{"id":11437,"date":"2023-05-18T18:05:39","date_gmt":"2023-05-18T15:05:39","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=11437"},"modified":"2023-05-18T18:05:39","modified_gmt":"2023-05-18T15:05:39","slug":"fake-trezor-hardware-crypto-wallet","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/fake-trezor-hardware-crypto-wallet\/11437\/","title":{"rendered":"Vaka \u00e7al\u0131\u015fmas\u0131: sahte so\u011fuk kripto para c\u00fczdan\u0131"},"content":{"rendered":"

\u00c7almas\u0131 ve paraya \u00e7evirmesi kolay olan kripto para birimleri sald\u0131rganlar i\u00e7in en cazip dijital varl\u0131klardand\u0131r<\/a>. Bundan dolay\u0131, ciddi yat\u0131r\u0131mc\u0131lar kripto para yat\u0131r\u0131mlar\u0131n\u0131 korumak i\u00e7in genelde so\u011fuk kripto para c\u00fczdanlar\u0131 kullan\u0131rlar. Bu t\u00fcr c\u00fczdanlar, \u00f6zel anahtarlar\u0131 zay\u0131f bilgisayarlar ve ak\u0131ll\u0131 telefonlardan uzak tutar ve i\u015flem yapmay\u0131 daha g\u00fcvenli hale getirir. Ancak, m\u00fc\u015fterilerimizden birinin de ac\u0131 yollarla \u00f6\u011frendi\u011fi gibi, so\u011fuk bir c\u00fczdana sahip olmak tek ba\u015f\u0131na fonlar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini garanti etmez<\/a>.<\/p>\n

Korsanl\u0131k belirtileri<\/h2>\n

Sald\u0131rganlar sinsice \u00e7al\u0131\u015ft\u0131: Bir kripto para c\u00fczdan\u0131n\u0131n i\u015flem ge\u00e7mi\u015finde u\u011fursuz bir g\u00fcnde b\u00fcy\u00fck miktarda paran\u0131n birilerine aktar\u0131ld\u0131\u011f\u0131 bir operasyon g\u00f6r\u00fcn\u00fcyordu.\u00a0Ne var ki, o g\u00fcn kurban taraf\u0131ndan tek bir i\u015flem bile yap\u0131lmam\u0131\u015ft\u0131. Hatta, kripto para c\u00fczdan\u0131 bilgisayara bile tak\u0131l\u0131 de\u011fildi!<\/p>\n

\"Veee...<\/a>

Veee\u2026 Gitti!<\/p><\/div>\n

C\u00fczdan incelemesi<\/h2>\n

Kurban olduk\u00e7a pop\u00fcler bir so\u011fuk c\u00fczdan modeli olan Trezor Model T<\/strong> sat\u0131n alm\u0131\u015ft\u0131. Bu model hem yaz\u0131l\u0131m hem de donan\u0131m i\u00e7in uygun tam a\u00e7\u0131k kaynak kodu kullan\u0131r ve pop\u00fcler STM32F427 mikro denetleyiciye dayal\u0131d\u0131r.<\/p>\n

Trezor Model T sat\u0131c\u0131s\u0131, teoride cihaz\u0131 sald\u0131rganlara kar\u015f\u0131 g\u00fcvenle korumas\u0131 gereken geni\u015f kapsaml\u0131 g\u00fcvenlik \u00f6nlemleri ald\u0131\u011f\u0131n\u0131 taahh\u00fct etmi\u015ftir. Hem kutusu hem de birim muhafazas\u0131 holografik etiketlerle m\u00fch\u00fcrlenmi\u015f olan mikro denetleyici, flash bellek okuma koruma modundad\u0131r (RDP 2). Bootloader, \u00fcretici yaz\u0131l\u0131m\u0131n\u0131n dijital imzas\u0131n\u0131 kontrol eder ve bir anormallik tespit ederse orijinal olmayan bir \u00fcretici yaz\u0131l\u0131m\u0131 mesaj\u0131 g\u00f6sterir ve c\u00fczdandaki t\u00fcm verileri siler. Cihaza ula\u015fmak ve i\u015flemleri onaylamak i\u00e7in depolamay\u0131 tutuldu\u011fu yerde \u015fifrelemek i\u00e7in kullan\u0131lan bir PIN kodu gerekir ama bu master eri\u015fim anahtar\u0131n\u0131 (bellek parola ifadesi olu\u015fturmak i\u00e7in bir temel) korumaz. Ekstra se\u00e7enek olarak, PIN kodunun yan\u0131 s\u0131ra master eri\u015fim anahtar\u0131n\u0131z\u0131 BIP-39 standard\u0131 uyar\u0131nca bir parolayla da koruyabilirsiniz.<\/p>\n

\"Beni<\/a>

Beni kullanma, ben g\u00fcvenli de\u011filim! (Source<\/a>)<\/p><\/div>\n

\u0130lk \u00fcst\u00fcnk\u00f6r\u00fc bak\u0131\u015fta, inceledi\u011fimiz c\u00fczdan orijinal c\u00fczdanla tamamen ayn\u0131 gibiydi ve hi\u00e7bir kurcalama i\u015fareti g\u00f6r\u00fcnm\u00fcyordu. Birim, pop\u00fcler bir s\u0131n\u0131fland\u0131r\u0131lm\u0131\u015f web sitesi \u00fczerinden g\u00fcvenilir bir sat\u0131c\u0131dan al\u0131nm\u0131\u015ft\u0131 ve kutuyla c\u00fczdan\u0131n \u00fczerindeki holografik etiketlerin hepsi tam ve el de\u011fmemi\u015fti. G\u00fcncelleme modunda ba\u015flat\u0131lan c\u00fczdan 2.4.3 \u00fcretici yaz\u0131l\u0131m\u0131 s\u00fcr\u00fcm\u00fcn\u00fc ve 2.0.4 bootloader s\u00fcr\u00fcm\u00fcn\u00fc g\u00f6sterdi.<\/p>\n

\"Sahte<\/a>

Sahte c\u00fczdan g\u00fcncelleme modu ekran\u0131<\/p><\/div>\n

C\u00fczdan\u0131 incelerken \u015f\u00fcphe \u00e7eken bir \u015fey g\u00f6r\u00fcnmedi: t\u00fcm fonksiyonlar olmas\u0131 gerekti\u011fi gibi \u00e7al\u0131\u015f\u0131yordu ve kullan\u0131c\u0131 aray\u00fcz\u00fc orijinal aray\u00fczden farks\u0131zd\u0131. Ancak, yap\u0131lan h\u0131rs\u0131zl\u0131ktan haberdar oldu\u011fumuz i\u00e7in biraz daha derine indik. Ve bu noktada ilgin\u00e7 ke\u015fiflerimiz ba\u015flad\u0131.<\/p>\n

\u00d6ncelikle, sat\u0131c\u0131n\u0131n 2.0.4 numaral\u0131 bir bootloader s\u00fcr\u00fcm\u00fc yay\u0131nlamad\u0131\u011f\u0131n\u0131 \u00f6\u011frendik. GitHub\u2019daki proje de\u011fi\u015fikli\u011fi ge\u00e7mi\u015finde \u00f6zetle bu s\u00fcr\u00fcm\u00fcn \u201csahte cihazlar sebebiyle atland\u0131\u011f\u0131\u201d belirtiliyordu. Bu t\u00fcr bir kafa kar\u0131\u015ft\u0131r\u0131c\u0131 ifadeyi g\u00f6r\u00fcnce ne\u015fteri ele al\u0131p cihaz incelemesini ba\u015flatmak zorunda kald\u0131k\u2026<\/p>\n

\"Bu<\/a>

Bu 2.0.4 s\u00fcr\u00fcm\u00fc de nereden \u00e7\u0131kt\u0131?<\/p><\/div>\n

Muhafazay\u0131 a\u00e7mak zordu: Cihaz\u0131n iki yar\u0131s\u0131 fabrika yap\u0131m\u0131 Trezor cihazlarda kullan\u0131lan ultrasonik ba\u011flay\u0131c\u0131 yerine bolca tutkal ve \u00e7ift tarafl\u0131 yap\u0131\u015ft\u0131r\u0131c\u0131 bantla tutturulmu\u015ftu. Daha enteresan\u0131, cihaz\u0131n i\u00e7inde lehimleme izleri bulunan tamamen farkl\u0131 bir mikro denetleyici vard\u0131! Orijinal STM32F427 yerine, birimin i\u00e7inde tamamen devre d\u0131\u015f\u0131 b\u0131rak\u0131lm\u0131\u015f mikro denetleyici flash bellek okuma koruma mekanizmalar\u0131na sahip STM32F429 bulunuyordu (ger\u00e7ek Trezor cihazlardaki RDP 2 yerine RDP 0 vard\u0131).<\/p>\n

\"D\u0131\u015far\u0131dan<\/a>

D\u0131\u015far\u0131dan tamamen orijinal g\u00f6r\u00fcn\u00fcyordu ama\u2026 (soldaki \u2014 orijinal, sa\u011fdaki \u2014 sahte)<\/p><\/div>\n

Bu \u015fekilde, sahte kripto para c\u00fczdan\u0131 teorisi ispatland\u0131: Klasik bir tedarik zinciri sald\u0131r\u0131s\u0131 d\u00fczenlenmi\u015f ve tam g\u00fcven duygusuyla hareket eden bir kurban \u00e7oktan s\u0131z\u0131lm\u0131\u015f bir cihaz sat\u0131n alm\u0131\u015ft\u0131. Ancak as\u0131l kripto para birimi \u00e7alma mekanizmas\u0131 hala anla\u015f\u0131lamad\u0131\u2026<\/p>\n\n

Truva at\u0131 \u00fcretici yaz\u0131l\u0131m\u0131<\/h2>\n

Daha \u00f6nce bahsetti\u011fimiz<\/a> genel kripto para c\u00fczdan\u0131 ger\u00e7eklerini tekrar etmeyece\u011fiz fakat size tek bir hat\u0131rlatmam\u0131z olacak: Kripto para c\u00fczdanlar\u0131nda sizin \u00f6zel anahtar\u0131n\u0131z bulunur ve o anahtar\u0131 bilen herkes i\u015flem yaparak paran\u0131z\u0131 harcayabilir. \u00c7evrimd\u0131\u015f\u0131 c\u00fczdan sahibinin kasas\u0131nda dururken sald\u0131rganlar\u0131n i\u015flem yapabildi\u011fi ger\u00e7e\u011fi g\u00f6z \u00f6n\u00fcnde bulunduruldu\u011funda, bu ki\u015filerin \u00f6zel anahtar\u0131 ya olu\u015fturulduktan sonra kopyalad\u0131\u011f\u0131 ya da zaten en ba\u015f\u0131ndan beri bildi\u011fi ortaya \u00e7\u0131kmaktad\u0131r!<\/p>\n

Yeni mikro denetleyici lehimlendikten sonra sald\u0131rganlar\u0131n a\u00e7mamaya karar verdi\u011fi, devre d\u0131\u015f\u0131 b\u0131rak\u0131lm\u0131\u015f flash bellek okuma korumas\u0131 sayesinde, c\u00fczdan \u00fcretici yaz\u0131l\u0131m\u0131n\u0131 kolayca \u00e7\u0131kard\u0131k ve kodunu tekrar olu\u015fturarak sald\u0131rganlar\u0131n \u00f6zel anahtar\u0131 zaten en ba\u015f\u0131ndan beri bildi\u011fini ke\u015ffettik. Peki nas\u0131l?<\/p>\n

Orijinal bootloader ve c\u00fczdan \u00fcretici yaz\u0131l\u0131m\u0131 \u00fczerinde sadece \u00fc\u00e7 de\u011fi\u015fiklik yap\u0131lm\u0131\u015ft\u0131:<\/p>\n

\u00d6ncelikle, bootloader\u2019\u0131n koruma mekanizmas\u0131 kontrolleri ve dijital imzalar kald\u0131r\u0131lm\u0131\u015f ve bu sayede ba\u015flang\u0131\u00e7taki \u00fcretici yaz\u0131l\u0131m\u0131 orijinalli\u011fi kontrol\u00fc esnas\u0131nda \u201ck\u0131rm\u0131z\u0131 ekran\u201d problemi saf d\u0131\u015f\u0131 b\u0131rak\u0131lm\u0131\u015ft\u0131.<\/p>\n

\u0130kincisi, ba\u015flang\u0131\u00e7 a\u015famas\u0131nda ya da c\u00fczdan\u0131 s\u0131f\u0131rlarken rastgele \u00fcretilen kurtarma terimi, s\u0131z\u0131lan \u00fcretici yaz\u0131l\u0131m\u0131nda kay\u0131tl\u0131 \u00f6nceden \u00fcretilmi\u015f 20 kurtarma teriminden biriyle de\u011fi\u015ftirilmi\u015fti. Cihaz sahibi, yeni ve benzersiz terim yerine bunu kullanmaya ba\u015flayacakt\u0131.<\/p>\n

\u00dc\u00e7\u00fcnc\u00fcs\u00fc, kullan\u0131c\u0131n\u0131n ek bir master-seed koruma parolas\u0131 olu\u015fturmay\u0131 se\u00e7mesi halinde bunun sadece ilk sembol\u00fc (a\u2026z, A\u2026Z, 0\u20269 veya her t\u00fcrl\u00fc \u00f6zel karakter i\u00e7in !) kullan\u0131lm\u0131\u015f ve parolas\u0131zl\u0131k se\u00e7ene\u011fiyle birlikte sadece 64 olas\u0131 kombinasyon geriye kalm\u0131\u015ft\u0131. Bu \u015fekilde, belli bir sahte c\u00fczdana s\u0131zmak i\u00e7in sadece 64*20=1280 olas\u0131l\u0131k de\u011ferlendirilecekti.<\/p>\n

Sahte kripto para c\u00fczdan\u0131 normal \u00e7al\u0131\u015facakt\u0131 ancak sald\u0131rganlar en ba\u015f\u0131ndan itibaren c\u00fczdan \u00fczerinde tam kontrol elde edecekti. \u0130\u015flem ge\u00e7mi\u015fine bak\u0131ld\u0131\u011f\u0131nda, sald\u0131rganlar hi\u00e7 acele etmemi\u015f, c\u00fczdana ilk para y\u00fcklenmesinin ard\u0131ndan paray\u0131 alana de\u011fin tam bir ay beklemi\u015flerdi. C\u00fczdan sahibinin hi\u00e7bir korumas\u0131 yoktu: Paran\u0131n Truva at\u0131 c\u00fczdana vard\u0131\u011f\u0131 ilk anda zaten oyun kaybedilmi\u015fti.<\/p>\n

\u00dcreticiden yan\u0131t<\/h2>\n

Ara\u015ft\u0131rmam\u0131z yay\u0131nland\u0131ktan sonra, Trezor (bu kripto para c\u00fczdan\u0131 modelinin \u00fcreticisi) resmi Twitter hesab\u0131nda bu olay\u0131n asl\u0131nda, yetkisiz bir Rus bayisinin birka\u00e7 sahte kripto para c\u00fczdan\u0131n\u0131n piyasaya girdi\u011fi 2022 senesinde ger\u00e7ekle\u015fti\u011fini kaydetti<\/a>\u00a0ve bu olaydan sonra ba\u015fka bu t\u00fcr bir olay\u0131n kendilerine bildirilmedi\u011fini vurgulad\u0131.<\/p>\n

\"Trezor'un<\/a>

Trezor\u2019un ara\u015ft\u0131rmam\u0131za yan\u0131t\u0131. (Source<\/a>)<\/p><\/div>\n

Sahte cihaz tehdidinden korunma y\u00f6ntemi<\/h2>\n

\u00d6zel bilgiler ve deneyimler olmadan sahte bir kripto para c\u00fczdan\u0131n\u0131 ger\u00e7e\u011finden ay\u0131rmak kolay de\u011fildir. Ba\u015fl\u0131ca koruma c\u00fczdan\u0131n\u0131z\u0131 do\u011frudan resmi sat\u0131c\u0131dan<\/strong> sat\u0131n almak ve \u00f6zel korumal\u0131 mikro denetleyiciler bar\u0131nd\u0131ran modelleri se\u00e7mekle sa\u011flan\u0131r (Orijinal Trezor cihazlar bile bu anlamda ideal de\u011fildir: Daha iyi korumal\u0131 \u00e7iplere ve ekstra koruma mekanizmalar\u0131na sahip ba\u015fka marka c\u00fczdanlar da mevcuttur).<\/p>\n

Ger\u00e7ek ve de\u011fi\u015ftirilmemi\u015f bir c\u00fczdan\u0131n bile bir dizi tehdide<\/a> kar\u015f\u0131 zay\u0131f olabilece\u011fi unutulmamal\u0131d\u0131r. \u00d6ncelikli \u00f6nlemler aras\u0131nda (c\u00fczdan\u0131n\u0131z destekliyorsa) bir parola kullan\u0131m\u0131 ve elbette t\u00fcm bilgisayarlar\u0131n\u0131z ve ak\u0131ll\u0131 telefonlar\u0131n\u0131z i\u00e7in koruma<\/a> sa\u011flamak bulunmaktad\u0131r.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

Sahte bir kripto para c\u00fczdan\u0131 olay\u0131n\u0131n tam incelemesi. G\u00f6r\u00fcn\u00fc\u015f ve his olarak tamamen bir Trezor c\u00fczdan\u0131na benzese de t\u00fcm kripto para yat\u0131r\u0131mlar\u0131n\u0131z\u0131 su\u00e7lular\u0131n eline teslim ediyor.<\/p>\n","protected":false},"author":2735,"featured_media":11441,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1351],"tags":[374,2615,612,1444,1500,2620,2621,1588,537],"class_list":{"0":"post-11437","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-bitcoin","9":"tag-blok-zincir","10":"tag-dolandiricilik","11":"tag-ethereum","12":"tag-kripto-para-birimleri","13":"tag-kripto-para-cuzdanlari","14":"tag-soguk-cuzdanlar","15":"tag-tedarik-zinciri-saldirisi","16":"tag-tehditler"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/fake-trezor-hardware-crypto-wallet\/11437\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/fake-trezor-hardware-crypto-wallet\/25652\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/fake-trezor-hardware-crypto-wallet\/21071\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/fake-trezor-hardware-crypto-wallet\/10592\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/fake-trezor-hardware-crypto-wallet\/28299\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/fake-trezor-hardware-crypto-wallet\/25951\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/fake-trezor-hardware-crypto-wallet\/26333\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/fake-trezor-hardware-crypto-wallet\/28819\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/fake-trezor-hardware-crypto-wallet\/27765\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/fake-trezor-hardware-crypto-wallet\/35272\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/fake-trezor-hardware-crypto-wallet\/48155\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/fake-trezor-hardware-crypto-wallet\/20586\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/fake-trezor-hardware-crypto-wallet\/21284\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/fake-trezor-hardware-crypto-wallet\/30153\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/fake-trezor-hardware-crypto-wallet\/33750\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/fake-trezor-hardware-crypto-wallet\/26262\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/fake-trezor-hardware-crypto-wallet\/31959\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/fake-trezor-hardware-crypto-wallet\/31648\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/kripto-para-birimleri\/","name":"kripto para birimleri"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/11437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2735"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=11437"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/11437\/revisions"}],"predecessor-version":[{"id":11447,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/11437\/revisions\/11447"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/11441"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=11437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=11437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=11437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}