{"id":10499,"date":"2022-04-14T13:36:03","date_gmt":"2022-04-14T10:36:03","guid":{"rendered":"https:\/\/kutaybilen.com.tr\/?p=10499"},"modified":"2022-04-14T13:36:03","modified_gmt":"2022-04-14T10:36:03","slug":"eski-bir-kod-yuzunden-milyonlarca-aygit-risk-altinda","status":"publish","type":"post","link":"https:\/\/kutaybilen.com.tr\/?p=10499","title":{"rendered":"Eski Bir Kod Y\u00fcz\u00fcnden Milyonlarca Ayg\u0131t Risk Alt\u0131nda"},"content":{"rendered":"

Ge\u00e7ti\u011fimiz a\u011fustos ay\u0131nda bir hastaneden gelen ba\u015f kar\u0131\u015ft\u0131r\u0131c\u0131 ihbar, Armis isimli g\u00fcvenlik \u015firketinde dikkatleri \u00fczerine toplad\u0131. Armis\u2019ten hizmet alan hastanenin s\u0131v\u0131 pompas\u0131nda\u00a0birka\u00e7 hafta \u00f6ncesinde ke\u015ffedilen ve VxWorks isimli i\u015fletim sistemi \u00fczerinde bulunan kusur nedeniyle bu t\u00fcrl\u00fc bir a\u00e7\u0131k vard\u0131. \u00d6te yandan bahsi ge\u00e7en ayg\u0131tta bu i\u015fletim sistemi bulunmuyordu.\u00a0<\/p>\n

Hastane yetkilileri, bunun yaln\u0131zca bir yanl\u0131\u015f alarm olup olmad\u0131\u011f\u0131n\u0131 merak etse de g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131, beklemedikleri bir sonu\u00e7la kar\u015f\u0131la\u015ft\u0131. VxWorks ile pompan\u0131n i\u015fletim sistemi ortas\u0131nda ba\u015f kar\u0131\u015ft\u0131r\u0131c\u0131 bir sinyalle\u015fme fark edildi. Ortaya \u00e7\u0131kan durum, kritik k\u0131ymet ta\u015f\u0131yan pek \u00e7ok ayg\u0131t\u0131n, \u00f6rne\u011fin hasta monit\u00f6rlerinin, modemlerin, g\u00fcvenlik kameralar\u0131n\u0131n ve daha fazla ayg\u0131t\u0131n tehlikede oldu\u011funu g\u00f6steriyordu.\u00a0<\/p>\n

15 y\u0131ld\u0131r g\u00fcncellemeler olsa da yanl\u0131\u015flar d\u00fczeltilmedi:<\/b><\/p>\n

<\/p>\n

Armis, bug\u00fcn yapt\u0131\u011f\u0131 a\u00e7\u0131klamada, sorunun kayna\u011f\u0131 olan a\u00e7\u0131\u011f\u0131n iddia edilenden \u00e7ok daha fazla ayg\u0131t\u0131 etkiledi\u011fini a\u00e7\u0131klad\u0131. Ger\u00e7ek vakitli i\u015fletim sistemi (RTO) olarak isimlendirilen sistemler, sanayide ve s\u0131hhat b\u00f6l\u00fcm\u00fcnde s\u0131k s\u0131k kullan\u0131l\u0131yor. \u00c7ok farkl\u0131 platformlar olsalar da her iki tarafta da hayli eski bir koda dayal\u0131 eserler kullan\u0131l\u0131yor.\u00a0Armis Lider Yard\u0131mc\u0131s\u0131 Ben Seri, g\u00f6m\u00fcl\u00fc olarak kullan\u0131lan ve \u00f6zel olarak y\u00f6netilmeyen ayg\u0131tlar\u0131n sorunu oldu\u011funu belirtirken\u00a0ge\u00e7en 15 y\u0131lda kodlarda inan\u0131lmaz de\u011fi\u015fimler olsa da yan\u0131lg\u0131lar\u0131n t\u0131pk\u0131 kald\u0131\u011f\u0131n\u0131 s\u00f6yl\u00fcyor.\u00a0<\/p>\n

\u0130sve\u00e7li Interpeak taraf\u0131ndan olu\u015fturulan TCP\/IP stok protokol\u00fc, pek \u00e7ok firmaya sat\u0131l\u0131yor. Bu firmalar ortas\u0131nda RTO kullanan firmalar da yer al\u0131yor. 2006 y\u0131l\u0131nda da Wind River taraf\u0131ndan VxWorks geli\u015ftirildi. Wind River, t\u0131pk\u0131 vakitte Interpeak\u2019i de sat\u0131n ald\u0131 ve h\u00e2liyle firman\u0131n TCP\/IP stok sistemi\u00a0IPNet de onlara ge\u00e7ti.\u00a0Bu da Urgent\/11 isimli yanl\u0131\u015f\u0131n neden Becton Dickinson Alaris taraf\u0131ndan \u00fcretilen pompada oldu\u011funu g\u00f6steriyor. Firma, bir \u00f6b\u00fcr IPNet tabanl\u0131 sistem kullanan bir \u00f6teki firma olan\u00a0ENEA\u2019ya ili\u015fkin bir RTO kullan\u0131yor.\u00a0<\/p>\n

<\/p>\n

IPNet sistemindeki a\u00e7\u0131klar, yan\u0131lg\u0131n\u0131n pratikte de ortaya \u00e7\u0131kmas\u0131ndan evvel Las Vegas\u2019taki hack konferans\u0131nda da konu\u015fulmu\u015ftu. Orada BD Alaris temsilcileri ile Armis temsilcileri bir ortaya gelmi\u015fti.\u00a0Bir BD Alaris temsilcisi, bu kusurun istismar\u0131n\u0131n\u00a0zor oldu\u011funu belirtti. Hackerler, her ayg\u0131t\u0131 farkl\u0131 ayr\u0131 ama\u00e7 almak zorundalar ve ak\u0131nlar\u0131nda ba\u015far\u0131l\u0131 bile olsalar devam eden s\u00fcreci etkileyemiyorlar. M\u00fcmk\u00fcn taarruzlar, ayg\u0131t\u0131n alarm\u0131n\u0131n \u00e7almas\u0131na, ihtar \u0131\u015f\u0131klar\u0131n\u0131n yanmas\u0131na ve \u201cileti\u015fim hatas\u0131\u201d uyar\u0131s\u0131 vermesine neden olabiliyor.<\/p>\n

Devlet kurumlar\u0131ndan yetkililer, Armis ve BD Alaris temsilcileri, sistemdeki yan\u0131lg\u0131n\u0131n tespiti ve ortadan kald\u0131r\u0131lmas\u0131 i\u00e7in \u00e7al\u0131\u015fmalar y\u00fcr\u00fct\u00fcyor. \u015eimdilik uzmanlar a\u00e7\u0131\u011f\u0131n formuyla ilgili bilgileri topluyor.\u00a0<\/p>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

Ge\u00e7ti\u011fimiz a\u011fustos ay\u0131nda bir hastaneden gelen ba\u015f kar\u0131\u015ft\u0131r\u0131c\u0131 ihbar, Armis isimli g\u00fcvenlik \u015firketinde dikkatleri \u00fczerine toplad\u0131. Armis\u2019ten …<\/p>\n","protected":false},"author":1,"featured_media":10500,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[854],"tags":[990,1117,1503,1311],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/10499"}],"collection":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10499"}],"version-history":[{"count":1,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/10499\/revisions"}],"predecessor-version":[{"id":10501,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/10499\/revisions\/10501"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/media\/10500"}],"wp:attachment":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}