| 翻訳と辞書 |
| Regin (malware) ： ウィキペディア英語版 |
Regin (malware)
Regin (also known as Prax or WarriorPride〔http://www.spiegel.de/international/world/regin-malware-unmasked-as-nsa-tool-after-spiegel-publishes-source-code-a-1015255.html〕) is a sophisticated malware toolkit revealed by Kaspersky Lab,〔(【引用サイトリンク】title=Regin Revealed )〕 Symantec, and The Intercept〔 in November 2014 that targets specific users of Microsoft Windows-based computers. One operator of Regin is known to be the British spy agency GCHQ. ''The Intercept'' provided samples of Regin for download including malware discovered at Belgian telecommunications provider, Belgacom.〔 Kaspersky Lab says it first became aware of Regin in spring 2012, but that some of the earliest samples date from 2003.〔(Kaspersky:Regin: a malicious platform capable of spying on GSM networks ), 24 November 2014〕 (The name Regin is first found on the VirusTotal website on 9 March 2011.〔) Among computers infected worldwide by Regin, 28 percent were in Russia, 24 percent in Saudi Arabia, 9 percent each in Mexico and Ireland, and 5 percent in each of India, Afghanistan, Iran, Belgium, Austria and Pakistan. Kaspersky Lab was unable to determine the attack vector used, and said the malware's main victims are private individuals, small businesses and telecom companies. Regin has been compared to Stuxnet and is thought to have been developed by "well-resourced teams of developers," possibly a Western government, as a targeted multi-purpose data collection tool.〔(【引用サイトリンク】title=BBC News - Regin, new computer spying bug, discovered by Symantec )〕〔(【引用サイトリンク】title=Regin White Paper )〕〔(【引用サイトリンク】title=Regin White Paper )〕
According to Die Welt, security experts at Microsoft gave it the name "Regin" in 2011, after the cunning Norse dwarf Regin.
==Operation==
Regin uses a modular approach allowing it to load features that exactly fit the target, enabling customized spying. The design makes it highly suited for persistent, long-term mass surveillance operations against targets.〔(【引用サイトリンク】title=Regin Malware - 'State-Sponsored' Spying Tool Targeted Govts )〕
Regin is stealthy and does not store multiple files on the infected system; instead it uses its own encrypted virtual file system (EVFS) entirely contained within what looks like a single file with an innocuous name to the host, within which files are identified only by a numeric code, not a name. The EVFS employs a variant encryption of the rarely used RC5 cipher.〔 Regin communicates over the Internet using ICMP/ping, commands embedded in HTTP cookies and custom TCP and UDP protocols with a command and control server which can control operations, upload additional payloads, etc.〔〔
抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』
■ウィキペディアで「Regin (malware)」の詳細全文を読む
スポンサード リンク
| 翻訳と辞書 : 翻訳のためのインターネットリソース |
Copyright(C) kotoba.ne.jp 1997-2016. All Rights Reserved.
|
|