{"id":19771,"date":"2022-05-01T19:54:03","date_gmt":"2022-05-01T16:54:03","guid":{"rendered":"https:\/\/kutaybilen.com.tr\/?p=19771"},"modified":"2022-05-01T19:54:03","modified_gmt":"2022-05-01T16:54:03","slug":"koronavirus-temali-4-yeni-berbat-gayeli-yazilim-kesfedildi","status":"publish","type":"post","link":"https:\/\/kutaybilen.com.tr\/?p=19771","title":{"rendered":"Koronavir\u00fcs Temal\u0131 4 Yeni Berbat Gayeli Yaz\u0131l\u0131m Ke\u015ffedildi"},"content":{"rendered":"<p>\u00c7abucak \u00e7abucak d\u00fcnyan\u0131n b\u00fct\u00fcn \u00fclkeleri koronavir\u00fcsle u\u011fra\u015f\u0131rken, <strong>berbat maksatl\u0131 yaz\u0131l\u0131m geli\u015ftiricileri de\u00a0<\/strong>salg\u0131n\u0131n yaratt\u0131\u011f\u0131 panik havas\u0131n\u0131 kullanmaya ba\u015flad\u0131lar. Koronavir\u00fcs temal\u0131 makus emelli yaz\u0131l\u0131mlar ortaya \u00e7\u0131karan geli\u015ftiriciler,\u00a0bilgisayarlardaki belgeleri siliyorlar yahut bir bilgisayar\u0131n \u00f6ny\u00fckleme kayd\u0131 olan MBR\u2019yi ama\u00e7 al\u0131yorlar.\u00a0<\/p>\n<p>G\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131,\u00a0<strong>4 yeni\u00a0<\/strong>koronavir\u00fcs temal\u0131 makus emelli yaz\u0131l\u0131m ke\u015ffettiler. Bu yaz\u0131l\u0131mlar\u0131n hepsi koronavir\u00fcs temas\u0131n\u0131 kullan\u0131yor ve bilgisayarlarda b\u00fcy\u00fck ziyanlar ortaya \u00e7\u0131kar\u0131yor. Bu yaz\u0131l\u0131mlardan ikisi \u00f6ny\u00fckleme kayd\u0131 olan MBR\u2019yi ama\u00e7 al\u0131rken, ba\u015fka iki yaz\u0131l\u0131m da bilgisayarda bulunan datalar\u0131 silecek bi\u00e7imde olu\u015fturuldu.<\/p>\n<p>MalwareHunterTeam isimli inan\u00e7l\u0131 ara\u015ft\u0131rmac\u0131s\u0131 taraf\u0131ndan ke\u015ffedilen <strong>COVID19.exe<\/strong> isimli mak\u00fbs maksatl\u0131 yaz\u0131l\u0131m, bilgisayara bula\u015ft\u0131ktan sonra iki basamak izliyor. Birinci a\u015famada\u00a0bilgisayar\u0131n Windows Vazife Y\u00f6neticisi\u00a0devre d\u0131\u015f\u0131 kal\u0131yor. Kullan\u0131c\u0131 Misyon Y\u00f6neticisi\u2019ni a\u00e7maya u\u011fra\u015f\u0131rken vir\u00fcs art planda bilgisayar\u0131n \u00f6ny\u00fckleme kayd\u0131n\u0131 silerek yerine yenisini yaz\u0131yor. Bu sayede bilgisayar\u0131n a\u00e7\u0131l\u0131\u015f\u0131nda \u00f6ny\u00fckleme ekran\u0131ndan evvel kullan\u0131c\u0131n\u0131n kar\u015f\u0131s\u0131na di\u011fer bir ekran \u00e7\u0131k\u0131yor.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.webtekno.com\/images\/editor\/default\/0002\/54\/9d2605fd60b546086d5e60545c518346ef2b6649.jpeg\"\/><\/p>\n<p>MBR\u2019yi ama\u00e7 alan \u00f6b\u00fcr makus hedefli yaz\u0131l\u0131m ise bir fidye uygulamas\u0131 \u00fczere durmakla bir arada <strong>as\u0131l yapt\u0131\u011f\u0131 i\u015f,\u00a0<\/strong>kullan\u0131c\u0131n\u0131n \u015fifre\u00a0ve bilgilerini \u00e7almakt\u0131r. Kullan\u0131c\u0131n\u0131n bunu anlamamas\u0131 i\u00e7in de \u00f6n planda kullan\u0131c\u0131dan para istenen bir ileti g\u00f6sterilir. B\u00f6ylelikle bilgileri \u00e7al\u0131nan kullan\u0131c\u0131, yaln\u0131zca bir fidye yaz\u0131l\u0131m ile kar\u015f\u0131 kar\u015f\u0131ya oldu\u011funu d\u00fc\u015f\u00fcn\u00fcr.<\/p>\n<p>G\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131, ikinci mak\u00fbs gayeli yaz\u0131l\u0131m\u0131n kodlar\u0131n\u0131 incelediklerinde bilgisayardaki <strong>evraklar\u0131 silmek i\u00e7in de<\/strong> bir kod blo\u011fu oldu\u011funu g\u00f6rd\u00fcler. Lakin bu kodlar faal de\u011fildi. Vir\u00fcs\u00fcn ikinci versiyonunda ise data silme \u00f6zelli\u011fi fonksiyonel bir ekran kilidi ile de\u011fi\u015ftirilmi\u015f g\u00f6r\u00fcn\u00fcyordu. \u00a0<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.webtekno.com\/images\/editor\/default\/0002\/54\/13e422f96b7a8903159f282044efdcfc6831b019.jpeg\"\/><\/p>\n<p>MBR\u2019yi gaye alan vir\u00fcslerin d\u0131\u015f\u0131nda iki tane de <strong>bilgileri silmek \u00fczere geli\u015ftirilmi\u015f <\/strong>berbat emelli yaz\u0131l\u0131m ortaya \u00e7\u0131kar\u0131ld\u0131. Bunlardan birincisi \u00c7ince bir evrak ismiyle ortaya \u00e7\u0131kt\u0131. \u015eubat ay\u0131nda ortaya \u00e7\u0131kan \u00c7ince evrak isimli vir\u00fcs, direkt olarak kullan\u0131c\u0131 bilgilerini maksat al\u0131yordu.\u00a0D\u00fcn tespit edilen ikinci bilgi silme uygulamas\u0131 ise \u0130talya\u2019da bulunan biri taraf\u0131ndan VirusPortal\u2019a y\u00fcklendi.\u00a0<\/p>\n<p>G\u00fcvenlik ara\u015ft\u0131rmac\u0131s\u0131 MalwareHunterTeam, bula\u015ft\u0131klar\u0131 sistemdeki belgeleri silmek i\u00e7in kulland\u0131klar\u0131 prosed\u00fcrleri verimsiz, yan\u0131lg\u0131ya a\u00e7\u0131k ve vakit al\u0131c\u0131 oldu\u011fu i\u00e7in iki mak\u00fbs hedefli yaz\u0131l\u0131m\u0131 da <strong>zay\u0131f vir\u00fcs \u00e7e\u015fitleri <\/strong>olarak nitelendirdi.\u00a0<\/p>\n<div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u00c7abucak \u00e7abucak d\u00fcnyan\u0131n b\u00fct\u00fcn \u00fclkeleri koronavir\u00fcsle u\u011fra\u015f\u0131rken, berbat maksatl\u0131 yaz\u0131l\u0131m geli\u015ftiricileri de\u00a0salg\u0131n\u0131n yaratt\u0131\u011f\u0131 panik havas\u0131n\u0131 &#8230;<\/p>\n","protected":false},"author":1,"featured_media":19772,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[854],"tags":[1590,859,3263,863,2323],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/19771"}],"collection":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19771"}],"version-history":[{"count":1,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/19771\/revisions"}],"predecessor-version":[{"id":19773,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/posts\/19771\/revisions\/19773"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=\/wp\/v2\/media\/19772"}],"wp:attachment":[{"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kutaybilen.com.tr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}