{"id":2365,"date":"2016-08-25T03:32:51","date_gmt":"2016-08-25T07:32:51","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=2365"},"modified":"2019-11-15T14:58:04","modified_gmt":"2019-11-15T11:58:04","slug":"chip-and-pin-cards-insecure","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/chip-and-pin-cards-insecure\/2365\/","title":{"rendered":"\u00c7ipli kartlar hala korumas\u0131z"},"content":{"rendered":"<p>Bankac\u0131l\u0131k sekt\u00f6r\u00fc, banka kartlar\u0131n\u0131 korumak i\u00e7in \u00e7aba, zaman ve para harc\u0131yor. Y\u0131llar boyunca bu g\u00fcvenlik kabartma say\u0131larla ve imza alan\u0131 ile sa\u011fland\u0131, ama \u015fimdi paran\u0131z ile paran\u0131z\u0131 \u00e7almak isteyenlerin aras\u0131nda sadece tek a\u015famal\u0131 koruma sa\u011flayan ak\u0131ll\u0131 bir \u00e7ip var.<\/p>\n<p>Yeni \u00e7ipli ve PIN\u2019li kartlar (<a href=\"https:\/\/eksisozluk.com\/emv--683760\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">EMV standartl\u0131<\/a>) manyetik \u00e7izgili kartlardan daha sa\u011flam koruma vadediyor,  ancak \u00e7ok ge\u00e7meden su\u00e7lular korumay\u0131 a\u015fmay\u0131 denedi. Neyse ki, bu korumay\u0131 a\u015fmay\u0131 deneyenler sadece su\u00e7lular de\u011fil; g\u00fcvenlik uzmanlar\u0131 da sistemleri ara\u015ft\u0131r\u0131yor. \u015eirket ara\u015ft\u0131rmac\u0131lar\u0131 \u00f6deme sistemi ekipmanlar\u0131n\u0131 ve \u00f6deme sistemi yap\u0131lar\u0131n\u0131n a\u00e7\u0131klar\u0131n\u0131 aramak ad\u0131na derinlemesine inceliyorlar, bulurlarsa geli\u015ftiricileri uyararak su\u00e7lular da bu a\u00e7\u0131klar\u0131 bulmadan \u2018delikleri kapatmalar\u0131\u2019 sa\u011flan\u0131yor. <\/p>\n<p>Ara\u015ft\u0131rmac\u0131lar\u0131n Black Hat sunumu hem umuta hem de endi\u015feye sebep oldu: Evet, su\u00e7lular \u00e7ipli kartlardan para \u00e7alabilir \u2013 ama insanlar kendilerini korumak i\u00e7in korumas\u0131z de\u011filler. NCR Corp\u2019un (ATM ve \u00f6deme terminalleri \u00fcreten bir firma) iki \u00e7al\u0131\u015fan\u0131 yapt\u0131klar\u0131 sunumda, \u00f6deme terminallerine yap\u0131lan sald\u0131r\u0131lar\u0131n en \u00e7ok benzincilerde ve d\u00fckkanlarda oldu\u011funu <a href=\"https:\/\/threatpost.com\/researchers-bypass-chip-and-pin-protections-at-black-hat\/119637\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">belirttiler<\/a>. Ucuz ve k\u00fc\u00e7\u00fck Raspberry Pi bilgisayar kullanarak, kendilerini d\u00fckkan\u0131n ana bilgisayar\u0131 (k\u0131saca yazar kasa) ile \u00f6deme mod\u00fcl\u00fc (k\u0131saca \u015fifrenizi girdi\u011finiz o k\u00fc\u00e7\u00fck cihaz) aras\u0131na yerle\u015ftiler. <\/p>\n<p>Genel olarak, bu iki sistem aras\u0131ndaki ba\u011flant\u0131 tamamen \u015fifrelenmi\u015f olmal\u0131d\u0131r, ama bir\u00e7ok durumda, sadece terminalin zay\u0131f bir \u015fifresi oluyor. Sonu\u00e7 olarak, su\u00e7lular <a href=\"https:\/\/www.kaspersky.com\/blog\/man-in-the-middle-attack\/1613\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">man-in-the-middle<\/a> (<a href=\"https:\/\/tr.wikipedia.org\/wiki\/Man-in-the-middle_attack\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Aradaki adam sald\u0131r\u0131s\u0131 veya Ortadaki adam sald\u0131r\u0131s\u0131<\/a>) uygulayarak: \u00f6deme mod\u00fcl\u00fc ve ana bilgisayar aras\u0131ndaki ba\u011flant\u0131ya eri\u015fip \u015fifreyi \u00e7\u00f6zebiliyor. <\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Unfortunately two-factor authentication can't save you from <a href=\"https:\/\/twitter.com\/hashtag\/banking?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#banking<\/a> Trojans <a href=\"https:\/\/t.co\/dEKfOWPaXo\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/dEKfOWPaXo<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/mobile?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#mobile<\/a> <a href=\"https:\/\/t.co\/hRP7WnTNmS\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/hRP7WnTNmS<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/708316552937000961?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 11, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Sald\u0131r\u0131 asl\u0131nda \u00e7ipli karttaki temel g\u00fcvenlik verilerini \u00e7ekmiyor; kesin veriler (PIN kodu gibi), \u00e7ipte \u015fifrelidirler ve asla aktar\u0131lmazlar. Buna ra\u011fmen, sald\u0131rganlar \u00e7ipten ba\u015fka veriler elde ederler \u2013 veriler genellikle manyetik banta yaz\u0131lm\u0131\u015ft\u0131r. <\/p>\n<p>Bu \u015fekilde, su\u00e7lular kart sahibinin ad\u0131n\u0131 ve kart numaras\u0131n\u0131 kullanarak kurban\u0131n kart\u0131 ile online \u00f6deme yapabilirler. Tabi, kart\u0131n arkas\u0131nda bulunan CVV2 ya da CVC2 kodunuzu da bilmesi gerekiyor \u2013 bu da genellikle veri transferi s\u0131ras\u0131nda gizli tutulur. Ama su\u00e7lular kart sahibini kand\u0131r\u0131p bilgileri almaya \u00e7al\u0131\u015fabilirler. \u00d6deme terminalindeki s\u0131radan \u201dKart\u0131n\u0131z\u0131 okutun\u201d ve \u201d\u015eifrenizi girin\u201d sorular\u0131n yan\u0131 s\u0131ra, ba\u015fka sorulara da cevap vermeniz gerekebilir \u2013 mesela \u201dCVV2 ya da CVC2 kodunuzu girin.\u201d <\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">ICYMI: Five lessons I\u2019ve learned from having my credit card hacked <a href=\"http:\/\/t.co\/dAQQfNXnE3\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/dAQQfNXnE3<\/a> <a href=\"http:\/\/t.co\/dSYKBglVgO\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/dSYKBglVgO<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/533624300302249985?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 15, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Ba\u015fka bir benzeri; Su\u00e7lular \u201cHata, l\u00fctfen \u015firenizi tekrar girin\u201d gibi \u015feyler ekleyebilirler \u2013 ama bu sefer de terminal a\u00e7\u0131k ve g\u00fcvenli olmayan bilgi i\u00e7in sordu\u011funu anlayabilir. E\u011fer bu y\u00f6ntem i\u015fe yararsa, terminal g\u00fcvenli olan veriyi g\u00fcvensiz bir \u015fekilde su\u00e7luya g\u00f6nderir ve kurban\u0131n \u015fifresi \u00e7al\u0131n\u0131r. <\/p>\n<p>Ara\u015ft\u0131rmac\u0131lar\u0131n kart sahiplerini g\u00fcvende tutabilecek iki ipucu var. Birincisi, \u015fifrenizi asla iki defa girmeyin. E\u011fer bir hata al\u0131rsan\u0131z ve size tekrar \u015fifrenizi sorarsa, i\u015flemi iptal edin, kart\u0131 \u00e7\u0131kart\u0131n, kart\u0131 tekrar cihazdan ge\u00e7irip tekrar deneyin ve \u015fifrenizi sadece bir defa kullan\u0131n. \u0130kinci olarak ise, size \u015f\u00fcpheli sorular soran terminallerden al\u0131\u015fveri\u015f yapmay\u0131n \u2013 hele ki e\u011fer \u00f6zellikle \u201dCVC2 ya da CVV2\u2033 kodunuzu soruyorsa..<\/p>\n<p>\u0130kinci ipucu t\u00fcm \u00fclkelerde ge\u00e7erli de\u011fil, ama ilgi \u00e7ekici. NCR uzmanlar\u0131 \u00f6zellikle mobil \u00f6deme sistemlerini (Apple Pay gibi) kullanman\u0131n, kredi kart\u0131 kullanmaktan daha g\u00fcvenli oldu\u011funu belirtiyor.<\/p>\n<p>Tabi eski us\u00fcl nakit kullanmak her t\u00fcrl\u00fc kart ve banka doland\u0131r\u0131c\u0131l\u0131\u011f\u0131 yapmak isteyenlere kar\u015f\u0131 en iyi korunma olacakt\u0131r. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bankac\u0131l\u0131k sekt\u00f6r\u00fc, banka kartlar\u0131n\u0131 korumak i\u00e7in \u00e7aba, zaman ve para harc\u0131yor. Y\u0131llar boyunca bu g\u00fcvenlik kabartma say\u0131larla ve imza alan\u0131 ile sa\u011fland\u0131, ama \u015fimdi paran\u0131z ile paran\u0131z\u0131 \u00e7almak isteyenlerin aras\u0131nda<\/p>\n","protected":false},"author":32,"featured_media":2366,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1287,1351],"tags":[977,978,950,979,744,611],"class_list":{"0":"post-2365","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-banka-karti","10":"tag-bankalar","11":"tag-black-hat","12":"tag-cipler","13":"tag-guvenlik","14":"tag-kredi-karti"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/chip-and-pin-cards-insecure\/2365\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/chip-and-pin-cards-insecure\/7528\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/chip-and-pin-cards-insecure\/7552\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/chip-and-pin-cards-insecure\/7528\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/chip-and-pin-cards-insecure\/8959\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/chip-and-pin-cards-insecure\/8786\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/chip-and-pin-cards-insecure\/12790\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/chip-and-pin-cards-insecure\/12787\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/chip-and-pin-cards-insecure\/5989\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/chip-and-pin-cards-insecure\/6491\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/chip-and-pin-cards-insecure\/5257\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/chip-and-pin-cards-insecure\/8482\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/chip-and-pin-cards-insecure\/12355\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/chip-and-pin-cards-insecure\/12790\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/chip-and-pin-cards-insecure\/12787\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/chip-and-pin-cards-insecure\/12787\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/banka-karti\/","name":"banka kart\u0131"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=2365"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2365\/revisions"}],"predecessor-version":[{"id":7153,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2365\/revisions\/7153"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/2366"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=2365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=2365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=2365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}