Ge\u00e7ti\u011fimiz ay #Wannacry<\/strong> sald\u0131r\u0131lar\u0131 ile bir\u00e7ok \u00fclkenin sa\u011fl\u0131k, finans ve enerji gibi \u00f6nemli sekt\u00f6rleri kritik duruma gelmi\u015f ve b\u00fcy\u00fck zararlara u\u011fram\u0131\u015ft\u0131. T\u00fcrkiye saati ile d\u00fcn ak\u015fam \u00fcst\u00fc (27 Haziran 2017 itibariyle) yeni bir fidyecilik zararl\u0131 yaz\u0131l\u0131m\u0131 kar\u015f\u0131m\u0131za \u00e7\u0131kt\u0131. Yap\u0131lan siber sald\u0131r\u0131 k\u00fcresel olarak bir\u00e7ok kurumu tehdit etmeye ve b\u00fcy\u00fck zararlara yol a\u00e7maya ba\u015flad\u0131.<\/p>\n G\u00f6r\u00fcnen o ki, ger\u00e7ekle\u015ftirilen siber sald\u0131r\u0131 #WannaCry\u2019a g\u00f6re daha tehlikeli ve daha profesyonelce d\u00fc\u015f\u00fcn\u00fclm\u00fc\u015f.<\/strong><\/p>\n \u00d6zellikle de Rusya ve Ukrayna\u2019da etkili olan sald\u0131r\u0131 i\u00e7in analistler \u00e7\u00f6z\u00fcm yollar\u0131 aramaya ve sald\u0131r\u0131lara kar\u015f\u0131 korunmak i\u00e7in \u00f6nerilerde bulunmaya devam ediyorlar.<\/p>\n Son birka\u00e7 g\u00fcnd\u00fcr t\u00fcm d\u00fcnyay\u0131 tehdit eden ve b\u00fcy\u00fck zararlara yol a\u00e7an Petya fidyecilik sald\u0131r\u0131s\u0131 i\u00e7in a\u015fa\u011f\u0131daki gibi \u00e7\u00f6z\u00fcm \u00f6nerilerimizi ve Petya wormu hakk\u0131ndaki tespitlerimizi sizlerle payla\u015f\u0131yoruz.<\/p>\n \u201cTheShadowBrokers\u201d<\/strong>\u00a0isimli hacker grubu, Nisan ay\u0131nda National Security Agency\u2019in (NSA) FUZZBUNCH isimli exploit kitini s\u0131zd\u0131rd\u0131. S\u0131zd\u0131r\u0131lan bu zafiyet kiti i\u00e7erisinde bir \u00e7ok exploit bulunmaktayd\u0131. \u0130lgili exploitlerden EternalBlue exploiti yine exploit kiti i\u00e7erisinde bulunan DOUBLEPULSAR payload\u0131 ile birlikte kullan\u0131ld\u0131\u011f\u0131nda Windows i\u015fletim sistemlerindeki SMB servisinin zafiyetini kullanarak y\u00f6netici haklar\u0131nda komut \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131na olanak sa\u011flamaktad\u0131r.<\/p>\n MS17-010 (CVE-\u200e2017-0144) kodu ile isimlendirilen bu zafiyet 27 Haziran 2017 itibariyle Petya(Win32\/Diskcoder.Petya.C) adl\u0131 bir fidye yaz\u0131l\u0131m\u0131 taraf\u0131ndan kullan\u0131lmaya ba\u015fland\u0131.<\/p>\n Ayn\u0131 zamanda, fidye yaz\u0131l\u0131m\u0131 herhangi bir kullan\u0131c\u0131 etkile\u015fimi gerektirmeksizin bula\u015ft\u0131\u011f\u0131 a\u011fda ayn\u0131 kullan\u0131c\u0131 ad\u0131 ve parola bilgisini kullanan sistemleri tarayarak bulmakta ve tespit etti\u011fi sistemleri de etkilemektedir.<\/p>\n Wannacry zararl\u0131s\u0131n\u0131n yay\u0131lmas\u0131nda ilk \u00e7\u0131k\u0131\u015f noktas\u0131 olarak SMB servisini etkileyen Windows a\u00e7\u0131kl\u0131\u011f\u0131 \u00f6n plana \u00e7\u0131km\u0131\u015ft\u0131, Petya zararl\u0131 yaz\u0131l\u0131m\u0131nda ise birden fazla ilk yay\u0131l\u0131m vekt\u00f6r\u00fc s\u00f6z konusu. Bunlardan bir tanesi \u00f6zellikle bahse de\u011fer, Ukrayna merkezli bir yaz\u0131l\u0131m firmas\u0131n\u0131n sistemlerinin hacklendi\u011fi ve yaz\u0131l\u0131m firmas\u0131n\u0131n g\u00fcncelleme dosyalar\u0131 \u00fczerinden sistemlere bula\u015ft\u0131\u011f\u0131 tespit edilmi\u015f. \u201cME Doc\u201d (My Electronic Document) adl\u0131 yaz\u0131l\u0131m\u0131n kullan\u0131c\u0131lar\u0131 22 Haziran ve sonras\u0131 g\u00fcncelleme ge\u00e7tiyse do\u011frudan internete a\u00e7\u0131k herhangi bir zafiyet olmasa da sistemlere bula\u015fabiliyor ve yerel a\u011fda bula\u015ft\u0131\u011f\u0131 sistem \u00fczerindeki a\u00e7\u0131k parola bilgilerini alarak di\u011fer sistemlere atlama yapabiliyor.<\/p>\n Petya wormu a\u011f\u0131rl\u0131kl\u0131 Windows SMB (v1) protokol\u00fcn\u00fc kullanarak yay\u0131lmaktad\u0131r. NSA taraf\u0131ndan bu a\u00e7\u0131kl\u0131\u011f\u0131 bar\u0131nd\u0131ran sistemlere s\u0131zmak i\u00e7in kullan\u0131lan bir suistimal arac\u0131 (exploit), NSA\u2019den bu bilgiler s\u0131zd\u0131r\u0131ld\u0131\u011f\u0131nda internet \u00fczerinden yay\u0131nlanmaya ba\u015flad\u0131. A\u00e7\u0131klanan belgeler ve bilgiler \u0131\u015f\u0131\u011f\u0131nda biri ya da birileri taraf\u0131ndan bu zafiyeti istismar eden fidye zararl\u0131 yaz\u0131l\u0131m\u0131 geli\u015ftirilerek internete sunuldu.<\/p>\n Windows kullan\u0131c\u0131 ad\u0131 ve parola bilgilerini kullanarak yerel a\u011flarda yay\u0131labildi\u011fi de bir \u00e7ok g\u00fcvenlik uzman\u0131 taraf\u0131ndan yap\u0131lan analizler sonucu ortaya \u00e7\u0131kt\u0131.<\/p>\n Zararl\u0131 yaz\u0131l\u0131m\u0131 incelemek isteyenler a\u015fa\u011f\u0131daki adresten \u00f6rnek dosyalar\u0131 bulabilirler.<\/strong><\/p>\n \u0130ndir:\u00a0https:\/\/yadi.sk\/d\/QT0l_AYg3KXCqc<\/a><\/p>\n Not:<\/strong>\u00a0Dosyalar\u0131n parolas\u0131 \u201cvirus\u201d t\u00fcr.<\/p>\n Siber Tehdit \u0130stihbarat\u0131 destekli bir SIEM \u00e7\u00f6z\u00fcm\u00fc kullan\u0131yorsan\u0131z a\u015fa\u011f\u0131da belirtilen IP adreslerine eri\u015fim olup olmad\u0131\u011f\u0131n\u0131 ge\u00e7mi\u015fe y\u00f6nelik kontrol edebilirsiniz.<\/p>\n Petya zararl\u0131s\u0131n\u0131n kulland\u0131\u011f\u0131 bilinen IP adresleri:<\/strong><\/p>\n Tehdit g\u00f6zetleme sistemi olarak Snort veya Suricata veya bunlar\u0131n kural setini destekleyen bir sald\u0131r\u0131 tespit ve engelleme sistemi (IDS\/IPS) kullan\u0131yorsan\u0131z Positive Tech taraf\u0131ndan yay\u0131nlanm\u0131\u015f a\u015fa\u011f\u0131daki imzalar\u0131 sisteminize y\u00fckleyebilirsiniz.<\/p>\n alert tcp any any -> $HOME_NET 445 (msg: \u201c[PT Open] Unimplemented Trans2 Sub-Command code. Possible ETERNALBLUE (WannaCry, Petya) tool\u201d; flow: to_server, established; content: \u201c|FF|SMB2|00 00 00 00|\u201d; depth: 9; offset: 4; byte_test: 2, >, 0x0008, 52, relative, little; pcre: \u201c\/\\xFFSMB2\\x00\\x00\\x00\\x00.{52}(?:\\x04|\\x09|\\x0A|\\x0B|\\x0C|\\x0E|\\x11)\\x00\/\u201d; flowbits: set, SMB.Trans2.SubCommand.Unimplemented; reference: url, msdn.microsoft.com\/en-us\/library\/ee441654.aspx; classtype: attempted-admin; sid: 10001254; rev: 2;)<\/em><\/p>\n alert tcp any any -> $HOME_NET 445 (msg: \u201c[PT Open] ETERNALBLUE (WannaCry, Petya) SMB MS Windows RCE\u201d; flow: to_server, established; content: \u201c|FF|SMB3|00 00 00 00|\u201d; depth: 9; offset: 4; flowbits: isset, SMB.Trans2.SubCommand.Unimplemented.Code0E; threshold: type limit, track by_src, seconds 60, count 1; reference: cve, 2017-0144; classtype: attempted-admin; sid: 10001255; rev: 3;)<\/em><\/p>\n alert tcp any any -> $HOME_NET 445 (msg: \u201c[PT Open] Trans2 Sub-Command 0x0E. Likely ETERNALBLUE (WannaCry, Petya) tool\u201d; flow: to_server, established; content: \u201c|FF|SMB2|00 00 00 00|\u201d; depth: 9; offset: 4; content: \u201c|0E 00|\u201d; distance: 52; within: 2; flowbits: set, SMB.Trans2.SubCommand.Unimplemented.Code0E; reference: url, msdn.microsoft.com\/en-us\/library\/ee441654.aspx; classtype: attempted-admin; sid: 10001256; rev: 2;)<\/em><\/p>\n alert tcp any any -> $HOME_NET 445 (msg: \u201c[PT Open] Petya ransomware perfc.dat component\u201d; flow: to_server, established, no_stream; content: \u201c|fe 53 4d 42|\u201d; offset: 4; depth: 4; content: \u201c|05 00|\u201d; offset: 16; depth: 2; byte_jump: 2, 112, little, from_beginning, post_offset 4; content: \u201c|70 00 65 00 72 00 66 00 63 00 2e 00 64 00 61 00 74 00|\u201d; distance:0; classtype:suspicious-filename-detect; sid: 10001443; rev: 1;)<\/em><\/p>\n alert tcp any any -> $HOME_NET 445 (msg:\u201d[PT Open] SMB2 Create PSEXESVC.EXE\u201d; flow:to_server, established, no_stream; content: \u201c|fe 53 4d 42|\u201d; offset: 4; depth: 4; content: \u201c|05 00|\u201d; offset: 16; depth: 2; byte_jump: 2, 112, little, from_beginning, post_offset 4; content:\u201d|50 00 53 00 45 00 58 00 45 00 53 00 56 00 43 00 2e 00 45 00 58 00 45|\u201d; distance:0; classtype:suspicious-filename-detect; sid: 10001444; rev:1;)<\/em><\/p>\n Hen\u00fcz sistemlerinize Pedya fidye yaz\u0131l\u0131m\u0131 bula\u015fmad\u0131ysa internet \u00fczerinden ip adreslerinizi (SMBv1 deste\u011fine kar\u015f\u0131 ) taratarak a\u00e7\u0131kl\u0131\u011f\u0131n olup olmad\u0131\u011f\u0131n\u0131 tespit edebilirsiniz. Ek olarak MEDOC yaz\u0131l\u0131m\u0131 kullan\u0131yorsan\u0131z ilgili sistemleri a\u011fdan yal\u0131t\u0131p inceleme yapman\u0131z gerekebilir.<\/p>\n Hen\u00fcz ne kadar sistemin bu zararl\u0131 yaz\u0131l\u0131mdan etkilendi\u011fi tam olarak bilinemiyor fakat Shodanhq\u2019e g\u00f6re d\u00fcnya \u00fczerinde bu zafiyeti bar\u0131nd\u0131rma\u00a0ihtimali<\/u>\u00a0olan bilgisayar say\u0131s\u0131 1.000.000, bu da zafiyetin sonu\u00e7lar\u0131n\u0131n nerelere gidece\u011fi hakk\u0131nda bize bilgi veriyor.<\/p>\n T\u00fcrkiye\u2019de ise durum biraz daha iyi gibi, Petya zafiyetinden etkilenme durumu olan bilgisayar say\u0131s\u0131 15.000 civar\u0131 g\u00f6z\u00fck\u00fcyor. Kendi yapt\u0131\u011f\u0131m\u0131z ara\u015ft\u0131rmalar sonucu T\u00fcrkiye\u2019de do\u011frudan bu zararl\u0131 yaz\u0131l\u0131mdan etkilenecek sunucu say\u0131s\u0131 yakla\u015f\u0131k olarak\u00a0 2.000 [1] \u00e7\u0131kmaktad\u0131r.<\/strong><\/p>\n Yaz\u0131y\u0131 haz\u0131rlad\u0131\u011f\u0131m\u0131z tarihe kadar a\u015fa\u011f\u0131da ismi ge\u00e7en b\u00fcy\u00fck firmalar\u0131n sald\u0131r\u0131dan etkilendi\u011fi do\u011frulanm\u0131\u015f g\u00f6z\u00fck\u00fcyor.<\/p>\n Bula\u015ft\u0131\u011f\u0131 tespit edilen sistemin a\u011f ba\u011flant\u0131s\u0131 acilen devre d\u0131\u015f\u0131 b\u0131rak\u0131lmal\u0131 ve a\u011fdan izole edilmelidir. Bu \u015feklide di\u011fer sistemlere yay\u0131lmas\u0131 \u00f6nlenebilir.<\/p>\n Zararl\u0131 yaz\u0131l\u0131m geli\u015ftiricisi \u00f6demeleri wowsmith123456@posteo.net\u00a0 e-posta hesab\u0131 kullanarak bitcoin \u00fczerinden toplamaktad\u0131r. Sald\u0131r\u0131da kullan\u0131lan e-postan\u0131n sa\u011flay\u0131c\u0131s\u0131 Posteo, Petya zararl\u0131s\u0131n\u0131 yayan crook\u2019un e-posta hesab\u0131n\u0131 kapatt\u0131\u011f\u0131n\u0131 a\u00e7\u0131klad\u0131: wowsmith123456@posteo.net<\/p>\n Dosyalar\u0131n\u0131z\u0131 geri almak i\u00e7in t\u00fcm ileti\u015fim yollar\u0131 kapal\u0131, bu durumdan dolay\u0131 fidye\u00a0\u00f6dememenizi<\/strong>\u00a0ve dan\u0131\u015fmanl\u0131k firman\u0131za alternatif \u00f6neriler konusunda dan\u0131\u015fman\u0131z\u0131 \u00f6neririz.<\/p>\n Kullan\u0131lan Microsoft Windows i\u015fletim sistemlerinin g\u00fcncellemelerini kontrol edip 14 Mart 2017 de yay\u0131nlanan MS17-010 kodlu yaman\u0131n y\u00fcklendi\u011finden emin olunmas\u0131 gereklidir.<\/p>\n Aktif kullan\u0131lan t\u00fcm Microsoft Windows i\u015fletim sistemleri Petya zararl\u0131 fidye yaz\u0131l\u0131m\u0131ndan etkilenmektedir.<\/p>\n Microsoft taraf\u0131ndan MS17-010 SMB zafiyetine y\u00f6nelik yay\u0131nlad\u0131\u011f\u0131 dok\u00fcmanda etkilenen t\u00fcm i\u015fletim sistemlerine bakabilirsiniz. [2]\n E-posta \u00fczerinden gelen siber sald\u0131r\u0131lar E-posta sunucunun eksik\/hatal\u0131 yap\u0131land\u0131r\u0131lmas\u0131 ve e-postay\u0131 kullanan ki\u015filerin bilgi g\u00fcvenli\u011fi fark\u0131ndal\u0131k eksikli\u011fini istismar eder.<\/p>\n E-posta sunucunuzun zararl\u0131 yaz\u0131l\u0131m veya link bar\u0131nd\u0131ran postalar\u0131 ge\u00e7irip ge\u00e7irmedi\u011fini test etmek ve hatal\u0131 yap\u0131land\u0131rmalar\u0131 d\u00fczeltmek i\u00e7in SinaraLabs taraf\u0131ndan \u00fccretsiz sunulan ETS hizmetini kullanabilirsiniz. ETS hizmeti e-posta servisinizin g\u00fcncel siber sald\u0131r\u0131lar kar\u015f\u0131s\u0131ndaki durumunu ve iyile\u015ftirmelerini rapor olarak sunan etkili bir hizmettir.<\/p>\n ETS hizmetini \u00fccretsiz kullanmak i\u00e7in:\u00a0https:\/\/ets.sinaralabs.com\/User\/PRegister<\/a>\u00a0adresinden kay\u0131t olabilirsiniz.<\/p>\n A\u00e7\u0131k kaynak ya da kurumsal siber tehdit istihbarat\u0131 sa\u011flayan yaz\u0131l\u0131mlar kullanarak kurumunuzu hedef alabilecek siber tehditlere kar\u015f\u0131 \u00f6nceden haberdar olabilirsiniz.<\/p>\n Kaynaklar:<\/strong><\/p>\n Detayl\u0131 bilgi, analizler ve dan\u0131\u015fmanl\u0131k i\u00e7in\u00a0some@bga.com.tr<\/strong>\u00a0adresimiz ile ileti\u015fime ge\u00e7ebilirsiniz.<\/p>\n1. Petya (#petrWrap) Nedir? Sistemlere Nas\u0131l Bir Zarar Verir?<\/strong><\/h2>\n
Petya Zararl\u0131s\u0131n\u0131n Wannacry\u2019dan Farklar\u0131 Nelerdir?<\/strong><\/h3>\n
2. #Petya Fidye Zararl\u0131 Yaz\u0131l\u0131m\u0131 Nas\u0131l Yay\u0131lmaktad\u0131r, Neden Kaynaklanmaktad\u0131r?<\/strong><\/h2>\n
3. Kendi Sistemlerimize Bula\u015f\u0131p Bula\u015fmad\u0131\u011f\u0131n\u0131 Nas\u0131l Tespit Edebiliriz?<\/strong><\/h2>\n
\n
4.T\u00fcrkiye ve D\u00fcnyada Ne Kadar Sistem #Petya Sald\u0131r\u0131s\u0131ndan Etkilendi?<\/strong><\/h2>\n
\n
5. Baz\u0131 Sistemlerimize Bula\u015ft\u0131\u011f\u0131n\u0131 Tespit Ettik Ne Yapmal\u0131y\u0131z?<\/strong><\/h2>\n
\n
6.Talep Edilen Fidye \u00d6dendi\u011fi Durumda Dosyalar Geri Al\u0131nabilir mi?<\/strong><\/h2>\n
7. Kurumsal Bir \u015eirket \u00c7al\u0131\u015fan\u0131 Ne Yapmal\u0131d\u0131r, Nas\u0131l \u00d6nlem Alabilir?<\/strong><\/h2>\n
\n
8. Hangi \u0130\u015fletim Sistemleri Etkilenmektedir?<\/strong><\/h2>\n
\n
9. E-posta \u00dczerinden Gelebilecek Tehditlere Kar\u015f\u0131 Sistemlerini Nas\u0131l Test Edebilirim?<\/strong><\/h2>\n
10. Petya, Wannacry ve Benzeri Zararl\u0131 Yaz\u0131l\u0131mlardan Erkenden Haberdar Olmak ve Uzun Vadeli Korunmak \u0130\u00e7in Neler Yapmal\u0131y\u0131m?<\/strong><\/h2>\n
\n
\n
Hamza \u015eAMLIO\u011eLU<\/h3>\n","protected":false},"excerpt":{"rendered":"BGA Security uzmanlar\u0131na g\u00f6re Petya isimli zararl\u0131 fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131 daha \u00f6nce d\u00fcnyay\u0131 kas\u0131p kavuran Wannacry sald\u0131r\u0131lar\u0131na g\u00f6re…\n","protected":false},"author":7,"featured_media":13010,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[53],"tags":[],"class_list":{"0":"post-12817","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-guvenlik"},"_links":{"self":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts\/12817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/comments?post=12817"}],"version-history":[{"count":0,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts\/12817\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/media\/13010"}],"wp:attachment":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/media?parent=12817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/categories?post=12817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/tags?post=12817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}