{"id":5742,"date":"2019-03-13T11:47:42","date_gmt":"2019-03-13T08:47:42","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=5742"},"modified":"2019-11-15T14:32:07","modified_gmt":"2019-11-15T11:32:07","slug":"middle-earth-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/middle-earth-cybersecurity\/5742\/","title":{"rendered":"Orta D\u00fcnya&#8217;dan siber g\u00fcvenlik raporu"},"content":{"rendered":"<p>Tolkien\u2019in eserleri ne anlat\u0131r? Bu eserleri kimi e\u011flence olarak, kimi derin Hristiyan felsefesi olarak, kimi de propaganda olarak okur. Bense siber g\u00fcvenlik hikayeleri olarak okuyorum. Ve son birka\u00e7 y\u0131ld\u0131r bu hikayeleri her yerde g\u00f6r\u00fcyor olmam, Tolkien kitaplar\u0131nda olmad\u0131klar\u0131 anlam\u0131na gelmiyor.<\/p>\n<p>\u0130kinci D\u00fcnya Sava\u015f\u0131 ba\u015flamadan k\u0131sa bir s\u00fcre \u00f6nce Tolkien\u2019in \u0130ngiliz H\u00fck\u00fcmet Kod ve \u015eifre Okulu\u2019nda kriptanalist olarak e\u011fitim g\u00f6rd\u00fc\u011f\u00fcn\u00fc biliyor muydunuz? Bu kurulu\u015f, Alman Enigma kodlar\u0131n\u0131 k\u0131rmaya \u00e7al\u0131\u015fan kurulu\u015ftu. Daha sonra \u0130ngiliz h\u00fck\u00fcmeti ve silahl\u0131 kuvvetlere istihbarat ve bilgi g\u00fcvencesi sa\u011flama sinyallerinden sorumlu olan hizmet olarak GCHQ ad\u0131n\u0131 ald\u0131. A\u00e7\u0131k bir \u015fekilde g\u00f6r\u00fcl\u00fcyor ki, Tolkien\u2019in bir dilbilimci ve bir kriptanalist olarak edindi\u011fi becerilerle d\u00fc\u015fman \u015fifrelerini \u00e7\u00f6zmesi gerekiyordu. Burada tam anlam\u0131yla bilgi g\u00fcvenli\u011finden bahsediyoruz. Bu nedenle, Tolkien, bir bak\u0131ma sayg\u0131n bir meslekta\u015f\u0131m\u0131zd\u0131r. \u00d6yleyse Tolkien\u2019in \u00e7al\u0131\u015fmalar\u0131na siber g\u00fcvenlik a\u00e7\u0131s\u0131ndan bakal\u0131m.<\/p>\n<h2>G\u00fc\u00e7 Y\u00fcz\u00fckleri<\/h2>\n<p><em>Y\u00fcz\u00fcklerin Efendisi<\/em>\u2018nin konusu, Sauron taraf\u0131ndan d\u00fcnyaya h\u00fckmetmek i\u00e7in yarat\u0131lan Tek Y\u00fcz\u00fck\u2019\u00fcn etraf\u0131nda d\u00f6nmektedir. Bu y\u00fcz\u00fck, \u00fc\u00e7\u00fc Elfler taraf\u0131ndan tak\u0131lan, yedisi C\u00fcceler taraf\u0131ndan tak\u0131lan ve dokuzu \u0130nsanlar taraf\u0131ndan tak\u0131lan 19 y\u00fcz\u00fc\u011f\u00fc daha kontrol etmektedir. Kitab\u0131n kahramanlar\u0131, Tek Y\u00fcz\u00fck yarat\u0131c\u0131s\u0131na geri d\u00f6nerse korkun\u00e7 bir g\u00fc\u00e7 kazanaca\u011f\u0131ndan ve her \u015feye h\u00fckmedece\u011finden korkmaktad\u0131r. Kula\u011fa fantastik gibi gelse de biraz daha derine indi\u011fimizde asl\u0131nda bunun bir bilim kurgu filmi oldu\u011funu g\u00f6rebiliriz.<\/p>\n<h2>\u00dc\u00e7 Y\u00fcz\u00fck g\u00f6\u011f\u00fcn alt\u0131nda ya\u015fayan Elf krallar\u0131na<\/h2>\n<p>\u00c7ocukken Tolkien\u2019in kitaplar\u0131n\u0131 okurken en kar\u0131\u015f\u0131k gelen hikaye \u00dc\u00e7 Elf Y\u00fcz\u00fc\u011f\u00fc\u2019n\u00fcn hikayesiydi. S\u00f6zde, demirci Elfler taraf\u0131ndan d\u00f6v\u00fclen y\u00fcz\u00fckler, Karanl\u0131klar Efendisi taraf\u0131ndan dokunulmazd\u0131. Ancak, Sauron\u2019un karanl\u0131k sanatlar\u0131n\u0131 kullanarak yarat\u0131ld\u0131klar\u0131 i\u00e7in hala Tek Y\u00fcz\u00fck\u2019e ba\u011fl\u0131lard\u0131. Bu y\u00fczden Elfler; Tek Y\u00fcz\u00fck, Sauron ile kald\u0131\u011f\u0131 s\u00fcrece y\u00fcz\u00fcklerini g\u00fcvenli bir \u015fekilde saklad\u0131lar. Y\u00fcz\u00fckler iyilik i\u00e7in yarat\u0131ld\u0131ysa ya da \u00f6yle g\u00f6r\u00fcn\u00fcyorsa nas\u0131l yap\u0131ld\u0131\u011f\u0131n\u0131n ne \u00f6nemi var?<\/p>\n<p>\u00d6nemi olduk\u00e7a b\u00fcy\u00fck ve bunu art\u0131k a\u00e7\u0131k\u00e7a g\u00f6rebiliriz. Durumu modern bir bak\u0131\u015f a\u00e7\u0131s\u0131yla ve bilgi g\u00fcvenli\u011fi a\u00e7\u0131s\u0131ndan inceledi\u011finizde \u015funlar\u0131 elde edersiniz:<\/p>\n<ul>\n<li>Elfler kendi i\u00e7lerinde \u00fc\u00e7 adet cihaz \u00fcretiyor;<\/li>\n<li>Cihazlar\u0131n yaz\u0131l\u0131m\u0131 Sauron taraf\u0131ndan geli\u015ftirilen bir SDK (yaz\u0131l\u0131m geli\u015ftirme kiti) kullan\u0131larak olu\u015fturuluyor;<\/li>\n<li>Bir Y\u00fcz\u00fck K&amp;K (komuta ve kontrol) merkezinin adresi y\u00fcz\u00fcklere kodlan\u0131yor;<\/li>\n<li>Bu y\u00fczden Sauron K&amp;K sunucusunu kontrol ederken Elfler cihazlar\u0131n\u0131 kullanma konusunda dikkatli davran\u0131yor.<\/li>\n<\/ul>\n<p>Ba\u015fka bir deyi\u015fle, bu bir klasik tedarik zinciri sald\u0131r\u0131s\u0131d\u0131r. Yaln\u0131zca bu durumda Elfler \u00f6nlem olarak savunmas\u0131z cihazlar\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 durdurmak i\u00e7in tehditi zaman\u0131nda tespit edebiliyorlard\u0131.<\/p>\n<h2>Yedi y\u00fcz\u00fck ta\u015ftan saraylar\u0131ndaki C\u00fcce h\u00fck\u00fcmdarlara<\/h2>\n<p>Yedi Y\u00fcz\u00fck, C\u00fcce h\u00fck\u00fcmdarlara Sauron\u2019un kendisi taraf\u0131ndan verildi. C\u00fccelerin onlar\u0131 servet biriktirmek i\u00e7in kulland\u0131klar\u0131 s\u00f6ylenirdi. Kitaba g\u00f6re, y\u00fcz\u00fc\u011f\u00fc takanlar do\u011frudan Sauron\u2019un kontrol\u00fcne boyun e\u011fmedi, ancak y\u00fcz\u00fck bu ki\u015filerin a\u00e7g\u00f6zl\u00fcl\u00fc\u011f\u00fcn\u00fc olduk\u00e7a artt\u0131rd\u0131. Bu nedenle, a\u00e7g\u00f6zl\u00fcl\u00fcklerini ve \u00f6fkelerini etkileyerek, Sauron yedi c\u00fcce h\u00fck\u00fcmdar\u0131n\u0131n d\u00fc\u015f\u00fc\u015f\u00fcn\u00fc sa\u011flamay\u0131 ba\u015fard\u0131.<\/p>\n<p>Ne yaz\u0131k ki, Yedi Y\u00fcz\u00fck, Y\u00fcz\u00fcklerin Efendisi\u2019nde a\u00e7\u0131klanan olaylardan \u00e7ok \u00f6nce kaybedilmi\u015ftir, bu nedenle bu cihazlar\u0131n adli t\u0131p analizi m\u00fcmk\u00fcn de\u011fildir. Fakat a\u00e7g\u00f6zl\u00fcl\u00fc\u011f\u00fc kullanmak, tipik bir kimlik av\u0131 tekni\u011fidir. Siber su\u00e7lular, cihaz sahiplerinin, sonunda \u00e7\u00f6k\u00fc\u015flerine neden olacak bilgileri alg\u0131lama bi\u00e7imini de\u011fi\u015ftirmektedir. Bu bir kimlik av\u0131 sald\u0131r\u0131s\u0131 de\u011fil de nedir?<\/p>\n<h2>Dokuz Y\u00fcz\u00fck \u00f6l\u00fcme mahkum \u00d6l\u00fcml\u00fc \u0130nsanlara<\/h2>\n<p>Burada a\u00e7\u0131klanacak fazla bir \u015fey yok. Sauron, Dokuz Y\u00fcz\u00fc\u011f\u00fc \u00d6l\u00fcml\u00fc \u0130nsanlar\u2019a verdi: krallar, b\u00fcy\u00fcc\u00fcler ve ya\u015fl\u0131 sava\u015f\u00e7\u0131lar. Y\u00fcz\u00fc\u011f\u00fc takanlar \u00f6l\u00fcms\u00fcz, g\u00f6r\u00fcnmez ve Sauron\u2019un iradesine itaatkar oldu. Ba\u015fka bir deyi\u015fle, bir botnet.<\/p>\n<p>\u0130lgin\u00e7tir ki, Nazg\u00fbl botnetinin bir yedekleme kontrol protokol\u00fc oldu\u011fu g\u00f6r\u00fcl\u00fcyor; K&amp;K sunucusunu kaybettikten sonra bile, Sauron, Y\u00fcz\u00fck Tayflar\u0131\u2019na komut verebildi.<\/p>\n<h2>Bir y\u00fcz\u00fck kara taht\u0131nda oturan Karanl\u0131klar Efendisine<\/h2>\n<p>Ansiklopedimiz, K&amp;K sunucusunu siber su\u00e7lular\u0131n botnet\u2019leri kontrol etti\u011fi, k\u00f6t\u00fc niyetli komutlar g\u00f6nderdi\u011fi, casus yaz\u0131l\u0131mlar\u0131 y\u00f6netti\u011fi vb. bir sunucu olarak tan\u0131mlamaktad\u0131r. Tek Y\u00fcz\u00fck\u2019\u00fcn bundan bir fark\u0131 var m\u0131?<\/p>\n<p>Tek Y\u00fcz\u00fck yok edildi\u011finde, ona ba\u011fl\u0131 t\u00fcm y\u00fcz\u00fckler g\u00fc\u00e7lerini kaybeder. Donan\u0131m yaz\u0131l\u0131m\u0131na periyodik K&amp;K kullan\u0131labilirlik kontrol\u00fc ve ayr\u0131ca ileti\u015fimi kaybetme durumunda aktif hale getirilecek bir kendi kendini imha etme mekanizmas\u0131 kurmak m\u00fcmk\u00fcnd\u00fcr. Bu t\u00fcr davran\u0131\u015flar,<a href=\"https:\/\/www.kaspersky.com.tr\/blog\/pegasus-spyware\/3100\/\" target=\"_blank\" rel=\"noopener\"> siber tehdit uzmanlar\u0131m\u0131za \u00e7ok tan\u0131d\u0131k geliyor<\/a>. Siber su\u00e7lular adli t\u0131p\u0131 engellemek i\u00e7in s\u0131kl\u0131kla kendi kendini imha eden mekanizmalar kullan\u0131r.<\/p>\n<h2>Hepsine h\u00fckmedecek Tek Y\u00fcz\u00fck, hepsini o bulacak, hepsini bir araya getirip karanl\u0131kta birbirine ba\u011flayacak<\/h2>\n<p>Bu sat\u0131rlar y\u00fcz\u00fc\u011f\u00fcn i\u00e7ine bo\u015funa kaz\u0131nmad\u0131. Tek Y\u00fcz\u00fck\u2019\u00fcn neden Isildur\u2019un Laneti olarak da bilindi\u011fini hat\u0131rl\u0131yor musunuz? Her taraf\u0131 \u00e7evrili olan Isildur y\u00fcz\u00fc\u011f\u00fc takt\u0131, ancak nehri ge\u00e7meye \u00e7al\u0131\u015f\u0131rken y\u00fcz\u00fck parma\u011f\u0131ndan \u00e7\u0131kt\u0131 ve b\u00f6ylelikle \u00f6l\u00fcm\u00fcne sebep oldu. Gollum da \u201ck\u0131ymetli\u201dsini kaybetti. \u00c7\u00fcnk\u00fc y\u00fcz\u00fck \u00fczerindeki yaz\u0131t asl\u0131nda bir talimatt\u0131. G\u00f6r\u00fcn\u00fc\u015fe g\u00f6re yanl\u0131\u015f \u00e7evrilmi\u015f veya tamamen g\u00f6z ard\u0131 edilen yaz\u0131t.<\/p>\n<p>Y\u00fcz\u00fckteki orijinal yaz\u0131t asl\u0131nda \u015fu \u015fekildedir:<\/p>\n<p><em>Ash nazg durbatul\u00fbk, ash nazg gimbatul,<\/em><br>\n<em>Ash nazg thrakatul\u00fbk agh burzum-ishi krimpatul.<\/em><\/p>\n<p>Son kelime olan krimpatul, genellikle \u201cba\u011flamak\u201d olarak \u00e7evrilir. Ancak y\u00fcz\u00fckleri birbirine ba\u011flamak da olduk\u00e7a anlams\u0131z bir harekettir. Ya bu Kara Lisan de\u011filse ve onun yerine her BT uzman\u0131n\u0131n \u00e7ok iyi bildi\u011fi \u201ck\u0131v\u0131rma pensesi\u201dnin transliterasyonuysa?<\/p>\n<p>\u00d6yleyse, asl\u0131nda yaz\u0131t\u0131n s\u00f6yledi\u011fi \u015fey y\u00fcz\u00fc\u011f\u00fcn k\u0131vr\u0131lmas\u0131 gerekti\u011fidir. Isildur\u2019un parma\u011f\u0131ndan d\u00fc\u015fmesinin sebebi de buydu. Bu hikayeden \u00e7\u0131kan ders, ne kadar k\u0131sa ve basit g\u00f6z\u00fckse de belgelerin, Gollum vari \u00f6zveriyle, okunup \u00e7evrilmesi gerekti\u011fidir.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ash nazg durbatul\u00fbk, ash nazg gimbatul,<br \/>\nAsh nazg thrakatul\u00fbk agh burzum-ishi krimpatul.<\/p>\n","protected":false},"author":700,"featured_media":5743,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1194,1727],"tags":[392,1865,1867,1866,1175,1611],"class_list":{"0":"post-5742","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-smb","9":"tag-botnet","10":"tag-cc","11":"tag-gercek","12":"tag-kk","13":"tag-oltalama-saldirisi","14":"tag-tedarik-zinciri"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/middle-earth-cybersecurity\/5742\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/middle-earth-cybersecurity\/15349\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/middle-earth-cybersecurity\/12913\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/middle-earth-cybersecurity\/17287\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/middle-earth-cybersecurity\/15442\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/middle-earth-cybersecurity\/14143\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/middle-earth-cybersecurity\/17950\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/middle-earth-cybersecurity\/16981\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/middle-earth-cybersecurity\/22469\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/middle-earth-cybersecurity\/25846\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/middle-earth-cybersecurity\/18656\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/middle-earth-cybersecurity\/22698\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/middle-earth-cybersecurity\/23888\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/middle-earth-cybersecurity\/18166\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/middle-earth-cybersecurity\/22222\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/middle-earth-cybersecurity\/22155\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/gercek\/","name":"ger\u00e7ek"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/5742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/700"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=5742"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/5742\/revisions"}],"predecessor-version":[{"id":6827,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/5742\/revisions\/6827"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/5743"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=5742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=5742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=5742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}