{"id":8504,"date":"2020-06-24T14:10:35","date_gmt":"2020-06-24T11:10:35","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=8504"},"modified":"2020-06-24T14:10:35","modified_gmt":"2020-06-24T11:10:35","slug":"web-skimming-with-ga","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/web-skimming-with-ga\/8504\/","title":{"rendered":"Bir veri s\u0131z\u0131nt\u0131 kanal\u0131 olarak Google Analytics"},"content":{"rendered":"<p>\u0130nternet ma\u011fazas\u0131 ziyaret\u00e7ilerinden kart sahibi verilerini elde etmenin olduk\u00e7a yayg\u0131n bir y\u00f6ntemi olan Web skimming, yayg\u0131n bir siber su\u00e7 y\u00f6ntemidir. Ancak uzmanlar\u0131m\u0131z son d\u00f6nemde \u00e7al\u0131nan verileri s\u0131zd\u0131rmak i\u00e7in Google Analytics\u2019in kullan\u0131m\u0131n\u0131 i\u00e7eren olduk\u00e7a tehlikeli yeni bir y\u00f6ntem ke\u015ffetti. Bu y\u00f6ntemin neden tehlikeli oldu\u011funu ve bununla nas\u0131l ba\u015fa \u00e7\u0131k\u0131laca\u011f\u0131n\u0131 inceleyelim.<\/p>\n<h2>Web skimming y\u00f6ntemi nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/h2>\n<p>Ana fikir, sald\u0131rganlar\u0131n hedef internet sitesindeki sayfalara k\u00f6t\u00fc ama\u00e7l\u0131 kod yerle\u015ftirmesidir. Bunu nas\u0131l yapt\u0131klar\u0131 ise ayr\u0131 bir konu. Bazen bir y\u00f6netici hesab\u0131 parolas\u0131n\u0131 k\u0131rmaya \u00e7al\u0131\u015f\u0131rlar (veya \u00e7alarlar). Bazen i\u00e7erik y\u00f6netim sistemindeki (CMS) veya \u00fc\u00e7\u00fcnc\u00fc taraf eklentilerinden birinde bulunan g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 k\u00f6t\u00fcye kullan\u0131rlar. Bazen de yanl\u0131\u015f kodlanm\u0131\u015f bir giri\u015f formuna k\u00f6t\u00fc ama\u00e7l\u0131 kod yerle\u015ftirerek yaparlar.<\/p>\n<p>Yerle\u015ftirilen kod t\u00fcm kullan\u0131c\u0131 i\u015flemlerini (girilen banka kart\u0131 verileri dahil) kaydeder ve her \u015feyi sahibine g\u00f6nderir. Bu nedenle, vakalar\u0131n b\u00fcy\u00fck \u00e7o\u011funlu\u011funda Web skimming bir t\u00fcr siteler aras\u0131 komut dosyas\u0131d\u0131r.<\/p>\n<h2>Neden Google Analytics?<\/h2>\n<p>Veri toplama i\u015fin sadece yar\u0131s\u0131d\u0131r. K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n toplanan bu verileri sald\u0131rgana g\u00f6ndermesi gerekir. Web skimming y\u0131llard\u0131r var olan bir y\u00f6ntemdir. Bu sebeple sekt\u00f6r de buna kar\u015f\u0131 koymak i\u00e7in y\u00f6ntemler geli\u015ftirmi\u015ftir. Bu y\u00f6ntemlerden biri, belirli bir internet sitesinde veya sayfada bilgi toplama yetkisine sahip t\u00fcm hizmetlerin listelendi\u011fi teknik bir \u00fcst bilgi olan \u0130\u00e7erik G\u00fcvenli\u011fi \u0130lkesi\u2019nin (CSP) kullan\u0131lmas\u0131d\u0131r. Siber su\u00e7lular taraf\u0131ndan kullan\u0131lan hizmet bu \u00fcst bilgide listelenmemi\u015fse su\u00e7lular toplad\u0131klar\u0131 bu bilgileri alamazlar. Bu t\u00fcr koruyucu \u00f6nlemler g\u00f6z \u00f6n\u00fcne al\u0131nd\u0131\u011f\u0131nda, doland\u0131r\u0131c\u0131lar Google Analytics\u2019i kullanma fikrini ortaya att\u0131lar.<\/p>\n<p>Bug\u00fcn, hemen hemen her internet sitesi ziyaret\u00e7i istatistiklerini dikkatle takip ediyor. Elbette, internet ma\u011fazalar\u0131 da bunu yap\u0131yor. Bu amaca en uygun ara\u00e7 ise Google Analytics. Google Analytics, bir\u00e7ok parametreye dayal\u0131 veri toplamaya izin veriyor ve yakla\u015f\u0131k <a href=\"https:\/\/trends.builtwith.com\/analytics\/Google-Analytics\" target=\"_blank\" rel=\"noopener nofollow\">29 milyon<\/a> internet sitesi bu hizmeti kullan\u0131yor. Bir internet ma\u011fazas\u0131n\u0131n CSP \u00fcst bilgisinde Google Analytics\u2019e veri aktar\u0131m\u0131na izin verme olas\u0131l\u0131\u011f\u0131 \u00e7ok y\u00fcksektir.<\/p>\n<p>\u0130nternet sitesi istatistiklerini toplamak i\u00e7in yapman\u0131z gereken tek \u015fey, takip parametrelerini yap\u0131land\u0131rmak ve sayfalar\u0131n\u0131za bir takip kodu eklemek. Google Analytics\u2019e g\u00f6re bu kodu siteye ekleyebiliyorsan\u0131z sitenin yasal sahibisiniz demektir. B\u00f6ylece sald\u0131rganlar\u0131n k\u00f6t\u00fc ama\u00e7l\u0131 komut dosyas\u0131 kullan\u0131c\u0131 verilerini toplar ve ard\u0131ndan kendi takip kodlar\u0131n\u0131 kullanarak Google Analytics \u00d6l\u00e7\u00fcm Protokol\u00fc arac\u0131l\u0131\u011f\u0131yla do\u011frudan hesaplar\u0131na g\u00f6nderir. <a href=\"https:\/\/securelist.com\/web-skimming-with-google-analytics\/97414\/\" target=\"_blank\" rel=\"noopener\">Securelist\u2019in g\u00f6nderisinde<\/a> sald\u0131r\u0131 y\u00f6ntemi ve ortaya \u00e7\u0131kma belirtileri hakk\u0131nda daha fazla ayr\u0131nt\u0131 bulunuyor.<\/p>\n<h2>Ne yapmal\u0131y\u0131z?<\/h2>\n<p>Y\u00f6ntemin as\u0131l kurbanlar\u0131, banka kart\u0131 verilerini \u00e7evrimi\u00e7i olarak giren kullan\u0131c\u0131lard\u0131r. Ancak sorunun \u00e7o\u011funlukla internet sitelerini \u00f6deme formlar\u0131yla destekleyen \u015firketler taraf\u0131ndan ele al\u0131nmas\u0131 gerekir. \u0130nternet sitenizden kullan\u0131c\u0131 verilerinin s\u0131zd\u0131r\u0131lmas\u0131n\u0131 \u00f6nlemek i\u00e7in \u015funlar\u0131 yapman\u0131z\u0131 \u00f6neririz:<\/p>\n<ul>\n<li>\u0130nternet uygulamalar\u0131 (CMS ve t\u00fcm eklentileri) dahil olmak \u00fczere t\u00fcm yaz\u0131l\u0131mlar\u0131 d\u00fczenli olarak g\u00fcncellemek,<\/li>\n<li>CMS bile\u015fenlerini yaln\u0131zca g\u00fcvenilir kaynaklardan y\u00fcklemek,<\/li>\n<li>Kullan\u0131c\u0131 haklar\u0131n\u0131 gereken minimum d\u00fczeye indiren ve g\u00fc\u00e7l\u00fc ve benzersiz \u015fifrelerin kullan\u0131m\u0131n\u0131 zorunlu k\u0131lan kat\u0131 bir CMS eri\u015fim politikas\u0131 benimsemek,<\/li>\n<li>\u00d6deme formu ile birlikte internet sitesinin periyodik g\u00fcvenlik denetimlerini yapmak.<\/li>\n<\/ul>\n<p>Bu y\u00f6ntemin do\u011frudan potansiyel kurban\u0131 olan kullan\u0131c\u0131lar i\u00e7in verilecek tavsiye olduk\u00e7a basittir: G\u00fcvenilir g\u00fcvenlik yaz\u0131l\u0131m\u0131 kullan\u0131n. Hem <a href=\"https:\/\/www.kaspersky.com.tr\/internet-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2c_kasperskydaily_wpplaceholder____kismd___\" target=\"_blank\" rel=\"noopener\">ev kullan\u0131c\u0131lar\u0131<\/a> hem de <a href=\"https:\/\/www.kaspersky.com.tr\/small-business-security\/small-office-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_banner____ksos___\" target=\"_blank\" rel=\"noopener\">k\u00fc\u00e7\u00fck i\u015fletmeler i\u00e7in<\/a> Kaspersky \u00e7\u00f6z\u00fcmleri, Safe Money teknolojimiz sayesinde \u00f6deme sitelerindeki k\u00f6t\u00fc ama\u00e7l\u0131 komut dosyalar\u0131n\u0131 alg\u0131lar.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"ksos\">\n","protected":false},"excerpt":{"rendered":"<p>Uzmanlar\u0131m\u0131z, kart sahiplerine ait verileri Google ara\u00e7lar\u0131n\u0131 kullanarak elde edebilecekleri bir yol buldular.<\/p>\n","protected":false},"author":2506,"featured_media":8505,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194],"tags":[1626,612,2219,2218],"class_list":{"0":"post-8504","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"tag-dolandircilik","10":"tag-dolandiricilik","11":"tag-kart-sahibi-verileri","12":"tag-web-skimming"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/web-skimming-with-ga\/8504\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/web-skimming-with-ga\/21477\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/web-skimming-with-ga\/16946\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/web-skimming-with-ga\/8394\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/web-skimming-with-ga\/22664\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/web-skimming-with-ga\/20768\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/web-skimming-with-ga\/19142\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/web-skimming-with-ga\/22982\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/web-skimming-with-ga\/22063\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/web-skimming-with-ga\/28633\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/web-skimming-with-ga\/35986\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/web-skimming-with-ga\/15154\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/web-skimming-with-ga\/15655\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/web-skimming-with-ga\/13593\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/web-skimming-with-ga\/24336\/"},{"hreflang":"zh","url":"https:\/\/www.kaspersky.com.cn\/blog\/web-skimming-with-ga\/11639\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/web-skimming-with-ga\/28712\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/web-skimming-with-ga\/25601\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/web-skimming-with-ga\/22517\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/web-skimming-with-ga\/27760\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/web-skimming-with-ga\/27601\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/dolandircilik\/","name":"doland\u0131rc\u0131l\u0131k"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/8504","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2506"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=8504"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/8504\/revisions"}],"predecessor-version":[{"id":8506,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/8504\/revisions\/8506"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/8505"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=8504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=8504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=8504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}