Privacy – Invasion of public people’s mobiles in the national politics

Former judge Sergio Moro is one of the protagonists of the leak of messages that have been disclosed by The Intercept website. In addition to the political issues raised through the disclosure of messages, another important issue is under discussion: how could these messages have been leaked? 

 According to the current Minister of Justice and Public Security, hackers have invaded his Telegram account for the purpose of obtaining data from his private conversations through the application. 

Hackers, as said by the minister, are the possible perpetrators of this message leak. However, it is still under debate how they managed to collect the content of these messages. The security of the Telegram application was put on hold after the news, prompting the company to publicly announce it on its official Twitter account: “There is no security breach in our platform or applications…” The company said, in response to a follower. 

According to a Telegram representative, some of the possible reasons are related to some malware, unauthorized access to the application, both through the mobile device and through the Telegram Web interface. Another aspect that allowed attackers to gain access to these conversations may be linked to the activation of a security measure called two-factor authentication. 

The two-factor authentication is a feature frequently used by applications to increase user security: to verify the identity of the user and to allow their access to the application, besides the password, a second access code is required, which can be obtained through SMS, a device (such as those used by banks) or a code generator application, such as Google Authenticator.  

Telegram itself reinforces that if the two-factor verification is set up, a leak is almost impossible to be achieved. “The Two-Factor Authentication adds a *password* to the SMS code. Therefore, even if someone has cloned your cellphone chip, that person cannot log in without the password.”, The company said in its Twitter. 

What could have happened?

The case is still being investigated, but the causes have not yet been determined. Some of the possibilities being considered are:

• SIM Swap: it is a technique used by malicious agents that aims to transfer the number and data of the victim’s SIM chip to another one in their possession. In this case, a social engineer convinces a telephone line operator that something has happened to their chip and needs to transfer the number to another. This type of attack requires that some information, such as the number, name and other data is already in the attacker’s hands. Depending on the case, there is not much trouble in getting this information, especially considering that we are dealing with public people. Similarly, agents can also persuade operators to perform this transfer, since they have access to all data required for the swap. 

In an attack like this, the two-factor authentication may not be very helpful, since the verification code is sent via SMS. In this case, the attacker would have easy access to the code, since it would be sent to the device after the swap was made. Symptoms that the SIM card may have been compromised can be identified when the phone line begins to display errors and the messages are no longer received. To prevent this from happening, the only way is to disconnect the number from important accounts whenever possible and identify when the telephone line has problems as quickly as possible;

• Physical access: another possibility is that some third party has had physical access to the minister’s device. For various reasons, mobile devices without active protection mechanisms can be left without supervision and accessed by a malicious agent. The physical access to the mobile device gives the attacker permission to view and manipulate all applications, including taking screenshots, copying and sending messages, or any other malicious action;
• Malware: Viruses and malware are the reasons for much of the data and information leaks. Once infected, the device can be controlled by a third party, without even the victim noticing it. In this case, a keylogger (a spyware-type malware) installed on the device may have recorded all the entered information, even the two-factor authentication code. The malware used for this purpose is most often sent via phishing emails, prompting the user to access a link or download a malicious file. The infection can also be done through a USB connection with compromised devices;
• Vulnerability Exploitation: Unknown faults (0-day) may also be one of the reasons and may have been exploited before a device’s software or application update has been sent. A few weeks ago, something like that has occurred with the Whatsapp application, Telegram’s most popular competitor: a 0-day vulnerability allowed for the installation of spyware over a call that did not need to be answered. As simple as that;
• SS7: the acronym for Signaling System No. 7 is a protocol used between the operators for sending messages and calls. Many attackers already find failures in this channel that allow them to manipulate the route of messages and calls and intercept them once the target number is known, and with advanced knowledge, they can even get control over the device. 

Beyond just messaging applications, privacy can be compromised in a number of ways, as these devices have become essential for everyday life and store personal information that is very important to the owners, such as documents, photos, audios, and others. Some ways to maintain the privacy of your data on these devices include:

• Understanding the permissions of installed applications – what your applications are collecting and storing about you through enabled permissions is sometimes not necessary for their operation, such as location, device data, and features. There is also the risk of fake applications that mimic the originals, but with malicious permissions to do some damage, as it was the case for cryptocurrency transaction applications that were allowed to access all of the users’ SMS and e-mail information to practice bypass in systems with two-factor authentication. 

• Using encryption-guaranteed messaging applications – Telegram is considered by many to be the safest option available for messaging, which may have prompted the current Minister and Lava Jato’s attorneys to elect it to handle matters relating to the operation. However, the application has been criticized for the type of encryption it uses, and the way it handles SS7 attacks. You should try to understand and consider whether the solutions provided by this type of application meet your needs, and what settings should be used to make the application more secure. In addition to Telegram, other applications such as Signal and Threema have been well rated and recognized for their security mechanisms;
• Using trusted networks – public networks do not have encryption, which means the activities and information are transmitted in plain text, without any kind of protection to users. Thus, a malicious agent with advanced knowledge in networks and sniffer applications – software that captures the data traffic of a device connected to a network – can see messages and any other information of the connected target device. The best option, in this case, is to use private Wi-Fi networks. 
• Keeping an eye for phishing attacks – The privacy of a device can be compromised when it comes to messages that can cause the victim to become infected with viruses, such as by accessing a fake page that induces the user to enter their credentials or sensitive data, and then the attack takes place.  
• Using a multi-factor authentication – two-factor authentication is a good measure to avoid leaks, but it may still not be the absolute guarantee that the information will not be accessed. This is due to the fact that, once the device is compromised, the verification code is no longer an authentic measure. Unfortunately, some applications do not allow more than one authentication factor, but whenever possible, it is recommended to use some other factor besides credentials passwords, such as tokens that can be connected to the device’s USB port guarantee the access authenticity. 
• Protecting the device through physical means – no security control can protect a device permanently if someone has access to it. One should be aware of where the device is and if it is not in the hands of someone who should not have access to it. Requiring a password to unlock the device is a great measure, but the password must be known exclusively to those who need it and created through a strong standard. 

There are many vulnerabilities that can lead to privacy breaches, particularly within a mobile device that has endless personal information, but there are also measures to prevent these vulnerabilities from being exploited. It is up to the user to assume the responsibility for protection by taking the necessary measures and controls to keep their privacy secure.