Kripto para g\u00fcvenli\u011finde so\u011fuk saklama \u00e7\u00f6z\u00fcmlerinin k\u00fcresel \u00f6l\u00e7ekteki en b\u00fcy\u00fck \u00fcreticilerinden biri olan Trezor, Trezor Safe 5 modeli \u00fczerinde tespit edilen \u015f\u00fcpheli bir donan\u0131m manip\u00fclasyonu hakk\u0131nda kritik bir g\u00fcvenlik b\u00fclteni yay\u0131mlad\u0131. G\u00fcneydo\u011fu Asya pazar\u0131nda faaliyet g\u00f6steren yetkili sat\u0131c\u0131 CryptoBilis arac\u0131l\u0131\u011f\u0131yla sat\u0131lan baz\u0131 cihazlarda, kullan\u0131c\u0131lar\u0131n kripto varl\u0131klar\u0131n\u0131 ele ge\u00e7irmeyi ama\u00e7layan k\u00f6t\u00fc niyetli bir donan\u0131m implant\u0131n\u0131n (cihaz i\u00e7ine sonradan eklenmi\u015f yabanc\u0131 mikro\u00e7ip) yer ald\u0131\u011f\u0131na dair g\u00fcvenilir istihbaratlar al\u0131nd\u0131\u011f\u0131 a\u00e7\u0131kland\u0131.<\/p>\n
Siber g\u00fcvenlik literat\u00fcr\u00fcnde “tedarik zinciri sald\u0131r\u0131s\u0131” veya “araya girme” (interdiction) olarak adland\u0131r\u0131lan bu y\u00f6ntem, cihaz\u0131n fabrikadan \u00e7\u0131kt\u0131ktan sonra son kullan\u0131c\u0131ya ula\u015fana kadarki lojistik veya da\u011f\u0131t\u0131m s\u00fcre\u00e7lerinde fiziksel olarak modifiye edilmesini kaps\u0131yor. Trezor yetkilileri, \u00fcretim band\u0131nda herhangi bir zafiyet bulunmad\u0131\u011f\u0131n\u0131, sorunun G\u00fcneydo\u011fu Asya’daki yerel da\u011f\u0131t\u0131m kanal\u0131 \u00fczerinden dola\u015f\u0131ma giren s\u0131n\u0131rl\u0131 say\u0131daki Trezor Safe 5 cihaz\u0131yla ili\u015fkili oldu\u011funu vurguluyor.<\/p>\n
Fiziksel donan\u0131m c\u00fczdanlar\u0131, internete ba\u011fl\u0131 olmayan izole yap\u0131lar\u0131 sayesinde \u00f6zel anahtarlar\u0131 (private keys) \u00e7evrimd\u0131\u015f\u0131 ortamda g\u00fcvenle saklamak \u00fczere tasarlanm\u0131\u015ft\u0131r. Ancak k\u00f6t\u00fc niyetli akt\u00f6rler taraf\u0131ndan cihaz\u0131n dahili bask\u0131l\u0131 devre kart\u0131na (PCB) gizlice lehimlenen ek \u00e7ipler, bu g\u00fcvenlik duvar\u0131n\u0131 do\u011frudan i\u00e7eriden a\u015fmay\u0131 hedefler. Cihaz\u0131n i\u00e7 mimarisine yerle\u015ftirilen yabanc\u0131 bir donan\u0131m bile\u015feni; kullan\u0131c\u0131n\u0131n PIN kodunu, kurtarma kelimelerini (seed phrase) ya da i\u015flem onaylama verilerini cihaz belle\u011finden veya ekran\/tu\u015f tak\u0131m\u0131 yollar\u0131ndan dinleyerek sald\u0131rganlara s\u0131zd\u0131rma potansiyeline sahiptir.<\/p>\n
Donan\u0131m tabanl\u0131 sald\u0131r\u0131lar, yaz\u0131l\u0131msal tehditlere k\u0131yasla tespit edilmesi \u00e7ok daha g\u00fc\u00e7 vakalard\u0131r. Zira cihaz \u00e7o\u011fu zaman orijinal aray\u00fcz\u00fcyle a\u00e7\u0131l\u0131r ve standart Trezor Suite yaz\u0131l\u0131m\u0131 taraf\u0131ndan ilk bak\u0131\u015fta orijinal bir \u00fcr\u00fcn olarak alg\u0131lanabilir. Buna kar\u015f\u0131n, cihaz\u0131n kriptografik i\u015flemci \u00fcnitesiyle periferik bile\u015fenleri aras\u0131ndaki veri yollar\u0131 manip\u00fcle edildi\u011finde, kullan\u0131c\u0131 fark\u0131nda olmadan t\u00fcm c\u00fczdan kontrol\u00fcn\u00fc sald\u0131rgan\u0131n belirledi\u011fi arka kap\u0131ya teslim edebilir.<\/p>\n
Trezor ve siber g\u00fcvenlik uzmanlar\u0131, kripto varl\u0131k sahiplerinin bu t\u00fcr sofistike tedarik zinciri sald\u0131r\u0131lar\u0131ndan korunabilmesi i\u00e7in belirli operasyonel ad\u0131mlar\u0131n harfiyen uygulanmas\u0131n\u0131 \u00f6nermektedir:<\/p>\n
Trezor, s\u00f6z konusu hadiseyle ba\u011flant\u0131l\u0131 olan G\u00fcneydo\u011fu Asya men\u015feli tedarik\u00e7iyi inceleme alt\u0131na al\u0131rken, \u015f\u00fcpheli cihazlara dair teknik analiz s\u00fcre\u00e7lerinin s\u00fcrd\u00fc\u011f\u00fcn\u00fc bildirdi. \u015eirket, g\u00fcvenlik a\u00e7\u0131\u011f\u0131 \u015f\u00fcphesi ta\u015f\u0131yan kullan\u0131c\u0131lardan cihazlar\u0131 inceleme amac\u0131yla do\u011frudan Trezor g\u00fcvenlik birimine iletmelerini talep ediyor. Ya\u015fanan bu son vaka, kripto ekosisteminde donan\u0131m g\u00fcvenli\u011finin yaln\u0131zca g\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131ndan ibaret olmad\u0131\u011f\u0131n\u0131, lojistik s\u00fcre\u00e7lerin ve fiziksel b\u00fct\u00fcnl\u00fck denetimlerinin de en az yaz\u0131l\u0131m kadar kritik bir savunma hatt\u0131 olu\u015fturdu\u011funu bir kez daha g\u00f6zler \u00f6n\u00fcne seriyor.<\/p>\n","protected":false},"excerpt":{"rendered":"
Kripto para saklama \u00e7\u00f6z\u00fcmleri \u00fcreticisi Trezor, G\u00fcneydo\u011fu Asya’daki bir sat\u0131c\u0131 \u00fczerinden da\u011f\u0131t\u0131lan Trezor Safe 5 modellerinde donan\u0131m manip\u00fclasyonu tespit edildi\u011fini duyurdu. Tedarik zinciri g\u00fcvenli\u011fine dikkat \u00e7eken \u015firket, kullan\u0131c\u0131lar\u0131 kritik \u00f6nlemler almaya \u00e7a\u011f\u0131rd\u0131.<\/p>\n","protected":false},"author":1,"featured_media":516,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-505","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-siber-guvenlik-istihbarat"],"yoast_head":"\n