{"id":10898,"date":"2022-08-01T13:02:27","date_gmt":"2022-08-01T10:02:27","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=10898"},"modified":"2022-08-01T13:02:27","modified_gmt":"2022-08-01T10:02:27","slug":"obi-wan-kenobi-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/obi-wan-kenobi-cybersecurity\/10898\/","title":{"rendered":"Bilgi g\u00fcvenli\u011fi a\u00e7\u0131s\u0131ndan Obi-Wan Kenobi"},"content":{"rendered":"

Obi-Wan Kenobi<\/em>, Galaktik \u0130mparatorlu\u011fun<\/a> ilan\u0131ndan on y\u0131l sonra, skandal niteli\u011finde g\u00fcvenlik a\u00e7\u0131klar\u0131 y\u00fcz\u00fcnden Asi Birli\u011fi<\/a> sald\u0131r\u0131s\u0131nda b\u00fcy\u00fck \u00f6l\u00e7\u00fcde yok edilen kritik altyap\u0131 tesisi \u00d6Y-1 Mobil Sava\u015f \u0130stasyonu\u2019nun<\/em> (daha bilinen ad\u0131yla \u00d6l\u00fcm Y\u0131ld\u0131z\u0131\u2019nun<\/a>) \u0130mparatorluk taraf\u0131ndan terk edilmesinden ise dokuz y\u0131l \u00f6nce ge\u00e7iyor. Diziyi, \u0130mparatorlu\u011fun bilgi g\u00fcvenli\u011fi geli\u015fiminin izlerini s\u00fcrebilme umuduyla izledim, ancak sonu\u00e7ta \u201cgeli\u015fim\u201d yerine \u201c\u00e7\u00f6k\u00fc\u015f\u201d s\u00f6zc\u00fc\u011f\u00fcn\u00fcn daha yerinde olaca\u011f\u0131 ortaya \u00e7\u0131kt\u0131. (Bu arada, her zamanki gibi senaryodaki b\u00fcy\u00fck s\u00fcrprizlerden bahsetmemeye \u00e7al\u0131\u015faca\u011f\u0131m ama baz\u0131 spoiler\u2019lar\u0131 vermek zorunday\u0131m, dikkatli olun!)<\/p>\n

Siber g\u00fcvenlik ve \u0130mparatorluk \u00e7al\u0131\u015fanlar\u0131<\/h2>\n

Dizinin b\u00fct\u00fcn\u00fcne bak\u0131ld\u0131\u011f\u0131nda siber g\u00fcvenlik a\u00e7\u0131s\u0131ndan en ilgi \u00e7ekici yer, Engizisyon\u2019un gizli tesisine d\u0131\u015far\u0131dan s\u0131z\u0131l\u0131p \u0130mparatorluk bilgisayar sistemine eri\u015fim kazan\u0131lan k\u0131s\u0131m. Ancak buraya gelmeden \u00f6nce Mapuzo gezegeninde yine merak uyand\u0131ran bir \u00e7at\u0131\u015fma g\u00f6r\u00fcyoruz. Bununla ba\u015flayal\u0131m.<\/p>\n

Mapuzo\u2019daki kontrol noktas\u0131<\/h3>\n

\u0130mparatorlu\u011fun en \u00e7ok aranan Jedi\u2019\u0131 Kenobi\u2019nin bu ya\u011fmalanm\u0131\u015f madencilik gezegeninde oldu\u011funa inan\u0131l\u0131yor. Kontrol noktas\u0131ndaki Stormtrooper\u2019lar \u015f\u00fcpheli g\u00f6r\u00fcnen bir adam\u0131 yakal\u0131yor ve kimli\u011fini belirlemek i\u00e7in y\u00fcz tan\u0131ma sistemine sahip Engerek Sonda Droid\u2019ini \u00e7a\u011f\u0131r\u0131yor. Bilin bakal\u0131m ne oluyor. \u0130\u015fe yar\u0131yor!<\/p>\n

Tek bir sorum var: Bu ak\u0131ll\u0131 makineler dokuz y\u0131l sonra B\u00f6l\u00fcm IV\u2019te<\/em> droidleri ararken neden kullan\u0131lm\u0131yor? Mos Eisley\u2019deki devriyeler yoldan ge\u00e7enlere aptalca sorular sormak yerine y\u00fcz tan\u0131ma sistemini kullansalard\u0131 Obi-Wan\u2019\u0131 bulup tutuklayabilirlerdi. \u0130mparator, Kenobi\u2019nin ba\u015fka bir akt\u00f6r taraf\u0131ndan canland\u0131r\u0131laca\u011f\u0131n\u0131 bilemezdi ki!<\/p>\n

Su alt\u0131 Engizisyon Kalesi ve Mustafar\u2019\u0131n uydusu Nur<\/h3>\n

(Herkesin bildi\u011fi) gizli Engizisyon Kalesi, Y\u0131ld\u0131z Sava\u015flar\u0131<\/em> evreninde g\u00f6rd\u00fc\u011f\u00fcm\u00fcz bilgi g\u00fcvenli\u011fi a\u00e7\u0131s\u0131ndan en geli\u015fmi\u015f tesislerden biri. Ayn\u0131 \u015fekilde fiziksel olarak da olduk\u00e7a iyi korunuyor.<\/p>\n

Y\u0131ld\u0131z Sava\u015flar\u0131 evreni standartlar\u0131na g\u00f6re inan\u0131lmaz \u015fekilde giri\u015flerde insanlar\u0131n kimlik kartlar\u0131 kontrol ediliyor, kap\u0131lar kod silindiri<\/a> denen kimlik do\u011frulama cihazlar\u0131yla a\u00e7\u0131l\u0131yor, su alt\u0131 ge\u00e7idi ise genelde oldu\u011fu gibi giri\u015f kap\u0131s\u0131n\u0131n yan\u0131ndaki bir panelden de\u011fil, tamamen bir bilgisayar konsolundan kontrol ediliyor. Ayr\u0131ca daha \u00f6nce hi\u00e7 g\u00f6rmedi\u011fimiz bir \u015fey daha var: Koridorlarda mobil g\u00fcvenlik kameralar\u0131 devriye geziyor. \u0130mparatorlu\u011fun dokuz y\u0131l sonra t\u00fcm bu g\u00fcvenlik pratiklerini neden terk etti\u011fi ise gizemini koruyor. B\u00f6l\u00fcm IV\u2019te<\/em> Kenobi\u2019nin bizzat kendisi \u00d6l\u00fcm Y\u0131ld\u0131z\u0131\u2019nda serbest\u00e7e gezebiliyor, \u00e7ekici \u0131\u015f\u0131n kontrol \u00fcnitesine eri\u015fmek i\u00e7in sisteme giri\u015f yapmas\u0131 bile gerekmiyor.<\/p>\n

Ancak, tahmin edebilece\u011finiz gibi, t\u00fcm bu g\u00fcvenlik \u00f6nlemleri hi\u00e7bir i\u015fe yaram\u0131yor. Her zamanki gibi i\u015f yine tek bir \u00e7al\u0131\u015fan\u0131n, \u201cbu kat\u0131n ba\u015f g\u00fcvenlik\u00e7isi\u201d denen ki\u015finin dikkatsizli\u011fine kal\u0131yor. Kenobi\u2019ye i\u00e7eriden biri, \u0130mparatorlu\u011fun ger\u00e7ek y\u00fcz\u00fcn\u00fc g\u00f6ren, m\u00fckemmel sosyal m\u00fchendislik becerilerine sahip iyi niyetli bir \u0130mparatorluk subay\u0131 olan Kaptan Tala Durith yard\u0131m ediyor.<\/p>\n\n

Kalenin giri\u015finde Tala\u2019n\u0131n belgeleri kontrol edilirken asl\u0131nda tamamen farkl\u0131 bir b\u00f6lgede g\u00f6revlendirildi\u011fi, gizli tesiste hi\u00e7bir i\u015fi olmad\u0131\u011f\u0131 ortaya \u00e7\u0131k\u0131yor. Ancak Tala r\u00fctbesini kullanarak g\u00f6revli memuru (az \u00f6nce bahsetti\u011fimiz \u201cba\u015f g\u00fcvenlik\u00e7iyi\u201d) Engizisyoncular i\u00e7in gizli istihbarat getirdi\u011fine ikna ediyor ve i\u00e7eri al\u0131n\u0131yor.<\/p>\n

\u0130\u00e7eri s\u0131zmay\u0131 ba\u015fard\u0131ktan sonra bir t\u00fcr kontrol odas\u0131na girerek terminallerden birine giri\u015f yap\u0131yor, kod silindiriyle kimlik do\u011frulama a\u015famas\u0131n\u0131 ge\u00e7iyor. Burada kesinlikle kullan\u0131c\u0131 haklar\u0131n\u0131n s\u0131n\u0131rland\u0131r\u0131lmas\u0131yla ilgili bir sorun var: Ger\u00e7ekten bu b\u00f6lgede hi\u00e7bir g\u00f6revi yoksa neden sistemde haklara sahip?<\/p>\n

Tala bir \u015fekilde hem kalenin planlar\u0131na hem de su alt\u0131 ge\u00e7it kontrol \u00fcnitesine eri\u015fim elde ederek Kenobi\u2019yi i\u00e7eri al\u0131yor. Kontrol odas\u0131ndaki \u00fcst d\u00fczey g\u00f6revli bir noktada terminale birinin d\u0131\u015far\u0131dan girdi\u011fini fark ediyor ama bu yakla\u015f\u0131k 20 dakika s\u00fcr\u00fcyor. Ancak ard\u0131ndan yapt\u0131\u011f\u0131 \u015feyler hi\u00e7bir mant\u0131\u011fa s\u0131\u011fm\u0131yor: Bir sebeple Tala\u2019y\u0131 giri\u015f belgelerini kontrol etmek i\u00e7in \u00fcnitelerin arkas\u0131ndaki gizli sakl\u0131 bir k\u00f6\u015feye g\u00f6t\u00fcr\u00fcyor, dizinin geri kalan\u0131 boyunca da boynu k\u0131r\u0131lm\u0131\u015f halde bu k\u00f6\u015fede kal\u0131yor.<\/p>\n

A\u00e7\u0131k\u00e7a g\u00f6r\u00fcl\u00fcyor ki bu tesisin personeli bu t\u00fcr olaylara kesinlikle haz\u0131rl\u0131kl\u0131 de\u011fil. Genel anlamda bu sorun d\u00fczenli pen testleriyle<\/a> \u00e7\u00f6z\u00fclebilir. \u00d6te yandan b\u00fcy\u00fck olas\u0131l\u0131kla Mustafar\u2019da bu alnda uzman pek fazla ki\u015fi yoktur.<\/p>\n

\u0130mparatorluk kar\u015f\u0131tlar\u0131n\u0131n siber g\u00fcvenlik y\u00f6ntemleri<\/h2>\n

Biraz da \u0130mparatorluk kar\u015f\u0131tlar\u0131ndan bahsedelim. Bu dizide bildi\u011fimiz asi birlikleri yok. Geleneksel iyi yaln\u0131zca kar\u015f\u0131t g\u00f6r\u00fc\u015fl\u00fc Alderaan ve \u0130mparatorluk kar\u015f\u0131t\u0131 yer alt\u0131 Path yap\u0131lanmas\u0131yla temsil ediliyor. Bunlar da \u0130mparatorlukla sava\u015fmaktan ziyade muhaliflere (hayatta kalan Jedi\u2019lara ve G\u00fc\u00e7\u2019\u00fc hissedebilenlere) kalacak yer ve ula\u015f\u0131m sa\u011fl\u0131yorlar. Elbette bir de Ben Kenobi var. Bilgi g\u00fcvenli\u011fi a\u00e7\u0131s\u0131ndan i\u015fler, bekledi\u011fimiz \u00fczere hi\u00e7 de iyi de\u011fil.<\/p>\n

Alderaan\u2019\u0131n h\u00fck\u00fcmdar ailesi<\/h3>\n

Alderaan\u2019a h\u00fckmeden Organa ailesi g\u00fcvenlik a\u00e7\u0131s\u0131ndan \u00e7ok tuhaf bir tutuma sahip. Bu da pek \u00e7ok soru do\u011furuyor. Senat\u00f6r Bail Organa, \u0130mparatorlu\u011fun kurulu\u015fundan beri her t\u00fcrl\u00fc \u0130mparatorluk kar\u015f\u0131t\u0131 giri\u015fimin i\u00e7inde aktif olarak yer al\u0131yor. Dahas\u0131, evlatl\u0131k k\u0131z\u0131 Leia\u2019n\u0131n varl\u0131\u011f\u0131 da Vader\u2019dan gizlenmek zorunda. Bu durumda insan en az\u0131ndan kendi ailesinin g\u00fcvenli\u011fi hakk\u0131nda kayg\u0131lar\u0131 olmas\u0131n\u0131 bekliyor. Ama yok, Red Hot Chili Peppers\u2019\u0131n Flea\u2019si<\/span> taraf\u0131ndan canland\u0131r\u0131lan paral\u0131 asker Vect Nokru, prensesi saray\u0131n i\u00e7inden ka\u00e7\u0131r\u0131rken hi\u00e7 zorlanm\u0131yor.<\/p>\n

Leia\u2019n\u0131n mini droid Lola\u2019dan (L0-LA59) hi\u00e7 ayr\u0131lmad\u0131\u011f\u0131n\u0131 da belirtmek gerek. O halde Bail neden Leia\u2019n\u0131n bu \u00e7ok sevgili cihaz\u0131na Kaspersky Safe Kids<\/a> gibi bir \u00e7\u00f6z\u00fcm y\u00fcklememi\u015f? En az\u0131ndan prensesin nereye g\u00f6t\u00fcr\u00fcld\u00fc\u011f\u00fcn\u00fc bilirdi! \u00dcstelik uzaktan droid konumu belirleme teknolojileri de var ve dizide aktif \u015fekilde kullan\u0131l\u0131yor.<\/p>\n\n

L0-LA59 droid g\u00fcvenli\u011fi<\/h3>\n

B\u00f6l\u00fcmlerden birinde L0-LA59\u2019u ka\u00e7\u0131ran Engizisyoncular droid\u2019e cihaz\u0131 uzaktan kontrol etmelerini sa\u011flayan k\u00f6t\u00fc ama\u00e7l\u0131 bir g\u00f6zetleme cihaz\u0131 tak\u0131yor. \u0130mparatorlu\u011fun bu teknolojiyi neden sonras\u0131nda daha fazla kullanmad\u0131\u011f\u0131 belirsiz. \u00d6rne\u011fin B\u00f6l\u00fcm V\u2019te<\/em> C-3PO\u2019yu yok edilmeye g\u00f6ndermek yerine Bulut \u015eehri\u2019nde kontrol\u00fcn\u00fc ele ge\u00e7irebilirlerdi. Organa Hanedan\u0131\u2019n\u0131n hem g\u00fcvenilir olmayan cihazlara ba\u011flant\u0131lar\u0131 hem de d\u0131\u015far\u0131dan gelen k\u00f6t\u00fc ama\u00e7l\u0131 komutlar\u0131 engelleyecek siber ba\u011f\u0131\u015f\u0131kl\u0131\u011f\u0131 olan i\u015fletim sistemlerine<\/a> sahip droidler kullanmamas\u0131 ise daha da \u015fa\u015f\u0131rt\u0131c\u0131.<\/p>\n

Bail Organa ve ileti\u015fim<\/h3>\n

En b\u00fcy\u00fck gizem, Bail Organa\u2019n\u0131n b\u00fct\u00fcn kar\u015f\u0131t g\u00f6r\u00fc\u015flerine ra\u011fmen Alderaan\u2019\u0131n yok edilmesine kadar nas\u0131l hayatta kald\u0131\u011f\u0131. Yaln\u0131zca tekrar tekrar Obi-Wan Kenobi ile ileti\u015fim kurmakla kalm\u0131yor (ki bu tek ba\u015f\u0131na cezas\u0131 \u00f6l\u00fcm olan bir su\u00e7), ayn\u0131 zamanda bunu g\u00fcvenli olmayan bir ileti\u015fim kanal\u0131 \u00fczerinden, Luke ve Tatooine\u2019e at\u0131fta bulunan gizli bilgileri a\u00e7\u0131k metin \u015feklinde ortaya sererek yap\u0131yor.<\/p>\n

\u00dcstelik tek sorun mesajla\u015fma sisteminin \u015fifresiz olmas\u0131 de\u011fil, al\u0131c\u0131 cihazda temel kimlik do\u011frulama da bulunmuyor. Yani cihaz\u0131 eline alan herkes son mesaj\u0131 dinleyebilir. Bu insanlar\u0131n kesinlikle siber g\u00fcvenlik fark\u0131ndal\u0131\u011f\u0131 e\u011fitimine<\/a> ihtiya\u00e7lar\u0131 var!<\/p>\n

Jabiim gezegenindeki Path s\u0131\u011f\u0131na\u011f\u0131<\/h3>\n

Path s\u0131\u011f\u0131na\u011f\u0131 siber g\u00fcvenlikle neredeyse hi\u00e7 tan\u0131\u015fmam\u0131\u015f. S\u0131\u011f\u0131na\u011f\u0131n h\u0131zla bo\u015falt\u0131labilmesinin tek yolu olan hangar kap\u0131s\u0131 kumandas\u0131, havaland\u0131rma kanal\u0131na yerle\u015ftirilmi\u015f kablolarla dolu garip bir mekanizma. K\u00f6t\u00fc ama\u00e7l\u0131 droid kolayl\u0131kla bu cihaza eri\u015fim sa\u011flay\u0131p i\u00e7indeki bir \u015feyleri fiziksel yolla devre d\u0131\u015f\u0131 b\u0131rakarak kap\u0131y\u0131 kontrol edilemez hale getirebiliyor.<\/p>\n

Dahas\u0131, bu kritik sistem \u00f6yle bir yere yerle\u015ftirilmi\u015f ki kap\u0131 kumandas\u0131na ula\u015f\u0131p tamir etmek m\u00fcmk\u00fcn de\u011fil. Elbette burada hi\u00e7bir maddi kayna\u011f\u0131 olmayan kahraman muhaliflerden bahsediyoruz. Yine de on ya\u015f\u0131nda bir \u00e7ocu\u011fun bile cihaza ula\u015fabilmek i\u00e7in ne kadar zorland\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcnce tasar\u0131mc\u0131lar\u0131n sistem bak\u0131m\u0131 ve tamiri i\u00e7in ne boyutta bir insan hayal etti\u011fini anlamak g\u00fc\u00e7.<\/p>\n

\u00c7\u0131kar\u0131lan sonu\u00e7lar<\/h2>\n

G\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi, ilk Star Wars<\/em> filminden dokuz y\u0131l \u00f6nce \u0130mparatorluk bilgi g\u00fcvenli\u011finde \u00e7ok \u00e7ok daha iyi bir durumdayken kar\u015f\u0131tlar temel siber g\u00fcvenlik anlay\u0131\u015f\u0131ndan bile yoksunmu\u015f. Belki de \u0130mparatorlu\u011fun ilerici g\u00fcvenlik \u00f6nlemlerini terk etmesinin nedeni, nas\u0131l olsa izinsiz giri\u015fleri ve di\u011fer olaylar\u0131 \u00f6nlemek i\u00e7in hi\u00e7bir \u015fey yapm\u0131yor olmalar\u0131d\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"

Yavin Sava\u015f\u0131’ndan dokuz y\u0131l \u00f6nce, \u00e7ok \u00e7ok uzak bir galakside, bilgi g\u00fcvenli\u011finde durumlar nas\u0131ld\u0131.<\/p>\n","protected":false},"author":700,"featured_media":10899,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194,1727],"tags":[2051,2025,1604],"class_list":{"0":"post-10898","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"category-smb","10":"tag-gercekler","11":"tag-siber-bagisiklik","12":"tag-star-wars"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/obi-wan-kenobi-cybersecurity\/10898\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/obi-wan-kenobi-cybersecurity\/24416\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/obi-wan-kenobi-cybersecurity\/19882\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/obi-wan-kenobi-cybersecurity\/26812\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/obi-wan-kenobi-cybersecurity\/24717\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/obi-wan-kenobi-cybersecurity\/27461\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/obi-wan-kenobi-cybersecurity\/27125\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/obi-wan-kenobi-cybersecurity\/33582\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/obi-wan-kenobi-cybersecurity\/44952\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/obi-wan-kenobi-cybersecurity\/19237\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/obi-wan-kenobi-cybersecurity\/29100\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/obi-wan-kenobi-cybersecurity\/25304\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/obi-wan-kenobi-cybersecurity\/30782\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/obi-wan-kenobi-cybersecurity\/30528\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/gercekler\/","name":"ger\u00e7ekler"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/700"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=10898"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10898\/revisions"}],"predecessor-version":[{"id":10900,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10898\/revisions\/10900"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/10899"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=10898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=10898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=10898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}