{"id":6583,"date":"2012-06-05T09:44:41","date_gmt":"2012-06-05T06:44:41","guid":{"rendered":"http:\/\/blog.lifeoverip.net\/?p=6583"},"modified":"2012-06-05T09:48:03","modified_gmt":"2012-06-05T06:48:03","slug":"cloudflare-hacklenmesi-ile-ilgili-notlar","status":"publish","type":"post","link":"http:\/\/blog.lifeoverip.net\/2012\/06\/05\/cloudflare-hacklenmesi-ile-ilgili-notlar\/","title":{"rendered":"CloudFlare Hacklenmesi ile \u0130lgili Notlar"},"content":{"rendered":"<p>Detaylar\u0131na http:\/\/blog.cloudflare.com\/the-four-critical-security-flaws-that-resulte ve http:\/\/blog.cloudflare.com\/post-mortem-todays-attack-apparent-google-app adreslerinden eri\u015febilece\u011finiz Cloudflare hacking olay\u0131n\u0131n arka plan\u0131 ve detaylar\u0131.<\/p>\n<p>Son zamanlarda g\u00f6rd\u00fc\u011f\u00fcm en sofistike sald\u0131r\u0131lardan biri.<\/p>\n<p><!--more-->Writing that report wasn&#8217;t fun, but I believe it is important to share the details of the event so others who may be affected can learn from the events that transpired last Friday. This is not the usual way for the security industry, but we believe it&#8217;s the way the security industry should be. To that end, here&#8217;s what we know about the hack&#8230;<\/p>\n<p><strong>The Four Key Security Flaws<\/strong><\/p>\n<p>There were four key security flaws that allowed the hack to happen:<\/p>\n<ul>\n<li>AT&amp;T was tricked into redirecting my voicemail to a fraudulent voicemail box;<\/li>\n<li>Google&#8217;s account recovery process was tricked by the fraudulent voicemail box and left an account recovery PIN code that allowed my personal Gmail account to be reset;<\/li>\n<li>A flaw in Google&#8217;s Enterprise Apps account recovery process allowed the hacker to bypass two-factor authentication on my CloudFlare.com address; and<\/li>\n<li>CloudFlare BCCing transactional emails to some administrative accounts allowed the hacker to reset the password of a customer once the hacker had gained access to the administrative email account.<\/li>\n<\/ul>\n<p>Google has publicly stated that the flaw in the Google Enterprise App account recovery process has been patched and you can no longer use it get around two-factor authentication. Again, since any security system is only as strong as its weakest link, we would recommend using an out-of-band authentication that doesn&#8217;t rely on the phone company&#8217;s network (e.g., Google Authenticator App, not SMS or voice verification)<\/p>\n<p><strong>Cloudflare Hacking Incident Timeline<\/strong><br \/>\nhttp:\/\/share.cloudflare.com\/3g1X141s2s3J2G2Z0e0O\/o<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Detaylar\u0131na http:\/\/blog.cloudflare.com\/the-four-critical-security-flaws-that-resulte ve http:\/\/blog.cloudflare.com\/post-mortem-todays-attack-apparent-google-app adreslerinden eri\u015febilece\u011finiz Cloudflare hacking olay\u0131n\u0131n arka plan\u0131 ve detaylar\u0131. Son zamanlarda g\u00f6rd\u00fc\u011f\u00fcm en sofistike sald\u0131r\u0131lardan biri.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[518,519],"_links":{"self":[{"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/posts\/6583"}],"collection":[{"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/comments?post=6583"}],"version-history":[{"count":3,"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/posts\/6583\/revisions"}],"predecessor-version":[{"id":6585,"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/posts\/6583\/revisions\/6585"}],"wp:attachment":[{"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/media?parent=6583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/categories?post=6583"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.lifeoverip.net\/wp-json\/wp\/v2\/tags?post=6583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}