The messenger from the state company "Krymtekhnologii" hacked in three minutes



After today's Telegram lock, many users are wondering what to do next. The installation of VPN and proxy servers in Russia increased tenfold . Saleswomen in stores help shoppers set up a proxy in the cart . According to analysts , more than 50% of Telegram users in Russia will set up VPN or proxy services and continue to use the instant messenger.

But some officials do not intend to put up with the fact that Russian citizens bypass the established prohibitions. Representatives of Roskomnadzor stated that Telegram poses a threat to the interests of the Russian Federation and the lives of citizens. The head of this organization, Alexander Zharov, promised to take measures with regard to various tools to bypass the blocking of the messenger. Presidential adviser on the Internet, German Klimenko himself stopped using Telegram and recommended switching to Russian ICQ .

At the same time, one after another, new IM services appear that position themselves as a replacement for Telegram. They intend to fight for the multimillion audience of the blocked messenger.

For example, the Mail.Ru Group holding has placed in the newspapers Vedomosti, Kommersant and Delovoy Peterburg an advertisement for a “messenger with channels” called “TamTam”.

There are other attempts to "import substitution." For example, the state-owned unitary enterprise Krymtekhnologii , which calls itself “the leading software developer in Crimea, automation systems for businesses in the business sector, state-owned enterprises, and e-government systems in the constituent entities of the Russian Federation,” presented its own development.

On April 14, the Crimetechnology company began open testing of the Dialog M messenger , which is positioned as a replacement for the blocked Telegram. The developers directly linked the early launch of their “fast and secure” service with the decision to block Telegram. One of the developers, Igor Martynenko, said that “Dialogue M” is presented as “a possible alternative to similar applications of foreign companies” and noted: “In terms of the conference, it will be even better than Telegram”.

“The testing features basic functionality that allows exchanging personal messages and messages in work groups, as well as sending files. While this is only a beta version. After the decision of Roskomnadzor to block Telegram, we decided to release our instant messenger to the test operation in order to get feedback from users. And in order to show them an alternative and possible replacement of popular applications with a Russian product, ”said Martynenko. - In the near future, it will certainly not be inferior to the existing messengers. He is never banned. In terms of the conference, it will be even better than Telegram, where addition, exit, delegation of rights to the conference is not very convenient. We are planning to add such functionality as an organizer - for organizations and individual users. Suppose a wife writes a list of products for her husband to buy. From this message, he can create a task in the organizer with a reminder. ”

First of all, the browser version of the messenger and the Android application ( dialogm.apk ) came out .

Unfortunately, the browser version of the Crimean messenger was far from being as secure as the developers had suggested. User TJ named Artem Legotin made sure that any account can be hijacked in 3-4 minutes. On the TJ website, he posted step-by-step instructions on how account hijacking takes place. The bottom line is that when authorizing in the messenger, you need to enter the four-digit code that came to the specified number. This code is verified at https://im.krtech.ru/auth/3556666666666/xxxx , where you can quickly check all 10,000 possible code variants and get an authorization token.



The same procedure can be repeated with the number of any registered user.

Artyom Legotin expressed hope that the developers of the Crimean messenger will improve and be more attentive to security. He stressed that for testing, he hacked the account of the editor TJ with his consent, and it is illegal to hack other people's accounts.

Note: When commenting on this material, please follow the rules of Geektimes. Please refrain from insults and toxic behavior. Postmoderation works in the comments.

Source: https://habr.com/ru/post/411539/


All Articles