0

How could Telegram OTP password be hacked?

My timeline of Telegram hack attempt today:

хх:хх Login attempt?
00:47 OTP code in Telegram
00:47 OTP code in SMS to associated mobile
00:48 incomplete login, device added (iPhone 12 from Canary Wharf, London UK - different country)
00:53 incomplete login notification in Telegram

Obviously stopped by 2FA password 🔑

Do they sniff on Telegram SMS service providers and look for non-secure OTP SMS routing to your mobile (which they know and used to login)?

telegram notifications device added SMS OTP

Improve this question
2
  • 1
    If you’re worried, just contact Telegram support. This is a question for them, not us.
    – security_paranoid
    Commented Dec 6 at 9:51
  • 3
    I'm not aware anybody here has access to the internal systems of Telegram, and without concrete data, discussing how the OTP might have been compromised would be pure speculation. If Telegram offers stronger authentication than a password + SMS OTP, then use that. If not, make sure the password is completely immune to brute-force attacks by using a randomly generated, sufficiently long string -- a password manager can help with this.
    – Ja1024
    Commented Dec 6 at 10:31

1 Answer 1

Reset to default
1

Looks like OTP never got compromised. The logs are showing "incomplete login" and that means the attacker could not login because OTP was in the way.

I don't use Telegram and don't know the authentication details, but if Telegram allows you to connect on another device using a code sent to your current device, this can happen: the attacker gets your userid (or login, or whatever is used to authenticate on Telegram), tries to connect on a new device, but don't have the OTP token.

If Telegram have a password, your password may have leaked. Maybe you reused it and some other service leaked it, maybe the attacker guessed it. If that's the case, change the password, and consider using a password manager.

Improve this answer
2
  • According to the messages in the screenshots, the OTP was compromised, not the password: “The code was entered correctly, but no correct password was given.”
    – Ja1024
    Commented Dec 6 at 17:55
  • 1
    It says "OTP in Telegram" so I assume was his device. And the SMS was on his device too.
    – ThoriumBR
    Commented Dec 6 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .