{"id":24946,"date":"2024-06-13T04:00:00","date_gmt":"2024-06-13T01:00:00","guid":{"rendered":"https:\/\/rockvell.com\/?p=24946"},"modified":"2024-06-13T12:33:53","modified_gmt":"2024-06-13T09:33:53","slug":"kaspersky-taninmis-biometrik-terminalda-24-sistem-boslugu-askarlayib","status":"publish","type":"post","link":"https:\/\/rockvell.com\/?p=24946","title":{"rendered":"Kaspersky tan\u0131nm\u0131\u015f biometrik terminalda 24 sistem bo\u015flu\u011fu a\u015fkarlay\u0131b"},"content":{"rendered":"\n<p class=\"has-medium-font-size\"><strong>Kaspersky tan\u0131nm\u0131\u015f biometrik terminalda 24 sistem bo\u015flu\u011fu a\u015fkarlay\u0131b<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Kaspersky beyn\u0259lxalq istehsal\u00e7\u0131 \u201cZKTeco\u201dnun biometrik terminal\u0131nda \u00e7oxsayl\u0131 bo\u015fluqlar a\u015fkar edib. Onlardan giri\u015f\u0259 n\u0259zar\u0259t sisteml\u0259rind\u0259n yan ke\u00e7m\u0259k v\u0259 m\u00fchafiz\u0259 olunan \u0259razil\u0259r\u0259 fiziki daxil olmaq, h\u0259m\u00e7inin biometrik m\u0259lumatlar\u0131 o\u011furlamaq, m\u0259lumat bazalar\u0131nda d\u0259yi\u015fiklikl\u0259r etm\u0259k v\u0259 arxa qap\u0131lar\u0131n (gizli m\u00fcdaxil\u0259 \u00fcsulu) qura\u015fd\u0131r\u0131lmas\u0131 \u00fc\u00e7\u00fcn istifad\u0259 oluna bil\u0259r.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"650\" height=\"433\" src=\"https:\/\/rockvell.com\/wp-content\/uploads\/2023\/05\/Kaspersky.png\" alt=\"\" class=\"wp-image-11072\" style=\"width:344px;height:auto\" srcset=\"https:\/\/rockvell.com\/wp-content\/uploads\/2023\/05\/Kaspersky.png 650w, https:\/\/rockvell.com\/wp-content\/uploads\/2023\/05\/Kaspersky-300x200.png 300w, https:\/\/rockvell.com\/wp-content\/uploads\/2023\/05\/Kaspersky-360x240.png 360w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/figure><\/div>\n\n\n<p>S\u00f6z\u00fcged\u0259n biometrik oxucular b\u00fct\u00fcn d\u00fcnyada m\u00fcxt\u0259lif s\u0259naye sah\u0259l\u0259rind\u0259 &#8211; n\u00fcv\u0259 elektrik stansiyalar\u0131ndan v\u0259 istehsalatdan tutmu\u015f ofisl\u0259r\u0259 v\u0259 s\u0259hiyy\u0259 t\u0259\u015fkilatlar\u0131na q\u0259d\u0259r geni\u015f \u015f\u0259kild\u0259 istifad\u0259 olunur. Onlar istifad\u0259\u00e7i autentifikasiyas\u0131n\u0131n d\u00f6rd \u00fcsulunu d\u0259st\u0259kl\u0259yir: biometrik (\u00fcz tan\u0131ma), \u015fifr\u0259, elektron burax\u0131l\u0131\u015f v\u0259 ya QR kodu. Bu terminallarda minl\u0259rl\u0259 insan\u0131n biometrik m\u0259lumatlar\u0131n\u0131 saxlana bilirl\u0259r. Kaspersky m\u00fct\u0259x\u0259ssisl\u0259ri a\u015fkar edilmi\u015f b\u00fct\u00fcn bo\u015fluqlar\u0131 qrupla\u015fd\u0131raraq, bu bar\u0259d\u0259 istehsal\u00e7\u0131ya \u0259vv\u0259lc\u0259d\u0259n m\u0259lumat ver\u0259r\u0259k onlar\u0131 qeyd\u0259 al\u0131b.<\/p>\n\n\n\n<p><strong>T\u0259cav\u00fczkarlara qapal\u0131 \u0259razil\u0259r\u0259 fiziki giri\u015f \u0259ld\u0259 etm\u0259y\u0259 imkan ver\u0259n bo\u015fluq <\/strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3938\" target=\"_blank\" rel=\"noopener\" title=\"\"><strong>(CVE-2023-3938<\/strong><\/a><strong>).<\/strong> Bo\u015fluq qruplar\u0131ndan biri SQL inyeksiyas\u0131na \u0259saslanan kiberh\u00fccumlar \u00fc\u00e7\u00fcn istifad\u0259 oluna bil\u0259r. T\u0259cav\u00fczkarlar icaz\u0259siz daxil olmaq m\u00fcmk\u00fcn olmayan yerl\u0259r\u0259 giri\u015f \u0259ld\u0259 etm\u0259k \u00fc\u00e7\u00fcn m\u0259lumatlar\u0131 QR koduna yerl\u0259\u015fdir\u0259 bil\u0259r. Terminal bel\u0259 bir z\u0259r\u0259rli QR kodu olan sor\u011funu emal etm\u0259y\u0259 ba\u015flasa, m\u0259lumat bazas\u0131 s\u0259hv\u0259n onun sonuncu icaz\u0259li qanuni istifad\u0259\u00e7id\u0259n g\u0259ldiyini m\u00fc\u0259yy\u0259n ed\u0259c\u0259k. N\u0259tic\u0259d\u0259 bu tip bo\u015fluqlardan istifad\u0259 il\u0259 h\u0259yata ke\u00e7iril\u0259n h\u00fccum terminala icaz\u0259siz giri\u015f \u0259ld\u0259 etm\u0259y\u0259 v\u0259 qapal\u0131 \u0259razil\u0259r\u0259 fiziki olaraq daxil olma\u011fa imkan ver\u0259c\u0259k.<\/p>\n\n\n\n<p>\u201cQR kodunun d\u0259yi\u015fdirilm\u0259si il\u0259 yana\u015f\u0131, sistemi \u201caldatmaq\u201d v\u0259 qapal\u0131 qorunan \u0259razil\u0259r\u0259 giri\u015f \u0259ld\u0259 etm\u0259k \u00fc\u00e7\u00fcn daha bir potensial imkan var. T\u0259cav\u00fczkar cihaz\u0131n m\u0259lumat bazas\u0131na giri\u015f \u0259ld\u0259 ed\u0259rs\u0259, qanuni istifad\u0259\u00e7inin \u015f\u0259klini y\u00fckl\u0259m\u0259k, \u00e7ap etm\u0259k v\u0259 ondan cihaz\u0131n kameras\u0131n\u0131 aldatmaq m\u0259qs\u0259dil\u0259 istifad\u0259 etm\u0259k v\u0259 t\u0259hl\u00fck\u0259siz \u0259raziy\u0259 giri\u015f \u0259ld\u0259 etm\u0259k \u00fc\u00e7\u00fcn dig\u0259r bo\u015fluqlardan istifad\u0259 ed\u0259 bil\u0259rl\u0259r. Bu metodun, \u0259lb\u0259tt\u0259 ki, m\u00fc\u0259yy\u0259n m\u0259hdudiyy\u0259tl\u0259ri var. Foto\u015f\u0259kil \u00e7ap edilm\u0259li v\u0259 ya telefon ekran\u0131nda g\u00f6st\u0259rilm\u0259li, biometrik terminaldak\u0131 istilik sensorlar\u0131 s\u00f6nd\u00fcr\u00fclm\u0259lidir. Bununla bel\u0259, bu \u00fcsul h\u0259l\u0259 d\u0259 ciddi t\u0259hl\u00fck\u0259 yarad\u0131r\u201d, &#8211; dey\u0259 Kaspersky-nin kibert\u0259hl\u00fck\u0259sizlik \u00fczr\u0259 m\u00fct\u0259x\u0259ssisi Georgi Kiquradze bildirir.<\/p>\n\n\n\n<p><strong>Biometrik m\u0259lumatlar\u0131n o\u011furlanmas\u0131, arxa qap\u0131lar\u0131n (gizli m\u00fcdaxil\u0259 \u00fcsulu) qura\u015fd\u0131r\u0131lmas\u0131<\/strong>. Dig\u0259r bo\u015fluqlar qrupu (<a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3940\" target=\"_blank\" rel=\"noopener\" title=\"\">CVE-2023-3940<\/a>) potensial h\u00fccum\u00e7uya sistemd\u0259ki ist\u0259nil\u0259n fayla giri\u015f \u0259ld\u0259 etm\u0259k v\u0259 onu oradan \u00e7\u0131xarmaq imkan\u0131 verir. Bu o dem\u0259kdir ki, t\u0259cav\u00fczkarlar h\u0259ssas istifad\u0259\u00e7i biometrikl\u0259rin\u0259 v\u0259 \u015fifr\u0259 toplular\u0131na giri\u015f \u0259ld\u0259 ed\u0259 v\u0259 sonradan korporativ hesab m\u0259lumatlar\u0131n\u0131 \u0259l\u0259 ke\u00e7ir\u0259 bil\u0259rl\u0259r. Bununla bel\u0259, o\u011furlanm\u0131\u015f biometrik m\u0259lumatlar\u0131 ayd\u0131nla\u015fd\u0131rmaq olduqca \u00e7\u0259tin olaraq qal\u0131r.<\/p>\n\n\n\n<p>Dig\u0259r bo\u015fluqlar qrupu (<a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3941\" target=\"_blank\" rel=\"noopener\" title=\"\">CVE-2023-3941<\/a>) biometrik oxucunun m\u0259lumat bazas\u0131nda d\u0259yi\u015fiklikl\u0259r etm\u0259y\u0259 imkan verir. Bel\u0259likl\u0259, t\u0259cav\u00fczkarlar \u00f6z m\u0259lumatlar\u0131n\u0131, m\u0259s\u0259l\u0259n, foto\u015f\u0259kill\u0259ri ona y\u00fckl\u0259y\u0259, y\u0259ni m\u00fcst\u0259qil olaraq \u00f6zl\u0259rini t\u0259sdiql\u0259nmi\u015f istifad\u0259\u00e7il\u0259r siyah\u0131s\u0131na \u0259lav\u0259 ed\u0259 v\u0259 sonra turniket v\u0259 ya qap\u0131lardan ke\u00e7\u0259 bil\u0259rl\u0259r. Bu bo\u015fluqlar qrupu h\u0259m d\u0259 icra edil\u0259 bil\u0259n fayllar\u0131 d\u0259yi\u015fm\u0259y\u0259 imkan verir ki, bu da potensial olaraq arxa qap\u0131 yaratma\u011fa imkan verir.<\/p>\n\n\n\n<p>Dig\u0259r iki bo\u015fluq qrupu (<a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3939\" target=\"_blank\" rel=\"noopener\" title=\"\">CVE-2023-3939<\/a>, <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3943\" target=\"_blank\" rel=\"noopener\" title=\"\">CVE-2023-3943<\/a>) cihazda ixtiyari \u0259mrl\u0259rin v\u0259 ya kodun icras\u0131na imkan verir v\u0259 t\u0259cav\u00fczkara \u0259n y\u00fcks\u0259k imtiyazlarla tam n\u0259zar\u0259t imkan\u0131 t\u0259qdim edir. Bu o dem\u0259kdir ki, cihaz dig\u0259r \u015f\u0259b\u0259k\u0259 qov\u015faqlar\u0131na h\u00fccumlar etm\u0259k \u00fc\u00e7\u00fcn istifad\u0259 edil\u0259 bil\u0259r, bu is\u0259 b\u00fct\u00fcn korporativ infrastrukturun risk alt\u0131na d\u00fc\u015fm\u0259si dem\u0259kdir.<\/p>\n\n\n\n<p>ZKTeco biometrik terminallar\u0131nda z\u0259iflik n\u00f6vl\u0259ri haqq\u0131nda daha \u0259trafl\u0131 <a href=\"https:\/\/securelist.ru\/biometric-terminal-vulnerabilities\/109673\/\" target=\"_blank\" rel=\"noopener\" title=\"\">buradan<\/a> oxuya bil\u0259rsiniz.<\/p>\n\n\n\n<p>Sadalanan bo\u015fluqlardan \u00fcz\u0259rind\u0259n h\u0259yata ke\u00e7iril\u0259n h\u00fccumlar\u0131n qar\u015f\u0131s\u0131n\u0131 almaq \u00fc\u00e7\u00fcn Kaspersky bu c\u00fcr terminal modell\u0259rind\u0259n istifad\u0259 ed\u0259n m\u00fc\u0259ssis\u0259l\u0259r\u0259 t\u00f6vsiy\u0259 edir:<\/p>\n\n\n\n<ul>\n<li>onlar\u0131 ayr\u0131ca \u015f\u0259b\u0259k\u0259 seqmentin\u0259 ay\u0131r\u0131n;<\/li>\n\n\n\n<li>g\u00fccl\u00fc administrator \u015fifr\u0259l\u0259rind\u0259n istifad\u0259 edin, standart \u015fifr\u0259l\u0259ri yenil\u0259diyinizd\u0259n \u0259min olun;<\/li>\n\n\n\n<li>cihaz\u0131n t\u0259hl\u00fck\u0259sizlik parametrl\u0259rini yoxlay\u0131n v\u0259 g\u00fccl\u0259ndirin, t\u0259sad\u00fcfi foto\u015f\u0259kild\u0259n vasit\u0259sil\u0259 avtorizasiyan\u0131 \u00f6nl\u0259m\u0259k \u00fc\u00e7\u00fcn biometrik terminalda istilik sensorlar\u0131n\u0131 i\u015f\u0259 sal\u0131n;<\/li>\n\n\n\n<li>QR kodlar\u0131n\u0131n istifad\u0259sini minimuma endirin;<\/li>\n\n\n\n<li>proqram t\u0259minat\u0131n\u0131 m\u00fct\u0259madi olaraq yenil\u0259yin.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Kaspersky tan\u0131nm\u0131\u015f biometrik terminalda 24 sistem bo\u015flu\u011fu a\u015fkarlay\u0131b Kaspersky beyn\u0259lxalq istehsal\u00e7\u0131 \u201cZKTeco\u201dnun biometrik terminal\u0131nda \u00e7oxsayl\u0131 bo\u015fluqlar a\u015fkar edib. Onlardan giri\u015f\u0259 n\u0259zar\u0259t sisteml\u0259rind\u0259n yan ke\u00e7m\u0259k v\u0259 m\u00fchafiz\u0259 olunan \u0259razil\u0259r\u0259 fiziki daxil olmaq, h\u0259m\u00e7inin biometrik m\u0259lumatlar\u0131 o\u011furlamaq,&#8230;<\/p>\n","protected":false},"author":2,"featured_media":11072,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts\/24946"}],"collection":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=24946"}],"version-history":[{"count":1,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts\/24946\/revisions"}],"predecessor-version":[{"id":24947,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/posts\/24946\/revisions\/24947"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=\/wp\/v2\/media\/11072"}],"wp:attachment":[{"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rockvell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}