Activists say Russian telecoms group hacked Telegram accounts
A group of Russian activists plans to sue telecoms group MTS over claims the company helped hack into their accounts on messaging app Telegram.
Opposition leader Alexei Navalny’s Anti-Corruption Foundation is exploring a US class-action lawsuit against the New York-listed Russian operator, after activists Oleg Kozlovsky and Georgy Alburov received warnings that their accounts on the app had been accessed from other devices last month.
The hack has raised concerns over the vulnerability of Telegram, which has gained popularity among the millennial generation, political activists and terrorist groups because of the privacy it offers.
Governments around the world are increasingly seeking ways to access data that has been encrypted by services such as these. Earlier this year, the FBI and Apple were engaged in a stand-off over a request to access data on the iPhone of one of the attackers in the San Bernardino shootings.
The activists published documents on Wednesday that they say show MTS colluded with the unknown intruders without following the legal procedures required for the FSB, the KGB’s successor agency, to gain access.
Mr Kozlovsky and Mr Alburov’s phone records show that MTS turned off their text messaging services at about 2:25am on April 29. Shortly afterwards, someone using Tor, an anonymous web browser, requested access to their Telegram accounts through a confirmation code.
Mr Kozlovsky and Mr Alburov were both asleep and could not receive the codes, which were sent to an unknown number and used to download their message history. Only after the hack was over were their text functions restored later that morning.
Though the activists admit they left themselves exposed by not using two-factor authentication or Telegram’s secret chat function, they blame MTS for actively assisting the intruder. “You can’t blame someone for having their car stolen if they leave it outside rather than in a garage,” Mr Kozlovsky said. “Some guy from the organs just called up and said, ‘Do this and that’.”
MTS, Russia’s largest mobile provider with over 70m subscribers, denies the charges. The company said it was conducting a detailed technical audit to see if the incident was the result of a virus attack.
Pavel Durov, the founder and chief executive of Telegram, said he suspects Russia’s secret services were behind the hacks. Though Russian law grants them the right to access any and all user data, it also requires the approval of a judge. That formality was not followed in this case.
“This is technically possible everywhere, but democratic countries typically try to avoid intercepting SMS without a court order, because such measures are highly visible and can lead to public uproar,” he said.
Frederic Jacobs, a former developer at rival messaging app Signal, said the activists would still have been vulnerable without end-to-end encryption, which means messages cannot be read from any device other than the sender’s. “If there are encrypted messages I cannot send messages to the recipient without showing that I am someone else,” he said.
Mr Durov founded Vkontakte, Russia’s biggest social network, but left Russia in 2013 saying that the Kremlin had forced him out of the company.
The FSB did not respond to requests for comment.