<\/p>\n
\n\tSiber g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131 taraf\u0131ndan fark edilen ve do\u011frulanan s\u0131z\u0131nt\u0131, milyonlarca kullan\u0131c\u0131y\u0131 kimlik h\u0131rs\u0131zl\u0131\u011f\u0131 ve hedefli kimlik av\u0131 sald\u0131r\u0131lar\u0131na kar\u015f\u0131 savunmas\u0131z b\u0131rakan geni\u015f bir ileti\u015fim veri setini kaps\u0131yor.<\/p>\n
\n\tS\u00f6z konusu veri seti, bu haftan\u0131n ba\u015flar\u0131nda “Solonik” takma ad\u0131n\u0131 kullanan bir sald\u0131rgan taraf\u0131ndan bilinen bir bilgisayar korsan\u0131 forumunda yay\u0131nland\u0131.<\/p>\n
\n\t“INSTAGRAM.COM 17M GLOBAL USERS \u2014 2024 API LEAK” ba\u015fl\u0131\u011f\u0131yla payla\u015f\u0131lan ilan, JSON ve TXT formatlar\u0131nda 17,5 milyon kay\u0131t i\u00e7erdi\u011fini iddia ediyor.<\/p>\n
\n\tForumdaki payla\u015f\u0131ma g\u00f6re veriler, 2024 y\u0131l\u0131n\u0131n sonlar\u0131nda bir “API s\u0131z\u0131nt\u0131s\u0131” yoluyla elde edildi.<\/p>\n
\n\tSald\u0131rganlar\u0131n, standart g\u00fcvenlik \u00f6nlemlerini atlayarak d\u00fcnya \u00e7ap\u0131ndaki kullan\u0131c\u0131 profillerini veri kaz\u0131ma (scraping) y\u00f6ntemiyle toplad\u0131\u011f\u0131 belirtiliyor.<\/p>\n
\n\tS\u0131zd\u0131r\u0131lan veri taban\u0131, sadece kullan\u0131c\u0131 adlar\u0131n\u0131 de\u011fil, \u015fu kritik bilgileri de i\u00e7eriyor:<\/p>\n
\n\tTam isimler ve kullan\u0131c\u0131 adlar\u0131<\/p>\n
\n\tDo\u011frulanm\u0131\u015f e-posta adresleri<\/p>\n
\n\tTelefon numaralar\u0131<\/p>\n
\n\tKullan\u0131c\u0131 kimlik numaralar\u0131 (ID)<\/p>\n
\n\t\u00dclke ve k\u0131smi konum verileri<\/p>\n
\n\tVeri \u00f6rneklerinden al\u0131nan ekran g\u00f6r\u00fcnt\u00fcleri, siber su\u00e7lular\u0131n hedefleri hakk\u0131nda kapsaml\u0131 profiller olu\u015fturmas\u0131na olanak tan\u0131yan bu alanlar\u0131n ge\u00e7erlili\u011fini do\u011fruluyor.<\/p>\n
\n\tVeri s\u0131z\u0131nt\u0131s\u0131, yay\u0131nlanmas\u0131n\u0131n ard\u0131ndan h\u0131zla aktif bir tehdide d\u00f6n\u00fc\u015ft\u00fc. \u00c7ok say\u0131da Instagram kullan\u0131c\u0131s\u0131, verilerin s\u0131zd\u0131r\u0131lmas\u0131ndan bu yana istenmeyen \u015fifre s\u0131f\u0131rlama bildirimlerinde b\u00fcy\u00fck bir art\u0131\u015f oldu\u011funu bildirdi.<\/p>\n
\n\tS\u0131z\u0131nt\u0131n\u0131n \u015fifreleri i\u00e7ermedi\u011fi g\u00f6r\u00fclse de e-posta ve telefon numaralar\u0131n\u0131n birle\u015fimi, “SIM kart de\u011fi\u015fimi” sald\u0131r\u0131lar\u0131 ve geli\u015fmi\u015f sosyal m\u00fchendislik y\u00f6ntemleri i\u00e7in yeterli kabul ediliyor.<\/p>\n
\n\tDoland\u0131r\u0131c\u0131lar, kendilerini Instagram destek ekibi gibi tan\u0131tarak veya if\u015fa olan ki\u015fisel detaylar\u0131 kullanarak g\u00fcven in\u015fa edip kurbanlar\u0131 iki fakt\u00f6rl\u00fc do\u011frulama (2FA) kodlar\u0131n\u0131 veya giri\u015f bilgilerini vermeleri i\u00e7in kand\u0131rabiliyor.<\/p>\n
\n\tOlay, Instagram’\u0131n ana sunucular\u0131na do\u011frudan bir s\u0131zma yerine, halka a\u00e7\u0131k aray\u00fczler \u00fczerinden otomatik veri toplama i\u015flemi olan “kaz\u0131ma” olarak s\u0131n\u0131fland\u0131r\u0131ld\u0131.<\/p>\n
\n\tAncak API s\u0131z\u0131nt\u0131s\u0131n\u0131n \u00f6l\u00e7e\u011fi, h\u0131z s\u0131n\u0131rlamas\u0131 veya gizlilik korumalar\u0131ndaki bir eksikli\u011fin, sald\u0131rganlar\u0131n tespit edilmeden milyonlarca hesab\u0131 sorgulamas\u0131na izin verdi\u011fini g\u00f6steriyor.<\/p>\n
\n\t10 Ocak 2026 itibar\u0131yla Meta, 17,5 milyonluk bu veri s\u0131z\u0131nt\u0131s\u0131na ili\u015fkin hen\u00fcz resmi bir a\u00e7\u0131klama yapmad\u0131.<\/p>\n
\n\tSiber g\u00fcvenlik uzmanlar\u0131, t\u00fcm Instagram kullan\u0131c\u0131lar\u0131na SMS yerine bir kimlik do\u011frulama uygulamas\u0131 kullanarak \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulamay\u0131 (MFA) hemen etkinle\u015ftirmelerini ve talep edilmeyen \u015fifre s\u0131f\u0131rlama e-postalar\u0131n\u0131 dikkate almamalar\u0131n\u0131 tavsiye ediyor.<\/p>\n<\/p><\/div>\n