{"id":8221,"date":"2020-05-13T13:47:18","date_gmt":"2020-05-13T10:47:18","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=8221"},"modified":"2020-05-13T13:47:18","modified_gmt":"2020-05-13T10:47:18","slug":"ransomware-collateral-damage","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/ransomware-collateral-damage\/8221\/","title":{"rendered":"Fidye yaz\u0131l\u0131m\u0131: \u0130kincil hasarlar"},"content":{"rendered":"<p>Fidye yaz\u0131l\u0131m\u0131 bula\u015fm\u0131\u015f bir ATM, hava alan\u0131nda bir \u015fantajc\u0131n\u0131n mesaj\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleyen bir zaman \u00e7izelgesi veya bitcoin cinsinden fidye isteyen bir slot makinesinin \u015fehir efsaneleri oldu\u011funu d\u00fc\u015f\u00fcnebilirsiniz. Ne var ki, insanlar \u00fc\u00e7 y\u0131l \u00f6nce WannaCry fidye yaz\u0131l\u0131m\u0131 salg\u0131n\u0131 s\u0131ras\u0131nda tam olarak bunlar\u0131 ya\u015fad\u0131. Bu nedenle, Fidye Yaz\u0131l\u0131mlar\u0131yla M\u00fccadele G\u00fcn\u00fc ilan edilen bug\u00fcn, bu tuhaf vakalar\u0131 hat\u0131rlamak i\u00e7in bir f\u0131rsat gibi g\u00f6r\u00fcn\u00fcyor.<\/p>\n<p>Bir \u00f6deme terminaline fidye yaz\u0131l\u0131m\u0131 bula\u015ft\u0131rmak kimin akl\u0131na gelirdi? Bundan ne kazan\u0131labilirdi ki? Ger\u00e7ek \u015fu ki, WannaCry yarat\u0131c\u0131lar\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 i\u00e7in belirli hedefler se\u00e7mediler. WannaCry, a\u011fa s\u0131radan ki\u015fisel bilgisayarlar arac\u0131l\u0131\u011f\u0131yla girdi ve SMB protokol\u00fcnde e\u015fi g\u00f6r\u00fclmemi\u015f bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131yla ula\u015fabilece\u011fi her cihaza bula\u015ft\u0131. Bu, fidye yaz\u0131l\u0131m\u0131n\u0131n ayn\u0131 zamanda fidye i\u00e7in yeterince de\u011ferli veri i\u00e7ermeyen, i\u00e7eremeyen, pek \u00e7ok cihaza da bula\u015ft\u0131\u011f\u0131 anlam\u0131na geliyor. Bu cihazlar, ikincil hasarlard\u0131.<\/p>\n<p>Di\u011fer bir\u00e7ok k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m WannaCry\u2019a benzese de, uygun yay\u0131lma mekanizmalar\u0131na sahip de\u011fildir. Ancak bu, di\u011fer \u015fifreleyicilerin yarat\u0131c\u0131lar\u0131n\u0131n hedefleri dikkatle se\u00e7ti\u011fi anlam\u0131na gelmez. Yani, bazen sald\u0131rganlar i\u00e7in finansal kazan\u00e7 sa\u011flamayacak cihazlar da hala fidye yaz\u0131l\u0131mlar\u0131na kurban gidiyor. Fidye yaz\u0131l\u0131m\u0131 bula\u015fm\u0131\u015f en s\u0131ra d\u0131\u015f\u0131 cihazlar\u0131 toplad\u0131\u011f\u0131m\u0131z bu yaz\u0131, bu t\u00fcr sald\u0131r\u0131lar\u0131n kurbanlar\u0131n\u0131n ne kadar rastgele olabilece\u011fini g\u00f6steriyor.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-8223\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2020\/05\/13133643\/Anti-Ransomware_Day_logotype_color_Screen-300x115.png\" alt=\"\" width=\"300\" height=\"115\"><\/p>\n<h2>1. T\u0131bbi ekipmanlar<\/h2>\n<p><a href=\"https:\/\/www.forbes.com\/sites\/thomasbrewster\/2017\/05\/17\/wannacry-ransomware-hit-real-medical-devices\/#210dc26a425c\" target=\"_blank\" rel=\"noopener nofollow\">Forbes\u2019ta yay\u0131nlanan foto\u011fraf<\/a>, bir MR makinesinden elde edilen g\u00f6r\u00fcnt\u00fcn\u00fcn kalitesini art\u0131rmak i\u00e7in kullan\u0131lan ve kontrast maddenin hastaya ak\u0131\u015f\u0131n\u0131 izleyen bir t\u0131bbi cihaz\u0131n ekran\u0131n\u0131 g\u00f6steriyor. Manyetik rezonans g\u00f6r\u00fcnt\u00fcleme kullanan bir hastaya zaman\u0131nda tan\u0131 konmas\u0131n\u0131n ne kadar \u00f6nemli oldu\u011funu vurgulamam\u0131za gerek yok. Peki ya b\u00f6yle bir cihaz, tam prosed\u00fcr\u00fcn ortas\u0131nda sabote edilirse?<\/p>\n<h2>2. Trafik kameralar\u0131<\/h2>\n<p>Siber sald\u0131r\u0131lar, Wanna\u0421ry salg\u0131n\u0131ndan \u00e7ok uzun zaman \u00f6nce trafik ihlallerini kaydeden kameralar\u0131 vurdu. Fakat sald\u0131r\u0131lar genellikle yasa d\u0131\u015f\u0131 eri\u015fim veya sabotajla ilgiliydi. Ancak k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar, Avustralya\u2019n\u0131n Victoria eyaletinde <a href=\"https:\/\/www.itnews.com.au\/news\/vic-police-cancels-590-road-fines-after-wannacry-infection-466202\" target=\"_blank\" rel=\"noopener nofollow\">590 s\u00fcr\u00fcc\u00fcn\u00fcn para cezas\u0131 \u00f6demek zorunda kalmamas\u0131n\u0131 sa\u011flad\u0131<\/a>. ITNews\u2019e g\u00f6re vir\u00fcsl\u00fc kameralar tamamen \u00e7al\u0131\u015f\u0131r durumdayd\u0131. Polis, s\u00f6z konusu delilleri kullanarak para cezas\u0131 toplayamad\u0131, \u00e7\u00fcnk\u00fc hareket ihlalleri g\u00fcvenli\u011fi ihlal edilen cihazlar taraf\u0131ndan kaydedilmi\u015fti.<\/p>\n<h2>3. ATM\u2019ler<\/h2>\n<p>WannaCry <a href=\"https:\/\/www.indiatoday.in\/india\/story\/atms-shut-down-india-wanna-cry-ransomware-attack-977191-2017-05-15\" target=\"_blank\" rel=\"noopener nofollow\">t\u00fcm d\u00fcnyada ATM\u2019leri vurdu<\/a>. \u0130\u015fletim sisteminin yeniden y\u00fcklenmesi vir\u00fcsl\u00fc ATM\u2019leri eski haline geri getirdi; ancak bunu yapmak \u00f6zellikle de vir\u00fcs\u00fcn \u00e7ok fazla cihaza bula\u015fmas\u0131 durumunda olduk\u00e7a fazla zaman al\u0131r. Dahas\u0131, bu cihazlar genellikle ayn\u0131 a\u011fa ba\u011flan\u0131r ve ayn\u0131 korumaya sahiptir. Bu y\u00fczden koruma birinde i\u015fe yaramazsa, hi\u00e7birinde i\u015fe yaram\u0131yor demektir. ATM\u2019lerde depolanan nakit tehlikeye girmese de, bir\u00e7ok banka ATM a\u011flar\u0131n\u0131 yeniden in\u015fa etmek i\u00e7in uzun u\u011fra\u015flar vermek zorunda kald\u0131; itibarlar\u0131n\u0131n g\u00f6rd\u00fc\u011f\u00fc zarardan bahsetmiyoruz bile.<\/p>\n<h2>4. Var\u0131\u015f ve kalk\u0131\u015f ekranlar\u0131<\/h2>\n<p>WannaCry, hava alanlar\u0131nda ve tren istasyonlar\u0131nda bulunan baz\u0131 <a href=\"https:\/\/www.ft.com\/content\/404ad0b2-388f-11e7-821a-6027b8a20f23\" target=\"_blank\" rel=\"noopener nofollow\">var\u0131\u015f ve kalk\u0131\u015f ekranlar\u0131n\u0131 bile etkiledi<\/a>. Burada kimsenin herhangi bir fidye \u00f6demesi s\u00f6z konusu olamaz; bu cihazlarda kesinlikle hi\u00e7bir de\u011ferli bilgi depolanmaz. Bunun yan\u0131 s\u0131ra, b\u00f6yle bir ekran\u0131 eski haline geri d\u00f6nd\u00fcrmek, hem zamana hem de paraya mal olur. Tren istasyonlar\u0131nda ve hava alanlar\u0131nda \u00e7al\u0131\u015fmayan ekranlar, yolculara i\u00e7in de \u00e7ok fazla sorun \u00e7\u0131karabilir. \u00dcstelik yolcular k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar nedeniyle hedeflerine zaman\u0131nda ula\u015famad\u0131\u011f\u0131nda bunun sorumlusu kim olacak?<\/p>\n<h2>5. D\u0131\u015f reklam tabelalar\u0131<\/h2>\n<p><a href=\"https:\/\/swarajyamag.com\/technology\/lesson-from-wannacry-we-should-not-become-slaves-to-tech-or-tech-experts\" target=\"_blank\" rel=\"noopener nofollow\">Reklam panolar\u0131 da fidye yaz\u0131l\u0131mlar\u0131na kurban gitti<\/a>. Yoldan ge\u00e7enlerin alayc\u0131 s\u00f6zlerini ve ekranlar\u0131 onarmak veya de\u011fi\u015ftirmek i\u00e7in g\u00f6nderilenlerin ya\u015fad\u0131klar\u0131 s\u0131k\u0131nt\u0131y\u0131 bir kenara b\u0131rak\u0131rsak esas kurbanlar, \u00f6nemli itibar kayb\u0131na u\u011frayan reklam verenlerdi. Sonu\u00e7ta, m\u00fc\u015fterilerinin videolar\u0131n\u0131 veya reklamlar\u0131n\u0131 g\u00f6stermek i\u00e7in \u00f6deme alm\u0131\u015flard\u0131 ve fidye yaz\u0131l\u0131m\u0131 mesajlar\u0131n\u0131 g\u00f6steren ekranlar m\u00fc\u015fteri s\u00f6zle\u015fmelerini ihlal etmi\u015fti. Bu t\u00fcr problemler, \u015firketlerin etkilenen reklam firmas\u0131n\u0131n hizmetlerini kullanmaya devam etmesini de engelleyebilir.<\/p>\n<h2>6. Otopark \u00f6deme terminalleri<\/h2>\n<p>Otoparka d\u00f6nd\u00fc\u011f\u00fcn\u00fczde \u00f6deme terminalinde bir <a href=\"https:\/\/nltimes.nl\/2017\/05\/15\/dutch-police-call-citizens-report-cyberattacks-following-global-ransomware-attack\" target=\"_blank\" rel=\"noopener nofollow\">fidye talebi g\u00f6rd\u00fc\u011f\u00fcn\u00fcz\u00fc d\u00fc\u015f\u00fcn\u00fcn<\/a>. O anda otopark \u00f6demesini yapamad\u0131\u011f\u0131n\u0131z i\u00e7in garajdan \u00e7\u0131kmaya \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131zda \u00e7\u0131k\u0131\u015f kap\u0131s\u0131n\u0131n kolu a\u00e7\u0131lmayacakt\u0131r. Yine de buradaki esas kurban elbette otopark i\u015fletmecisidir. O s\u0131rada otoparka park edemeyen veya tesisi zaman\u0131nda terk edemeyen herkes \u015firkete sinirlenecektir.<\/p>\n<h2>7. Bilet makineleri<\/h2>\n<p>Bilet sat\u0131\u015f makinelerine de vir\u00fcs bula\u015ft\u0131. \u00d6rne\u011fin, San Francisco\u2019da, BART metro sisteminin bilet makineleri, <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/mamba-hddcryptor-ransomware\/2691\/\" target=\"_blank\" rel=\"noopener\">Mamba fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131s\u0131 nedeniyle iki g\u00fcn boyunca bozuk kald\u0131<\/a>. Sald\u0131rganlar h\u0131zl\u0131 transit operat\u00f6r\u00fcnden 73.000 dolar talep etti. Ancak, ma\u011fdur taraf, hakl\u0131 bir \u015fekilde, fidye \u00f6demeyi reddetti ve sonu\u00e7 olarak San Francisco Belediye Ta\u015f\u0131mac\u0131l\u0131k Ajans\u0131, makineler onar\u0131lana kadar metro biletlerini \u00fccretsiz olarak vermek zorunda kald\u0131.<\/p>\n<h2>Pratik \u00e7\u0131kar\u0131mlar<\/h2>\n<p>Cihazlara istenmedi\u011fi halde fidye yaz\u0131l\u0131mlar\u0131 bula\u015fmas\u0131n\u0131n sebebi, operat\u00f6rlerin g\u00fcncel koruyucu \u00e7\u00f6z\u00fcmler kurmaya ve i\u015fletim sistemlerini zaman\u0131nda g\u00fcncellemeye gerek duymamas\u0131yd\u0131. Pratikte de g\u00f6rd\u00fc\u011f\u00fcm\u00fcz gibi, bir\u00e7ok insan bu t\u00fcr ekipmanlar\u0131n eninde sonunda birer bilgisayar oldu\u011funu, bir t\u00fcr Windows \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131 ve i\u015fletim sistemi ailelerinin g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 ta\u015f\u0131d\u0131\u011f\u0131n\u0131 bilmiyor.<br>\nBu nedenle, \u015firketiniz bu t\u00fcr bir ekipman kullan\u0131yorsa, size a\u015fa\u011f\u0131daki \u00f6nerilerde bulunabiliriz:<\/p>\n<ul>\n<li>Bu makineleri ayr\u0131 bir alt a\u011fa ta\u015f\u0131yarak di\u011fer bilgisayarlardan yal\u0131t\u0131n;<\/li>\n<li>\u0130\u015fletim sistemi yamalar\u0131n\u0131 zaman\u0131nda y\u00fckleyin;<\/li>\n<li>Uygun koruyucu \u00e7\u00f6z\u00fcmler kurun.<\/li>\n<\/ul>\n<p>\u00dcr\u00fcn grubumuzda bu t\u00fcr cihazlara \u00f6zel koruma \u00e7\u00f6z\u00fcmleri de yer al\u0131yor: <a href=\"https:\/\/www.kaspersky.com.tr\/enterprise-security\/embedded-systems\" target=\"_blank\" rel=\"noopener\">Kaspersky Embedded Systems Security<\/a>, ATM\u2019lerde, \u00f6deme terminallerinde ve di\u011fer benzer cihazlarda s\u0131kl\u0131kla bulunan d\u00fc\u015f\u00fck g\u00fc\u00e7l\u00fc g\u00f6m\u00fcl\u00fc bilgisayarlar\u0131 bile korur.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fidye yaz\u0131l\u0131mlar\u0131, birincil hedeflerine ek olarak baz\u0131 ola\u011fan d\u0131\u015f\u0131 cihazlar\u0131 da etkiledi.<\/p>\n","protected":false},"author":2593,"featured_media":8222,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194],"tags":[591,935,1227],"class_list":{"0":"post-8221","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"tag-fidye-yazilimi","10":"tag-sifreleyiciler","11":"tag-wannacry"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/ransomware-collateral-damage\/8221\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/ransomware-collateral-damage\/21255\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/ransomware-collateral-damage\/16720\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/ransomware-collateral-damage\/8281\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/ransomware-collateral-damage\/22250\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/ransomware-collateral-damage\/20439\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/ransomware-collateral-damage\/18706\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/ransomware-collateral-damage\/22669\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/ransomware-collateral-damage\/21597\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/ransomware-collateral-damage\/28382\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/ransomware-collateral-damage\/35330\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/ransomware-collateral-damage\/14893\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/ransomware-collateral-damage\/15178\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/ransomware-collateral-damage\/13448\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/ransomware-collateral-damage\/23969\/"},{"hreflang":"zh","url":"https:\/\/www.kaspersky.com.cn\/blog\/ransomware-collateral-damage\/11455\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/ransomware-collateral-damage\/28285\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/ransomware-collateral-damage\/25415\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/ransomware-collateral-damage\/22281\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/ransomware-collateral-damage\/27557\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/ransomware-collateral-damage\/27393\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/wannacry\/","name":"WannaCry"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/8221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2593"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=8221"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/8221\/revisions"}],"predecessor-version":[{"id":8224,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/8221\/revisions\/8224"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/8222"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=8221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=8221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=8221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}