{"id":43818,"date":"2026-11-10T04:00:04","date_gmt":"2026-11-10T01:00:04","guid":{"rendered":"https:\/\/kibrisayna.com\/index.php\/2026\/11\/10\/iki-otomobil-markasinda-guvenlik-acigi-admin-sifresi-ile-girildi-araclar-calistirildi\/"},"modified":"2026-11-10T04:00:04","modified_gmt":"2026-11-10T01:00:04","slug":"iki-otomobil-markasinda-guvenlik-acigi-admin-sifresi-ile-girildi-araclar-calistirildi","status":"publish","type":"post","link":"https:\/\/kibrisayna.com\/index.php\/2026\/11\/10\/iki-otomobil-markasinda-guvenlik-acigi-admin-sifresi-ile-girildi-araclar-calistirildi\/","title":{"rendered":"\u0130ki otomobil markas\u0131nda g\u00fcvenlik a\u00e7\u0131\u011f\u0131: &#8220;Admin&#8221; \u015fifresi ile girildi, ara\u00e7lar \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p>Siber g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131 Shubham Shah ve Sam Curry, yay\u0131mlad\u0131klar\u0131 raporda iki <a href=\"https:\/\/www.ntv.com.tr\/otomobil\" class=\"text-light-blue hover:opacity-75 transition-opacity duration-150\" target=\"_blank\" rel=\"noopener noreferrer\">otomobil<svg viewbox=\"0 0 12 12\" fill=\"none\" style=\"display:inline-block;width:0.75em;height:0.75em;vertical-align:baseline;margin:0 0.25em\"><path d=\"M3.5 1.5H1.5a1 1 0 00-1 1v8a1 1 0 001 1h8a1 1 0 001-1V8.5M7 .5H11.5V5M4.5 7.5L11 1\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><\/a> \u00fcreticisinin m\u00fc\u015fteri hesaplar\u0131n\u0131 y\u00f6neten ForgeRock adl\u0131 kimlik y\u00f6netimi altyap\u0131s\u0131n\u0131 incelediklerini a\u00e7\u0131klad\u0131. Her iki \u00fcreticinin de mobil uygulamalar\u0131na giri\u015f bu altyap\u0131 \u00fczerinden yap\u0131l\u0131yordu. Ara\u015ft\u0131rmac\u0131lar, \u015firketlerin talebi \u00fczerine marka adlar\u0131n\u0131 a\u00e7\u0131klamad\u0131.<\/p>\n<p>\u00a0<\/p>\n<p><strong>Y\u00d6NET\u0130M PANEL\u0130 VARSAYILAN \u015e\u0130FREYLE \u00c7ALI\u015eIYORDU<\/strong><\/p>\n<p>\u00a0<\/p>\n<p>\u0130ncelenen sistemlerde y\u00f6netim paneline do\u011frudan eri\u015fim g\u00fcvenlik duvar\u0131yla engelleniyordu. Ancak g\u00fcvenlik duvar\u0131 ile sunucunun ayn\u0131 web adresini farkl\u0131 yorumlamas\u0131, ara\u015ft\u0131rmac\u0131lar\u0131n panele ula\u015fmas\u0131na imkan verdi. Panel, hem kullan\u0131c\u0131 ad\u0131 hem de parola olarak hala \u201cadmin\u201d bilgisini kabul ediyordu.\u00a0<\/p>\n<p>Platformun sahibi Ping Identity, kendi g\u00fcvenlik k\u0131lavuzunda bu panelin canl\u0131 sistemde kald\u0131r\u0131lmas\u0131n\u0131 veya eri\u015fim bilgilerinin de\u011fi\u015ftirilerek korunmas\u0131n\u0131 \u00f6neriyor.<\/p>\n<p>\u00a0<\/p>\n<p>Ara\u015ft\u0131rmac\u0131lar, sunucuya eri\u015ftikten sonra izinli bir test hesab\u0131n\u0131n e-posta adresini ve \u015fifresini de\u011fi\u015ftirerek mobil uygulama \u00fczerinden yeni bir oturum a\u00e7t\u0131. B\u00f6ylece arac\u0131n konumuna ve uygulaman\u0131n destekledi\u011fi uzaktan kumanda i\u015flevlerine eri\u015febildiler. Hesap bilgilerindeki de\u011fi\u015fiklik, ara\u00e7 sahibinin telefonundaki mevcut oturumu kapatmad\u0131. Shah, ara\u00e7 sahibi otomobilin yan\u0131ndayken kap\u0131lar\u0131n kilidini a\u00e7t\u0131 ve motoru \u00e7al\u0131\u015ft\u0131rd\u0131.<\/p>\n<p>\u00a0<\/p>\n<p><strong>AVUSTRALYA\u2019DA AYRI B\u0130R A\u00c7IK BULUNDU<\/strong><\/p>\n<p>\u00a0<\/p>\n<p>Shah\u2019\u0131n ayr\u0131 raporuna g\u00f6re Avustralya\u2019daki sistemde, test ortam\u0131 i\u00e7in haz\u0131rlanm\u0131\u015f y\u00f6netici bilgilerinin bir JavaScript dosyas\u0131na g\u00f6m\u00fcl\u00fc oldu\u011fu ve ayn\u0131 bilgilerin m\u00fc\u015fterilere hizmet veren sistemde de \u00e7al\u0131\u015ft\u0131\u011f\u0131 g\u00f6r\u00fcld\u00fc. Ara\u015ft\u0131rmac\u0131lar, bu y\u00f6ntemle izinli bir test arac\u0131n\u0131n kap\u0131 kilidini a\u00e7t\u0131. Shah, iki \u00e7al\u0131\u015fman\u0131n birlikte ABD, Kanada ve Avustralya\u2019daki ba\u011fl\u0131 ara\u00e7lara uzaktan komut g\u00f6nderilebildi\u011fini g\u00f6sterdi\u011fini belirtiyor.<\/p>\n<p>\u00a0<\/p>\n<p>Curry ve Shah, \u015eubat 2026&#8217;da Amerika Birle\u015fik Devletleri&#8217;nde yaln\u0131zca kendi onay veren ara\u00e7 sahiplerinin otomobillerinde tam sald\u0131r\u0131y\u0131 test ettiler. \u0130ki \u00fcretici, ara\u00e7 \u00fczerinde denenen a\u00e7\u0131\u011f\u0131 bildirimin ard\u0131ndan ayn\u0131 g\u00fcn giderdi ve etkilenen eri\u015fim bilgilerini yeniledi.\u00a0<\/p>\n<p>Avustralya\u2019daki a\u00e7\u0131\u011f\u0131n ne zaman kapat\u0131ld\u0131\u011f\u0131 ve bu y\u00f6ntemlerin ara\u015ft\u0131rmac\u0131lar d\u0131\u015f\u0131nda kullan\u0131l\u0131p kullan\u0131lmad\u0131\u011f\u0131 kamuya a\u00e7\u0131k raporlarda belirtilmedi.<\/p>\n<\/div>\n<p><br \/>\n<br \/><a href=\"https:\/\/www.ntv.com.tr\/otomobil\/iki-otomobil-markasinda-guvenlik-acigi-admin-sifresi-ile-girildi-araclar-calistirildi-1750177\"><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Siber g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131 Shubham Shah ve Sam Curry, yay\u0131mlad\u0131klar\u0131 raporda iki otomobil \u00fcreticisinin m\u00fc\u015fteri hesaplar\u0131n\u0131 y\u00f6neten ForgeRock adl\u0131 kimlik y\u00f6netimi altyap\u0131s\u0131n\u0131 incelediklerini a\u00e7\u0131klad\u0131. Her iki \u00fcreticinin de mobil uygulamalar\u0131na giri\u015f bu altyap\u0131 \u00fczerinden yap\u0131l\u0131yordu. Ara\u015ft\u0131rmac\u0131lar, \u015firketlerin talebi \u00fczerine marka adlar\u0131n\u0131 a\u00e7\u0131klamad\u0131. \u00a0 Y\u00d6NET\u0130M PANEL\u0130 VARSAYILAN \u015e\u0130FREYLE \u00c7ALI\u015eIYORDU \u00a0 \u0130ncelenen sistemlerde y\u00f6netim paneline do\u011frudan eri\u015fim g\u00fcvenlik [&hellip;]<\/p>\n","protected":false},"author":908,"featured_media":43819,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[13],"tags":[],"class_list":["post-43818","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-otomobil"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/kibrisayna.com\/wp-content\/uploads\/2026\/11\/hacker5-374302.jpg","_links":{"self":[{"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/posts\/43818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/users\/908"}],"replies":[{"embeddable":true,"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/comments?post=43818"}],"version-history":[{"count":0,"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/posts\/43818\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/media\/43819"}],"wp:attachment":[{"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/media?parent=43818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/categories?post=43818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kibrisayna.com\/index.php\/wp-json\/wp\/v2\/tags?post=43818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}