KÖTÜCÜL VE CASUS YAZILIMLAR: KAPSAMLI BİR ARAŞTIRMA

Öz

Bilgisayar teknolojileri gelişip yaygınlaştıkça, günlük iş ve işlemler elektronik ortamlara taşınmakta vekolaylaşmaktadır. Bunun sonucu olarak bilgi ve bilgisayar güvenliğinin önemi ve karşılaşılan tehditler, gereksayı gerekse çeşitlilik açısından artmıştır. Kötücül (malware) ve casus (spyware) yazılımlar ise bunların enbaşında gelmektedir. Bu yazılımlar ile ilgili olarak literatürdeki mevcut kaynaklar araştırılıp incelendiğinde,kapsamlı ve güncel bir çalışma olmadığı, sunulan çalışmaların ise anti-virüs web sitelerinde ve bilgisayarmagazin dergilerinde yer aldığı ve nasıl korunması gerektiğiyle ilgili kısa bilgilere yer verildiği tespit edilmiştir.Bu tespitlerden yola çıkarak bu kapsamlı araştırma çalışmasında, en önemli tehditlerden olan kötücül ve casusyazılımlar üzerine kapsamlı bir inceleme gerçekleştirilmiştir. Elde edilen bulgular doğrultusunda, bu yazılımlarsınıflandırılmış; sahip oldukları temel özellikler ve taşıdıkları riskler özetlenmiştir. Bu çalışmanın, literatürdegerçekleştirilen kapsamlı bir çalışma olması sebebiyle, kötü niyetli olarak geliştirilen yazılım türlerinin daha iyibilinmesi, tanınması ve gerekli önlemlerin alınmasına büyük katkılar sağlayacağı, karşılaşılabilecek zararlarınazaltılabileceği değerlendirilmektedir.

Anahtar Kelimeler

• Kötücül yazılım, casus yazılım, bilgi ve bilgisayar güvenliği, virüs, solucan, arka kapı, Truva atı, kök kullanıcı takımı, klavye dinleme sistemi.

Kaynakça

1. Canbek, G., Klavye Dinleme ve Önleme Sistemleri
2. Analiz, Tasarım ve Geliştirme, Yüksek Lisans
3. Tezi, Gazi Üniversitesi, Fen Bilimleri Enstitüsü,
4. , 31-32, 43, 50, 58, 154, Eylül 2005.
5. Heiser, J. G., Understanding Today’s Malware,
6. Information Security Technical Report. Vol. 9, No.
7. , 47-64, April-June 2004.
8. Calder, A., Watkins, S., It Governance: A Manager's

9. Guide to Data Security & BS 7799/ISO
10. , Kogan Page, 14, 163, September 1, 2003.
11. Thompson, R., The Four Ages of Malware,
12. Infosecurity Today, 47-48, March/April, 2005.
13. Grimes, R. A., Malicious Mobile Code, O'Reilly, 3,
14. -203, 226-228, 238-244, 467-468, August 1, 2001.
15. İnternet: How Bad Is The Malware Problem?,
16. http://searchsmb.techtarget.com/sDefinition/0.sid4
17. _gci991471.00.html, Eylül 2005.
18. İnternet: 2005 CSI/FBI Computer Crime and
19. Security Survey,
20. http://www.gocsi.com/forms/fbi/csi_fbi_survey.jh
21. tml , Computer Security Institute, Kasım 2005.
22. İnternet: Spyware and Increasing Security Risks-
23. Proactive Protection for fhe Enterprise Client,
24. http://enterprisesecurity.symantec.com/content/we
25. bcastinfo.cfm?webcastid=146, Kasım 2005.
26. İnternet: Symantec, Symantec Internet Security
27. Threat Report, 2005,
28. http://ses.symantec.com/WP000ITR8, Kasım 2005.
29. Peikari, C., Fogie, S., Maximum Wireless Security,
30. Sams Publishing, 153, 164, December 18, 2002.
31. Skoudis, E., Malware: Fighting Malicious Code,
32. Prentice Hall PTR, 13, 96, 123-125, 149-151, 179,
33. November 7, 2003.
34. İnternet: Symantec Security Response - W95.CIH,
35. http://www.symantec.com/avcenter/venc/data/cih.
36. html , Ekim 2005.
37. Mohay, G., Collie, B., Vel, O., McKemmish, R.,
38. Anderson, A., Computer and Intrusion Forensics,
39. Artech House, 236, April 1, 2003.
40. Gustin, J., Cyber Terrorism, Marcel Dekker, 26-
41. , October 15, 2003.
42. Russell, D., Gangemi, Sr. G.T., Computer
43. Security Basics, O'Reilly, 82, July 1, 1991.
44. Thompson, D. P., The Trojan War: Literature
45. and Legends from the Bronze Age to the
46. Present, McFarland & Company, 33, January 6, 2004.
47. İnternet: Trojan Programs, VirusList,
48. http://www.viruslist.com/en/virusesdescribed?cha
49. pter=152540521 , Eylül 2005.
50. Hansen, J. B., Young, S., The Hacker's Handbook,
51. CRC Press, 72-74, 126, 530, 714, November 24,
52. -
53. Conway, R., Cordingley, J., Code Hacking: A
54. Developer's Guide to Network Security, Charles
55. River Media, 55-56, 92, May 1, 2004.
56. Cole, E., Hackers Beware: The Ultimate Guide
57. to Network Security, Sams Publishing, 104-108,
58. -193, 544, 550, August 13, 2001.
59. Hansche, S., Berti, J., Hare, C., Official (Isc) 2
60. Guide to the Cissp Exam, CRC Press, 590,
61. December 15, 2003.
62. Connally, K. I., Law of Internet Security and
63. Privacy 2004, Aspen Publishers, Inc., 112, 2004.
64. İnternet: Email Spam Statistics and
65. Information, McAfee,
66. http://us.mcafee.com/fightspam/default.asp?id=sta
67. ts , Eylül 2005.
68. May 2005 Symantec™ Spam Statistics,
69. http://www.symantec.com/region/reg_ap/promo/b
70. rightmail/docs/May2005SpamStats.pdf, Eylül 2005.
71. Mohay, G., Collie, B., Vel, O., McKemmish, R.,
72. Anderson, A., Computer and Intrusion Forensics,
73. Artech House, 226, April 1, 2003.
74. Caloyannides, M. A., Privacy Protection and
75. Computer Forensics, Artech House, 118-120,
76. October 1, 2004.
77. Gralla, P., Schaeffer, J. P., The Complete Idiot's
78. Guide to Internet Privacy and Security, Alpha
79. Books, 37, January 4, 2002.
80. Bishop, M. A., Computer Security: Art and
81. Science, Addison-Wesley Professional, 724-725,
82. December 2, 2002.
83. Tipton, H. F., Krause, M., Information Security
84. Management Handbook, CRC Press, 132,
85. -1255, December 30, 2003.
86. Russell, R., Hack Proofing Your Network,
87. Syngress Publishing, 78, January 1, 2001.
88. İnternet: Gostev A., Malware Evolution:
89. January - March 2005, Kaspersky Lab.
90. http://www.viruslist.com/en/analysis?pubid=1624
91. , Nisan 2005.
92. Reynolds, J., Complete E-Commerce Book:
93. Design, Build and Maintain a Successful Web-
94. Based Business, CMP Books, 365, April 1, 2004.
95. Stephenson, P., Investigating Computer-Related
96. Crime, CRC Press, 57-58, September 28, 1999.
97. Mutton, P., IRC Hacks, O'Reilly, 39-41, July 27, 2004.
98. Hausman, K. K., Barrett, D., Weiss, M., Exam
99. Cram 2 Security +: Exam Cram SYO-101, Que
100. Publishing, 59, April 10, 2003.
101. Mandia, K., Prosise, C., Incident Response
102. Second Edition: Computer Forensics, McGraw-
103. Hill Professional, 389-390, July 17, 2003.
104. İnternet: Binder, SearchWin2000, TechTarget.
105. http://searchwin2000.techtarget.com/sDefinition/
106. ,,sid1_gci948478,00.html , Mayıs 2005.
107. Poole, O., Network Security: A Practical Guide,
108. Elsevier, 69-71, December 9, 2002.
109. Pipkin, D. L., Halting the Hacker - A Practical
110. Guide to Computer Security, Prentice Hall PTR,
111. , August 26, 2002.
112. Bace, R. G., Intrusion Detection, Sams
113. Publishing, 151, December 22, 1999.
114. İnternet : Zone Labs Virus Information Center,
115. Virus Glossary,
116. http://vic.zonelabs.com/tmpl/body/CA/virusGloss
117. ary.jsp , Ekim 2005.
118. Campbell, P., Calvert, B., Boswell, S., Security+
119. in Depth, Thomson Course Technology, 83,
120. February 1, 2003.
121. Stewart, J., This business of malware,
122. Information Security Technical Report. Vol. 9,
123. No. 2, 35-41, April 2004.
124. Mena, J., Homeland Security Techniques and
125. Technologies, Charles River Media, 47-48, May
126. , 2004.
127. Vacca, J. R., Computer Forensics - Computer
128. Crime Scene Investigation, Charles River
129. Media, 489-490, May 1, 2005.
130. Burgess, R. C., Small, M. P., Computer
131. Security in the Workplace, SEO Press, 21, 2005.
132. Shimonski, R. J., Johnson, N. L., Crump, R. J.,
133. Security+, Syngress Publishing, 142-143,
134. December 1, 2002.
135. Bennett, J., Digital Umbrella: Technology's
136. Attack on Personal Privacy in America, Brown
137. Walker Press (FL), 47-50, September 1, 2004.
138. Gralla, P., Windows XP Hacks, O'Reilly, 152-
139. , April 1, 2005.
140. İnternet: Sanal Dolandırıcılıkta Son Nokta
141. Phishing, İstanbul Emniyet Müdürlüğü.
142. http://www.iem.gov.tr/iem/?idno=147, Mayıs
143. -
144. İnternet: Consumer Online: Home > Scams >
145. Major Scams,
146. http://www.consumer.org.nz/topic.asp?docid=25
147. &category=&subcategory=&topic=Scams&title
148. =Major%20Scams&contenttype=summary ,
149. Eylül 2005.
150. Brown, S., The Complete Idiot's Guide to
151. Private Investigating, Alpha Books, 144-146,
152. October 1, 2002.
153. Jones, S., Encyclopedia of New Media: An
154. Essential Reference to Communication and
155. Technology, Sage Publications Inc, 212-216,
156. December 10, 2002.
157. Orebaugh, A. D., Ethereal Packet Sniffing,
158. Syngress Publishing, 6-10, 27-28, February 17, 2004.
159. Garfinkel, S., Web Security, Privacy &
160. Commerce, 2nd Edition, O'Reilly, 216-221,
161. November 1, 2001.
162. İnternet: Macromedia Flash content reaches
163. 3% of Internet viewers, Flash Player
164. Penetration Survey, March 2005, NPD Research.
165. http://www.macromedia.com/software/player_ce
166. nsus/flashplayer/ , Haziran 2005.
167. Petersen, J. K., Understanding Surveillance
168. Technologies, CRC Press, 2-9, September 21,
169. -
170. İnternet: Self Replicating Wabbits – Sounds
171. Strange. Brings Chaos, SYL Articles,
172. http://articles.syl.com/selfreplicatingwabbitssoun
173. dsstrangebringschaos.html, Eylül 2005.
174. Chuvakin, A., Peikari, C., Security Warrior,
175. O'Reilly, 324, January 12, 2004.
176. Furnell, S., Ward, J., Malware comes of age:
177. The arrival of the true computer parasite,
178. Network Security, 11-15, October 2004.
179. Williamson, D., Deconstructing malware: what
180. it is and how to stop it, Information Security
181. Technical Report. Vol. 9, No. 2, 27-34, 2004.
182. Levenhagen, R., Trends, codes and virus attacks
183. - 2003 year in review, Network Security, Vol.
184. , No. 1, 13-15, January 2004.
185. Hacker 2004 Raporu, Chip Dergisi, Nisan 2004,
186. -61, 2004.