TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or
2) A "telegram engineer" access my telegram account by changing a bit the system such that the SMS code is not sent over the GSM network but to his device?
Full question: Hi, I am concerned about a very specific part of the telegram security protocol. I have read a lot of criticism about the protocol itself, but no answer to my question yet. I also know about the telegram security contests, but I know that they are bullshit because they will only tell telegram secure against KPA attacks. Furthermore, I am not asking about secret chats, I know they are end-to-end encrypted.
I'm asking about the content of cloud based chats, which is kept on telegram servers. The only article I have found about the topic is this one. It states:
Since without E2EE Cloud Chat data is theoretically accessible, we use a unique distributed infrastructure to protect it. Cloud Chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, local intruders or engineers can't access this data, and several court orders from different jurisdictions are required to force us to give up any of it.
Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people's privacy and freedom of expression. Telegram can be forced to give up data only if an issue is grave and universal enough to pass the scrutiny of several different legal systems around the world.
As a result, we have disclosed 0 bytes of user data to third parties, including governments, to this day.
I suppose that when I want to access my telegram account from a new device and an authentication token is sent to my other telegram device, this authentication mode is secure, not just in the sense that it cannot be seen by hackers. In fact, I can easily imagine a scenario where the telegram server generates a token that is sent to my device, and the telegram app on my device computes the 6-digit code using both the token and my very private key. In this way a telegram employee can not access my account even if she knows the token generated on the server. (I hope I made it clear on this point, I am not so sure :) )
But, continuing the quote from the linked article:
If you are concerned about security in general, there are other important precautions you could take. Consider protecting your account by enabling 2-Step Verification and setting up a strong passcode to lock your app, then it won’t be possible to access your chats by stealing your device or even by intercepting your SMS code. You will find both options in ‘Settings’ under ‘Privacy and Security,’ ask me if you’d like more details.
Does that mean that if someone put my number into web.telegram.org and then intercept the SMS code she can just use it to log in to my account, pretending she is me?
I know that the SMS token only works with the keys generated by the device on which I am trying to access, but another possible attack scenario can be the following: a "telegram engineer" (I am not sure about how telegram employees are organized or structured) modifies the infrastructure a bit such that when a login is required, the token is not sent to me via SMS, but saved somewhere or such that it is sent to her device. Then she can enter my phone number in the official web.telegram.org web portal and log in as me.
Note that in these attacks it is not required to break any jurisdictions nor to access any encrypted database, just to use the existent official web login portal.
Please, do not reply with standard telegram insecurity flaws, nor with a RTFM answer unless it is a very specific part of the documentation which - I apologize - I could not found.
Thank you in advance.