00f6r angriparna befann sig i de flesta fall i Samara. <\/p>\n

\u00c5tkomst p\u00e5 best\u00e4llning <\/h3>\n

\nUnders\u00f6kningen av Group-IB:s laboratorium f\u00f6r datakriminalitet, dit de drabbades elektroniska enheter skickades, visade att utrustningen inte var infekterad med spionprogram eller banktrojaner, kontona var inte hackade, och SIM-kortsbyten hade inte utf\u00f6rts. I alla fall fick angriparna tillg\u00e5ng till offrets meddelandetj\u00e4nst via SMS-koder som erh\u00f6lls vid inloggning p\u00e5 kontot med en ny enhet. <\/p>\n

Denna procedur ser ut som f\u00f6ljer: n\u00e4r meddelandetj\u00e4nsten aktiveras p\u00e5 en ny enhet skickar Telegram en kod via servicekanalen till alla anv\u00e4ndarens enheter, och sedan (p\u00e5 beg\u00e4ran) skickas ett SMS till telefonen. Genom att k\u00e4nna till detta initierar angriparna sj\u00e4lva beg\u00e4ran om att meddelandetj\u00e4nsten ska skicka ett SMS med aktiveringskoden, f\u00e5ngar detta SMS och anv\u00e4nder den erh\u00e5llna koden f\u00f6r att framg\u00e5ngsrikt autentisera sig i meddelandetj\u00e4nsten. <\/p>\n

Genom detta f\u00e5r angriparna olaglig \u00e5tkomst till alla aktuella chattar, f\u00f6rutom de hemliga, samt till historiken f\u00f6r konversationer i dessa chattar, inklusive filer och fotografier som har skickats i dem. N\u00e4r en legitim Telegram-anv\u00e4ndare uppt\u00e4cker detta kan de tvinga avsluta angriparens session. Tack vare den implementerade skyddsmekanismen kan det motsatta inte intr\u00e4ffa; angriparen kan inte avsluta de \u00e4ldre sessionerna f\u00f6r den verkliga anv\u00e4ndaren inom 24 timmar. Det \u00e4r d\u00e4rf\u00f6r viktigt att snabbt uppt\u00e4cka en obeh\u00f6rig session och avsluta den f\u00f6r att inte f\u00f6rlora \u00e5tkomsten till kontot. Specialister fr\u00e5n Group-IB har skickat en notis till Telegram-teamet om sin forskning kring situationen.<\/p>\n

Unders\u00f6kningen av incidenterna forts\u00e4tter, och f\u00f6r n\u00e4rvarande har det inte fastst\u00e4llts exakt vilken metod som anv\u00e4ndes f\u00f6r att kringg\u00e5 SMS-faktorn. Vid olika tidpunkter har forskare gett exempel p\u00e5 avlyssning av SMS genom attacker p\u00e5 protokoll som SS7 eller Diameter, som anv\u00e4nds i mobiln\u00e4t. Teoretiskt kan s\u00e5dana attacker realiseras genom olaglig anv\u00e4ndning av specialtekniska medel eller insiderinformation fr\u00e5n mobiloperat\u00f6rer. S\u00e4rskilt p\u00e5 hackarforum i Darknet finns det f\u00e4rska annonser som erbjuder hacking av olika meddelandeappar, inklusive Telegram. <\/p>\n

\"Hur<\/p>\n

\u00bbSpecialister i olika l\u00e4nder, inklusive Ryssland, har upprepade g\u00e5nger p\u00e5pekat att sociala n\u00e4tverk, mobilbanking och meddelandeappar kan hackas genom en s\u00e5rbarhet i SS7-protokollet, men detta har varit isolerade fall av riktade attacker eller experimentella studier, s\u00e4ger Sergey Lupanin, chef f\u00f6r avdelningen f\u00f6r unders\u00f6kning av cyberbrott p\u00e5 Group-IB. I en serie nya incidenter, som redan \u00f6verstiger 10, \u00e4r det uppenbart att angriparna vill g\u00f6ra denna inkomstmetod till en rutin. F\u00f6r att detta inte ska ske \u00e4r det n\u00f6dv\u00e4ndigt att h\u00f6ja sin egen niv\u00e5 av digital hygien: \u00e5tminstone anv\u00e4nda tv\u00e5faktorsautentisering d\u00e4r det \u00e4r m\u00f6jligt och l\u00e4gga till en obligatorisk andra faktor till SMS, vilket funktionellt finns inbyggt i Telegram sj\u00e4lv.<\/p>\n

Hur skyddar man sig?<\/h3>\n

\n 1. Telegram har redan implementerat alla n\u00f6dv\u00e4ndiga alternativ f\u00f6r cybers\u00e4kerhet som kan neutralisera angriparnas insatser.
\n 2. P\u00e5 iOS- och Android-enheter f\u00f6r Telegram beh\u00f6ver du g\u00e5 till Telegram-inst\u00e4llningarna, v\u00e4lja fliken \"Sekretess\" och st\u00e4lla in \"Molnl\u00f6senordTv\u00e5stegsverifiering\" eller \"Two step verification\". En detaljerad beskrivning av hur man aktiverar detta alternativ finns i instruktionerna p\u00e5 meddelandeappens officiella webbplats: telegram.org\/blog\/sessions-and-2-step-verification<\/a><\/noindex> (https:\/\/telegram.org\/blog\/sessions-and-2-step-verification)<\/p>\n

\"Hur<\/p>\n

3. Det \u00e4r viktigt att inte ange en e-postadress f\u00f6r att \u00e5terst\u00e4lla detta l\u00f6senord, eftersom \u00e5terst\u00e4llning av l\u00f6senord vanligtvis ocks\u00e5 sker via SMS. P\u00e5 samma s\u00e4tt kan du \u00f6ka s\u00e4kerheten f\u00f6r ditt konto i WhatsApp.<\/p>\n

\r\n \"Spela\r\n
<\/div>\r\n <\/div><\/center>
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u043d\u0446\u0435 2019 \u0433\u043e\u0434\u0430 \u0432 \u043e\u0442\u0434\u0435\u043b \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0439 Group-IB \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438\u0441\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a \u0438\u0445 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0435 \u0432 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0435 Telegram. \u0418\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0438 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 iOS \u0438 Android, \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0442\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u043a\u0430\u043a\u043e\u0433\u043e \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u043e\u0442\u043e\u0432\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u044f\u0432\u043b\u044f\u043b\u0441\u044f \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0439. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u043b\u0430\u0441\u044c \u0441 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0432 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440 Telegram \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u043b\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53591","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hur angripare kan l\u00e4sa din konversation i Telegram. Och hur du kan f\u00f6rhindra det | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/kak-zloumyshlenniki-mogut-chitat-vashu-perepisku-v-telegram-i-kak-im-v-etom-pomeshat","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0447\u0438\u0442\u0430\u0442\u044c \u0432\u0430\u0448\u0443 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0443 \u0432 Telegram. \u0418 \u043a\u0430\u043a \u0438\u043c \u0432 \u044d\u0442\u043e\u043c \u043f\u043e\u043c\u0435\u0448\u0430\u0442\u044c | ProHoster","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/kak-zloumyshlenniki-mogut-chitat-vashu-perepisku-v-telegram-i-kak-im-v-etom-pomeshat","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53591","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:01:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:49","updated":"2026-01-24 08:01:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=53591"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53591\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=53591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=53591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=53591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}