{"id":6458,"date":"2019-09-23T13:53:27","date_gmt":"2019-09-23T10:53:27","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=6458"},"modified":"2019-11-15T14:24:11","modified_gmt":"2019-11-15T11:24:11","slug":"fairy-tales-red-hood","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/fairy-tales-red-hood\/6458\/","title":{"rendered":"K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z ve Ortadaki Kurt"},"content":{"rendered":"

Bilgi g\u00fcvenli\u011fi konular\u0131n\u0131 \u00e7ocuklar\u0131n\u0131za anlat\u0131yor musunuz? Muhtemelen anlatm\u0131yorsunuz. Baz\u0131lar\u0131 bilgi g\u00fcvenli\u011fini anla\u015f\u0131l\u0131r hale getirmekten vazge\u00e7mekte ve \u00e7ocuklar\u0131n \u00e7evrimi\u00e7i ortamda baz\u0131 \u015feyleri yapmas\u0131n\u0131 ya da genel olarak internet kullanmas\u0131n\u0131 yasaklamaktad\u0131r. Ancak a\u00e7\u0131klama yap\u0131lmadan bir \u015feylerin yasaklanmas\u0131 verimsizdir ve \u00e7ocuklar\u0131n yasak meyvelerin pe\u015finden gitmesi daha muhtemeldir.<\/p>\n

\u201c\u00c7ocu\u011funuzla siber tehditler ve bilgi g\u00fcvenli\u011finin ne oldu\u011fu hakk\u0131nda neden konu\u015fmuyorsunuz?\u201d sorusuna cevap olarak, zaten bu kavramlara \u00e7ok hakim olmayan ebeveynler ne yapacaklar\u0131n\u0131 bilemeyip pes etme e\u011filimi g\u00f6sterir.
\nAma her \u015fey \u00e7oktan a\u00e7\u0131klanm\u0131\u015ft\u0131r asl\u0131nda. Fark\u0131nda olmayabilirsiniz ama k\u00fc\u00e7\u00fckler i\u00e7in siber g\u00fcvenlik \u00fczerine \u00e7ok say\u0131da ders kitab\u0131 asl\u0131nda y\u00fczlerce y\u0131l \u00f6nce kaleme al\u0131nm\u0131\u015ft\u0131r. Onlar\u0131 masal olarak da adland\u0131r\u0131yoruz. Tek yapman\u0131z gereken o masallar\u0131n biraz derinine inmek.<\/p>\n

K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z<\/h2>\n

\u00d6rne\u011fin, K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z<\/em> masal\u0131na bakal\u0131m. Grimm Karde\u015fler, Charles Perrault ve daha pek \u00e7ok \u00fcnl\u00fc siber g\u00fcvenlik uzman\u0131 taraf\u0131ndan defalarca ele al\u0131nm\u0131\u015f, bilindik bir Avrupa halk masal\u0131<\/a>. Hik\u00e2yenin \u00e7e\u015fitli versiyonlar\u0131 olabilir ancak temeli ayn\u0131. Neler oldu\u011funu ad\u0131m ad\u0131m inceleyelim.<\/p>\n

    \n
  1. Anne k\u0131z\u0131n\u0131 bir sepet yiyecekler ninesine g\u00f6nderir.<\/li>\n
  2. K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z kurtla kar\u015f\u0131la\u015ft\u0131\u011f\u0131nda kurt sorar: \u201cNereye gidiyorsun?\u201d<\/li>\n
  3. K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z cevap verir: \u201cNineme gidiyorum, ona yiyecek g\u00f6t\u00fcrece\u011fim.\u201d<\/li>\n<\/ol>\n

    Siber g\u00fcvenli\u011fe dair k\u0131sm\u0131 en ba\u015ftan bellidir. Burada, iki taraf aras\u0131nda ileti\u015fim kurma s\u00fcreci olan el s\u0131k\u0131\u015fma<\/a> s\u00fcrecini a\u00e7\u0131klayabilir ve ilgili tehditleri birlikte g\u00f6zlemleyebilirsiniz.<\/p>\n

    K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z, ninesinin kap\u0131s\u0131n\u0131 \u00e7al\u0131p \u201cKim o?\u201d sorgusu almak ve ninesinin eve eri\u015fimine izin verebilmesi i\u00e7in annenin g\u00f6nderdi\u011fi yiyeceklerle ilgili parolayla yan\u0131t vermek \u00fczere programlanm\u0131\u015f durumda \u015fu an. Ancak bir sebepten \u00f6t\u00fcr\u00fc, do\u011fru \u201cKim o?\u201d sorgusunu alamadan \u00f6nce rastgele bir talep do\u011frultusunda parolay\u0131 veriyor. Bu da sald\u0131rgan\u0131n kullanabilece\u011fi bir f\u0131rsat do\u011furuyor.<\/p>\n

      \n
    1. firmware<\/s> masal versiyonuna ba\u011fl\u0131 olarak, kurt ya K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z\u2019\u0131 ba\u015fka bir yola g\u00f6nderiyor ya da ninesi i\u00e7in gidip \u00e7i\u00e7ek toplamas\u0131n\u0131 \u00f6neriyor.<\/li>\n<\/ol>\n

      Her iki durumda da, bir t\u00fcr Hizmet Reddi (DoS) sald\u0131r\u0131s\u0131. Kurt, K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z\u2019\u0131n gelmesinden sonra ninenin evine girmeye \u00e7al\u0131\u015f\u0131rsa, i\u00e7eri girmesi m\u00fcmk\u00fcn olmaz; beklenen ziyaret\u00e7i zaten i\u00e7eridedir. Bu nedenle, K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z\u2019\u0131 bir s\u00fcreli\u011fine uzakla\u015ft\u0131rmas\u0131 \u00f6nemlidir, b\u00f6ylece k\u00fc\u00e7\u00fck k\u0131z g\u00f6revini zaman\u0131nda tamamlayamaz.<\/p>\n

        \n
      1. \u00a0Her iki durumda da, kurt ninenin evine ula\u015fan ilk ki\u015fi olur ve \u201cKim o?\u201d sorgusuna do\u011fru cevab\u0131 vererek giri\u015f yapar. Ve nine eve girmesine izin verir.<\/li>\n<\/ol>\n

        Bu, tekrarlama sald\u0131r\u0131s\u0131 y\u00f6ntemini kullanan Ortadaki Adam (MitM) sald\u0131r\u0131s\u0131n\u0131n tipik bir versiyonudur (ger\u00e7i bizim durumumuzda, Ortada Kurt daha do\u011fru bir betimleme olur). Kurt, iki taraf aras\u0131ndaki ileti\u015fim kanal\u0131na girer, el s\u0131k\u0131\u015fma prosed\u00fcr\u00fcn\u00fc ve parolay\u0131 m\u00fc\u015fteriden \u00f6\u011frenir ve yasa d\u0131\u015f\u0131 olarak sunucuya eri\u015febilmek i\u00e7in ikisini de tekrar \u00fcretir.<\/p>\n

          \n
        1. \u00a0Kurt nineyi yer, \u00fcst\u00fcne geceli\u011fiyle ba\u015fl\u0131\u011f\u0131n\u0131 ge\u00e7irir ve yata\u011fa uzan\u0131p yorgan\u0131 \u00fcst\u00fcne \u00e7eker.<\/li>\n<\/ol>\n

          Modern anlamda bir kimlik av\u0131 sitesi kurar. D\u0131\u015far\u0131dan bak\u0131nca her \u015fey ger\u00e7ek\u00e7i g\u00f6r\u00fcn\u00fcr. Ninenin yata\u011f\u0131 oradad\u0131r, nineye benzeyen biri i\u00e7inde yatmaktad\u0131r.<\/p>\n

            \n
          1. Eve yakla\u015f\u0131p da \u201cKim o?\u201d sorgusunu alan K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z getirdi\u011fi yiyeceklerle ilgili parolay\u0131 s\u00f6yler.<\/li>\n<\/ol>\n

            Bu, MitM sald\u0131r\u0131s\u0131n\u0131n bir devam\u0131d\u0131r, ancak \u015fimdi bilgi al\u0131\u015fveri\u015fi prosed\u00fcr\u00fcn\u00fcn ikinci b\u00f6l\u00fcm\u00fcn\u00fc \u00f6\u011frenen kurt, sunucunun <\/s> ninenin normal davran\u0131\u015f\u0131n\u0131 taklit eder. \u015e\u00fcpheli bir \u015fey g\u00f6rmeyen K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z i\u00e7eri girer.<\/p>\n

              \n
            1. \u00a0Eve girer ve ninesinin neden bu kadar b\u00fcy\u00fck kulaklar\u0131, g\u00f6zleri ve di\u015fleri oldu\u011funu y\u00fcksek sesle merak eder. Ak\u0131ll\u0131ca sorulard\u0131r, ama nihayetinde, kurdun mu\u011flak a\u00e7\u0131klamalar\u0131ndan tatmin olunca giri\u015f yapar\u2026 ve mideye indirilir.<\/li>\n<\/ol>\n

              Ger\u00e7ek hayatta, kimlik av\u0131 siteleri bu masaldaki gibi %100 ikna edici de\u011fildir ve \u015f\u00fcpheli bir k\u00f6pr\u00fc ba\u011flant\u0131s\u0131 gibi ku\u015fku uyand\u0131ran \u00f6\u011feler i\u00e7erir. Sorunlar\u0131 \u00f6nlemek i\u00e7in dikkatli olman\u0131z gerekir:
              \n\u00d6rne\u011fin ninenin alan ad\u0131 ad\u0131 geceli\u011finden belli oluyorsa, derhal siteyi terk edin.<\/p>\n

              K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z baz\u0131 tutars\u0131zl\u0131klar g\u00f6rm\u00fc\u015f, ancak ne yaz\u0131k ki onlar\u0131 g\u00f6rmezden gelmi\u015ftir. Burada, \u00e7ocu\u011funuza K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z\u2019\u0131n dikkatsiz davrand\u0131\u011f\u0131n\u0131 a\u00e7\u0131klaman\u0131z ve bunun yerine ne yapmas\u0131 gerekti\u011fini s\u00f6ylemeniz gerekir.<\/p>\n

                \n
              1. \u00a0Neyse ki, bir grup oduncu (baz\u0131 versiyonlarda avc\u0131lar) ortaya \u00e7\u0131k\u0131yor, kurdu kesiyor ve nine ve K\u0131rm\u0131z\u0131 Ba\u015fl\u0131kl\u0131 K\u0131z mucizevi bir \u015fekilde g\u00fcvenli ve sa\u011flam bir \u015fekilde ortaya \u00e7\u0131k\u0131yor.<\/li>\n<\/ol>\n

                Bilgi g\u00fcvenli\u011fiyle ilgili paralelliklerin kusursuz olmad\u0131\u011f\u0131 ortada. Paran\u0131z\u0131, itibar\u0131n\u0131z\u0131 veya g\u00fcvenli\u011finizi geri almak i\u00e7in bir siber su\u00e7luyu kesemezsiniz. Ger\u00e7i d\u00fcr\u00fcst olmam\u0131z gerekirse, b\u00f6yle bir \u015fey denemedik. Ve kay\u0131tlara ge\u00e7sin, denemi\u015f olanlarla da hi\u00e7bir ili\u015fkimiz bulunmuyor.<\/p>\n

                Di\u011fer masallarda siber g\u00fcvenlik<\/h2>\n

                Masallar hayat dersleri i\u00e7erir ve neredeyse her masalda bilgi g\u00fcvenli\u011fine dair alt metinler kesinlikle vard\u0131r. As\u0131l mesele, o alt metni do\u011fru bir \u015fekilde ortaya \u00e7\u0131karmakt\u0131r. \u00d6rne\u011fin \u00dc\u00e7 K\u00fc\u00e7\u00fck Domuz <\/em> masal\u0131nda, brute-force sald\u0131r\u0131lar\u0131 i\u00e7in \u00fcfleyip p\u00fcfleme arac\u0131n\u0131 kullanan bir script kiddie g\u00f6r\u00fcyoruz. Karlar Krali\u00e7esi <\/em> Kay\u2019a troll-mirror denilen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 y\u00fckl\u00fcyor ve uzaktan eri\u015fim arac\u0131 (RAT) d\u0131\u015far\u0131daki bir su\u00e7lu i\u00e7eriden birinin sistem kontrol d\u00fczeyine nas\u0131l ula\u015fabiliyorsa Kay\u2019\u0131 da o \u015fekilde kontrol ediyor.<\/p>\n

                Buna kar\u015f\u0131l\u0131k, \u00c7izmeli Kedi <\/em> temel olarak, Kedi\u2019nin \u00f6nce devin altyap\u0131s\u0131n\u0131 ele ge\u00e7irdi\u011fi, daha sonra orada varl\u0131\u011f\u0131n\u0131 ortaya koyup bilinirlik hizmetlerini i\u00e7eren karma\u015f\u0131k bir hile sayesinde yerel y\u00f6netimle sahte bir anla\u015fma yapmay\u0131 ba\u015fard\u0131\u011f\u0131 sofistike bir APT sald\u0131r\u0131s\u0131 ger\u00e7ekle\u015ftirmesini ayr\u0131nt\u0131lar\u0131yla anlat\u0131r.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

                Halk masallar\u0131 pek \u00e7ok bilginin kayna\u011f\u0131d\u0131r ancak pek \u00e7ok insan \u00e7ocuklara bilgi g\u00fcvenli\u011finin temellerini \u00f6\u011fretmek i\u00e7in bu masallar\u0131 kullanmaz. Fakat siz yapabilirsiniz!<\/p>\n","protected":false},"author":700,"featured_media":6459,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1351],"tags":[661,2018,744,1074,2016,2017],"class_list":{"0":"post-6458","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-cocuklar","9":"tag-dos","10":"tag-guvenlik","11":"tag-kimlik-avi","12":"tag-masallar","13":"tag-mitm"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/fairy-tales-red-hood\/6458\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/fairy-tales-red-hood\/16674\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/fairy-tales-red-hood\/14067\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/fairy-tales-red-hood\/6521\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/fairy-tales-red-hood\/18643\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/fairy-tales-red-hood\/16715\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/fairy-tales-red-hood\/15431\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/fairy-tales-red-hood\/19330\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/fairy-tales-red-hood\/18022\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/fairy-tales-red-hood\/28707\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/fairy-tales-red-hood\/12369\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/fairy-tales-red-hood\/11213\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/fairy-tales-red-hood\/20237\/"},{"hreflang":"zh","url":"https:\/\/www.kaspersky.com.cn\/blog\/fairy-tales-red-hood\/10213\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/fairy-tales-red-hood\/24206\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/fairy-tales-red-hood\/24241\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/fairy-tales-red-hood\/23460\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/fairy-tales-red-hood\/23304\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/cocuklar\/","name":"\u00e7ocuklar"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/6458","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/700"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=6458"}],"version-history":[{"count":4,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/6458\/revisions"}],"predecessor-version":[{"id":6726,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/6458\/revisions\/6726"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/6459"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=6458"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=6458"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=6458"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}