{"id":11484,"date":"2023-06-14T15:25:38","date_gmt":"2023-06-14T12:25:38","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=11484"},"modified":"2023-06-15T11:14:21","modified_gmt":"2023-06-15T08:14:21","slug":"fingerprint-brute-force-android","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/fingerprint-brute-force-android\/11484\/","title":{"rendered":"BrutePrint: Ak\u0131ll\u0131 telefonlardaki parmak izi korumas\u0131n\u0131 a\u015fmak"},"content":{"rendered":"<p>Parmak izi tan\u0131ma y\u00f6nteminin olduk\u00e7a g\u00fcvenli bir kimlik do\u011frulama y\u00f6ntemi oldu\u011funa inan\u0131l\u0131yor. Zaman zaman, <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/sas2020-fingerprint-cloning\/8113\/\" target=\"_blank\" rel=\"noopener\">parmak izi sens\u00f6r\u00fcn\u00fc yan\u0131ltma<\/a> konusunda farkl\u0131 y\u00f6ntemlere dair g\u00f6nderiler payla\u015f\u0131l\u0131r. Bu y\u00f6ntemlerde, silikon ped veya <a href=\"https:\/\/slate.com\/technology\/2016\/03\/michigan-state-university-research-shows-how-easy-it-is-to-trick-a-fingerprint-scanner.html\" target=\"_blank\" rel=\"noopener nofollow\">iletken m\u00fcrekkep \u00e7\u0131kt\u0131s\u0131<\/a> gibi materyaller kullan\u0131lsa da \u00f6nerilen t\u00fcm y\u00f6ntemler, asl\u0131nda telefon sahibinin parma\u011f\u0131n\u0131n fiziksel bir kopyas\u0131n\u0131 olu\u015fturma temeline dayan\u0131r. Bu y\u00f6ntem, parmak izinin y\u00fcksek kaliteli bir g\u00f6r\u00fcnt\u00fcs\u00fcn\u00fc kullanmay\u0131 gerektirir ancak buradaki parmak, rastgele bir parmak olamaz. Sistemde kay\u0131tl\u0131 olan parma\u011f\u0131n kopyas\u0131 olmas\u0131 gerekir.<\/p>\n<p>\u00d6zetle, t\u00fcm bu y\u00f6ntemler ger\u00e7ek d\u00fcnyan\u0131n zorluklar\u0131n\u0131 beraberinde getirir. Bir yandan dijital d\u00fcnyan\u0131n avantajlar\u0131ndan faydalanmaya devam ederken, di\u011fer yandan bu i\u015flemi daha zarif bir \u015fekilde ger\u00e7ekle\u015ftirmek m\u00fcmk\u00fcn m\u00fcd\u00fcr? Yu Chen ve Yiling He adl\u0131 iki \u00c7inli ara\u015ft\u0131rmac\u0131, parmak izi korumal\u0131 hemen hemen t\u00fcm Android ak\u0131ll\u0131 telefonlara nas\u0131l deneme yan\u0131lma sald\u0131r\u0131s\u0131 uygulanabilece\u011fi hakk\u0131nda bir ara\u015ft\u0131rma yay\u0131nland\u0131. Sald\u0131r\u0131y\u0131 <a href=\"https:\/\/arxiv.org\/pdf\/2305.10791.pdf\" target=\"_blank\" rel=\"noopener nofollow\">BrutePrint<\/a> olarak adland\u0131rd\u0131lar.<\/p>\n<h2>Parmak izleri ne kadar benzersizdir?<\/h2>\n<p>\u00c7inli yolda\u015flar\u0131m\u0131z\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 \u00f6zetlemeden \u00f6nce biraz arka plan teorisi sunal\u0131m. Parmak izleri ger\u00e7ekten benzersizdir ve ya\u015fla de\u011fi\u015fmez. Bu bilgiyi zaten biliyor olabilirsiniz ancak tekrar hat\u0131rlatmakta fayda var.<\/p>\n<p>\u0130ngiliz bilim adam\u0131 Sir Francis Galton, 1892 y\u0131l\u0131nda k\u0131sa ve net bir \u015fekilde <a href=\"https:\/\/galton.org\/books\/finger-prints\/galton-1892-fingerprints-1up.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Finger Prints<\/a> ad\u0131n\u0131 verdi\u011fi \u00e7al\u0131\u015fmay\u0131 yay\u0131nlad\u0131. Sir Francis Galton bu eserinde, o d\u00f6nemde parmak izleriyle ilgili mevcut olan bilimsel verileri bir araya getirdi. Galton\u2019un \u00e7al\u0131\u015fmas\u0131, parmak izlerinin adli t\u0131pta pratik kullan\u0131m\u0131 i\u00e7in teorik temellerin at\u0131lmas\u0131na katk\u0131 sa\u011flad\u0131.<\/p>\n<p>Sir Francis Galton, parmak izi e\u015fle\u015fme olas\u0131l\u0131\u011f\u0131n\u0131n \u201c2&lt;sup&gt;36&lt;\/sup&gt;\u2019dan az veya 64 milyarda bir\u201d oldu\u011funu hesaplad\u0131. G\u00fcn\u00fcm\u00fczde bile adli t\u0131p uzmanlar\u0131 bu de\u011fere ba\u011fl\u0131 kalmaya devam etmektedir.<\/p>\n<p>Bu arada, ileri seviye anatomi veya parmak izlerinin benzersizli\u011finin ard\u0131ndaki biyolojik fakt\u00f6rlerle ilgileniyorsan\u0131z i\u015fte size konuyla ilgili <a href=\"https:\/\/www.cell.com\/action\/showPdf?pii=S0092-8674(23)00045-4\" target=\"_blank\" rel=\"noopener nofollow\">yeni bir ara\u015ft\u0131rma makalesi<\/a>.<\/p>\n<h2>Parmak izi sens\u00f6rleri ne kadar g\u00fcvenilir?<\/h2>\n<p>Sir Francis Galton\u2019un \u00e7al\u0131\u015fmas\u0131 ve onunla ili\u015fkili konular genellikle (s\u0131cak) analog d\u00fcnya ile ilgilidir. Parmak izlerinin al\u0131nmas\u0131, su\u00e7 mahallinde bulunan izlerin e\u015fle\u015ftirilmesi gibi durumlar\u0131 kapsar ve bir bak\u0131ma Bob amca gibi ki\u015filerle ilgilidir. Ancak dijital (so\u011fuk) ger\u00e7eklikte i\u015fler biraz farkl\u0131d\u0131r. Dijital parmak izi temsilinin kalitesi; sens\u00f6r\u00fcn t\u00fcr\u00fc, boyutu ve \u00e7\u00f6z\u00fcn\u00fcrl\u00fc\u011f\u00fc gibi birden fazla fakt\u00f6re ba\u011fl\u0131d\u0131r. Ayr\u0131ca, \u201cg\u00f6r\u00fcnt\u00fc\u201d son i\u015fleme ve e\u015fle\u015ftirme algoritmalar\u0131 da b\u00fcy\u00fck bir \u00f6neme sahiptir.<\/p>\n<div id=\"attachment_11488\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-11488\" class=\"size-medium wp-image-11488\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2023\/06\/14123838\/fingeprint-brute-force-android-scr-1-300x180.jpg\" alt=\"Optik sens\u00f6r taraf\u0131ndan yakalanan dijital parmak izini, analog bir parmak izi kopyas\u0131yla kar\u015f\u0131la\u015ft\u0131rma.\" width=\"300\" height=\"180\"><p id=\"caption-attachment-11488\" class=\"wp-caption-text\">150 y\u0131l \u00f6nce Sir Francis Galton\u2019\u0131n g\u00f6rd\u00fc\u011f\u00fc parmak izleri (solda) ve g\u00fcn\u00fcm\u00fczdeki son teknoloji ak\u0131ll\u0131 telefonlar\u0131n optik sens\u00f6rleri taraf\u0131ndan g\u00f6r\u00fcnt\u00fclenen parmak izleri (sa\u011fda). <a href=\"https:\/\/galton.org\/books\/finger-prints\/galton-1892-fingerprints-1up.pdf\" target=\"_blank\" rel=\"nofollow noopener\">Kaynak<\/a> ve<a href=\"https:\/\/arxiv.org\/pdf\/2305.10791.pdf\" target=\"_blank\" rel=\"noopener nofollow\"> Kaynak.<\/a><\/p><\/div>\n<p>\u00a0<\/p>\n<p>Ve tabii ki geli\u015ftiricinin cihaz\u0131 \u00e7ok uygun fiyatl\u0131 yapmas\u0131 gerekiyor (aksi takdirde kimse sat\u0131n almaz), an\u0131nda kimlik do\u011frulamas\u0131n\u0131 sa\u011flamas\u0131 gerekiyor (yava\u015f h\u0131zla ilgili \u015fikayetlerle kar\u015f\u0131la\u015fmamak i\u00e7in) ve her ne pahas\u0131na olursa olsun yanl\u0131\u015f negatifleri en aza indirmesi gerekiyor (aksi takdirde kullan\u0131c\u0131lar tamamen vazge\u00e7ebilir). Bu nedenlerden dolay\u0131, kimlik do\u011frulama sistemlerinin tamamen do\u011fru olmad\u0131\u011f\u0131 s\u00f6ylenebilir.<\/p>\n<p>Bu nedenle, ak\u0131ll\u0131 telefonlarda kullan\u0131lan sens\u00f6rlerden bahsederken, parmak izi e\u015fle\u015fme olas\u0131l\u0131\u011f\u0131 i\u00e7in bilinen 64 milyarda bir say\u0131s\u0131ndan \u00e7ok daha az iyimser rakamlardan bahsediliyor. \u00d6rne\u011fin Apple, <a href=\"https:\/\/support.apple.com\/HT204587\" target=\"_blank\" rel=\"noopener nofollow\">Touch ID<\/a> benzerlik olas\u0131l\u0131\u011f\u0131n\u0131n 1 ile 50.000 aras\u0131nda oldu\u011funu tahmin ediyor. Dolay\u0131s\u0131yla, b\u00fct\u00e7e dostu sens\u00f6r modelleri i\u00e7in olas\u0131l\u0131\u011f\u0131n bir veya iki kat daha az olaca\u011f\u0131n\u0131 tahmin etmek zor olmaz.<\/p>\n<p>Milyarlardan binlere d\u00fc\u015fm\u00fc\u015f olduk. Yani <a href=\"https:\/\/en.wikipedia.org\/wiki\/Brute-force_search\" target=\"_blank\" rel=\"noopener nofollow\">deneme yan\u0131lma<\/a> sald\u0131r\u0131s\u0131 i\u00e7in uygun bir ortam olu\u015ftu. Bunlar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurursak potansiyel bir bilgisayar korsan\u0131n\u0131n kar\u015f\u0131s\u0131nda sadece bir engel kal\u0131yor: Parmak izi tan\u0131ma giri\u015fimlerinin say\u0131s\u0131n\u0131 s\u0131n\u0131rlamak. Normalde sadece be\u015f giri\u015fime izin verilir ve ard\u0131ndan uzun bir parmak izi kimlik do\u011frulama kilitleme s\u00fcresi devreye girer.<\/p>\n<p>Bu engel a\u015f\u0131labilir mi? Yu Chen ve Yiling He, yay\u0131nlanan \u00e7al\u0131\u015fmada bu soruya olumlu bir cevap verdi.<\/p>\n<h2>BrutePrint: Parmak izi korumal\u0131 Android ak\u0131ll\u0131 telefonlara deneme yan\u0131lma sald\u0131r\u0131s\u0131na haz\u0131rlanma<\/h2>\n<p>Ara\u015ft\u0131rmac\u0131lar\u0131n y\u00f6ntemi, Android ak\u0131ll\u0131 telefonlar\u0131n genel parmak izi sens\u00f6r\u00fc uygulamas\u0131ndaki bir kusura kusuru kullan\u0131yor: Test edilen modellerin hi\u00e7biri sens\u00f6r ile sistem aras\u0131ndaki ileti\u015fim kanal\u0131n\u0131 \u015fifrelememi\u015f. Bu durum, kimlik do\u011frulama sistemine ortadaki adam sald\u0131r\u0131s\u0131 yapma (<a href=\"https:\/\/encyclopedia.kaspersky.com\/glossary\/man-in-the-middle-attack\/\" target=\"_blank\" rel=\"noopener\">MITM<\/a>) f\u0131rsat\u0131 sunuyor: Cihaz arac\u0131l\u0131\u011f\u0131yla ak\u0131ll\u0131 telefona ba\u011flanan ve anakart\u0131n SPI ba\u011flant\u0131 noktas\u0131n\u0131 kullanan bir ki\u015fi, parmak izi sens\u00f6r\u00fcnden gelen mesajlar\u0131 yakalayabilir ve hatta parmak izi sens\u00f6r\u00fcn\u00fc taklit ederek kendi mesajlar\u0131n\u0131 g\u00f6nderebilir.<\/p>\n<p>Ara\u015ft\u0131rmac\u0131lar b\u00f6yle bir sahte sens\u00f6r olu\u015fturdular ve ak\u0131ll\u0131 telefonun sens\u00f6r ekran\u0131na otomatik dokunma cihaz\u0131 eklediler. B\u00f6ylece donan\u0131m bile\u015feni k\u0131sm\u0131, birden fazla parmak izi g\u00f6r\u00fcnt\u00fcs\u00fcn\u00fc ak\u0131ll\u0131 telefonlara otomatik olarak besleyecek \u015fekilde ayarland\u0131.<\/p>\n<div id=\"attachment_11490\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-11490\" class=\"size-medium wp-image-11490\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2023\/06\/14124935\/fingeprint-brute-force-android-scr-2-300x164.jpg\" alt=\"BrutePrint sald\u0131r\u0131s\u0131 i\u00e7in kullan\u0131lan cihaz\" width=\"300\" height=\"164\"><p id=\"caption-attachment-11490\" class=\"wp-caption-text\">Parmak izi kimlik do\u011frulama sistemini deneme yan\u0131lma sald\u0131r\u0131s\u0131 ile zorlamak i\u00e7in kullan\u0131lan cihaz. <a href=\"https:\/\/arxiv.org\/pdf\/2305.10791.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Kaynak<\/a><\/p><\/div>\n<p>\u00a0<\/p>\n<p>Ard\u0131ndan, deneme yan\u0131lma sald\u0131r\u0131s\u0131 i\u00e7in parmak izi \u00f6rnekleri haz\u0131rlamaya ba\u015flad\u0131lar. Ara\u015ft\u0131rmac\u0131lar, genellikle parmak izi veri tabanlar\u0131n\u0131n kaynaklar\u0131n\u0131 a\u00e7\u0131klamazlar ve kendilerini sald\u0131rganlar\u0131n bunu nas\u0131l elde edebileceklerine ili\u015fkin genel spek\u00fclasyonlarla (ara\u015ft\u0131rma koleksiyonlar\u0131, s\u0131zan veriler, kendi veritabanlar\u0131 gibi) s\u0131n\u0131rland\u0131r\u0131rlar.<\/p>\n<p>Sonraki ad\u0131mda, parmak izi veri taban\u0131, deneme yan\u0131lma sald\u0131r\u0131s\u0131n\u0131n performans\u0131n\u0131 en \u00fcst d\u00fczeye \u00e7\u0131karmak amac\u0131yla bir yapay zekaya g\u00f6nderilir, parmak izi s\u00f6zl\u00fc\u011f\u00fc gibi bir yap\u0131 olu\u015fturulmas\u0131 i\u00e7in kullan\u0131l\u0131r. Parmak izi g\u00f6r\u00fcnt\u00fcleri, yapay zeka taraf\u0131ndan, \u00e7al\u0131\u015fmaya kat\u0131lan ak\u0131ll\u0131 telefonlara tak\u0131lan sens\u00f6rlerden gelen verilerle e\u015fle\u015fecek \u015fekilde ba\u011fda\u015ft\u0131r\u0131l\u0131r.<\/p>\n<div id=\"attachment_11492\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-11492\" class=\"size-medium wp-image-11492\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2023\/06\/14132032\/fingeprint-brute-force-android-scr-3-300x109.jpg\" alt=\"Farkl\u0131 t\u00fcrlerdeki parmak izi sens\u00f6rleri taraf\u0131ndan olu\u015fturulan g\u00f6r\u00fcnt\u00fc \u00f6rnekleri\" width=\"300\" height=\"109\"><p id=\"caption-attachment-11492\" class=\"wp-caption-text\">Farkl\u0131 parmak izi sens\u00f6rlerinin \u00fcretti\u011fi g\u00f6r\u00fcnt\u00fcler birbirinden olduk\u00e7a farkl\u0131d\u0131r. <a href=\"https:\/\/arxiv.org\/pdf\/2305.10791.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Kaynak.<\/a><\/p><\/div>\n<p>\u00a0<\/p>\n<h2>BrutePrint\u2019i ortaya \u00e7\u0131karan iki g\u00fcvenlik a\u00e7\u0131\u011f\u0131: E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et ve Kilitlendikten Sonra E\u015fle\u015f<\/h2>\n<p>BrutePrint sald\u0131r\u0131s\u0131, iki g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlan\u0131r. Ara\u015ft\u0131rmac\u0131lar, g\u00f6r\u00fcn\u00fc\u015fe g\u00f6re istisnas\u0131z t\u00fcm Android ak\u0131ll\u0131 telefonlarda bulunan parmak izi kimlik do\u011frulama \u00e7er\u00e7evesinin temel mant\u0131\u011f\u0131nda meydana gelen bu g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 ke\u015ffettiler. G\u00fcvenlik a\u00e7\u0131klar\u0131, E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et ve Kilitlendikten Sonra E\u015fle\u015f olarak adland\u0131r\u0131ld\u0131.<\/p>\n<h3>E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et g\u00fcvenlik a\u00e7\u0131\u011f\u0131<\/h3>\n<p><strong>E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et (CAMF)<\/strong> g\u00fcvenlik a\u00e7\u0131\u011f\u0131, parmak izi kimlik do\u011frulama mekanizmas\u0131n\u0131n iki \u00f6nemli \u00f6zelli\u011finden yararlan\u0131r. Bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n ortaya \u00e7\u0131kmas\u0131n\u0131n birinci nedeni, \u00e7oklu \u00f6rneklemeye dayanmas\u0131d\u0131r. Yani, her kimlik do\u011frulama denemesinde yaln\u0131zca bir de\u011fil, iki ila d\u00f6rt parmak izi g\u00f6r\u00fcnt\u00fcs\u00fc kullan\u0131l\u0131r (ak\u0131ll\u0131 telefon modeline ba\u011fl\u0131 olarak). Bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n ortaya \u00e7\u0131kmas\u0131n\u0131n ikinci nedeni, kimlik do\u011frulama giri\u015fiminin <em>ba\u015far\u0131s\u0131zl\u0131\u011fa<\/em> ek olarak <em>hata<\/em> ile de sonu\u00e7lanabilmesidir. Bu durumda da ba\u015flang\u0131\u00e7 noktas\u0131na geri d\u00f6nme imkan\u0131 bulunur.<\/p>\n<p>Bu durum, hatay\u0131 tetiklemek i\u00e7in \u00f6nceden d\u00fczenlenmi\u015f \u00e7er\u00e7evelerle biten bir dizi g\u00f6r\u00fcnt\u00fcn\u00fcn g\u00f6nderilmesine olanak sa\u011flar. B\u00f6ylece g\u00f6nderilen g\u00f6r\u00fcnt\u00fclerden biri e\u015fle\u015fmeyi tetiklerse kimlik do\u011frulamas\u0131 ba\u015far\u0131l\u0131 olur. E\u015fle\u015fme tetiklenmezse d\u00f6ng\u00fc hata vererek sona erer ve ard\u0131ndan giri\u015fim hakk\u0131 harcanmadan g\u00f6r\u00fcnt\u00fc g\u00f6nderme i\u015flemi devam eder.<\/p>\n<div id=\"attachment_11493\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-11493\" class=\"wp-image-11493 size-medium\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2023\/06\/14141025\/fingeprint-brute-force-android-scr-4-300x103.jpg\" alt=\"E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et parmak izi kimlik do\u011frulama mant\u0131\u011f\u0131 g\u00fcvenlik a\u00e7\u0131\u011f\u0131 diyagram\u0131.\" width=\"300\" height=\"103\"><p id=\"caption-attachment-11493\" class=\"wp-caption-text\">E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et nas\u0131l \u00e7al\u0131\u015f\u0131r: Hata sayesinde giri\u015fim hakk\u0131 harcanmadan ba\u015flang\u0131\u00e7 noktas\u0131na geri d\u00f6n\u00fcl\u00fcr. Kaynak.<\/p><\/div>\n<p>\u00a0<\/p>\n<h3>Kilitlendikten Sonra E\u015fle\u015f g\u00fcvenlik a\u00e7\u0131\u011f\u0131<\/h3>\n<p>\u0130kinci g\u00fcvenlik a\u00e7\u0131\u011f\u0131: <strong>Kilitlendikten Sonra E\u015fle\u015f (MAL)<\/strong> Parmak izi kimlik do\u011frulama, ba\u015far\u0131s\u0131z bir giri\u015fimin ard\u0131ndan telefonu bir s\u00fcreli\u011fine kilitler ancak bir\u00e7ok ak\u0131ll\u0131 telefon sat\u0131c\u0131s\u0131 bu Android \u00f6zelli\u011fini do\u011fru bir \u015fekilde uygulayamamaktad\u0131r. Bu nedenle, telefon kilitlendikten sonra ba\u015far\u0131l\u0131 bir parmak izi kimlik do\u011frulamas\u0131 yapmak m\u00fcmk\u00fcn olmasa da sistem hala d\u00fcr\u00fcst bir \u201cdo\u011fru\u201d veya \u201cyanl\u0131\u015f\u201d cevab\u0131 verece\u011fi i\u00e7in daha fazla yeni g\u00f6r\u00fcnt\u00fc g\u00f6nderilebilir. Yani, do\u011fru g\u00f6r\u00fcnt\u00fcy\u00fc tespit etti\u011finizde sistem kilit durumundan \u00e7\u0131kar \u00e7\u0131kmaz bu g\u00f6r\u00fcnt\u00fcy\u00fc kullanabilir ve b\u00f6ylece kimlik do\u011frulama i\u015flemini ba\u015far\u0131yla tamamlayabilirsiniz.<\/p>\n<h2>E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et ve Kilitlendikten Sonra E\u015fle\u015f a\u00e7\u0131\u011f\u0131ndan yararlanan sald\u0131r\u0131lar<\/h2>\n<p>\u0130lk g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlanan sald\u0131r\u0131, orijinal olarak Android \u00fczerinde test edilen t\u00fcm ak\u0131ll\u0131 telefonlarda ba\u015far\u0131l\u0131 oldu ancak ilgin\u00e7 bir \u015fekilde <a href=\"https:\/\/tr.wikipedia.org\/wiki\/HarmonyOS\" target=\"_blank\" rel=\"noopener nofollow\">HarmonyOS<\/a> i\u015fletim sisteminde \u00e7al\u0131\u015fmad\u0131. Kilitlendikten Sonra E\u015fle\u015f y\u00f6ntemi, vivo ve Xiaomi ak\u0131ll\u0131 telefonlar\u0131n\u0131n yan\u0131 s\u0131ra HarmonyOS \u00e7al\u0131\u015ft\u0131ran Huawei telefonlar\u0131nda da kullan\u0131ld\u0131.<\/p>\n<div id=\"attachment_11495\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-11495\" class=\"wp-image-11495 size-medium\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2023\/06\/14150646\/fingeprint-brute-force-android-scr-5-300x205.jpg\" alt=\"\u00c7e\u015fitli ak\u0131ll\u0131 telefonlar\u0131n E\u015fle\u015fme Ba\u015far\u0131s\u0131z Olduktan Sonra \u0130ptal Et ve Kilitlendikten Sonra E\u015fle\u015f y\u00f6ntemlerine kar\u015f\u0131 g\u00fcvenlik a\u00e7\u0131\u011f\u0131 tablosu.\" width=\"300\" height=\"205\"><p id=\"caption-attachment-11495\" class=\"wp-caption-text\">Test edilen t\u00fcm ak\u0131ll\u0131 telefonlar\u0131n en az bir sald\u0131r\u0131ya kar\u015f\u0131 savunmas\u0131z oldu\u011fu ortaya \u00e7\u0131kt\u0131. <a href=\"https:\/\/arxiv.org\/pdf\/2305.10791.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Kaynak.<\/a><\/p><\/div>\n<p>\u00a0<\/p>\n<p>Ara\u015ft\u0131rmaya kat\u0131lan t\u00fcm Android ve HarmonyOS ak\u0131ll\u0131 telefonlar\u0131n, sald\u0131r\u0131lardan en az birine kar\u015f\u0131 savunmas\u0131z oldu\u011fu tespit edildi. Bu, t\u00fcm telefonlara belirsiz say\u0131da k\u00f6t\u00fc ama\u00e7l\u0131 parmak izi kimlik do\u011frulama giri\u015fiminde bulunuldu\u011fu anlam\u0131na gelir.<\/p>\n<p>Ara\u015ft\u0131rmaya g\u00f6re, tek parmak izi kayd\u0131na sahip olan bir Android ak\u0131ll\u0131 telefonun kimlik do\u011frulama sistemini ele ge\u00e7irmek 2,9 ila 13,9 saat ald\u0131. Ancak belirli bir modele ait olan ve m\u00fcmk\u00fcn olan maksimum say\u0131da kay\u0131tl\u0131 parmak izine sahip ak\u0131ll\u0131 telefonlarda (Samsung i\u00e7in d\u00f6rt, di\u011ferleri i\u00e7in be\u015f), bu s\u00fcre \u00f6nemli \u00f6l\u00e7\u00fcde azalarak 0,66 saatten 2,78 saate kadar indi.<\/p>\n<div id=\"attachment_11496\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-11496\" class=\"wp-image-11496 size-medium\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2023\/06\/14151004\/fingeprint-brute-force-android-scr-6-300x188.jpg\" alt=\"BrutePrint kullanarak ak\u0131ll\u0131 telefon ele ge\u00e7irme s\u00fcresi.\" width=\"300\" height=\"188\"><p id=\"caption-attachment-11496\" class=\"wp-caption-text\">Harcanan s\u00fcreye g\u00f6re BrutePrint sald\u0131r\u0131s\u0131n\u0131n ba\u015far\u0131l\u0131 olma olas\u0131l\u0131\u011f\u0131: Tek parmak izi kayd\u0131 i\u00e7in d\u00fcz \u00e7izgi ve maksimum say\u0131da parmak izi kayd\u0131 i\u00e7in kesikli \u00e7izgi kullan\u0131lm\u0131\u015ft\u0131r. <a href=\"https:\/\/arxiv.org\/pdf\/2305.10791.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Kaynak.<\/a><\/p><\/div>\n<p>\u00a0<\/p>\n<h2>Peki ya iPhone\u2019lar?<\/h2>\n<p>iPhone\u2019larda kullan\u0131lan Touch ID sisteminin BrutePrint\u2019e kar\u015f\u0131 daha diren\u00e7li oldu\u011fu ortaya \u00e7\u0131kt\u0131. Ara\u015ft\u0131rmaya g\u00f6re, parmak izi sens\u00f6r\u00fc ile sistemin geri kalan\u0131 aras\u0131ndaki ileti\u015fimin \u015fifreli olmas\u0131 iPhone telefonlara avantaj sa\u011fl\u0131yor. Bu nedenle, Touch ID ile donat\u0131lm\u0131\u015f bir cihazda kaydedilmi\u015f parmak izini yakalamak veya sisteme geri g\u00f6ndermek m\u00fcmk\u00fcn de\u011fildir.<\/p>\n<p>\u00c7al\u0131\u015fma, parmak izi tan\u0131ma giri\u015fimlerinin say\u0131s\u0131n\u0131 en \u00fcst d\u00fczeye \u00e7\u0131karmak i\u00e7in kullan\u0131lan baz\u0131 manip\u00fclasyonlara kar\u015f\u0131 iPhone\u2019lar\u0131n k\u0131smen savunmas\u0131z olabilece\u011fine i\u015faret ediyor. Ancak durum g\u00f6r\u00fcnd\u00fc\u011f\u00fc kadar k\u00f6t\u00fc de\u011fil. Android ak\u0131ll\u0131 telefonlarda s\u00fcrekli deneme yapma imkan\u0131 sunarken, iPhone\u2019larda deneme say\u0131s\u0131 sadece 5\u2019ten 15\u2019e kadar art\u0131r\u0131labilir.<\/p>\n<p>Yani iOS kullan\u0131c\u0131lar\u0131, rahat bir \u015fekilde uyuyabilirler. Touch ID, hem Android hem de HarmonyOS sisteminde kullan\u0131lan parmak izi kimlik do\u011frulamas\u0131na g\u00f6re daha g\u00fcvenilirdir. Zaten g\u00fcn\u00fcm\u00fczde \u00e7o\u011fu iPhone modeli Face ID kullan\u0131yor.<\/p>\n<h2>Endi\u015felenecek kadar b\u00fcy\u00fck bir tehlike var m\u0131?<\/h2>\n<p>Android ak\u0131ll\u0131 telefon sahipleri de BrutePrint konusunda \u00e7ok fazla endi\u015felenmemeli. Bu sald\u0131r\u0131 pratikte b\u00fcy\u00fck bir tehdit olu\u015fturmuyor. Bunun birka\u00e7 nedeni var:<\/p>\n<ul>\n<li>BrutePrint sald\u0131r\u0131s\u0131n\u0131 yapabilmek i\u00e7in <strong>cihaza fiziksel olarak eri\u015fmek gerekiyor<\/strong>. Sadece bu fakt\u00f6r bile sald\u0131r\u0131n\u0131n ba\u015f\u0131n\u0131za gelme olas\u0131l\u0131\u011f\u0131n\u0131 b\u00fcy\u00fck bir oranda azalt\u0131yor.<\/li>\n<li>Ayr\u0131ca, <strong>sald\u0131r\u0131y\u0131 ger\u00e7ekle\u015ftirmek i\u00e7in cihaz\u0131n a\u00e7\u0131lmas\u0131<\/strong> ve anakart \u00fczerindeki belirli bir konekt\u00f6r\u00fcn kullan\u0131lmas\u0131 gerekiyor. Bunu cihaz sahibinin bilgisi olmadan yapmak pek kolay de\u011fildir.<\/li>\n<li>En iyi senaryoda bile, sald\u0131r\u0131y\u0131 ger\u00e7ekle\u015ftirmek i\u00e7in <strong>saatlerce u\u011fra\u015f\u0131lmas\u0131 gerekir<\/strong>.<\/li>\n<li>Ve tabii ki, BrutePrint kullanabilmek i\u00e7in \u00f6zel ekipman, parmak izi veri taban\u0131 ve e\u011fitimli yapay zeka gibi hem donan\u0131m hem de yaz\u0131l\u0131m a\u00e7\u0131s\u0131ndan<strong> \u00f6zel bir kurulum<\/strong><\/li>\n<\/ul>\n<p>T\u00fcm bu fakt\u00f6rler bir araya geldi\u011finde, <a href=\"https:\/\/www.theguardian.com\/world\/2023\/apr\/06\/labor-under-pressure-to-ban-use-of-israeli-spyware-in-investigations-of-alleged-welfare\" target=\"_blank\" rel=\"noopener nofollow\">baz\u0131 giri\u015fimci zihniyete sahip ki\u015filer<\/a> taraf\u0131ndan kullan\u0131lmas\u0131 kolay bir ticari \u00fcr\u00fcn halinde getirilmedi\u011fi s\u00fcrece b\u00f6yle bir sald\u0131r\u0131n\u0131n ger\u00e7ek hayatta kullan\u0131lmas\u0131 pek olas\u0131 de\u011fildir.<\/p>\n<h2>Android ak\u0131ll\u0131 telefonlar\u0131 parmak izi deneme yan\u0131lma sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma<\/h2>\n<p>Yukar\u0131da bahsedilenlere ra\u011fmen b\u00f6yle bir sald\u0131r\u0131ya maruz kalma endi\u015fesi ta\u015f\u0131yorsan\u0131z kendinizi korumak i\u00e7in a\u015fa\u011f\u0131daki ipu\u00e7lar\u0131n\u0131 dikkate alabilirsiniz:<\/p>\n<ul>\n<li>M\u00fcmk\u00fcn oldu\u011fu kadar az parmak izi kaydedin (ideal olarak sadece bir tane). Kimlik do\u011frulama i\u00e7in kulland\u0131\u011f\u0131n\u0131z parmak izi say\u0131s\u0131n\u0131 art\u0131r\u0131rsan\u0131z sisteminiz bahsetti\u011fimiz sald\u0131r\u0131lara ve <a href=\"https:\/\/www.nytimes.com\/2017\/04\/10\/technology\/fingerprint-security-smartphones-apple-google-samsung.html\" target=\"_blank\" rel=\"noopener nofollow\">di\u011fer sald\u0131r\u0131lara<\/a> kar\u015f\u0131 daha savunmas\u0131z hale gelebilir.<\/li>\n<li>Telefonunuzda ekstra PIN veya \u015fifre korumas\u0131 \u00f6zelli\u011fi varsa kullanmay\u0131 unutmay\u0131n.<\/li>\n<li>Bu arada, <a href=\"https:\/\/www.kaspersky.com.tr\/mobile-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2c_kdaily_wpplaceholder_sm-team___kisa____c8090141bf3f79f6\" target=\"_blank\" rel=\"noopener\">Kaspersky for Android<\/a> uygulamas\u0131n\u0131n \u00fccretli s\u00fcr\u00fcm\u00fcnde bulunan Uygulama Kilidi i\u015flevi, uygulamalar\u0131n\u0131z\u0131n her biri i\u00e7in ayr\u0131 \u015fifre kullanman\u0131za olanak tan\u0131r.<\/li>\n<\/ul>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"android-malware\">\n<p>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Android parmak izi korumas\u0131, tam anlam\u0131yla g\u00fcvenilir bir y\u00f6ntem de\u011fildir. Parmak izinizin kopyas\u0131na ihtiya\u00e7 duyulmadan bile deneme yan\u0131lma sald\u0131r\u0131s\u0131 kullan\u0131larak a\u015f\u0131labilir.<\/p>\n","protected":false},"author":2726,"featured_media":11485,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1351],"tags":[555,105,2028,2624,750,1575,2174],"class_list":{"0":"post-11484","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-akilli-telefonlar","9":"tag-android","10":"tag-biyometri","11":"tag-biyometrik-kimlik-dogrulama","12":"tag-ios","13":"tag-kimlik-dogrulama","14":"tag-parmak-izleri"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/fingerprint-brute-force-android\/11484\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/fingerprint-brute-force-android\/25733\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/fingerprint-brute-force-android\/21154\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/fingerprint-brute-force-android\/10734\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/fingerprint-brute-force-android\/28428\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/fingerprint-brute-force-android\/26034\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/fingerprint-brute-force-android\/26420\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/fingerprint-brute-force-android\/28907\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/fingerprint-brute-force-android\/27811\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/fingeprint-brute-force-android\/35440\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/fingerprint-brute-force-android\/48303\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/fingerprint-brute-force-android\/20718\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/fingerprint-brute-force-android\/21407\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/fingerprint-brute-force-android\/30242\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/fingerprint-brute-force-android\/34082\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/fingeprint-brute-force-android\/26342\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/fingerprint-brute-force-android\/32045\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/fingerprint-brute-force-android\/31729\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/biyometrik-kimlik-dogrulama\/","name":"biyometrik kimlik do\u011frulama"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/11484","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2726"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=11484"}],"version-history":[{"count":6,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/11484\/revisions"}],"predecessor-version":[{"id":11487,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/11484\/revisions\/11487"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/11485"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=11484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=11484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=11484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}