{"id":13396,"date":"2025-05-30T19:27:56","date_gmt":"2025-05-30T16:27:56","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=13396"},"modified":"2025-05-30T19:27:56","modified_gmt":"2025-05-30T16:27:56","slug":"vulnerability-in-smart-home-control-app","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/vulnerability-in-smart-home-control-app\/13396\/","title":{"rendered":"O kadar da ak\u0131ll\u0131 olmayan ev"},"content":{"rendered":"<p>G\u00fcn\u00fcm\u00fcz\u00fcn ak\u0131ll\u0131 evleri, <a href=\"https:\/\/www.imdb.com\/title\/tt0192618\/\" target=\"_blank\" rel=\"nofollow noopener\">90\u2019lar\u0131n sonlar\u0131nda \u00e7ekilen bilim kurgu filmlerindeki<\/a> gibi uzakta de\u011fil, art\u0131k b\u00fcy\u00fck \u015fehirlerde ya\u015fayan hemen hemen herkes i\u00e7in bir ger\u00e7ek. Ak\u0131ll\u0131 elektrik prizleri, hoparl\u00f6r veya TV bulunmayan modern bir daire bulmak zor. Yeni in\u015faatlarda, bazen ba\u015ftan sona <em>ak\u0131ll\u0131<\/em> olarak in\u015fa edilmi\u015f evler g\u00f6rebilirsiniz, bu da <em>ak\u0131ll\u0131 konut<\/em> komplekslerinin ortaya \u00e7\u0131kmas\u0131na neden olur. Sakinler, tek bir uygulama \u00fczerinden sadece dairelerindeki cihazlar\u0131 de\u011fil; interkomlar, kameralar, kap\u0131lar, saya\u00e7lar ve yang\u0131n alarmlar\u0131 gibi d\u0131\u015f sistemleri de y\u00f6netebilirler.<\/p>\n<p>Peki, b\u00f6yle bir uygulamada g\u00fcvenlik a\u00e7\u0131\u011f\u0131 varsa ne olur? Global Ara\u015ft\u0131rma ve Analiz Ekibi (GReAT) uzmanlar\u0131m\u0131z Rubetek Home uygulamas\u0131nda bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ke\u015ffettiler ve ak\u0131ll\u0131 ev sahipleri i\u00e7in potansiyel g\u00fcvenlik risklerini ara\u015ft\u0131rd\u0131lar. Neyse ki, bu riskler ger\u00e7ekle\u015fmedi.<\/p>\n<h2>Bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131 neyle ilgiliydi?<\/h2>\n<p>Bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131, uygulaman\u0131n g\u00fcnl\u00fck kayd\u0131 i\u015flemi s\u0131ras\u0131nda hassas verileri g\u00f6ndermesinden kaynaklan\u0131yordu. Geli\u015ftiriciler, Telegram Bot API\u2019sini kullanarak analitik verileri toplad\u0131 ve kullan\u0131c\u0131lar\u0131n hata ay\u0131klama bilgi dosyalar\u0131n\u0131 Telegram botu arac\u0131l\u0131\u011f\u0131yla \u00f6zel bir geli\u015ftirme ekibi sohbetine g\u00f6nderdi.<\/p>\n<p>Sorun, bu dosyalar\u0131n sistem bilgilerinin yan\u0131 s\u0131ra kullan\u0131c\u0131lar\u0131n ki\u015fisel verilerini ve daha da \u00f6nemlisi, kullan\u0131c\u0131n\u0131n hesab\u0131na eri\u015fimi yetkilendirmek i\u00e7in gerekli olan yenileme token\u2019lar\u0131n\u0131 i\u00e7ermesiydi. Potansiyel sald\u0131rganlar, ayn\u0131 Telegram botunu kullanarak t\u00fcm bu dosyalar\u0131 kendilerine iletmi\u015f olabilirler. Bunu yapmak i\u00e7in, uygulama kodundan Telegram token\u2019\u0131n\u0131 ve sohbet kimli\u011fini elde edebilir ve ard\u0131ndan dosyalar\u0131 i\u00e7eren mesajlar\u0131n s\u0131ral\u0131 numaralar\u0131n\u0131 tek tek inceleyebilirler.<\/p>\n<p>Son zamanlarda, Telegram \u00fczerinden olaylar\u0131n kaydedilmesi giderek pop\u00fcler hale geldi. Mesajla\u015fma uygulamas\u0131nda \u00f6nemli bildirimleri almak kolay ve h\u0131zl\u0131d\u0131r. Ancak, bu yakla\u015f\u0131m dikkat gerektirir; uygulama g\u00fcnl\u00fcklerinde hassas verileri iletmemenizi ve ayr\u0131ca Telegram ayarlar\u0131ndan gruptaki i\u00e7eri\u011fin kopyalanmas\u0131n\u0131 ve iletilmesini yasaklaman\u0131z\u0131 veya Telegram botu arac\u0131l\u0131\u011f\u0131yla mesaj g\u00f6nderirken <em>protect_content<\/em> parametresini kullanman\u0131z\u0131 \u00f6neririz.<\/p>\n<blockquote><p>\u00d6nemli not: G\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 tespit eder etmez Rubetek ile ileti\u015fime ge\u00e7tik. <em>Bu yaz\u0131 yay\u0131nland\u0131\u011f\u0131nda sorun giderilmi\u015fti.<\/em><\/p><\/blockquote>\n<p>Potansiyel sald\u0131rganlar, kullan\u0131c\u0131n\u0131n t\u00fcm uygulamalar\u0131n\u0131n geli\u015ftiriciye g\u00f6nderdi\u011fi verilere eri\u015fim sa\u011flayabilirdi. Bu verilerin listesi ak\u0131l almaz boyutta:<\/p>\n<ul>\n<li>Tam ad, e-posta adresi veya cep telefonu numaras\u0131 ve uygulamaya ba\u011fl\u0131 m\u00fclk\u00fcn adresi<\/li>\n<li>Ak\u0131ll\u0131 ev sistemine ba\u011fl\u0131 cihazlar\u0131n listesi<\/li>\n<li>Ak\u0131ll\u0131 cihazlar taraf\u0131ndan kaydedilen olaylar hakk\u0131nda bilgiler, <em>\u00f6rne\u011fin evin g\u00fcvenlik sisteminin devrede olup olmad\u0131\u011f\u0131<\/em> veya <em>kameralar taraf\u0131ndan \u015f\u00fcpheli sesler alg\u0131lan\u0131p alg\u0131lanmad\u0131\u011f\u0131<\/em><\/li>\n<li>Yerel ev a\u011f\u0131ndaki cihazlarla ilgili sistem bilgileri: <em>MAC adresi, IP adresi ve cihaz t\u00fcr\u00fc<\/em><\/li>\n<li>WebRTC protokol\u00fc \u00fczerinden kameralara ba\u011flanmak i\u00e7in IP adresleri<\/li>\n<li>Ak\u0131ll\u0131 kameralar ve interkomlardan anl\u0131k g\u00f6r\u00fcnt\u00fcler<\/li>\n<li>Kullan\u0131c\u0131n\u0131n yard\u0131m formu ile sohbetleri<\/li>\n<li>Kullan\u0131c\u0131n\u0131n hesab\u0131yla yeni bir oturum ba\u015flatmaya izin veren token\u2019lar<\/li>\n<\/ul>\n<p>Android ve iOS uygulamalar\u0131n\u0131n kullan\u0131c\u0131lar\u0131 risk alt\u0131ndayd\u0131.<\/p>\n<h2>K\u00f6t\u00fc niyetli ki\u015filer ak\u0131ll\u0131 evinizin kontrol\u00fcn\u00fc ele ge\u00e7irirse ne olur?<\/h2>\n<p>Bu geni\u015f veri yelpazesi, kapsaml\u0131 bir g\u00f6zetim yap\u0131lmas\u0131na olanak sa\u011flayarak, kimin nerede ya\u015fad\u0131\u011f\u0131n\u0131 ve hangi g\u00fcnlerde evde olmad\u0131\u011f\u0131n\u0131 bilmeyi m\u00fcmk\u00fcn k\u0131labilirdi. Su\u00e7lular, bir ki\u015finin program\u0131n\u0131 \u00f6\u011frenip, bo\u015f saatlerde uygulamay\u0131 kullanarak kameralar\u0131 ve di\u011fer g\u00fcvenlik sistemlerini uzaktan devre d\u0131\u015f\u0131 b\u0131rakarak herhangi bir daireye girebilirdi.<\/p>\n<p>B\u00f6ylesine bariz bir h\u0131rs\u0131zl\u0131k kesinlikle fark edilirdi, ancak daha kurnazca ba\u015fka olas\u0131l\u0131klar da var. \u00d6rne\u011fin, sald\u0131rganlar bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 kullanarak ak\u0131ll\u0131 ampullerin renklerini ve zemin s\u0131cakl\u0131klar\u0131n\u0131 uzaktan de\u011fi\u015ftirebilir, \u0131\u015f\u0131klar\u0131 sonsuza kadar a\u00e7\u0131p kapatabilir ve ev sahiplerine \u00f6nemli maddi kay\u0131plara neden olabilirdi.<\/p>\n<p>Daha da rahats\u0131z edici olan ise, sald\u0131rgan\u0131n sadece bir daireyi veya evi de\u011fil, t\u00fcm kompleks i\u00e7indeki binlerce sakini hedef alabilme olas\u0131l\u0131\u011f\u0131yd\u0131. Elbette, eri\u015fim kontrol sistemlerinin ayn\u0131 anda devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131 bina y\u00f6netimi taraf\u0131ndan fark edilecekti, ancak neler oldu\u011funu ne kadar \u00e7abuk anlayacaklard\u0131 ve bu s\u0131rada sakinler ne kadar zarar g\u00f6rebilirdi?<\/p>\n<h2>Ak\u0131ll\u0131 evinizi nas\u0131l g\u00fcvence alt\u0131na alabilirsiniz?<\/h2>\n<p>Bahsetti\u011fimiz g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n di\u011fer ak\u0131ll\u0131 ev uygulamalar\u0131nda da yer alabilece\u011fini unutmay\u0131n. Milyonlarca m\u00fc\u015fteriden biri olarak, bir uygulaman\u0131n g\u00fcvenli\u011finin ihlal edilip edilmedi\u011fini bilmenin neredeyse hi\u00e7bir yolu yoktur. Bu nedenle, <em>misafir listenizde yeni ki\u015filer, kap\u0131lar\u0131n izinsiz a\u00e7\u0131lmas\u0131 ve kapat\u0131lmas\u0131 gibi<\/em> en ufak bir \u015f\u00fcpheli hareket fark ederseniz, m\u00fcmk\u00fcn olan en k\u0131sa s\u00fcrede uygulama y\u00f6neticisi ve sat\u0131c\u0131yla ileti\u015fime ge\u00e7menizi \u00f6neririz.<\/p>\n<p>Daha yayg\u0131n bir senaryoda, \u00f6rne\u011fin kendi evinizde a\u011f y\u00f6neticisi olmadan ak\u0131ll\u0131 cihazlar kullan\u0131yorsan\u0131z, a\u015fa\u011f\u0131daki kurallara uyman\u0131z\u0131 \u00f6neririz:<\/p>\n<ul>\n<li>Varsay\u0131lan parolay\u0131 daha g\u00fc\u00e7l\u00fc bir parola ile de\u011fi\u015ftirerek, <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/how-to-protect-wifi-from-neighbors\/9444\/#:~:text=WPS%E2%80%99yi%20devre%20d%C4%B1%C5%9F%C4%B1%20b%C4%B1rak%C4%B1n\" target=\"_blank\" rel=\"noopener\">WPS\u2019i devre d\u0131\u015f\u0131 b\u0131rakarak<\/a> ve WPA2 \u015fifrelemesini etkinle\u015ftirerek Wi-Fi y\u00f6nlendiricinizi g\u00fcvenli hale getirin.<\/li>\n<li>Ak\u0131ll\u0131 ev cihazlar\u0131n\u0131z i\u00e7in \u00f6zel bir Wi-Fi a\u011f\u0131 olu\u015fturun ve bunun i\u00e7in farkl\u0131 bir parola belirleyin. Modern y\u00f6nlendiriciler misafir a\u011flar\u0131n\u0131 destekler, bu nedenle \u00f6rne\u011fin <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/ces-2025-cybersecurity\/13097\/\" target=\"_blank\" rel=\"noopener\">ak\u0131ll\u0131 bir \u015farj yuvas\u0131<\/a> hacklenirse, su\u00e7lular bilgisayarlar\u0131n\u0131za veya ak\u0131ll\u0131 telefonlar\u0131n\u0131za eri\u015femez.<\/li>\n<li><a href=\"https:\/\/www.kaspersky.com.tr\/premium?icid=tr_bb2023-kdplacehd_acq_ona_smm__onl_b2c_kdaily_lnk_sm-team___kprem___\" target=\"_blank\" rel=\"noopener\">Kaspersky Premium<\/a> uygulamas\u0131n\u0131 kullanarak a\u011f\u0131n\u0131zda yetkisiz cihazlar olup olmad\u0131\u011f\u0131n\u0131 d\u00fczenli olarak kontrol edin. Her \u015fey yolundaysa, <strong>Ak\u0131ll\u0131 Ev Monit\u00f6r\u00fc<\/strong> yaln\u0131zca cihazlar\u0131n\u0131zla ilgili bilgileri g\u00f6sterir.<\/li>\n<li>Her cihaz i\u00e7in g\u00fc\u00e7l\u00fc parolalar belirleyin. Bunlar\u0131 ezberlemenize gerek yok: <a href=\"https:\/\/www.kaspersky.com.tr\/password-manager?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2c_kasperskydaily_wpplaceholder____kpm___\" target=\"_blank\" rel=\"noopener\">Kaspersky Password Manager<\/a>\u00a0bunu halledebilir.<\/li>\n<li>T\u00fcm ak\u0131ll\u0131 cihazlar\u0131n\u0131z\u0131n (y\u00f6nlendiriciniz dahil) donan\u0131m yaz\u0131l\u0131m\u0131n\u0131 d\u00fczenli olarak g\u00fcncelleyin.<\/li>\n<\/ul>\n<blockquote><p>Hacklenmi\u015f bir ak\u0131ll\u0131 evin di\u011fer potansiyel risklerini ve e\u015fyalar\u0131n\u0131z\u0131 koruman\u0131n yollar\u0131n\u0131 ke\u015ffetmek i\u00e7in a\u015fa\u011f\u0131daki ba\u011flant\u0131lar\u0131 inceleyebilirsiniz:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.kaspersky.com\/blog\/how-to-secure-smart-home\/47472\/\" target=\"_blank\" rel=\"noopener nofollow\"><em>Ak\u0131ll\u0131 evinizi nas\u0131l g\u00fcvence alt\u0131na alabilirsiniz?<\/em><\/a><\/li>\n<li><a href=\"https:\/\/www.kaspersky.com.tr\/blog\/ip-cameras-unsecurity-eufy\/11183\/\" target=\"_blank\" rel=\"noopener\"><em>IP kamera g\u00fcvenli\u011fi: K\u00f6t\u00fc, \u00e7irkin, felaket<\/em><\/a><\/li>\n<li><a href=\"https:\/\/www.kaspersky.com\/blog\/smart-home-zigbee-thread-matter-advice\/47343\/\" target=\"_blank\" rel=\"noopener nofollow\"><em>Evim ak\u0131ll\u0131 evim<\/em><\/a><\/li>\n<li><a href=\"https:\/\/www.kaspersky.com.tr\/blog\/smart-speaker-tv-smartphone-eavesdropping\/11996\/\" target=\"_blank\" rel=\"noopener\"><em>Televizyonunuz, ak\u0131ll\u0131 telefonunuz ve ak\u0131ll\u0131 hoparl\u00f6rleriniz sizi gizlice dinliyor mu?<\/em><\/a><\/li>\n<li><a href=\"https:\/\/www.kaspersky.com.tr\/blog\/pet-feeders-vulnerabilities\/11557\/\" target=\"_blank\" rel=\"noopener\"><em>K\u00e2se delik: Ak\u0131ll\u0131 mama kab\u0131 s\u0131z\u0131nt\u0131 yap\u0131yor<\/em><\/a><\/li>\n<\/ul>\n<\/blockquote>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"premium-generic\">\n","protected":false},"excerpt":{"rendered":"<p>GReAT uzmanlar\u0131m\u0131z, ak\u0131ll\u0131 ev kontrol uygulamas\u0131nda, sald\u0131rganlar\u0131n fiziksel g\u00fcvenlik sistemlerini devre d\u0131\u015f\u0131 b\u0131rakmas\u0131na olanak tan\u0131yan tehlikeli bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ke\u015ffetti.<\/p>\n","protected":false},"author":312,"featured_media":13397,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[994,1284],"tags":[1350,500,627,790,878],"class_list":{"0":"post-13396","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-privacy","8":"category-tips","9":"tag-akilli-ev","10":"tag-gizlilik","11":"tag-great","12":"tag-guvenlik-aciklari","13":"tag-teknoloji"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/vulnerability-in-smart-home-control-app\/13396\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/vulnerability-in-smart-home-control-app\/28895\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/vulnerability-in-smart-home-control-app\/24119\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/vulnerability-in-smart-home-control-app\/12458\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/vulnerability-in-smart-home-control-app\/28997\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/vulnerability-in-smart-home-control-app\/28158\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/vulnerability-in-smart-home-control-app\/30978\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/vulnerability-in-smart-home-control-app\/29693\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/vulnerability-in-smart-home-control-app\/39582\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/vulnerability-in-smart-home-control-app\/53471\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/vulnerability-in-smart-home-control-app\/22820\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/vulnerability-in-smart-home-control-app\/23859\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/vulnerability-in-smart-home-control-app\/32223\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/vulnerability-in-smart-home-control-app\/29173\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/vulnerability-in-smart-home-control-app\/34936\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/vulnerability-in-smart-home-control-app\/34567\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/akilli-ev\/","name":"ak\u0131ll\u0131 ev"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/13396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/312"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=13396"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/13396\/revisions"}],"predecessor-version":[{"id":13399,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/13396\/revisions\/13399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/13397"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=13396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=13396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=13396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}