{"id":7939,"date":"2026-10-20T10:39:50","date_gmt":"2026-10-20T07:39:50","guid":{"rendered":"https:\/\/ademocut.com\/blog\/?p=7939"},"modified":"2026-10-20T10:39:51","modified_gmt":"2026-10-20T07:39:51","slug":"sosyal-medya-hesap-guvenligi","status":"publish","type":"post","link":"https:\/\/ademocut.com\/blog\/sosyal-medya-hesap-guvenligi\/","title":{"rendered":"Sosyal medya hesap g\u00fcvenli\u011fi: 2FA, oltalama ve \u00fc\u00e7\u00fcnc\u00fc taraf eri\u015fimi"},"content":{"rendered":"<p>Bir sunucuyu internete a\u00e7an her sistem y\u00f6neticisi ilk i\u015f olarak parola ile giri\u015fi kapat\u0131r, anahtar tabanl\u0131 kimlik do\u011frulamaya ge\u00e7er ve kimlerin oturum a\u00e7t\u0131\u011f\u0131n\u0131 loglardan izler. Ayn\u0131 disiplin sosyal medya hesaplar\u0131na nadiren uygulan\u0131r; oysa bir i\u015fletmenin Instagram ya da Facebook hesab\u0131 da m\u00fc\u015fteri ileti\u015fimi, sat\u0131\u015f ve itibar a\u00e7\u0131s\u0131ndan kritik bir sistemdir. Bu yaz\u0131da hesap g\u00fcvenli\u011fini bir altyap\u0131 y\u00f6neticisinin bak\u0131\u015f a\u00e7\u0131s\u0131yla ele al\u0131yoruz: tehdit modeli, iki ad\u0131ml\u0131 do\u011frulama y\u00f6ntemlerinin kar\u015f\u0131la\u015ft\u0131rmas\u0131, oltalaman\u0131n teknik izleri ve d\u0131\u015f hizmet sa\u011flay\u0131c\u0131larla \u00e7al\u0131\u015f\u0131rken uygulanmas\u0131 gereken en az yetki ilkesi.<\/p>\n<h2>Tehdit modeli: Hesaplar nas\u0131l ele ge\u00e7iriliyor<\/h2>\n<p>Sosyal medya hesaplar\u0131na y\u00f6nelik sald\u0131r\u0131lar\u0131n b\u00fcy\u00fck k\u0131sm\u0131 birka\u00e7 bilinen y\u00f6ntemle y\u00fcr\u00fcr:<\/p>\n<ul>\n<li><strong>Parola doldurma (credential stuffing):<\/strong> Ba\u015fka bir siteden s\u0131zm\u0131\u015f e-posta ve parola \u00e7iftleri, otomatik ara\u00e7larla sosyal medya giri\u015f sayfalar\u0131nda denenir. Ayn\u0131 parolay\u0131 birden \u00e7ok yerde kullanmak bu sald\u0131r\u0131y\u0131 m\u00fcmk\u00fcn k\u0131lar.<\/li>\n<li><strong>Oltalama:<\/strong> Sahte telif ihlali uyar\u0131lar\u0131, &#8220;do\u011frulama rozeti ba\u015fvurunuz onayland\u0131&#8221; mesajlar\u0131 ya da hesab\u0131n kapat\u0131laca\u011f\u0131n\u0131 s\u00f6yleyen e-postalar, kullan\u0131c\u0131y\u0131 ger\u00e7e\u011fine benzeyen bir giri\u015f sayfas\u0131na y\u00f6nlendirir.<\/li>\n<li><strong>SIM de\u011fi\u015ftirme:<\/strong> Sald\u0131rgan, operat\u00f6r\u00fc kand\u0131rarak kurban\u0131n numaras\u0131n\u0131 kendi SIM kart\u0131na ta\u015f\u0131r ve SMS ile gelen kodlar\u0131 ele ge\u00e7irir.<\/li>\n<li><strong>Oturum \u00e7erezi h\u0131rs\u0131zl\u0131\u011f\u0131:<\/strong> Bilgisayara bula\u015fan bilgi \u00e7al\u0131c\u0131 zararl\u0131lar, taray\u0131c\u0131daki a\u00e7\u0131k oturum \u00e7erezlerini kopyalar; bu durumda parola ve ikinci ad\u0131m hi\u00e7 sorulmadan oturuma girilebilir.<\/li>\n<li><strong>A\u015f\u0131r\u0131 yetkili \u00fc\u00e7\u00fcnc\u00fc taraf eri\u015fimi:<\/strong> Hesaba ba\u011flanm\u0131\u015f eski uygulamalar, taray\u0131c\u0131 eklentileri veya \u015fifresi payla\u015f\u0131lm\u0131\u015f d\u0131\u015f ki\u015filer.<\/li>\n<\/ul>\n<p>Bu listeye bak\u0131nca savunman\u0131n tek bir ayarla bitmedi\u011fi g\u00f6r\u00fcl\u00fcr; katmanl\u0131 d\u00fc\u015f\u00fcnmek gerekir.<\/p>\n<h2>\u0130ki ad\u0131ml\u0131 do\u011frulama: Y\u00f6ntemler e\u015fit de\u011fil<\/h2>\n<p>Meta, <span style=\"color: #0000ff;\"><strong><a style=\"color: #0000ff;\" href=\"https:\/\/www.facebook.com\/help\/148233965247823\">Facebook Yard\u0131m Merkezi&#8217;ndeki iki fakt\u00f6rl\u00fc kimlik do\u011frulama sayfas\u0131nda<\/a><\/strong><\/span> ikinci ad\u0131m i\u00e7in \u00fc\u00e7 y\u00f6ntem sayar: g\u00fcvenlik anahtar\u0131, \u00fc\u00e7\u00fcnc\u00fc taraf kimlik do\u011frulama uygulamalar\u0131ndan al\u0131nan kodlar ve SMS ile g\u00f6nderilen kodlar. Ayn\u0131 sayfa, telefonunuza eri\u015femedi\u011finiz durumlar i\u00e7in kurtarma kodlar\u0131 olu\u015fturulabildi\u011fini de belirtir. Bu \u00fc\u00e7 y\u00f6ntemin g\u00fcvenlik d\u00fczeyi ise birbirinden farkl\u0131d\u0131r.<\/p>\n<p><strong>SMS<\/strong>, hi\u00e7 olmamas\u0131ndan iyidir ama SIM de\u011fi\u015ftirme sald\u0131r\u0131s\u0131na a\u00e7\u0131kt\u0131r. <strong>Do\u011frulama uygulamalar\u0131<\/strong> (TOTP), cihazda \u00fcretilen ve genellikle 30 saniyede yenilenen kodlarla bu riski ortadan kald\u0131r\u0131r; yine de kullan\u0131c\u0131 kodu sahte bir sayfaya kendi eliyle yazarsa, ger\u00e7ek zamanl\u0131 arac\u0131 sunucu kullanan bir oltalama kiti kodu an\u0131nda as\u0131l siteye iletebilir. <strong>G\u00fcvenlik anahtarlar\u0131<\/strong> (FIDO2\/WebAuthn) ise kimlik do\u011frulamay\u0131 alan ad\u0131na ba\u011flar; anahtar, sahte bir alan ad\u0131na imza \u00fcretmez. Oltalamaya kar\u015f\u0131 dayan\u0131kl\u0131 olan tek se\u00e7enek budur.<\/p>\n<p>Pratik \u00f6neri \u015f\u00f6yle \u00f6zetlenebilir: Kritik i\u015fletme hesaplar\u0131nda g\u00fcvenlik anahtar\u0131, di\u011ferlerinde do\u011frulama uygulamas\u0131 kullan\u0131n; SMS&#8217;i yaln\u0131zca yedek olarak b\u0131rak\u0131n. Kurtarma kodlar\u0131n\u0131 parola y\u00f6neticisinde ya da \u00e7evrimd\u0131\u015f\u0131 bir ortamda saklay\u0131n, ekran g\u00f6r\u00fcnt\u00fcs\u00fc olarak galeride tutmay\u0131n.<\/p>\n<h2>Oltalamay\u0131 teknik olarak tan\u0131mak<\/h2>\n<p>Oltalama sayfalar\u0131 g\u00f6rsel olarak kusursuz olabilir; ay\u0131rt edici olan teknik ayr\u0131nt\u0131lard\u0131r. Adres \u00e7ubu\u011fundaki alan ad\u0131n\u0131 karakter karakter okuyun: benzer g\u00f6r\u00fcnen harflerle kay\u0131t edilmi\u015f alan adlar\u0131 (homograf sald\u0131r\u0131lar\u0131), uzun alt alan adlar\u0131n\u0131n i\u00e7ine gizlenmi\u015f marka isimleri ve k\u0131salt\u0131lm\u0131\u015f linkler s\u0131k g\u00f6r\u00fclen tuzaklard\u0131r. Platformun resmi bir uyar\u0131s\u0131 varsa ayn\u0131 bilgiye uygulaman\u0131n kendi ayarlar ve bildirim ekranlar\u0131ndan da ula\u015fabilmeniz gerekir; yaln\u0131zca e-postada ya da do\u011frudan mesajda var olan bir &#8220;son uyar\u0131&#8221; \u015f\u00fcphelidir. Instagram, g\u00fcvenlik ayarlar\u0131nda son d\u00f6nemde g\u00f6nderdi\u011fi resmi e-postalar\u0131 listeleyen bir b\u00f6l\u00fcm sunar; gelen bir e-postan\u0131n ger\u00e7ek olup olmad\u0131\u011f\u0131n\u0131 oradan kar\u015f\u0131la\u015ft\u0131rabilirsiniz.<\/p>\n<h2>\u015eifre payla\u015fmamak ve oturum hijyeni<\/h2>\n<p>Kurumsal hesapta en s\u0131k yap\u0131lan hata, ajans ya da \u00e7al\u0131\u015fanla \u015fifre payla\u015fmakt\u0131r. Meta&#8217;n\u0131n i\u015fletme ara\u00e7lar\u0131, ki\u015filere \u015fifre vermeden rol bazl\u0131 eri\u015fim tan\u0131mlamaya izin verir; eri\u015fim, ki\u015fi ayr\u0131ld\u0131\u011f\u0131nda tek t\u0131kla geri al\u0131n\u0131r. Parolalar bir parola y\u00f6neticisinde, her servis i\u00e7in benzersiz ve uzun tutulmal\u0131d\u0131r.<\/p>\n<p>Bunun yan\u0131nda hesap merkezindeki &#8220;giri\u015f yap\u0131lan yerler&#8221; listesini d\u00fczenli kontrol edin, tan\u0131mad\u0131\u011f\u0131n\u0131z oturumlar\u0131 sonland\u0131r\u0131n ve hesaba ba\u011fl\u0131 uygulamalar ile web siteleri listesinden art\u0131k kullanmad\u0131klar\u0131n\u0131z\u0131n eri\u015fimini kald\u0131r\u0131n. Bir sunucudaki eski SSH anahtarlar\u0131n\u0131 temizlemek neyse, bu da odur.<\/p>\n<h2>\u00dc\u00e7\u00fcnc\u00fc taraf hizmet al\u0131rken en az yetki ilkesi<\/h2>\n<p>\u0130\u015fletmeler analiz, planlama ya da takip\u00e7i ve etkile\u015fim gibi b\u00fcy\u00fcme hizmetleri i\u00e7in d\u0131\u015f sa\u011flay\u0131c\u0131larla \u00e7al\u0131\u015fabilir. Burada sorulacak soru basittir: Bu hizmet i\u015fini yapmak i\u00e7in hangi veriye ihtiya\u00e7 duyar? Takip\u00e7i, be\u011feni ya da izlenme hizmeti yaln\u0131zca herkese a\u00e7\u0131k bir tan\u0131mlay\u0131c\u0131ya, yani kullan\u0131c\u0131 ad\u0131na veya g\u00f6nderi linkine ihtiya\u00e7 duyar. \u015eifre, do\u011frulama kodu veya &#8220;hesab\u0131n\u0131zla giri\u015f yap\u0131n&#8221; \u00fczerinden geni\u015f yetki isteyen bir sa\u011flay\u0131c\u0131, i\u015finin gerektirdi\u011finden fazlas\u0131n\u0131 talep ediyordur. \u00d6rne\u011fin <span style=\"color: #0000ff;\"><strong><a style=\"color: #0000ff;\" href=\"https:\/\/toade.com\/\">Toade<\/a> <\/strong><\/span>sipari\u015f i\u00e7in \u015fifre istemez; kullan\u0131c\u0131 ad\u0131 ya da link yeterlidir. \u00d6deme taraf\u0131nda ise TLS sertifikas\u0131n\u0131n do\u011fru alan ad\u0131na ait oldu\u011funu, kart \u00f6demesinde bankan\u0131n 3D Secure ekran\u0131n\u0131n a\u00e7\u0131ld\u0131\u011f\u0131n\u0131 ve sat\u0131c\u0131n\u0131n t\u00fczel ki\u015fili\u011finin faturada yazd\u0131\u011f\u0131n\u0131 kontrol edin. Hizmeti kullanmak i\u00e7in taray\u0131c\u0131 eklentisi ya da masa\u00fcst\u00fc uygulamas\u0131 kurman\u0131z\u0131 \u015fart ko\u015fan sa\u011flay\u0131c\u0131lara, hesab\u0131n\u0131z\u0131n a\u00e7\u0131k oldu\u011fu cihazda yer a\u00e7may\u0131n.<\/p>\n<p>\u00d6zetle sosyal medya hesab\u0131 da di\u011fer sistemleriniz gibi y\u00f6netilmeli: benzersiz parola, oltalamaya dayan\u0131kl\u0131 ikinci ad\u0131m, d\u00fczenli oturum denetimi ve yaln\u0131zca gerekti\u011fi kadar yetki. Bu d\u00f6rt katman yerindeyse hesab\u0131n\u0131z, sald\u0131rganlar\u0131n \u00e7o\u011fu i\u00e7in zahmetli bir hedef h\u00e2line gelir.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bir sunucuyu internete a\u00e7an her sistem y\u00f6neticisi ilk i\u015f olarak parola ile giri\u015fi kapat\u0131r, anahtar tabanl\u0131 kimlik do\u011frulamaya ge\u00e7er ve kimlerin oturum a\u00e7t\u0131\u011f\u0131n\u0131 loglardan izler. Ayn\u0131 disiplin sosyal medya hesaplar\u0131na nadiren uygulan\u0131r; oysa bir i\u015fletmenin Instagram ya da Facebook hesab\u0131 da m\u00fc\u015fteri ileti\u015fimi, sat\u0131\u015f ve itibar a\u00e7\u0131s\u0131ndan kritik bir sistemdir. Bu yaz\u0131da hesap g\u00fcvenli\u011fini bir [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":7941,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4124,4125,4122,4123,4121],"class_list":["post-7939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-genel","tag-hesap-koruma-yontemleri","tag-iki-adimli-dogrulama","tag-instagram-hesap-guvenligi","tag-olta-lama-saldirilari","tag-sosyal-medya-hesap-guvenligi"],"_links":{"self":[{"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/posts\/7939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/comments?post=7939"}],"version-history":[{"count":1,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/posts\/7939\/revisions"}],"predecessor-version":[{"id":7940,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/posts\/7939\/revisions\/7940"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/media\/7941"}],"wp:attachment":[{"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/media?parent=7939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/categories?post=7939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ademocut.com\/blog\/wp-json\/wp\/v2\/tags?post=7939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}