{"id":17716,"date":"2023-11-04T09:00:00","date_gmt":"2023-11-04T06:00:00","guid":{"rendered":"https:\/\/rockvell.com\/?p=17716"},"modified":"2023-11-04T16:24:22","modified_gmt":"2023-11-04T13:24:22","slug":"trianqulyasiya-%c9%99m%c9%99liyyati","status":"publish","type":"post","link":"https:\/\/rockvell.com\/?p=17716","title":{"rendered":"\u201cTrianqulyasiya\u201d \u018fm\u0259liyyat\u0131"},"content":{"rendered":"\n

\u201cTrianqulyasiya\u201d \u018fm\u0259liyyat\u0131: \u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259ri t\u0259cav\u00fczkarlar\u0131n m\u00fcdafi\u0259sind\u0259n nec\u0259 yan ke\u00e7ib<\/strong><\/p>\n\n\n\n

\u201cKaspersky\u201dnin\u00a0 Qlobal T\u0259dqiqat v\u0259 T\u0259hlil Qrupunun (GReAT) ekspertl\u0259ri T\u0259hl\u00fck\u0259sizlik Analitikl\u0259ri Sammiti (SAS) konfrans\u0131 zaman\u0131 \u201ctrianqulyasiya\u201d \u0259m\u0259liyyat\u0131n\u0131n t\u0259hlilinin yeni t\u0259f\u0259rr\u00fcatlar\u0131n\u0131 a\u00e7\u0131qlay\u0131blar. Yeni m\u0259lumatlar iOS-da insidentin \u0259sas\u0131n\u0131 t\u0259\u015fkil ed\u0259n z\u0259iflikl\u0259ri a\u015fkar etm\u0259y\u0259 imkan ver\u0259n h\u00fccumlar\u0131n t\u0259dqiqat metodlar\u0131na aiddir. M\u00fct\u0259x\u0259ssisl\u0259r, h\u0259m\u00e7inin kampaniyan\u0131n b\u00fct\u00fcn m\u0259rh\u0259l\u0259l\u0259rini ba\u015fa d\u00fc\u015fm\u0259k \u00fc\u00e7\u00fcn qapal\u0131 \u0259m\u0259liyyat sistemini \u00f6yr\u0259nm\u0259y\u0259 v\u0259 t\u0259cav\u00fczkarlar\u0131n m\u00fcdafi\u0259 mexanizml\u0259rind\u0259n yan ke\u00e7m\u0259sin\u0259 imkan ver\u0259n al\u0259tl\u0259r haqq\u0131nda m\u0259lumat payla\u015f\u0131blar.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

Q\u0131sa m\u0259lumat.<\/strong> \u201cKaspersky\u201d iOS cihazlar\u0131n\u0131 h\u0259d\u0259f alan \u201cTrianqulyasiya \u0259m\u0259liyyat\u0131\u201d adl\u0131 APT kampaniyas\u0131 haqq\u0131nda bu yay m\u0259lumat verib<\/a>. H\u00fccumlarda istifad\u0259\u00e7il\u0259rd\u0259n he\u00e7 bir h\u0259r\u0259k\u0259t t\u0259l\u0259b etm\u0259y\u0259n \u201ciMessage\u201d mesajlar\u0131 vasit\u0259sil\u0259 istismarlar\u0131n yay\u0131lmas\u0131n\u0131n m\u00fcr\u0259kk\u0259b metodundan istifad\u0259 edilib. N\u0259tic\u0259d\u0259 t\u0259cav\u00fczkarlar cihaz v\u0259 istifad\u0259\u00e7i m\u0259lumatlar\u0131 \u00fcz\u0259rind\u0259 tam n\u0259zar\u0259ti \u0259l\u0259 ke\u00e7ir\u0259 bilibl\u0259r. \u201cGReAT\u201d\u0131n m\u0259lumat\u0131na g\u00f6r\u0259, onlar\u0131n \u0259sas m\u0259qs\u0259di casusluq olub. H\u00fccumun m\u00fcr\u0259kk\u0259bliyi v\u0259 iOS-un qapal\u0131 olmas\u0131 s\u0259b\u0259bind\u0259n t\u0259f\u0259rr\u00fcatl\u0131 texniki analizin apar\u0131lmas\u0131 \u00fc\u00e7\u00fcn uzun vaxt t\u0259l\u0259b olunub.<\/p>\n\n\n\n

T<\/strong>\u0259<\/strong>cav<\/strong>\u00fc<\/strong>zkarlar<\/strong> <\/strong>hans<\/strong>\u0131 <\/strong>z<\/strong>\u0259<\/strong>iflikl<\/strong>\u0259<\/strong>rd<\/strong>\u0259<\/strong>n<\/strong> <\/strong>istifad<\/strong>\u0259 <\/strong>edib<\/strong>?<\/strong> T\u0259hl\u00fck\u0259sizlik Analitikl\u0259ri Sammitind\u0259 \u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259ri be\u015f bo\u015fluqdan istifad\u0259 ed\u0259n h\u00fccum z\u0259ncirini tam a\u015fkar etm\u0259y\u0259 imkan ver\u0259n bir ayl\u0131q t\u0259hlilin texniki detallar\u0131n\u0131 a\u00e7\u0131qlay\u0131blar. Onlardan d\u00f6rd\u00fcn\u00fcn \u0259vv\u0259ll\u0259r m\u0259lum olmayan s\u0131f\u0131r g\u00fcn z\u0259ifliyi oldu\u011fu ortaya \u00e7\u0131x\u0131b.<\/p>\n\n\n\n

\u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259rinin d\u0259 m\u00fc\u0259yy\u0259n etdiyi kimi, h\u00fccumun ilkin giri\u015f n\u00f6qt\u0259si \u015frift emal\u0131 bazas\u0131ndak\u0131 bo\u015fluq olub. \u0130kinci q\u00fcsur yadda\u015f x\u0259rit\u0259l\u0259\u015fdirm\u0259 kodunda a\u015fkar edilib ki, bu da son d\u0259r\u0259c\u0259 t\u0259hl\u00fck\u0259lidir v\u0259 istismar\u0131 asand\u0131r. Onun vasit\u0259sil\u0259 cihaz\u0131n fiziki yadda\u015f\u0131na daxil olmaq imkan\u0131 \u0259ld\u0259 edilib. T\u0259cav\u00fczkarlar \u201cApple\u201d prosessoru \u00fc\u00e7\u00fcn \u0259n son aparat m\u00fcdafi\u0259sind\u0259n yan ke\u00e7m\u0259k \u00fc\u00e7\u00fcn daha iki bo\u015fluqdan istifad\u0259 etdil\u0259r. H\u0259m\u00e7inin m\u0259lum olub ki, \u201ciMessage\u201d vasit\u0259sil\u0259 uzaqdan \u201ciOS\u201d cihazlar\u0131n\u0131 yoluxdurmaq imkan\u0131 il\u0259 yana\u015f\u0131, t\u0259cav\u00fczkarlar \u201cSafari\u201d veb-brauzeri vasit\u0259sil\u0259 h\u00fccumlar\u0131n h\u0259yata ke\u00e7irilm\u0259si \u00fc\u00e7\u00fcn platformaya da malikdirl\u0259r. Bunun say\u0259sind\u0259 bo\u015fluqlar\u0131n be\u015fincisini a\u015fkar etm\u0259k v\u0259 aradan qald\u0131rmaq m\u00fcmk\u00fcn olub.<\/p>\n\n\n\n

\u201cKaspersky\u201dd\u0259n g\u0259l\u0259n bildiri\u015find\u0259n sonra \u201cApple\u201d \u015firk\u0259ti r\u0259smi olaraq \u201cGReAT\u201d t\u0259dqiqat\u00e7\u0131lar\u0131 t\u0259r\u0259find\u0259n a\u015fkar edilmi\u015f d\u00f6rd s\u0131f\u0131r g\u00fcn bo\u015flu\u011funu \u0259hat\u0259 ed\u0259n v\u0259 iPhone, iPod, iPad, Mac OS cihazlar\u0131, Apple TV v\u0259 Apple Watch daxil olmaqla \u00e7oxlu sayda Apple m\u0259hsullar\u0131na y\u00f6n\u0259l\u0259n t\u0259hl\u00fck\u0259sizlik yenil\u0259m\u0259l\u0259rini yay\u0131mlay\u0131b (CVE-2023-32434, CVE-2023-32435, CVE-2023-38606, CVE-2023-41990).<\/p>\n\n\n\n

M<\/strong>\u00fc<\/strong>t<\/strong>\u0259<\/strong>x<\/strong>\u0259<\/strong>ssisl<\/strong>\u0259<\/strong>r<\/strong> <\/strong>h<\/strong>\u00fc<\/strong>cum<\/strong> <\/strong>z<\/strong>\u0259<\/strong>ncirini<\/strong> <\/strong>a<\/strong>\u00e7\u0131\u011f<\/strong>a<\/strong> \u00e7\u0131<\/strong>xarma<\/strong>\u011f<\/strong>a<\/strong> <\/strong>nec<\/strong>\u0259 <\/strong>m<\/strong>\u00fc<\/strong>v<\/strong>\u0259<\/strong>ff<\/strong>\u0259<\/strong>q<\/strong> <\/strong>olublar<\/strong>?<\/strong> Bu bo\u015fluqlar\u0131 a\u015fkar etm\u0259k v\u0259 t\u0259cav\u00fczkarlar\u0131n nec\u0259 i\u015fl\u0259diyini anlamaq \u00fc\u00e7\u00fcn \u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259ri ixtira\u00e7\u0131 kimi davranmal\u0131 olublar. X\u00fcsusil\u0259, onlar t\u0259cav\u00fczkarlar\u0131n \u015fifr\u0259l\u0259m\u0259sind\u0259n yan ke\u00e7\u0259c\u0259k \u00fcsullar tapmal\u0131 idil\u0259r. Tap\u015f\u0131r\u0131q iOS-un qapal\u0131 olmas\u0131 il\u0259 daha da \u00e7\u0259tinl\u0259\u015fib. M\u0259s\u0259l\u0259n, yoluxma z\u0259ncirinin ba\u015flan\u011f\u0131c\u0131 olan iMessage-d\u0259ki qo\u015fman\u0131 \u00e7\u0131xarmaq \u00fc\u00e7\u00fcn \u015fifr\u0259li m\u0259tni v\u0259 AES \u015fifr\u0259l\u0259m\u0259 a\u00e7ar\u0131n\u0131 \u0259ld\u0259 etm\u0259k laz\u0131m olub. Birinci komponent \u201cmitmproxy\u201d vasit\u0259sil\u0259 \u201ciCloud\u201d serverl\u0259rin\u0259 ged\u0259n trafikin qar\u015f\u0131s\u0131n\u0131 almaqla \u0259ld\u0259 edilib. A\u00e7arla eyni \u015feyi etm\u0259k m\u00fcmk\u00fcn olmay\u0131b, \u00e7\u00fcnki o, \u201ciMessage\u201d protokolu il\u0259 g\u00f6nd\u0259rilir. Buna g\u00f6r\u0259 d\u0259 m\u00fct\u0259x\u0259ssisl\u0259r a\u00e7ar\u0131n \u201cSMS.db\u201d m\u0259lumat bazas\u0131nda saxlanmas\u0131 \u00fc\u00e7\u00fcn qo\u015fman\u0131n \u015fifr\u0259l\u0259nmi\u015f m\u0259tninin y\u00fckl\u0259nm\u0259si prosesini pozma\u011f\u0131n qaydas\u0131n\u0131 m\u00fc\u0259yy\u0259n edibl\u0259r. Bunun \u00fc\u00e7\u00fcn onlar \u201cmitmproxy\u201d \u0259lav\u0259sind\u0259n istifad\u0259 ed\u0259r\u0259k \u015fifr\u0259li m\u0259tnd\u0259 bir ne\u00e7\u0259 bayt\u0131 d\u0259yi\u015fdirib, daha sonra is\u0259 yoluxmu\u015f cihazdan \u201ciTunes\u201d ehtiyat n\u00fcsx\u0259sini y\u00fckl\u0259yib v\u0259 a\u00e7ar\u0131 onun ehtiva etdiyi m\u0259lumat bazas\u0131ndan \u00e7\u0131xar\u0131blar.<\/p>\n\n\n\n

\u201cYeni \u2018Apple\u2019 \u00e7ipl\u0259rin\u0259 malik cihazlar\u0131n texniki t\u0259hl\u00fck\u0259sizlik x\u00fcsusiyy\u0259tl\u0259ri onlar\u0131n kiberh\u00fccumlara qar\u015f\u0131 m\u00fcqavim\u0259tini \u0259h\u0259miyy\u0259tli d\u0259r\u0259c\u0259d\u0259 art\u0131r\u0131r, amma onlar tamamil\u0259 toxunulmaz hesab olunmurlar. Trianqulyasiya \u0259m\u0259liyyat\u0131 \u2018iMessage\u2019a tan\u0131\u015f olmayan m\u0259nb\u0259l\u0259rd\u0259n daxil olan \u0259lav\u0259l\u0259r bar\u0259d\u0259 ehtiyatl\u0131 olma\u011f\u0131n vacibliyini xat\u0131rlad\u0131r. Bu kampaniyadak\u0131 strategiyalar\u0131n n\u0259tic\u0259l\u0259ri ox\u015far h\u00fccumlara qar\u015f\u0131 m\u00fcbariz\u0259 \u00fc\u00e7\u00fcn d\u0259y\u0259rli t\u0259limatlar ver\u0259 bil\u0259r. H\u0259m\u00e7inin, sistemin qapal\u0131 t\u0259bi\u0259ti il\u0259 onun t\u0259dqiqat\u00e7\u0131lar \u00fc\u00e7\u00fcn \u0259l\u00e7atanl\u0131\u011f\u0131 aras\u0131nda tarazl\u0131\u011f\u0131n tap\u0131lmas\u0131 t\u0259hl\u00fck\u0259sizliyi yax\u015f\u0131la\u015fd\u0131rma\u011fa k\u00f6m\u0259k ed\u0259 bil\u0259r\u201d, – dey\u0259 \u201cKaspersky\u201dnin kibert\u0259hl\u00fck\u0259sizlik \u00fczr\u0259 eksperti Boris Larin qeyd edir.<\/p>\n\n\n\n

\u0130stifad\u0259\u00e7il\u0259r\u0259 h\u00fccumlara qar\u015f\u0131 m\u00fcdafi\u0259 olunmaqda k\u00f6m\u0259k etm\u0259k \u00fc\u00e7\u00fcn \u201cKaspersky\u201d \u0259vv\u0259ll\u0259r h\u00fccum haqq\u0131nda \u0259trafl\u0131 hesabat<\/a> d\u0259rc etmi\u015f v\u0259 cihaz\u0131n virusa yoluxub-yoluxmad\u0131\u011f\u0131n\u0131 yoxlama\u011fa imkan ver\u0259n x\u00fcsusi yard\u0131m proqram\u0131<\/a> haz\u0131rlam\u0131\u015fd\u0131.<\/p>\n\n\n\n

\u201cSisteml\u0259ri qabaqc\u0131l kiberh\u00fccumlardan qorumaq asan m\u0259s\u0259l\u0259 deyil, x\u00fcsus\u0259n iOS kimi qapal\u0131 sisteml\u0259rd\u0259 bu m\u00fcr\u0259kk\u0259b bir prosesdir. Buna g\u00f6r\u0259 d\u0259 bel\u0259 hadis\u0259l\u0259rin a\u015fkarlanmas\u0131 v\u0259 qar\u015f\u0131s\u0131n\u0131n al\u0131nmas\u0131 \u00fc\u00e7\u00fcn \u00e7oxs\u0259viyy\u0259li t\u0259hl\u00fck\u0259sizlik t\u0259dbirl\u0259rinin h\u0259yata ke\u00e7irilm\u0259si vacibdir\u201d, – dey\u0259 \u201cKaspersky\u201d Laboratoriyas\u0131n\u0131n Qlobal Ara\u015fd\u0131rmalar M\u0259rk\u0259zinin r\u0259hb\u0259ri \u0130qor Kuznetsov \u00f6z n\u00f6vb\u0259sind\u0259 bildirir.<\/p>\n\n\n\n

\u201cTrianqulyasiya\u201d \u0259m\u0259liyyat\u0131 haqq\u0131nda \u0259trafl\u0131 m\u0259lumat\u0131 https:\/\/securelist.ru\/operation-triangulation-catching-wild-triangle\/108287\/<\/a> sayt\u0131ndan \u0259ld\u0259 ed\u0259 bil\u0259rsiniz.<\/p>\n\n\n\n

\u201cKaspersky\u201d \u00f6z t\u0259dqiqat\u0131na dair texniki t\u0259f\u0259rr\u00fcatlar v\u0259 hesabatlar\u0131n d\u0259rcini davam etdirm\u0259yi planla\u015fd\u0131r\u0131r.<\/p>\n\n\n\n

H\u0259d\u0259fli h\u00fccumlardan qorunmaq \u00fc\u00e7\u00fcn \u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259ri t\u00f6vsiy\u0259 edirl\u0259r:<\/p>\n\n\n\n

\u2022 z\u0259iflikl\u0259ri vaxt\u0131nda aradan qald\u0131rmaq \u00fc\u00e7\u00fcn \u0259m\u0259liyyat sistemini, t\u0259tbiql\u0259ri v\u0259 antivirus proqramlar\u0131n\u0131 m\u00fct\u0259madi olaraq yenil\u0259yin;<\/p>\n\n\n\n

\u2022 m\u0259xfi m\u0259lumat t\u0259l\u0259b ed\u0259n e-po\u00e7t, mesaj v\u0259 ya z\u0259ngl\u0259r\u0259 qar\u015f\u0131 ehtiyatl\u0131 olun. M\u0259lumat\u0131 h\u0259r k\u0259sl\u0259 payla\u015fmazdan v\u0259 ya \u015f\u00fcbh\u0259li linkl\u0259r\u0259 klikl\u0259m\u0259zd\u0259n \u0259vv\u0259l g\u00f6nd\u0259r\u0259ni diqq\u0259tl\u0259 yoxlay\u0131n;<\/p>\n\n\n\n

\u2022 T\u0259hl\u00fck\u0259sizlik \u018fm\u0259liyyatlar\u0131 M\u0259rk\u0259zinin (SOC) i\u015f\u00e7il\u0259rini T\u0259hdid M\u0259lumatlar\u0131na (TI) \u00e7\u0131x\u0131\u015fla t\u0259min edin. M\u0259s\u0259l\u0259n, \u201cKaspersky Threat Intelligence<\/a>\u201d portal\u0131nda siz \u201cKaspersky\u201d t\u0259r\u0259find\u0259n 20 ild\u0259n art\u0131q m\u00fcdd\u0259td\u0259 toplanm\u0131\u015f kiberh\u00fccumlar haqq\u0131nda m\u0259lumatlar\u0131 \u0259ld\u0259 ed\u0259 bil\u0259rsiniz;<\/p>\n\n\n\n

\u2022 \u0259n son h\u0259d\u0259fli t\u0259hdidl\u0259r d\u0259 daxil olmaqla t\u0259hl\u00fck\u0259sizlik i\u015f\u00e7il\u0259rinin bacar\u0131qlar\u0131n\u0131 t\u0259kmill\u0259\u015fdirin. Apar\u0131c\u0131 \u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259ri t\u0259r\u0259find\u0259n haz\u0131rlanm\u0131\u015f onlayn t\u0259liml\u0259r<\/a> bu i\u015fd\u0259 k\u00f6m\u0259k ed\u0259 bil\u0259r; \u2022 \u201cKaspersky Endpoint Detection and Response<\/a>\u201d kimi son n\u00f6qt\u0259 s\u0259viyy\u0259sind\u0259 insidentl\u0259ri a\u015fkar etm\u0259k v\u0259 onlara cavab verm\u0259k imkanlar\u0131na malik EDR h\u0259ll\u0259rind\u0259n istifad\u0259 edin.<\/p>\n","protected":false},"excerpt":{"rendered":"

\u201cTrianqulyasiya\u201d \u018fm\u0259liyyat\u0131: \u201cKaspersky\u201d m\u00fct\u0259x\u0259ssisl\u0259ri t\u0259cav\u00fczkarlar\u0131n m\u00fcdafi\u0259sind\u0259n nec\u0259 yan ke\u00e7ib \u201cKaspersky\u201dnin\u00a0 Qlobal T\u0259dqiqat v\u0259 T\u0259hlil Qrupunun (GReAT) ekspertl\u0259ri T\u0259hl\u00fck\u0259sizlik Analitikl\u0259ri Sammiti (SAS) konfrans\u0131 zaman\u0131 \u201ctrianqulyasiya\u201d \u0259m\u0259liyyat\u0131n\u0131n t\u0259hlilinin yeni t\u0259f\u0259rr\u00fcatlar\u0131n\u0131 a\u00e7\u0131qlay\u0131blar. Yeni m\u0259lumatlar iOS-da insidentin \u0259sas\u0131n\u0131 t\u0259\u015fkil…<\/p>\n","protected":false},"author":2,"featured_media":8743,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts\/17716"}],"collection":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17716"}],"version-history":[{"count":1,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts\/17716\/revisions"}],"predecessor-version":[{"id":17717,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts\/17716\/revisions\/17717"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/media\/8743"}],"wp:attachment":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}