![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/yazi-ici-gorsel-1-1200x464.jpg\")
Sunucular da dahil olmak \u00fczere a\u011fdaki t\u00fcm dosyalar\u0131 ve belgeleri tek bir bilgisayardan \u015fifreleyebilen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlara Ransomware denir.<\/p>\n\n\n\n
Ransomware bilgisayar\u0131n\u0131za bula\u015ft\u0131ktan sonra, siber su\u00e7lular taraf\u0131ndan genellikle kripto para birimi cinsinden bir fidye \u00f6demeniz istenir. Kar\u015f\u0131l\u0131\u011f\u0131nda da verilerinize kavu\u015fman\u0131z vadedilir.<\/p>\n\n\n\n
Fidye yaz\u0131l\u0131mlar konusundaki en tats\u0131z noktalardan biri su\u00e7lular\u0131n, i\u015fletmelerin kurumsal verilerini rehin tuttuklar\u0131n\u0131 a\u00e7\u0131k bir \u015fekilde duyurmalar\u0131d\u0131r.<\/p>\n\n\n\n
Ayr\u0131ca fidye \u00f6deyerek t\u00fcm dosyalar\u0131n \u015fifresinin \u00e7\u00f6z\u00fclmesini sa\u011flasan\u0131z bile, su\u00e7lular\u0131n verilerinizin kopyalar\u0131n\u0131 saklay\u0131p saklamad\u0131\u011f\u0131ndan emin olman\u0131z zordur. Yani bilgileriniz daha sonra doland\u0131r\u0131c\u0131l\u0131k veya kimlik av\u0131 giri\u015fimlerinde kullan\u0131labilir. <\/p>\n\n\n\n
![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/yazi-ici-gorsel-2-2-1200x464.jpg\")
2020’ye dair fidye yaz\u0131l\u0131m\u0131 istatistiklerini g\u00f6rd\u00fckten sonra pek \u00e7ok \u015firket siber g\u00fcvenlik plan\u0131n\u0131 revize etmeye \u00f6ncelik verebilir:<\/p>\n\n\n\n
- Microsoft’un Eyl\u00fcl 2020’de yay\u0131nlad\u0131\u011f\u0131 Dijital Savunma Raporu<\/a> fidye yaz\u0131l\u0131m\u0131 bula\u015fmalar\u0131n\u0131n y\u00fczde 96.88’inin hedefine ba\u015far\u0131l\u0131 bir \u015fekilde s\u0131zmas\u0131n\u0131n d\u00f6rt saatten az s\u00fcrd\u00fc\u011f\u00fcn\u00fc g\u00f6steriyor. Raporda k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n, bir \u015firketin t\u00fcm sistemini 45 dakikan\u0131n alt\u0131nda ele ge\u00e7irebilece\u011fi vurgulan\u0131yor.<\/li><\/ul>\n\n\n\n
- Kaybedilen f\u0131rsatlar ve azalan \u00fcretim veya i\u015fletme verimlili\u011fi dahil olmak \u00fczere kesinti s\u00fcresinden kaynaklanan maliyetler, \u00f6denen fidye kadar b\u00fcy\u00fck olabiliyor. 2020’de ortalama kesinti maliyeti 283.000 dolard\u0131 ve bu 2019’a g\u00f6re neredeyse y\u00fczde 100’l\u00fck art\u0131\u015f anlam\u0131na geliyor (Purplesec<\/a>).<\/li><\/ul>\n\n\n\n
- Bir fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131s\u0131ndan kurtulman\u0131n ortalama maliyeti, fidye \u00f6deyen \u015firketler i\u00e7in 1.450.000 $ iken, fidye \u00f6demeden kurtulmaya \u00e7al\u0131\u015fanlar\u0131n 730.000 $ harcad\u0131\u011f\u0131 biliniyor (Sophos<\/a>).<\/li><\/ul>\n\n\n\n
- Fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131 ne yaz\u0131k ki yaln\u0131zca maddi zarara neden olmuyor, sald\u0131r\u0131lar vatanda\u015flar\u0131n g\u00fcnl\u00fck ya\u015famlar\u0131 \u00fczerinde de b\u00fcy\u00fck etki yaratabiliyor: Yaln\u0131zca Amerika Birle\u015fik Devletleri’nde 113 devlet kurumunun, 1.233 \u00fcniversitenin ve 764 sa\u011fl\u0131k hizmeti sa\u011flay\u0131c\u0131s\u0131n\u0131n ge\u00e7ti\u011fimiz y\u0131l fidye yaz\u0131l\u0131mlar\u0131 nedeniyle ge\u00e7ici olarak \u00e7al\u0131\u015fmalar\u0131n\u0131 durdurmak zorunda kalmas\u0131 olduk\u00e7a d\u00fc\u015f\u00fcnd\u00fcr\u00fcc\u00fc (Emsisoft<\/a>). <\/li><\/ul>\n\n\n\n
<\/p>\n\n\n\n
Ransomware T\u00fcrleri<\/h2>\n\n\n\n
![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/yazi-ici-gorsel-4-1200x464.jpg\")
HASSAS DOSYALARI \u0130NTERNET \u00dcZER\u0130NDEN YAYINLAMAKLA TEHD\u0130T EDEN F\u0130DYE YAZILIMI T\u00dcRLER\u0130 LEAKWARE VEYA DOXWARE OLARAK ADLANDIRILIR.<\/figcaption><\/figure><\/div>\n\n\n\n Baz\u0131 fidye yaz\u0131l\u0131m\u0131 t\u00fcrleri yaln\u0131zca bir kullan\u0131c\u0131n\u0131n<\/span> dosyalar\u0131n\u0131 \u015fifre korumal\u0131 bir \u00f6deme duvar\u0131n\u0131n arkas\u0131na kilitleyerek \u00e7al\u0131\u015f\u0131r ve parola kar\u015f\u0131l\u0131\u011f\u0131nda \u00f6deme talep eder. Dosyalar\u0131 do\u011frudan etkilemedi\u011fi i\u00e7in bu t\u00fcr fidye yaz\u0131l\u0131mlar\u0131n\u0131n kald\u0131r\u0131lmas\u0131 olduk\u00e7a kolayd\u0131r.<\/p>\n\n\n\n
Ancak, daha geli\u015fmi\u015f fidye yaz\u0131l\u0131m\u0131 t\u00fcrleri, dosyalar\u0131n kendilerini \u015fifreler ve anahtar\u0131 bilmeden eri\u015filmeleri imkans\u0131z hale gelir.<\/p>\n\n\n\n
Leakware<\/strong> veya Doxware <\/strong>olarak da bilinen baz\u0131 fidye yaz\u0131l\u0131m\u0131 t\u00fcrleri ise \u015firketleri; hassas dosyalar\u0131 internet \u00fczerinden yay\u0131nlamakla tehdit eder. <\/p>\n\n\n\n
Say\u0131lar\u0131 s\u00fcrekli artan fidye yaz\u0131l\u0131mlar\u0131n\u0131 takip etmek zor olsa da 2020’deki veri ihlallerinde en \u00e7ok rastlanan Ransomware t\u00fcrleri \u015funlard\u0131r (Coveware<\/a>):<\/p>\n\n\n\n
- REvil (Sodinokibi)<\/strong>: Tespit edilmesi ger\u00e7ekten \u00e7ok zor olan bir fidye yaz\u0131l\u0131m\u0131d\u0131r.<\/li>
- Labirent<\/strong>: Verilerinizi satmakla tehdit ederek veri h\u0131rs\u0131zl\u0131\u011f\u0131 yapan bir fidye yaz\u0131l\u0131m\u0131d\u0131r.<\/li>
- Phobos<\/strong>: \u00dcretkenlik belgelerini kilitleyen fidye yaz\u0131l\u0131m\u0131 olarak bilinir.<\/li><\/ul>\n\n\n\n
Ransomware Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n\n\n\n
![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/yazi-ici-gorsel-3-1200x464.jpg\")
S\u0130BER SU\u00c7LULAR \u00d6DEMEN\u0130N GENELL\u0130KLE B\u0130TCO\u0130N G\u0130B\u0130 \u0130ZLENMES\u0130 ZOR OLAN D\u0130J\u0130TAL PARA B\u0130R\u0130MLER\u0130 \u0130LE YAPILMASINI \u0130STER.<\/figcaption><\/figure><\/div>\n\n\n\n K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m tasarlarken, sald\u0131rganlar bir genel anahtar olu\u015fturur ve bunu fidye yaz\u0131l\u0131m\u0131na yerle\u015ftirir. Fidye yaz\u0131l\u0131m\u0131 bir cihaza eri\u015fim sa\u011flad\u0131\u011f\u0131nda, rastgele olu\u015fturulmu\u015f bir anahtar ile kurban\u0131n dosyalar\u0131n\u0131 \u015fifreler. Fidye yaz\u0131l\u0131m\u0131, bu anahtar\u0131 genel anahtar\u0131 kullanarak \u015fifreler. Sald\u0131rgan, rastgele olu\u015fturulan anahtar\u0131n \u015fifresini \u00e7\u00f6zmek i\u00e7in genel anahtar\u0131 kullanabilir ve b\u00f6ylece dosyalar\u0131n \u015fifresi \u00e7\u00f6z\u00fcl\u00fcr ve kurban tekrar sald\u0131r\u0131ya u\u011frarsa ayn\u0131 anahtar\u0131n kullan\u0131lmamas\u0131 sa\u011flan\u0131r.<\/p>\n\n\n\n
![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/539-Converted-02-730x1200.png\")
<\/figure><\/div>\n\n\n\nK\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m dosyalar\u0131 \u015fifreledikten sonra, sald\u0131rgan kurbana fidye mesaj\u0131n\u0131 g\u00f6ndererek \u00f6deme talep eder ve \u00f6demenin nereye g\u00f6nderilmesi gerekti\u011fine dair talimatlar verir. \u00d6demenin genellikle Bitcoin gibi izlenmesi zor olan dijital para birimleri ile yap\u0131lmas\u0131 istenir.<\/p>\n\n\n\n
Sald\u0131rgan fidye mesaj\u0131n\u0131n, polis ya da h\u00fck\u00fcmet taraf\u0131ndan g\u00f6nderildi\u011fi alg\u0131s\u0131n\u0131 yaratabilir ve para cezas\u0131 talep eden sahte bir h\u00fck\u00fcmet uyar\u0131s\u0131 \u015feklinde mesaj\u0131 d\u00fczenlemi\u015f olabilir. <\/p>\n\n\n\n
Ayr\u0131ca, fidye mesajlar\u0131 kullan\u0131c\u0131y\u0131 yard\u0131m almaktan cayd\u0131ran pornografik veya hassas resimler de i\u00e7erebilir. Kullan\u0131c\u0131 belirtilen s\u00fcrede \u00f6deme yapmazsa, mesaj dosyalar\u0131n\u0131n kal\u0131c\u0131 olarak \u015fifrelenmesi, silinmesi ya da kamuya a\u00e7\u0131k hale getirilmesi ile tehdit edilebilir. <\/p>\n\n\n\n
\u00d6deme yap\u0131ld\u0131ktan sonra, sald\u0131rgan kullan\u0131c\u0131ya \u015fifre \u00e7\u00f6zme anahtar\u0131n\u0131 g\u00f6nderecektir ancak bu da elbette ki her zaman garanti edilemez!<\/p>\n\n\n\n
Fidye Yaz\u0131l\u0131m\u0131 Nas\u0131l Bula\u015f\u0131r?<\/h2>\n\n\n\n
Fidye yaz\u0131l\u0131m\u0131n\u0131n bula\u015fmas\u0131nda en s\u0131k rastlanan \u00fc\u00e7 y\u00f6ntem; e-postalar, yaz\u0131l\u0131m a\u00e7\u0131klar\u0131 ve sunuculardaki g\u00fcvenlik zaaflar\u0131d\u0131r. <\/p>\n\n\n\n
![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/3843870-02-1200x565.jpg\")
<\/a>2020’de i\u015fletmelere yap\u0131lan t\u00fcm fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131n\u0131n y\u00fczde 55’i, 100’den az \u00e7al\u0131\u015fan\u0131 olan i\u015fletmelere y\u00f6nelikti (Coveware<\/a>).<\/figcaption><\/figure><\/div>\n\n\n\n Nadiren yeterli korumaya sahip olduklar\u0131ndan, k\u00fc\u00e7\u00fck i\u015fletmeler genellikle sunucu a\u00e7\u0131klar\u0131 nedeniyle Ransomware sald\u0131r\u0131lar\u0131 i\u00e7in hedef haline gelir. \u0130\u015fletmelerin boyutu artt\u0131k\u00e7a, etkili sald\u0131r\u0131 y\u00f6ntemi olarak kimlik av\u0131 e-postalar\u0131n\u0131n kullan\u0131lmaya \u00e7al\u0131\u015f\u0131ld\u0131\u011f\u0131 s\u00f6ylenebilir.<\/p>\n\n\n\n
Fidye yaz\u0131l\u0131m\u0131 i\u00e7eren kimlik av\u0131 e-postalar\u0131 genellikle vir\u00fcsl\u00fc bir dosya bar\u0131nd\u0131r\u0131r. Masum g\u00f6r\u00fcnen bir e-posta ekine t\u0131klayan kullan\u0131c\u0131n\u0131n indirdi\u011fi k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m a\u011f\u0131 \u015fifreleyebilir. Norton Security’nin arkas\u0131ndaki \u015firket olan Symantec’e g\u00f6re, en yayg\u0131n fidye yaz\u0131l\u0131m\u0131 dosya uzant\u0131s\u0131 Microsoft Word’\u00fcn uzant\u0131lar\u0131 olan .DOC ve .DOT’tur.<\/p>\n\n\n\n
Ayr\u0131ca, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, g\u00fcvenli olmayan web sitelerinden veya indirme sayfalar\u0131ndan da gelebilir. Hatta vir\u00fcsl\u00fc USB s\u00fcr\u00fcc\u00fcler gibi donan\u0131mlar yoluyla da yay\u0131labilir.<\/p>\n\n\n\n
\u00c7ok daha b\u00fcy\u00fck fidye yaz\u0131l\u0131mlar\u0131, eri\u015fim elde etmek i\u00e7in yaz\u0131l\u0131m istismarlar\u0131n\u0131 ve kusurlar\u0131n\u0131, k\u0131r\u0131lm\u0131\u015f parolalar\u0131 ve di\u011fer g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kullan\u0131r: \u0130nternete ba\u011fl\u0131 sunucular\u0131nda veya uzak masa\u00fcst\u00fc oturum a\u00e7ma i\u015flemlerinde zay\u0131f noktalar\u0131 bulunan kurulu\u015flar\u0131 hedefler. <\/p>\n\n\n\n
Sald\u0131rganlar, sisteminizdeki her \u015feyi \u015fifrelemeden \u00f6nce, m\u00fcmk\u00fcn oldu\u011funca kontrol alt\u0131na alana kadar a\u011fda gizlice avlan\u0131r.<\/p>\n\n\n\n
\u00c7o\u011fu fidye yaz\u0131l\u0131m\u0131n\u0131n bir ki\u015fi taraf\u0131ndan de\u011fil belirli k\u00f6t\u00fc niyetli gruplar taraf\u0131ndan geli\u015ftirilip da\u011f\u0131t\u0131ld\u0131\u011f\u0131 biliniyor. Microsoft Dijital Savunma Raporu’na g\u00f6re bu gruplar\u0131n yar\u0131s\u0131 Rusya kaynakl\u0131. \u0130ran, \u00c7in ve Kuzey Kore ise Rusya’dan sonra fidye yaz\u0131l\u0131m\u0131 gruplar\u0131n\u0131n en yayg\u0131n oldu\u011fu yerler. En \u00e7ok hedeflenen \u00fclke ise ABD.<\/p>\n\n\n\n
Asl\u0131nda fidye yaz\u0131l\u0131mlar\u0131n\u0131n neden oldu\u011fu veri ihlalleri, yaln\u0131zca bir kurulu\u015fun mevcut i\u015fleyi\u015fini de\u011fil, ayn\u0131 zamanda \u00e7al\u0131\u015fanlar\u0131n ki\u015fisel bilgilerinin gizlili\u011fini de tehlikeye at\u0131yor. Bu nedenle de her \u015firketin sa\u011flam bir siber savunma stratejisi olmas\u0131 art\u0131k en temel ihtiya\u00e7lardan biri. Bunun i\u00e7in de Ransomware’den korunma yollar\u0131 aras\u0131nda hangi se\u00e7eneklerin oldu\u011funa g\u00f6z atmakta yarar var:<\/p>\n\n\n\n
Fidye Yaz\u0131l\u0131m\u0131ndan Nas\u0131l Korunulur?<\/h2>\n\n\n\n
![\"ransomware](\"https:\/\/www.turhost.com/blog\/wp-content\/uploads\/2020\/12\/yazi-ici-gorsel-5-1200x464.jpg\")
Acronis True Image gibi fidye yaz\u0131l\u0131m\u0131 \u00f6nleme ara\u00e7lar\u0131n\u0131n \u00f6nemli say\u0131da sald\u0131r\u0131y\u0131 durdurdu\u011fu bilnmektedir.<\/figcaption><\/figure><\/div>\n\n\n\n 2020’de, fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131n\u0131n y\u00fczde 73’\u00fcn\u00fcn amac\u0131na ula\u015ft\u0131\u011f\u0131n\u0131, sald\u0131r\u0131lar\u0131n y\u00fczde 24’\u00fcn\u00fcn ise herhangi bir veriyi \u015fifrelemeden ele ge\u00e7irildi\u011fini (Sophos<\/a>), biliyor musunuz? Sald\u0131r\u0131lar\u0131n bu denli ba\u015far\u0131l\u0131 oldu\u011funu bilmek bile asl\u0131nda verilerinin Ransomware yaz\u0131l\u0131mlar taraf\u0131ndan rehin al\u0131nmas\u0131n\u0131 engellemek isteyen \u015firketlerin ad\u0131m atmas\u0131 i\u00e7in yeterli.<\/p>\n\n\n\n
Ransomware bula\u015ft\u0131ktan sonra ma\u011fdurlar i\u00e7in iki se\u00e7enek s\u00f6z konusu: Ya fidye yaz\u0131l\u0131m\u0131n\u0131n ard\u0131ndaki su\u00e7lulara fidye \u00f6deyerek \u015fifrelenmi\u015f verilerine yeniden eri\u015fim kazanacaklar ya da varsa yedeklerden geri y\u00fcklemeyi se\u00e7ecekler. Peki bu a\u015famalardan \u00f6nce uygulanabilecek bir fidye yaz\u0131l\u0131m\u0131n\u0131 \u00f6nleme ve kald\u0131rma yollar\u0131 var m\u0131d\u0131r?<\/p>\n\n\n\n
Cihazlar\u0131n\u0131z\u0131n etraf\u0131nda sa\u011flam bir g\u00fcvenlik \u00e7er\u00e7evesi olu\u015fturmak i\u00e7in g\u00fcvenlik duvarlar\u0131 (firewall<\/a>), izleme yaz\u0131l\u0131m\u0131 (monitoring software), antivir\u00fcs yaz\u0131l\u0131m\u0131 ve silicon root of trust gibi g\u00fcvenlik uygulamalar\u0131 yoluyla fidye yaz\u0131l\u0131mlar\u0131n\u0131 \u00f6nlemek m\u00fcmk\u00fcnd\u00fcr.<\/p>\n\n\n\n
Fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131na kar\u015f\u0131 i\u015fletmelerin, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m taraf\u0131ndan de\u011fi\u015ftirilen ya da eri\u015filmez hale getirilen verilerini kurtarabilmeleri i\u00e7in yedeklemeye \u00f6nem vermeleri en kurtar\u0131c\u0131 \u00f6nlem say\u0131labilir. <\/p>\n\n\n\n
- Labirent<\/strong>: Verilerinizi satmakla tehdit ederek veri h\u0131rs\u0131zl\u0131\u011f\u0131 yapan bir fidye yaz\u0131l\u0131m\u0131d\u0131r.<\/li>
- REvil (Sodinokibi)<\/strong>: Tespit edilmesi ger\u00e7ekten \u00e7ok zor olan bir fidye yaz\u0131l\u0131m\u0131d\u0131r.<\/li>
- Fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131 ne yaz\u0131k ki yaln\u0131zca maddi zarara neden olmuyor, sald\u0131r\u0131lar vatanda\u015flar\u0131n g\u00fcnl\u00fck ya\u015famlar\u0131 \u00fczerinde de b\u00fcy\u00fck etki yaratabiliyor: Yaln\u0131zca Amerika Birle\u015fik Devletleri’nde 113 devlet kurumunun, 1.233 \u00fcniversitenin ve 764 sa\u011fl\u0131k hizmeti sa\u011flay\u0131c\u0131s\u0131n\u0131n ge\u00e7ti\u011fimiz y\u0131l fidye yaz\u0131l\u0131mlar\u0131 nedeniyle ge\u00e7ici olarak \u00e7al\u0131\u015fmalar\u0131n\u0131 durdurmak zorunda kalmas\u0131 olduk\u00e7a d\u00fc\u015f\u00fcnd\u00fcr\u00fcc\u00fc (Emsisoft<\/a>). <\/li><\/ul>\n\n\n\n
- Bir fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131s\u0131ndan kurtulman\u0131n ortalama maliyeti, fidye \u00f6deyen \u015firketler i\u00e7in 1.450.000 $ iken, fidye \u00f6demeden kurtulmaya \u00e7al\u0131\u015fanlar\u0131n 730.000 $ harcad\u0131\u011f\u0131 biliniyor (Sophos<\/a>).<\/li><\/ul>\n\n\n\n
- Kaybedilen f\u0131rsatlar ve azalan \u00fcretim veya i\u015fletme verimlili\u011fi dahil olmak \u00fczere kesinti s\u00fcresinden kaynaklanan maliyetler, \u00f6denen fidye kadar b\u00fcy\u00fck olabiliyor. 2020’de ortalama kesinti maliyeti 283.000 dolard\u0131 ve bu 2019’a g\u00f6re neredeyse y\u00fczde 100’l\u00fck art\u0131\u015f anlam\u0131na geliyor (Purplesec<\/a>).<\/li><\/ul>\n\n\n\n