{"id":7658,"date":"2020-02-13T12:00:05","date_gmt":"2020-02-13T09:00:05","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=7658"},"modified":"2020-02-13T12:00:05","modified_gmt":"2020-02-13T09:00:05","slug":"36c3-immobilizers","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/36c3-immobilizers\/7658\/","title":{"rendered":"Bir immobilizer arac\u0131n\u0131z\u0131 \u00e7al\u0131nmas\u0131n\u0131 engelleyebilir mi?"},"content":{"rendered":"

Gittik\u00e7e daha ak\u0131ll\u0131 hale gelen otomobillere bir levye ve bir tornavida ile girmek her zamankinden daha da zorla\u015f\u0131yor. \u0130statistikler de bu varsay\u0131m\u0131 destekliyor: Jan C. van Ours ve Ben Vollaard\u2019\u0131n araba h\u0131rs\u0131zl\u0131\u011f\u0131 ve kurtarma verilerini ele alan ara\u015ft\u0131rmas\u0131na g\u00f6re<\/a>, ara\u00e7 h\u0131rs\u0131zl\u0131\u011f\u0131 Hollanda\u2019da 1995 ile 2008 y\u0131llar\u0131 aras\u0131nda %70 oran\u0131nda, \u0130ngiltere\u2019de ise %80\u2019e kadar azalm\u0131\u015f.<\/p>\n

D\u00fc\u015f\u00fc\u015f\u00fcn nedenlerinden biri, \u201cimmobilizer\u201d adl\u0131 bulu\u015fun yayg\u0131n bi\u00e7imde kullan\u0131lmaya ba\u015flanmas\u0131. Bununla birlikte, immobilizerler de di\u011fer g\u00f6rece daha karma\u015f\u0131k teknolojiler gibi hacklenebilir. Bu konuyu y\u00fcksek lisans tezi konusu<\/a> olarak se\u00e7en siber g\u00fcvenlik ara\u015ft\u0131rmac\u0131s\u0131 Wouter Bokslag, ara\u015ft\u0131rmas\u0131n\u0131n sonu\u00e7lar\u0131n\u0131 36. Kaos \u0130leti\u015fim Kongresi\u2019nde (36\u04213) sundu.<\/p>\n

\u0130mmobilizer nedir<\/h2>\n

\u00d6zetle, bir immobilizer direksiyondaki ki\u015finin ger\u00e7ekten de arac\u0131 kullanmaya hakk\u0131 olup olmad\u0131\u011f\u0131n\u0131 tespit etmeye \u00e7al\u0131\u015f\u0131r. Emin olam\u0131yorsa, arac\u0131n \u00e7al\u0131\u015fmas\u0131na izin vermez. Tan\u0131nma i\u015flemi yasal sahip taraf\u0131ndan alg\u0131lanamaz; kullan\u0131c\u0131 kat\u0131l\u0131m\u0131 olmaks\u0131z\u0131n bir saniyeden az zaman i\u00e7inde ger\u00e7ekle\u015fir.<\/p>\n

D\u00fcnyan\u0131n ilk immobilizerinin patenti<\/a>, 1919 gibi erken bir tarihte al\u0131nd\u0131. O zamanlar, s\u00fcr\u00fcc\u00fcn\u00fcn konta\u011f\u0131 belirli bir s\u0131rada ba\u011flamas\u0131 gerekiyordu ve araba \u00e7al\u0131\u015ft\u0131r\u0131l\u0131rken kontak yanl\u0131\u015f s\u0131rada ba\u011flan\u0131rsa alarm \u00e7al\u0131yordu.<\/p>\n

\"\"

Otomobillere y\u00f6nelik bir h\u0131rs\u0131zl\u0131k \u00f6nleme sisteminin patenti ilk olarak 1919\u2019da al\u0131nd\u0131<\/p><\/div>\n

G\u00fcn\u00fcm\u00fcz\u00fcn immobilizerleri, iki anahtar par\u00e7adan olu\u015fuyor: Bunlardan biri kontak anahtar\u0131nda bulunan bir aktar\u0131c\u0131, di\u011feri ise araban\u0131n kendisinde bulunan bir al\u0131c\u0131. Birisi motoru \u00e7al\u0131\u015ft\u0131rmaya \u00e7al\u0131\u015ft\u0131\u011f\u0131nda, ara\u00e7 anahtara bir istek g\u00f6nderiyor. Anahtar, \u00f6nceden tan\u0131mlanm\u0131\u015f do\u011fru sinyali iletti\u011fi takdirde, immobilizer motor kontrol \u00fcnitesine \u00e7al\u0131\u015fmas\u0131 i\u00e7in bir komut g\u00f6nderiyor. Do\u011fru sinyal olmadan arabay\u0131 \u00e7al\u0131\u015ft\u0131rmak m\u00fcmk\u00fcn de\u011fil.<\/p>\n

Hitag2, DST40 ve Megamos Crypto, ilk aktar\u0131c\u0131lardan baz\u0131lar\u0131. Y\u0131llar boyunca incelenen bu aktar\u0131c\u0131lar art\u0131k g\u00fcvenli say\u0131lm\u0131yor. Hitag2\u2019nin eksiklikleri hakk\u0131nda buradan<\/a>, Megamos Crypto\u2019nunkiler hakk\u0131nda ise buradan<\/a> bilgi alabilirsiniz.<\/p>\n

20. y\u00fczy\u0131l\u0131n son on y\u0131l\u0131nda immobilizerler h\u0131zla \u00e7o\u011fald\u0131. Doksanlar\u0131n sonlar\u0131nda AB \u00fclkelerinde zorunlu hale geldiler; di\u011fer \u00fclkeler de yava\u015f yava\u015f bu dalgay\u0131 takip etti. Bu \u00fclkelerin raporlar\u0131na itibar edersek immobilizerler, oto h\u0131rs\u0131zl\u0131\u011f\u0131 oranlar\u0131nda \u00f6nemli bir azalma ya\u015fanmas\u0131na katk\u0131da bulundu.<\/p>\n

\"\"

S\u0131ras\u0131yla B\u00fcy\u00fck Britanya, Hollanda, \u0130sve\u00e7, Amerika Birle\u015fik Devletleri, Kanada ve Avustralya i\u00e7in araba h\u0131rs\u0131zl\u0131\u011f\u0131 istatistikleri, 1981\u20132013, 2000 y\u0131l\u0131 temel al\u0131narak. Kaynak<\/a><\/p><\/div>\n

Araba h\u0131rs\u0131zlar\u0131 geri d\u00f6nd\u00fc<\/h2>\n

Araba h\u0131rs\u0131zl\u0131\u011f\u0131 kesinlikle bununla sonlanmad\u0131. \u0130mmobilizerler ana ak\u0131m haline geldi\u011finde, beklendi\u011fi \u00fczere su\u00e7lular ve otomobil markalar\u0131 aras\u0131nda bir yar\u0131\u015f ba\u015flad\u0131. Arabalar daha ak\u0131ll\u0131 hale geldik\u00e7e su\u00e7lular da buna ayak uydurdu ve immobilizerlerin kand\u0131r\u0131lmas\u0131n\u0131n olduk\u00e7a kolay oldu\u011fu ortaya \u00e7\u0131kt\u0131. Ba\u015far\u0131l\u0131 sonu\u00e7lanan kand\u0131rma giri\u015fimleri s\u0131kla\u015ft\u0131 ve araba h\u0131rs\u0131zl\u0131\u011f\u0131n\u0131n uzun s\u00fcredir devam eden istikrarl\u0131 d\u00fc\u015f\u00fc\u015f e\u011filimi 2010 civar\u0131nda tersine d\u00f6nd\u00fc. \u0130ngiltere\u2019nin araba h\u0131rs\u0131zl\u0131\u011f\u0131 oran\u0131 2018\u2019de sekiz y\u0131l\u0131n en y\u00fcksek seviyesine ula\u015ft\u0131<\/a>; di\u011fer bir\u00e7ok \u00fclke benzer bir e\u011filimi, yani 2010 y\u0131l\u0131na<\/a> kadar s\u00fcren d\u00fc\u015f\u00fc\u015f\u00fcn ard\u0131ndan hafif bir toparlanma veya sabitlenme e\u011filimini g\u00f6rd\u00fc.<\/p>\n

Pahal\u0131 l\u00fcks markalar, en s\u0131k \u00e7al\u0131nan otomobiller olmaya devam ettiler. Siber g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131 da bu markalara odakland\u0131, ancak b\u00fcy\u00fck b\u00fct\u00e7elere ra\u011fmen \u00e7al\u0131\u015fmalar\u0131 hayal k\u0131r\u0131kl\u0131\u011f\u0131yla sonu\u00e7land\u0131.<\/p>\n

Pahal\u0131 l\u00fcks bir arabaya on saniye i\u00e7inde gizlice girilebiliyorsa<\/a>, \u00e7o\u011fu insan\u0131n s\u00fcrd\u00fc\u011f\u00fc daha yayg\u0131n modellerde durum nas\u0131l oldu\u011funu siz d\u00fc\u015f\u00fcn\u00fcn.<\/p>\n

\u0130mmobilizer g\u00fcvenli\u011finin incelenmesi<\/h2>\n

Bokslag, \u00e7al\u0131\u015fmas\u0131nda pop\u00fcler markalara ait \u00fc\u00e7 araban\u0131n kilidini k\u0131rmay\u0131 denedi. Arabalar\u0131n hi\u00e7biri yeni de\u011fildi; hepsi a\u015fa\u011f\u0131 yukar\u0131 2009 modeldi. Modeller, az \u00f6nce bahsetti\u011fimiz daha yayg\u0131n kullan\u0131lan modeller olan B s\u0131n\u0131f\u0131 ucuz k\u0131sa kasa arabalard\u0131. \u00c7al\u0131\u015fman\u0131n yazarlar\u0131na g\u00f6re, bir\u00e7ok yeni araba da benzer h\u0131rs\u0131zl\u0131k \u00f6nleme sistemleri kullan\u0131yor.<\/p>\n

Bokslag \u015fu yakla\u015f\u0131m\u0131 kulland\u0131:<\/p>\n

    \n
  1. CAN veri yolu trafi\u011fine eri\u015fim kazan. (CAN veri yolu, mevcut ara\u00e7lar\u0131n \u00e7o\u011funun dahili ileti\u015fim i\u00e7in kulland\u0131klar\u0131 \u015feydir.)<\/li>\n
  2. \u0130mmobilizer bile\u015fenlerinin al\u0131p iletti\u011fi mesajlar\u0131 oku.<\/li>\n
  3. Motor kontrol mod\u00fcl\u00fc (ECM) veya karoser kontrol mod\u00fcl\u00fc (BCM) sabit yaz\u0131l\u0131m\u0131n\u0131 ele ge\u00e7ir.<\/li>\n
  4. Mesajla\u015fmada kullan\u0131lan algoritmay\u0131 tan\u0131mla.<\/li>\n
  5. Arac\u0131n orijinal bir anahtar olmadan \u00e7al\u0131\u015ft\u0131r\u0131labilece\u011fini kan\u0131tlamak i\u00e7in \u00f6nceden elde edilen verileri kullan.<\/li>\n<\/ol>\n

    Birinci ad\u0131m olduk\u00e7a kolay: Veri yoluna standart OBD II ba\u011flant\u0131 noktas\u0131 \u00fczerinden eri\u015filebiliyor. 2000 y\u0131l\u0131ndan sonra \u00fcretilen t\u00fcm otomobillerde bu var ve te\u015fhis amac\u0131na hizmet ediyor. Araban\u0131n i\u00e7ine girdikten sonra aray\u00fcze eri\u015febiliyorsunuz.<\/p>\n

    \u00dcr\u00fcn yaz\u0131l\u0131m\u0131, olduk\u00e7a karma\u015f\u0131k tekniklerden tutun, internetten basit bir indirme yapmaya kadar y\u00fczlerce farkl\u0131 yolla edinilebiliyor. Evet, do\u011fru bildiniz: Bir\u00e7ok araban\u0131n \u00fcr\u00fcn yaz\u0131l\u0131m\u0131 \u00e7evrimi\u00e7i olarak mevcut; \u00fcreticiler bunu te\u015fhis veya bak\u0131m i\u00e7in sunuyor.<\/p>\n

    T\u00fcm trafik g\u00fcvenilir bir \u015fekilde \u015fifrelenmi\u015f oldu\u011fu s\u00fcrece bu k\u00f6t\u00fc bir \u015fey say\u0131lmaz. Ancak en b\u00fcy\u00fck hayal k\u0131r\u0131kl\u0131\u011f\u0131 da tam olarak burada yat\u0131yor: \u0130lk iki immobilizer \u00e7ok zay\u0131f bir \u015fifreleme kullan\u0131yordu. \u0130lk ara\u00e7ta, yeni bir anahtar\u0131n yetkilendirilmesine izin veren ve daha sonra immobilizasyonu devre d\u0131\u015f\u0131 b\u0131rakan ara\u00e7 g\u00fcvenlik kodunun al\u0131nmas\u0131 sadece birka\u00e7 saniye s\u00fcrd\u00fc. \u0130kinci test arac\u0131n\u0131n g\u00fcvenlik kodunun al\u0131nmas\u0131 ise 4.000 kadar giri\u015fim ya da yakla\u015f\u0131k 15 dakika s\u00fcrd\u00fc.<\/p>\n

    \u00dc\u00e7\u00fcnc\u00fc \u00f6rnek asl\u0131nda di\u011ferlerinden daha zordu: \u0130mmobilizer protokol\u00fcnde belirgin kusurlar\u0131 yoktu ve k\u0131r\u0131lmad\u0131. Ancak ara\u015ft\u0131rmac\u0131, anahtar \u00e7ipinin Hitag2\u2019de kullan\u0131lana benzeyen PCF7935 transponder\u2019\u0131n\u0131 taklit etti\u011fini belirledi. Hitag2\u2019nin bilinen zay\u0131f y\u00f6nlerini kullanarak, kriptografi ile u\u011fra\u015fmaya gerek kalmadan, sadece 6 dakika i\u00e7inde arac\u0131 \u00e7al\u0131\u015ft\u0131rabiliyordunuz.<\/p>\n

    Her \u00fc\u00e7 sistem de hala kullan\u0131l\u0131yor ve 2019\u2019da \u00fcretilen baz\u0131 arabalarda bile kurulu.<\/p>\n

    Biz ne yapabiliriz?<\/h2>\n

    \u0130mmobilizerler, hala mekanik teknikler kullanan daha eski moda su\u00e7lulara kar\u015f\u0131 ger\u00e7ekten de etkili. Bununla birlikte, daha sofistike araba h\u0131rs\u0131zlar\u0131na etki etmiyorlar; en az\u0131ndan kitlesel \u00fcretim yap\u0131lan segmentlerde.<\/p>\n

    Bu nedenle, kula\u011fa tuhaf gelse de, otomobil sahipleri i\u00e7in olas\u0131 bir tavsiye, k\u00f6klerine ba\u011fl\u0131 kal\u0131p seksenli ve doksanl\u0131 y\u0131llar\u0131n teknolojilerini atmamak olabilir. Bir araba h\u0131rs\u0131z\u0131, mekanik direksiyon kilidi ile desteklenen bir elektronik g\u00fcvenlik sistemine girmek i\u00e7in hem elektronik hem de mekani\u011fi k\u0131rma becerisine ihtiya\u00e7 duyar.<\/p>\n

    Her \u015feye ra\u011fmen, becerikli, \u201cikisi bir arada\u201d bir ara\u00e7 h\u0131rs\u0131z\u0131na denk gelebilirsiniz; ancak g\u00fcvenli\u011finizi iki kat\u0131na \u00e7\u0131karmak hi\u00e7 olmasa arac\u0131n\u0131z\u0131 bir yandaki arac\u0131 \u00e7almaktan daha zor hale getirecektir. Dedikleri gibi; ay\u0131dan de\u011fil, kovalad\u0131\u011f\u0131 di\u011fer adamdan daha h\u0131zl\u0131 olman\u0131z yeterli.<\/p>\n

    Bununla birlikte, otomobil \u00fcreticileri ara\u00e7 h\u0131rs\u0131zlar\u0131n\u0131n ba\u015f d\u00fc\u015fman\u0131 olmaya devam ediyorlar; ancak pek \u00e7ok a\u00e7\u0131dan siber g\u00fcvenlik a\u00e7\u0131s\u0131ndan yeni say\u0131l\u0131rlar. Ne yaz\u0131k ki, end\u00fcstri standartlar\u0131n\u0131 g\u00f6z ard\u0131 eden \u00f6zel ve genellikle karma\u015f\u0131k olmayan, telif hakk\u0131 ba\u015fkas\u0131na ait \u015fifreleme algoritmalar\u0131 kullan\u0131yorlar ve koruduklar\u0131 otomobiller piyasaya \u00e7\u0131kt\u0131\u011f\u0131nda bu h\u0131rs\u0131zl\u0131\u011fa kar\u015f\u0131 sistemler \u00e7oktan eskimi\u015f oluyor.<\/p>\n

    Buna ra\u011fmen biz ve ba\u015fkalar\u0131, otomobil g\u00fcvenli\u011fini art\u0131rmak i\u00e7in baz\u0131 ad\u0131mlar atmaya ba\u015flad\u0131k. Birka\u00e7 y\u0131ld\u0131r, modern ba\u011flant\u0131l\u0131 otomobilleri daha g\u00fcvenli hale getirmek i\u00e7in en b\u00fcy\u00fck ba\u011f\u0131ms\u0131z otomotiv sistemleri \u00fcreticisi olan AVL ile orta\u011f\u0131z. Ba\u011fl\u0131 otomobiller: Do\u011fu\u015ftan G\u00fcvenli<\/a> ba\u015fl\u0131kl\u0131 g\u00f6nderimizden g\u00fcvenli araba vizyonumuz hakk\u0131nda daha fazla bilgi edinebilirsiniz.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Ara\u015ft\u0131rmac\u0131lar, Chaos \u0130leti\u015fim Kongresi’nde modern ara\u00e7 immobilizasyon sistemlerinin g\u00fcvenilirli\u011fi \u00fczerine bir \u00e7al\u0131\u015fma sundu.<\/p>\n","protected":false},"author":2548,"featured_media":7659,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194],"tags":[2085,1507,2087,2115],"class_list":{"0":"post-7658","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"tag-36c3","10":"tag-ccc","11":"tag-chaos-iletisim-kongresi","12":"tag-immobilizer"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/36c3-immobilizers\/7658\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/36c3-immobilizers\/18484\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/36c3-immobilizers\/15360\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/36c3-immobilizers\/7511\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/36c3-immobilizers\/20264\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/36c3-immobilizers\/18577\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/36c3-immobilizers\/17096\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/36c3-immobilizers\/21076\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/36c3-immobilizers-2\/19914\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/36c3-immobilizers\/32419\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/36c3-immobilizers\/13716\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/36c3-immobilizers\/14038\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/36c3-immobilizers\/12765\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/36c3-immobilizers\/22172\/"},{"hreflang":"zh","url":"https:\/\/www.kaspersky.com.cn\/blog\/36c3-immobilizers\/10730\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/36c3-immobilizers\/26873\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/36c3-immobilizers\/24968\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/36c3-immobilizers\/25765\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/36c3-immobilizers\/25597\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/36c3\/","name":"36c3"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/7658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2548"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=7658"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/7658\/revisions"}],"predecessor-version":[{"id":7662,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/7658\/revisions\/7662"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/7659"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=7658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=7658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=7658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}