{"id":26305,"date":"2022-05-13T23:36:03","date_gmt":"2022-05-13T20:36:03","guid":{"rendered":"https:\/\/kutaybilen.com.tr\/?p=26305"},"modified":"2022-05-13T23:36:03","modified_gmt":"2022-05-13T20:36:03","slug":"neredeyse-300-windows-10-yurutulebilir-belgesinde-acik","status":"publish","type":"post","link":"https:\/\/kutaybilen.com.tr\/?p=26305","title":{"rendered":"Neredeyse 300 Windows 10 Y\u00fcr\u00fct\u00fclebilir Belgesinde A\u00e7\u0131k"},"content":{"rendered":"<p>\u0130\u015fletim sistemleri ve \u00f6teki yaz\u0131l\u0131mlarda vakit zaman <strong>g\u00fcvenlik a\u00e7\u0131klar\u0131 <\/strong>ya\u015fand\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcyoruz. Bu a\u00e7\u0131klar\u0131n ne kadar kritik ehemmiyette olduklar\u0131 ise de\u011fi\u015fiklik g\u00f6sterebiliyor. B\u00fcy\u00fck ve pek \u00e7ok farkl\u0131 ayg\u0131tta kullan\u0131lan programlar\u0131n a\u00e7\u0131klar\u0131n\u0131n olmama ihtimaliyse neredeyse yok.<\/p>\n<p>\u00d6te yandan Windows 10\u2019un yeni ortaya \u00e7\u0131kan a\u00e7\u0131klar\u0131 hem<strong> say\u0131ca hayli fazla <\/strong>hem de istismar edilmeleri epey kolay g\u00f6z\u00fck\u00fcyor. <strong>300 kadar <\/strong>farkl\u0131 g\u00fcvenlik a\u00e7\u0131\u011f\u0131 ke\u015ffedilirken\u00a0bu a\u00e7\u0131klar\u0131 kolay bir VBScript ile tetiklemek m\u00fcmk\u00fcn.<\/p>\n<p><b>PwC UK uyard\u0131<\/b><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.webtekno.com\/images\/editor\/default\/0002\/72\/b8b4fdd99ca4b023f7701a83c26254bab7e2e2b9.jpeg\"\/><\/p>\n<p>PwC Birle\u015fik Krall\u0131k\u2019tan g\u00fcvenlik ara\u015ft\u0131rmac\u0131s\u0131 olan<strong> Wietze Beukema<\/strong>, yapt\u0131\u011f\u0131 a\u00e7\u0131klamada 300 kadar <strong>Windows 10<\/strong> y\u00fcr\u00fct\u00fclebilir belgesinin DLL ele ge\u00e7irme h\u00fccumlar\u0131na a\u00e7\u0131k oldu\u011funu tabir etti. A\u00e7\u0131klamada, System32 belgesinin nispi yol DLL ele ge\u00e7irmeye a\u00e7\u0131k oldu\u011fu s\u00f6z edilirken\u00a0basit bir <strong>VBScript <\/strong>ile bu uygulama evraklar\u0131n\u0131n kullan\u0131labilece\u011fi, hatta UAC\u2019nin b\u00fcsb\u00fct\u00fcn baypas edilebilece\u011fi tabir edildi.<\/p>\n<p>Bu a\u00e7\u0131klar, <strong>DLL <\/strong>ele <strong>ge\u00e7irme <\/strong>olarak isimlendirilen ak\u0131nlar\u0131 g\u00f6steriyor. Bu sistemde sald\u0131rganlar, ge\u00e7erli bir program\u0131n kendi istedikleri bir DLL\u2019yi \u00e7al\u0131\u015ft\u0131rmas\u0131na neden oluyor. Bu da ekseriyetle ziyanl\u0131 i\u00e7erik emeliyle kullan\u0131l\u0131yor.<\/p>\n<p>Beukema\u2019n\u0131n blog g\u00f6nderisinde yer alan g\u00f6nderide,<strong> DLL de\u011fi\u015ftirme<\/strong>, DLL proxyleme, m\u00fcsaade h\u0131zland\u0131rma, DLL arama s\u0131ras\u0131 ele ge\u00e7irme, <strong>DLL yine y\u00f6nlendirme<\/strong> \u00fczere pek \u00e7ok farkl\u0131 tekni\u011fin kullan\u0131labildi\u011fi tabir ediliyor. Al\u0131\u015f\u0131lm\u0131\u015f bu formda bir kullan\u0131m i\u00e7in sald\u0131rganlar\u0131n teknik marifetlerinin y\u00fcksek olmas\u0131 gerekiyor.<\/p>\n<p><b>\u00d6rnek atak g\u00f6sterildi<\/b><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.webtekno.com\/images\/editor\/default\/0002\/72\/a0c5b0bafa64f0d4667e8c5d4f189d7b70c2d1f5.jpeg\"\/><\/p>\n<p>G\u00f6nderide ayr\u0131yeten bir bilgisayar\u0131n <strong>System32 <\/strong>klas\u00f6r\u00fcnde yer alan bir bilgisayara odaklan\u0131larak \u00f6rnek bir ak\u0131n\u0131n nas\u0131l oldu\u011fu g\u00f6sterildi. Bir program\u0131n \u00e7al\u0131\u015fmas\u0131 s\u0131ras\u0131nda kullan\u0131lan DLL\u2019leri s\u0131ralayan g\u00fcvenlik uzman\u0131, her bir DLL\u2019nin ak\u0131na a\u00e7\u0131k oldu\u011funu tabir etti.<\/p>\n<p>Ara\u015ft\u0131rmac\u0131ya nazaran bu \u00e7e\u015fit h\u00fccumlardan korunmak i\u00e7in d\u00fczg\u00fcn y\u00fcklenen <strong>DLL\u2019lerin <\/strong>\u00f6zel olarak bir klas\u00f6re yaz\u0131lmas\u0131n\u0131 sa\u011flamak gerekiyor. B\u00f6ylelikle sald\u0131rganlar\u0131n i\u015fi epey zorla\u015f\u0131yor. Ayr\u0131yeten her DLL h\u00fccumun maksad\u0131 olmuyor.<\/p>\n<p>Ayr\u0131yeten<strong> Microsoft Kullan\u0131c\u0131 Hesap Denetimi (UAC)<\/strong> \u00fczerinde evraklara m\u00fcdahale edilebilmesi durumunda, ola\u011fanda kar\u015f\u0131m\u0131za \u00e7\u0131kan \u201cBu uygulaman\u0131n bilgisayardaki belgelerde de\u011fi\u015fiklik yapmas\u0131na m\u00fcsaade veriyor musunuz?\u201d s\u00f6z\u00fcn\u00fc de g\u00f6remiyoruz, \u00e7\u00fcnk\u00fc art planda m\u00fcsaadeler sald\u0131rgan taraf\u0131ndan i\u015flenebiliyor.\u00a0<\/p>\n<p>Bu cins taarruzlardan korunmak i\u00e7in ise Windows belgelerindeki aktivitelere bakmak, <strong>UAC ayarlar\u0131n\u0131 <\/strong>\u201cdaima haberdar et\u201d olarak ayarlamak son kullan\u0131c\u0131 a\u00e7\u0131s\u0131ndan al\u0131nabilecek tedbirler ortas\u0131nda yer al\u0131yor. Ayr\u0131yeten <strong>DLL olu\u015fum b\u00f6lgelerini <\/strong>takip etmek ve beklenmedik yerlerde y\u00fcklenip y\u00fcklenmediklerini denetim etmek de bir alternatif olarak g\u00f6ze \u00e7arp\u0131yor.<\/p>\n<div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u0130\u015fletim sistemleri ve \u00f6teki yaz\u0131l\u0131mlarda vakit zaman g\u00fcvenlik a\u00e7\u0131klar\u0131 ya\u015fand\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcyoruz. Bu a\u00e7\u0131klar\u0131n ne kadar kritik ehemmiyette olduklar\u0131 &#8230;<\/p>\n","protected":false},"author":1,"featured_media":26306,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[854],"tags":[3724,2782,1102],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/26305"}],"collection":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=26305"}],"version-history":[{"count":1,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/26305\/revisions"}],"predecessor-version":[{"id":26307,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/26305\/revisions\/26307"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/media\/26306"}],"wp:attachment":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26305"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}