{"id":53579,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah"},"modified":"2021-01-02T13:04:14","modified_gmt":"2021-01-02T11:04:14","slug":"ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","title":{"rendered":"HackerOne'a yap\u0131lan sald\u0131r\u0131, kapal\u0131 g\u00fcvenlik a\u00e7\u0131kl\u0131klar\u0131 raporlar\u0131na eri\u015fim sa\u011flad\u0131","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

G\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131na, bulduklar\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 geli\u015ftiricilere bildirme ve bu i\u00e7in \u00f6d\u00fcller kazanma imkan\u0131 veren HackerOne platformu, rapor<\/a><\/noindex> kendi siber sald\u0131r\u0131s\u0131 hakk\u0131nda. Ara\u015ft\u0131rmac\u0131lardan biri, HackerOne'\u0131n kapal\u0131 materyallerini g\u00f6r\u00fcnt\u00fcleme yetkisine sahip bir g\u00fcvenlik analistinin hesab\u0131na eri\u015fmeyi ba\u015fard\u0131; bu materyaller aras\u0131nda hen\u00fcz giderilmemi\u015f g\u00fcvenlik a\u00e7\u0131klar\u0131 hakk\u0131nda bilgiler de yer al\u0131yordu. Platformun varl\u0131\u011f\u0131ndan bu yana, HackerOne \u00fczerinden g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit eden ara\u015ft\u0131rmac\u0131lara toplamda 23 milyon dolar \u00f6dendi, bu m\u00fc\u015fteriler aras\u0131nda Twitter, Facebook, Google, Apple, Microsoft, Slack, Pentagon ve ABD Donanmas\u0131 bulunmaktad\u0131r.<\/p>\n

Dikkate de\u011fer olan, hesab\u0131n ele ge\u00e7irilmesinin insani bir fakt\u00f6r nedeniyle m\u00fcmk\u00fcn olmas\u0131d\u0131r. Ara\u015ft\u0131rmac\u0131lardan biri, HackerOne'da potansiyel bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131na ili\u015fkin ba\u015fvuru g\u00f6nderdi. HackerOne analisti, ba\u015fvuruyu incelerken \u00f6nerilen sald\u0131r\u0131 y\u00f6ntemini yeniden \u00fcretmeye \u00e7al\u0131\u015ft\u0131, ancak problemi yeniden olu\u015fturamad\u0131 ve ba\u015fvuran ki\u015fiye ek bilgiler talep eden bir yan\u0131t g\u00f6nderdi. Bu s\u0131rada analist, dikkatsizli\u011finden dolay\u0131 ba\u015far\u0131s\u0131z kontrol\u00fcn sonu\u00e7lar\u0131na ek olarak oturum Cookie'sinin i\u00e7eri\u011fini de g\u00f6ndermeyi unuttu. \u00d6zellikle, analist diyalog s\u0131ras\u0131nda, temizlik yapmadan g\u00f6nderdi\u011fi oturum Cookie'sini i\u00e7eren HTTP ba\u015fl\u0131klar\u0131n\u0131 i\u00e7eren curl arac\u0131yla yap\u0131lm\u0131\u015f bir HTTP iste\u011fi \u00f6rne\u011fi verdi.<\/p>\n

Ara\u015ft\u0131rmac\u0131 bu dikkatsizli\u011fi fark etti ve hackerone.com'daki ayr\u0131cal\u0131kl\u0131 bir hesaba, oturum Cookie'sinde g\u00f6rd\u00fc\u011f\u00fc de\u011feri ekleyerek eri\u015fim sa\u011flad\u0131. Bu, hizmette uygulanan \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulamas\u0131ndan ge\u00e7me gereksinimi olmadan ger\u00e7ekle\u015fti. Sald\u0131r\u0131, hackerone.com'da oturumun IP'ye veya kullan\u0131c\u0131n\u0131n taray\u0131c\u0131s\u0131na ba\u011fl\u0131 olmad\u0131\u011f\u0131 i\u00e7in m\u00fcmk\u00fcn oldu. Problemli oturum kimli\u011fi, s\u0131z\u0131nt\u0131 raporunun yay\u0131nlanmas\u0131ndan iki saat sonra silindi. Ara\u015ft\u0131rmac\u0131ya sorun hakk\u0131nda bilgi vermesi i\u00e7in 20 bin dolar \u00f6denmesine karar verildi.<\/p>\n

HackerOne, ge\u00e7mi\u015fte benzer Cookie s\u0131z\u0131nt\u0131lar\u0131n\u0131n olu\u015fup olu\u015fmad\u0131\u011f\u0131n\u0131 analiz etmek ve hizmetin m\u00fc\u015fterileriyle ilgili kapal\u0131 bilgilerin potansiyel s\u0131z\u0131nt\u0131lar\u0131n\u0131 de\u011ferlendirmek i\u00e7in bir denetim ba\u015flatt\u0131. Denetim, ge\u00e7mi\u015fte s\u0131z\u0131nt\u0131 olaylar\u0131n\u0131 ortaya koymad\u0131 ve sorunu g\u00f6steren ara\u015ft\u0131rmac\u0131n\u0131n, analistin eri\u015fim sa\u011flad\u0131\u011f\u0131 hizmetteki t\u00fcm programlar\u0131n yakla\u015f\u0131k %5'ine dair bilgilere ula\u015fabilece\u011fini belirledi.<\/p>\n

Gelecekte benzer sald\u0131r\u0131lar\u0131n ger\u00e7ekle\u015fmesini \u00f6nlemek i\u00e7in oturum anahtar\u0131n\u0131n ba\u011flanmas\u0131 uyguland\u0131. IP \u00fcnvan\u0131<\/a> v\u0259 sessiya a\u00e7arlar\u0131n\u0131n v\u0259 autentifikasiya tokenl\u0259rinin \u015f\u0259rhl\u0259rd\u0259 filtr edilmesi. G\u0259l\u0259c\u0259kd\u0259 IP-\u0259 ba\u011fl\u0131l\u0131\u011f\u0131 istifad\u0259\u00e7il\u0259rin qur\u011fular\u0131na ba\u011fl\u0131l\u0131\u011fa d\u0259yi\u015fdirm\u0259k planla\u015fd\u0131r\u0131l\u0131r, \u00e7\u00fcnki dinamik IP-l\u0259rl\u0259 istifad\u0259\u00e7il\u0259r \u00fc\u00e7\u00fcn bu rahat deyil. H\u0259m\u00e7inin, istifad\u0259\u00e7il\u0259rin m\u0259lumatlara giri\u015fini \u0259ks etdir\u0259n log sisteminin geni\u015fl\u0259ndirilm\u0259si v\u0259 m\u00fc\u015ft\u0259ri m\u0259lumatlar\u0131na analitikl\u0259rin daxil olma modelinin h\u0259yata ke\u00e7irilm\u0259si q\u0259rara al\u0131n\u0131b.<\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0435. \u041e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HackerOne, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0431 \u0435\u0449\u0451 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0417\u0430 \u0432\u0440\u0435\u043c\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0447\u0435\u0440\u0435\u0437 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53579","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47HackerOne-da, z\u0259iflikl\u0259rin ba\u011fl\u0131 hesabatlar\u0131na giri\u015f \u0259ld\u0259 ed\u0259n h\u00fccum | ProHoster","description":"G\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131na, bulduklar\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 geli\u015ftiricilere bildirme ve bu i\u00e7in \u00f6d\u00fcller kazanma imkan\u0131 veren HackerOne platformu,","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 HackerOne, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0442\u0447\u0451\u0442\u0430\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-01-02T11:04:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53579","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-02-08 20:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=53579"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53579\/revisions"}],"predecessor-version":[{"id":157785,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53579\/revisions\/157785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=53579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=53579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=53579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}