{"id":5516,"date":"2024-09-02T12:12:07","date_gmt":"2024-09-02T09:12:07","guid":{"rendered":"https:\/\/yalovasondakika.com.tr\/?p=5516"},"modified":"2024-09-02T12:12:07","modified_gmt":"2024-09-02T09:12:07","slug":"siber-casuslar-guvenlik-aciklarindan-iceri-siziyor","status":"publish","type":"post","link":"https:\/\/yalovasondakika.com.tr\/index.php\/2024\/09\/02\/siber-casuslar-guvenlik-aciklarindan-iceri-siziyor\/","title":{"rendered":"Siber casuslar g\u00fcvenlik a\u00e7\u0131klar\u0131ndan i\u00e7eri s\u0131z\u0131yor"},"content":{"rendered":"<p><strong>ESET ara\u015ft\u0131rmac\u0131lar\u0131, Windows i\u00e7in WPS Office&#8217;te (CVE-2024-7262) bir uzaktan kod \u00e7al\u0131\u015ft\u0131rma g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ke\u015ffetti. A\u00e7\u0131\u011f\u0131n, G\u00fcney Kore&#8217;ye ba\u011fl\u0131 bir siber casusluk k\u00fcmesi olan APT-C-60 taraf\u0131ndan Do\u011fu Asya \u00fclkelerini gaye almak i\u00e7in kullan\u0131ld\u0131\u011f\u0131 payla\u015f\u0131ld\u0131.\u00a0<\/strong><\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p>ESET, temel nedeni incelerken yanl\u0131\u015fl\u0131 koddan (CVE-2924-7263) yararlanman\u0131n \u00f6b\u00fcr bir yolunu daha ke\u015ffetti. Koordineli bir if\u015fa s\u00fcrecinin akabinde, her iki g\u00fcvenlik a\u00e7\u0131\u011f\u0131 da yamaland\u0131. APT-C-60 h\u00fccumundaki son y\u00fck\u00fcn ESET Research&#8217;\u00fcn dahili olarak SpyGlace ismini verdi\u011fi siber casusluk yeteneklerine sahip \u00f6zel bir art kap\u0131 oldu\u011fu belirtildi. G\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tahlil eden ESET ara\u015ft\u0131rmac\u0131s\u0131 Romain Dumont \u015fu a\u00e7\u0131klamay\u0131 yapt\u0131: &#8220;APT-C-60 faaliyetlerini ara\u015ft\u0131r\u0131rken k\u00fcmenin bir\u00e7ok indirici bile\u015feninden birine at\u0131fta bulunan garip bir elektronik tablo dok\u00fcman\u0131 bulduk. WPS Office yaz\u0131l\u0131m\u0131n\u0131n d\u00fcnya \u00e7ap\u0131nda 500 milyondan fazla etkin kullan\u0131c\u0131s\u0131 var, bu da onu bilhassa Do\u011fu Asya b\u00f6lgesinde de\u011ferli say\u0131da bireye ula\u015fmak i\u00e7in \u00e2l\u00e2 bir gaye haline getiriyor.&#8221; ESET ve sat\u0131c\u0131 ortas\u0131ndaki koordineli g\u00fcvenlik a\u00e7\u0131\u011f\u0131 if\u015fa s\u00fcreci s\u0131ras\u0131nda, DBAPPSecurity ba\u011f\u0131ms\u0131z olarak silahland\u0131r\u0131lm\u0131\u015f g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n bir tahlilini yay\u0131mlad\u0131 ve APT-C-60&#8217;\u0131n \u00c7in&#8217;deki kullan\u0131c\u0131lara makus emelli yaz\u0131l\u0131m g\u00f6ndermek i\u00e7in g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararland\u0131\u011f\u0131n\u0131 do\u011frulad\u0131.<\/p>\n<p>\u00a0<\/p>\n<p>K\u00f6t\u00fc maksatl\u0131 dok\u00fcman, yayg\u0131n olarak kullan\u0131lan XLS elektronik tablo format\u0131n\u0131n bir MHTML d\u0131\u015fa transferi olarak geliyor. Bununla birlikte, WPS Spreadsheet uygulamas\u0131 kullan\u0131l\u0131rken t\u0131kland\u0131\u011f\u0131nda rastgele bir k\u00fct\u00fcphanenin y\u00fcr\u00fct\u00fclmesini tetiklemek i\u00e7in tasarlanm\u0131\u015f \u00f6zel olarak haz\u0131rlanm\u0131\u015f ve sakl\u0131 bir k\u00f6pr\u00fc i\u00e7erir. Al\u0131\u015f\u0131lmad\u0131k MHTML belge format\u0131, evrak a\u00e7\u0131l\u0131r a\u00e7\u0131lmaz bir evrak\u0131n indirilmesine m\u00fcsaade veriyor; bu nedenle, g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlan\u0131rken bu teknikten yararlanmak uzaktan kod y\u00fcr\u00fct\u00fclmesini sa\u011fl\u0131yor.\u00a0<\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p><strong>Romain Dumont ya\u015fanan olay\u0131 \u015f\u00f6yle a\u00e7\u0131klad\u0131<\/strong>: &#8220;Bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan faydalanmak i\u00e7in bir sald\u0131rgan\u0131n berbat hedefli bir k\u00fct\u00fcphaneyi gaye bilgisayar\u0131n eri\u015febilece\u011fi bir yerde, sistemde ya da uzak bir payla\u015f\u0131mda saklamas\u0131 ve belge yolunu evvelce bilmesi gerekir. Bu a\u00e7\u0131\u011f\u0131 maksat alan istismar geli\u015ftiricileri, bunu ba\u015farmalar\u0131na yard\u0131mc\u0131 olan birka\u00e7 numara biliyorlard\u0131. Elektronik tablo dok\u00fcman\u0131 WPS Spreadsheet uygulamas\u0131 ile a\u00e7\u0131ld\u0131\u011f\u0131nda uzak k\u00fct\u00fcphane otomatik olarak indirilir ve diskte saklan\u0131r&#8221;.<\/p>\n<p>\u00a0<\/p>\n<p>Bu tek t\u0131klamal\u0131 bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 oldu\u011fundan istismar geli\u015ftiricileri kullan\u0131c\u0131y\u0131 kand\u0131rmak ve evrak\u0131n ola\u011fan bir elektronik tablo oldu\u011funa ikna etmek i\u00e7in elektronik tablonun sat\u0131r ve s\u00fctunlar\u0131n\u0131n bir foto\u011fraf\u0131n\u0131 i\u00e7ine yerle\u015ftirmi\u015ftir. Berbat gayeli k\u00f6pr\u00fc resme ba\u011flanm\u0131\u015ft\u0131r b\u00f6ylelikle foto\u011fraftaki bir h\u00fccreye t\u0131kland\u0131\u011f\u0131nda istismar tetiklenecektir.<\/p>\n<p>\u00a0<\/p>\n<p>Kingsoft&#8217;un sessizce yay\u0131mlad\u0131\u011f\u0131 yamay\u0131 tahlil ettikten sonra Dumont, yan\u0131lg\u0131n\u0131n d\u00fczg\u00fcn bir bi\u00e7imde d\u00fczeltilmedi\u011fini fark etti ve kusurlu girdi do\u011frulamas\u0131 nedeniyle a\u00e7\u0131ktan yararlanman\u0131n \u00f6b\u00fcr bir yolunu ke\u015ffetti. ESET Research her iki g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 da Kingsoft&#8217;a bildirdi ve Kingsoft da bunlar\u0131 kabul ederek yamalad\u0131. \u0130ki y\u00fcksek k\u0131ymet dereceli CVE giri\u015fi olu\u015fturuldu: CVE-2024-7262\u00a0ve CVE-2024-7263.<\/p>\n<p>\u00a0<\/p>\n<p>Bu ke\u015fif, dikkatli bir yama do\u011frulama s\u00fcrecinin ve temel sorunun tam olarak ele al\u0131nd\u0131\u011f\u0131ndan emin olman\u0131n de\u011ferinin alt\u0131n\u0131 \u00e7iziyor. ESET, Windows i\u00e7in WPS Office kullan\u0131c\u0131lar\u0131na yaz\u0131l\u0131mlar\u0131n\u0131 en son s\u00fcr\u00fcme g\u00fcncellemelerini \u015fiddetle tavsiye ediyor.<\/p>\n<p>Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ESET, Windows i\u00e7in WPS Office kullan\u0131c\u0131lar\u0131na yaz\u0131l\u0131mlar\u0131n\u0131 en son s\u00fcr\u00fcme g\u00fcncellemelerini \u015fiddetle tavsiye ediyor.<\/p>\n","protected":false},"author":1,"featured_media":5517,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[1213,2306,243,2305,2307],"class_list":["post-5516","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji","tag-belge","tag-cve","tag-eset","tag-guvenlik-acigi","tag-wps"],"_links":{"self":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/5516"}],"collection":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/comments?post=5516"}],"version-history":[{"count":1,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/5516\/revisions"}],"predecessor-version":[{"id":5518,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/5516\/revisions\/5518"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/media\/5517"}],"wp:attachment":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/media?parent=5516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/categories?post=5516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/tags?post=5516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}