{"id":9421,"date":"2021-03-16T17:43:57","date_gmt":"2021-03-16T14:43:57","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=9421"},"modified":"2021-03-16T17:43:57","modified_gmt":"2021-03-16T14:43:57","slug":"accellion-fta-data-leaks","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/accellion-fta-data-leaks\/9421\/","title":{"rendered":"\u00c7al\u0131nan materyaller \u00e7evrimi\u00e7i yay\u0131nlan\u0131rsa"},"content":{"rendered":"<p>Ge\u00e7ti\u011fimiz y\u0131l\u0131n sonlar\u0131nda, Accellion Dosya Aktar\u0131m Arac\u0131\u2019n\u0131n (FTA) g\u00fcncel olmayan s\u00fcr\u00fcm\u00fc kullan\u0131larak \u015firketlere sald\u0131r\u0131lar ger\u00e7ekle\u015ftirildi\u011fine dair bilgiler \u00e7evrimi\u00e7i olarak ortaya \u00e7\u0131kt\u0131. Baz\u0131 siber su\u00e7lular, Accellion FTA\u2019n\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kullanarak elde ettikleri gizli verileri yay\u0131nlamakla tehdit ederek kurbanlardan fidye almaya \u00e7al\u0131\u015ft\u0131. S\u00f6zlerinin de arkalar\u0131nda olduklar\u0131n\u0131 s\u00f6ylemekten \u00fcz\u00fcnt\u00fc duyuyoruz.<\/p>\n<h2>Buradaki g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ne?<\/h2>\n<p>Accellion FTA, b\u00fcy\u00fck boyutlardaki dosyalar\u0131n h\u0131zl\u0131 ve kolayca aktar\u0131lmas\u0131 i\u00e7in \u015firketler taraf\u0131ndan kullan\u0131lan bir a\u011f arac\u0131.\u00a0 Yirmi y\u0131ld\u0131r var olan bu \u00e7\u00f6z\u00fcm, bu y\u0131l art\u0131k kullan\u0131mdan kald\u0131r\u0131lacak; geli\u015ftiriciler, uzun bir s\u00fcre \u00f6nce daha modern \u00fcr\u00fcnlere ge\u00e7i\u015f yap\u0131laca\u011f\u0131na dair \u00e7a\u011fr\u0131da bulundular.<\/p>\n<p>Aral\u0131k 2020\u2019de, s\u00f6z konusu ara\u00e7ta iki g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n \u2014 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27101\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2021-27101<\/a> ve <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27102\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2021-27102<\/a> \u2014 ke\u015ffedilmesi, sald\u0131rganlar\u0131n FTA cihazlar\u0131na y\u00fcklenen dosyalara eri\u015fim sa\u011flamas\u0131na neden olmu\u015ftu. Bu a\u00e7\u0131klar \u00e7\u00f6z\u00fcmlenmi\u015f olsa da, Ocak 2021\u2019de iki g\u00fcvenlik a\u00e7\u0131\u011f\u0131 daha (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27103\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2021-27103<\/a> ve <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27104\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2021-27104<\/a>) ortaya \u00e7\u0131kt\u0131 ve <a href=\"https:\/\/www.accellion.com\/sites\/default\/files\/trust-center\/accellion-fta-attack-timeline.png\">yama uyguland\u0131<\/a>.<\/p>\n<p>Ancak buna ra\u011fmen su\u00e7lular, bir\u00e7ok Accellion FTA kullan\u0131c\u0131s\u0131n\u0131n verilerini \u00e7almay\u0131 ba\u015fard\u0131lar. Bunu, <a href=\"https:\/\/www.securityweek.com\/qualys-confirms-unauthorized-access-data-accellion-hack\" target=\"_blank\" rel=\"noopener nofollow\">s\u0131z\u0131nt\u0131lar<\/a> ile ilgili yay\u0131nlanan bir\u00e7ok \u00fcst d\u00fczey <a href=\"https:\/\/www.zdnet.com\/article\/airplane-maker-bombardier-data-posted-on-ransomware-leak-site-following-fta-hack\/\" target=\"_blank\" rel=\"noopener nofollow\">bas\u0131n haberleri<\/a> izledi. T\u00fcm kurbanlar fidyeyi \u00f6demeyi kabul etmemi\u015f olacak ki, sald\u0131rganlar, \u00e7ald\u0131klar\u0131 verileri yay\u0131nlama tehditlerini yerine getirdiler.<\/p>\n<h2>Siber su\u00e7lular verileri nas\u0131l yay\u0131nl\u0131yor?<\/h2>\n<p>Yak\u0131n zamanda, kurbanlar\u0131n itibarlar\u0131n\u0131 \u00e7al\u0131\u015fanlar\u0131n\u0131n, m\u00fc\u015fterilerinin, ortaklar\u0131n\u0131n ve rakiplerinin g\u00f6z\u00fcnde zedeleme amac\u0131yla toplu e-postalar g\u00f6nderildi\u011fini tespit ettik. Bu e-postalar\u0131n kapsamlar\u0131 ve adreslerinin kaynaklar\u0131 kesin olarak bilinmese de, g\u00f6r\u00fcnen o ki siber su\u00e7lular ellerinden geldi\u011fince \u00e7ok izleyiciye ula\u015fmaya \u00e7al\u0131\u015f\u0131yor.<\/p>\n<div id=\"attachment_9425\" style=\"width: 1034px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-9425\" class=\"wp-image-9425 size-large\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2021\/03\/16174202\/accellion-fta-data-leaks-letter-1024x260.png\" alt=\"\" width=\"1024\" height=\"260\"><p id=\"caption-attachment-9425\" class=\"wp-caption-text\">Sald\u0131rganlar\u0131n \u00e7al\u0131\u015fanlara, m\u00fc\u015fterilere, i\u015f ortaklar\u0131na ve rakiplere g\u00f6nderdi\u011fi e-posta.<\/p><\/div>\n<p>\u00a0<\/p>\n<p>G\u00f6nderiler mesajlar, al\u0131c\u0131lar\u0131n\u0131 .onion uzant\u0131l\u0131 bir siteyi ziyaret etmeleri i\u00e7in Tor taray\u0131c\u0131s\u0131n\u0131 kullanmaya zorluyor ve s\u00f6z konusu internet sitesinin g\u00fcnde on binlerce kez ziyaret edildi\u011fini iddia ediyordu. Sitenin s\u00f6zde ziyaret\u00e7ileri aras\u0131nda, bir \u015firketin altyap\u0131s\u0131na ve itibar\u0131na \u00e7ok daha b\u00fcy\u00fck bir zarar verebilecek olan her t\u00fcrden hacker ve gazeteci yer al\u0131yor. \u0130lgin\u00e7 olan bir di\u011fer \u015fey ise, bahsedilen sitenin fidye yaz\u0131l\u0131m alan\u0131nda uzman olan CL0P gruba ait olmas\u0131, ancak Accellion FTA\u2019n\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131ndan faydalan\u0131lmas\u0131yla ger\u00e7ekle\u015fen bu sald\u0131r\u0131larda dosyalar\u0131n \u015fifrelenmemi\u015f olmas\u0131. Anla\u015f\u0131lan o ki, hackerlar\u0131n faydaland\u0131\u011f\u0131 \u015fey bu elveri\u015fli platform oldu.<\/p>\n<p>Tabii ki buradaki ama\u00e7lar\u0131, ba\u015fka kurbanlar\u0131n da g\u00f6zlerini korkutmak. Bu arada, hem e-postada hem de internet sitesinde, yay\u0131nlanan dosyalar\u0131 kald\u0131rmalar\u0131 i\u00e7in sald\u0131rganlarla ileti\u015fime ge\u00e7ilmesi y\u00f6n\u00fcnde bilgiler yer al\u0131yor, ancak bilgiler bir kere yay\u0131nland\u0131ktan sonra bu durum \u00e7ok bir anlam ifade etmiyor.<\/p>\n<p>Ayr\u0131ca sitede, y\u00f6neticilere, verilerin \u00e7al\u0131nd\u0131\u011f\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n giderilmesiyle ilgili \u2014 250.000 USD de\u011ferinde Bitcoin kar\u015f\u0131l\u0131\u011f\u0131nda\u2014 dersler sunan bir reklam\u0131n yer ald\u0131\u011f\u0131n\u0131 da belirtmeliyiz.<\/p>\n<div id=\"attachment_9426\" style=\"width: 697px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-9426\" class=\"wp-image-9426 size-full\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2021\/03\/16174233\/accellion-fta-data-leaks-help.jpg\" alt=\"\" width=\"687\" height=\"202\"><p id=\"caption-attachment-9426\" class=\"wp-caption-text\">Potansiyel kurbanlar\u0131n ayn\u0131 durumu ya\u015famamalar\u0131 i\u00e7in yard\u0131m teklifi.<\/p><\/div>\n<p>\u00a0<\/p>\n<p>Buna herhangi birinin inanaca\u011f\u0131ndan \u015f\u00fcpheliyiz. \u00d6ncelikle, Accellion FTA\u2019n\u0131n geli\u015ftiricileri arac\u0131n g\u00fcncellenmi\u015f s\u00fcr\u00fcmlerini halihaz\u0131rda yay\u0131nlam\u0131\u015f olsalar da, yard\u0131m talebinde bulunmak g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapatamad\u0131\u011f\u0131n\u0131z\u0131 ve hala bu a\u00e7\u0131klardan birilerinin faydalanabilece\u011fini kabul etmekle e\u015fde\u011fer.<\/p>\n<h2>\u015eirketinizi bu t\u00fcr sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilirsiniz?<\/h2>\n<p>Her \u015feyden \u00f6nce, Accellion FTA\u2019y\u0131 g\u00fcncelleyin \u2014 veya daha iyisi, bu \u00e7\u00f6z\u00fcm\u00fc kullanmay\u0131 tamamen b\u0131rak\u0131n (kendi geli\u015ftiricileri bile bunu tavsiye ediyor).<\/p>\n<p>Hemen ard\u0131ndan, internet eri\u015fimi olan t\u00fcm yaz\u0131l\u0131m \u00fcr\u00fcnlerinizi ve hizmetlerinizi g\u00fcncelleyin. Bunun bir an \u00f6nce ve s\u00fcrekli g\u00fcncellemelerin zaman\u0131nda yap\u0131ld\u0131\u011f\u0131ndan emin olunarak yap\u0131lmas\u0131 \u00f6nemlidir.<\/p>\n<p>Ayr\u0131ca, hen\u00fcz bilinmeyenler de dahil g\u00fcvenlik a\u00e7\u0131klar\u0131ndan faydalanma giri\u015fimlerini tespit edebilen modern <a href=\"https:\/\/www.kaspersky.com.tr\/small-to-medium-business-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder_______\" target=\"_blank\" rel=\"noopener\">bir g\u00fcvenlik \u00fcr\u00fcn\u00fc<\/a> ile t\u00fcm cihazlar\u0131n\u0131z\u0131 \u2014 ister i\u015f yerindekiler, ister sunucular veya donan\u0131m\/yaz\u0131l\u0131m \u00e7\u00f6z\u00fcmleri olsun \u2014 koruyun.<\/p>\n<p>Gasp\u00e7\u0131lar\u0131n kurban\u0131 olan hi\u00e7bir ki\u015finin para \u00f6demesi yapmalar\u0131n\u0131 \u00f6nermiyoruz. Daha derinlemesine bir inceleme i\u00e7in Eugene Kaspersky\u2019nin <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/to-pay-or-not-to-pay\/9401\/\" target=\"_blank\" rel=\"noopener\">son yaz\u0131s\u0131na<\/a> bakabilirsiniz.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kesb-trial-leadgen\">\n","protected":false},"excerpt":{"rendered":"<p>Verebilecekleri en y\u00fcksek seviyedeki itibar zarar\u0131n\u0131 vermeye \u00e7al\u0131\u015fan hackerlar, Accellion FTA&#8217;n\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131ndan faydalanarak \u00e7ald\u0131klar\u0131 verilere ba\u011flant\u0131lar g\u00f6nderiyor.<\/p>\n","protected":false},"author":2598,"featured_media":9424,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194],"tags":[790,1989,2007],"class_list":{"0":"post-9421","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"tag-guvenlik-aciklari","10":"tag-itibar","11":"tag-sizintilar"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/accellion-fta-data-leaks\/9421\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/accellion-fta-data-leaks\/22594\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/accellion-fta-data-leaks\/18087\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/accellion-fta-data-leaks\/24325\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/accellion-fta-data-leaks\/22392\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/accellion-fta-data-leaks\/21326\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/accellion-fta-data-leaks\/24887\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/accellion-fta-data-leaks\/24142\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/accellion-fta-data-leaks\/30247\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/accellion-fta-data-leaks\/38980\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/accellion-fta-data-leaks\/17127\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/accellion-fta-data-leaks\/14559\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/accellion-fta-data-leaks\/26352\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/accellion-fta-data-leaks\/30189\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/accellion-fta-data-leaks\/26778\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/accellion-fta-data-leaks\/23635\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/accellion-fta-data-leaks\/28974\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/sizintilar\/","name":"s\u0131z\u0131nt\u0131lar"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2598"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=9421"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9421\/revisions"}],"predecessor-version":[{"id":9427,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9421\/revisions\/9427"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/9424"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=9421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=9421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=9421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}