Regin sahifasining manbasini koʻrish

'''Regin''' ({{talaffuz|rejin}})(shuningdek, '''Prax''' ({{talaffuz|praks}}) yoki '''QWERTY'''({{talaffuz|kveti}}) nomi bilan ham tanilgan) — [[Amerika Qoʻshma Shtatlari|Amerika Qoʻshma Shtatlari]] [[AQSh Milliy Xavfsizlik Agentligi|Milliy Xavfsizlik Agentligi]] (NSA) va uning [[Britaniya]]dagi hamkasbi [[AQSh Hukumat Aloqa Bosh boshqarmasi|Hukumat Aloqa Bosh boshqarmasi]] (HAB) tomonidan qoʻllaniladigan murakkab [[zararli dastur]] va [[Haker|xakerlik]] vositalari toʻplami<ref name="nsa-und-gchq">[http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-ist-ein-werkzeug-von-nsa-und-gchq-a-1004950.html Christian Stöcker, Marcel Rosenbach „ Spionage-Software: Super-Trojaner Regin ist eine NSA-Geheimwaffe“ Der Spiegel, November 25, 2014]</ref><ref>{{Yangiliklar manbasi |title=Experts Unmask 'Regin' Trojan as NSA Tool |work=Spiegel.de |url=http://www.spiegel.de/international/world/regin-malware-unmasked-as-nsa-tool-after-spiegel-publishes-source-code-a-1015255.html |access-date=9-noyabr 2021-yil}}</ref>. Dastur ilk marotaba 2014-yil noyabr oyida [[Kaspersky Lab|Kasperskiy laboratoriyasi]], [[NortonLifeLock|Symantec]] va [[The Intercept]] tomonidan ommaga oshkor qilingan<ref name="news">{{Veb manbasi|url=http://securelist.com/blog/research/67741/regin-nation-state-ownage-of-gsm-networks|sarlavha=Regin Revealed|nashriyot=Kaspersky Lab|kirish sanasi=24-noyabr 2014-yil}}</ref><ref>{{Veb manbasi|url=https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/|ism=Morgan|muallif=Marquis-Boire|sarlavha=Secret Malware in European Union Attack Linked to U.S. and British Intelligence|nashriyot=The Intercept|sana=24-noyabr 2014-yil|qaralgan sana=2022-06-17|arxivsana=2015-07-29|arxivurl=https://web.archive.org/web/20150729041344/https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq}}</ref>. Zararli dastur [[Microsoft Windows|Microsoft Windows operatsion tizimi]]da ishlovchi kompyuterlarning muayyan foydalanuvchilarini nishoni deb biladi hamda AQSh razvedka agentligi NSA va uning britaniyalik hamkasbi GCHQ bilan doimiy aloqaga egadir<ref>{{Veb manbasi|url=https://arstechnica.com/tech-policy/2015/10/top-german-official-infected-by-highly-advanced-spy-trojan-with-nsa-ties/|sarlavha=Top German official infected by highly advanced spy trojan with NSA ties|sana=26-oktabr 2015-yil}}</ref><ref name="NYT-20141124-NP">{{Yangiliklar manbasi |last=Perlroth |first=Nicole |date=24-noyabr 2014-yil |title=Symantec Discovers 'Regin' Spy Code Lurking on Computer Networks |work=[[New York Times]] |url=http://bits.blogs.nytimes.com/2014/11/24/symantec-discovers-spy-code-lurking-on-computer-networks/ |access-date=25-noyabr 2014-yil}}</ref><ref>{{Veb manbasi|url=https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/|sarlavha=The Inside Story of How British Spies Hacked Belgium's Largest Telco|nashriyot=The Intercept|ism=Ryan|muallif=Gallagher|sana=13-dekabr 2014-yil|qaralgan sana=2022-06-17|arxivsana=2015-08-17|arxivurl=https://web.archive.org/web/20150817152413/https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/}}</ref>. ''Intercept'' dasturni yuklab olish uchun Regin namunalarini taqdim etadi. Belgiya telekommunikatsiya provayderi [[Belgacom|Belgacomda]] topilgan zararli dasturlar shular jumlasidandir<ref name="intercept20041124" />. Kasperskiy laboratoriyasi xodimlari soʻzlariga koʻra, Regin haqida ilk bor 2012-yil bahorida maʼlum boʻlgan. Biroq eng dastlabki namunalar 2003-yilga toʻgʻri kelisi haqida taʼkidlab oʻtilgan<ref>[http://www.kaspersky.com/about/news/virus/2014/Regin-a-malicious-platform-capable-of-spying-on-GSM-networks Kaspersky:Regin: a malicious platform capable of spying on GSM networks], 24 November 2014</ref>. (''Regin'' nomi birinchi marta [[VirusTotal]] veb-saytida 2011-yil 9-martda qoʻllangan)<ref name="intercept20041124" />. Regin zararli dasturi tomonidan butun dunyo boʻylab zararlangan kompyuterlarning 28 foizi [[Rossiya|Rossiyada]], 24 foizi [[Saudiya Arabistoni|Saudiya Arabistonida]], 9 foizi [[Meksika]] va [[Irlandiya oroli|Irlandiyada]] va 5 foizi [[Hindiston]], [[Afgʻoniston|Afgʻoniston]], [[Eron]], [[Belgiya]], [[Avstriya]] va [[Pokiston|Pokistonda]] boʻlgan<ref>{{Veb manbasi|url=http://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance|sarlavha=Regin: Top-tier espionage tool enables stealthy surveillance|nashriyot=Symantec|kirish sanasi=25-noyabr 2014-yil|sana=23-noyabr 2014-yil}}</ref>.

Kasperskiyning aytishicha, zararli dasturlardan asosiy qurbonlar jismoniy shaxslar, kichik biznes va telekommunikatsiya kompaniyalari hisoblanadi. Regin Stuxnet bilan taqqoslanadi va „yaxshi manbalarga ega ishlab chiqish guruhlari“, ehtimol Gʻarb hukumati tomonidan maqsadli koʻp maqsadli maʼlumotlarni yigʻish vositasi sifatida ishlab chiqilgan deb ishoniladi<ref name="bbc">{{Yangiliklar manbasi |date=23-noyabr 2014-yil |title=BBC News - Regin, new computer spying bug, discovered by Symantec |work=BBC News |url=https://www.bbc.com/news/technology-30171614 |access-date=23-noyabr 2014-yil}}</ref><ref>{{Veb manbasi|url=http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf|sarlavha=Regin White Paper|nashriyot=Symantec|kirish sanasi=23-noyabr 2014-yil|arxivsana=7-sentabr 2019-yil|arxivurl=https://web.archive.org/web/20190907005119/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf}}</ref><ref>{{Veb manbasi|url=https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf|sarlavha=Regin White Paper|nashriyot=Kaspersky Lab|kirish sanasi=24-noyabr 2014-yil}}</ref>.

''[[Die Welt]]'' nashrining yozishicha, [[Microsoft|Microsoftʼning]] xavfsizlik boʻyicha mutaxassislari unga 2011-yilda Norseʼning shu nomli ishi boʻyicha unga „Regin“ nomini berishgan<ref>{{Yangiliklar manbasi |last=Benedikt Fuest |date=24-noyabr 2014-yil |title=Ein Computervirus, so mächtig wie keines zuvor |work=Die Welt |url=https://www.welt.de/wirtschaft/webwelt/article134685163/Ein-Computervirus-so-maechtig-wie-keines-zuvor.html |archive-url=https://web.archive.org/web/20141128080847/http://www.welt.de/wirtschaft/webwelt/article134685163/Ein-Computervirus-so-maechtig-wie-keines-zuvor.html |archive-date=28-noyabr 2014-yil}}</ref>.

== Operatsiyalar ==
Regin modulli yondashuvdan foydalanadi, bu unga maqsadga toʻliq mos keladigan xususiyatlarni yuklash imkonini beradi va moslashtirilgan josuslik imkonini beradi. Dizayn uni nishonlarga qarshi doimiy, uzoq muddatli ommaviy kuzatuv operatsiyalari uchun juda mos deb biladi<ref>{{Veb manbasi|url=http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/|sarlavha=Regin Malware - 'State-Sponsored' Spying Tool Targeted Govts|ish=The Hacking Post - Latest hacking News & Security Updates|kirish sanasi=2014-11-24|arxivsana=2017-02-18|arxivurl=https://web.archive.org/web/20170218064037/http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/}}</ref><ref>{{Veb manbasi|url=http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/|sarlavha=NSA, GCHQ or both behind Stuxnet-like Regin malware?|nashriyot=scmagazineuk.com|kirish sanasi=25-noyabr 2014-yil|sana=24-noyabr 2014-yil|qaralgan sana=2022-06-17|arxivsana=2016-06-16|arxivurl=https://web.archive.org/web/20160616183435/http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/}}</ref>.

Regin yashirin va virusli tizimda bir nechta fayllarni saqlamaydi; Buning oʻrniga u oʻzining shifrlangan virtual fayl tizimidan (EVFS) foydalanadi, bu butunlay xost uchun zararsiz nomga ega boʻlgan yagona faylga oʻxshaydi, unda fayllar nom emas, faqat raqamli kod bilan aniqlanadi. EVFS kamdan-kam ishlatiladigan RC5 shifrining variantli shifrlashidan foydalanadi<ref>{{Veb manbasi|url=http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/|sarlavha=NSA, GCHQ or both behind Stuxnet-like Regin malware?|nashriyot=scmagazineuk.com|kirish sanasi=25-noyabr 2014-yil|sana=24-noyabr 2014-yil|qaralgan sana=2022-06-17|arxivsana=2016-06-16|arxivurl=https://web.archive.org/web/20160616183435/http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/}}<cite class="citation web cs1" data-ve-ignore="true">[http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/ „NSA, GCHQ or both behind Stuxnet-like Regin malware?“] {{Webarxiv|url=https://web.archive.org/web/20160616183435/http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/ |date=2016-06-16 }}. scmagazineuk.com. 24 November 2014<span class="reference-accessdate">. Retrieved <span class="nowrap">25 November</span> 2014</span>.</cite></ref>. Regin ICMP / ping, HTTP cookie fayllariga oʻrnatilgan buyruqlar va maxsus [[TCP]] va [[UDP]] protokollari yordamida Internet orqali muloqot qiladi, bu [[Botnet|buyruq va boshqaruv serveri]] bilan operatsiyalarni boshqarishi, qoʻshimcha fayllarni yuklashi va hokazo<ref name="symantecblog">{{Veb manbasi|url=http://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance|sarlavha=Regin: Top-tier espionage tool enables stealthy surveillance|nashriyot=Symantec|kirish sanasi=25-noyabr 2014-yil|sana=23-noyabr 2014-yil}}<cite class="citation web cs1" data-ve-ignore="true">[http://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance „Regin: Top-tier espionage tool enables stealthy surveillance“]. Symantec. 23 November 2014<span class="reference-accessdate">. Retrieved <span class="nowrap">25 November</span> 2014</span>.</cite></ref><ref name="whitepapers">{{Veb manbasi|url=http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf|sarlavha=Regin White Paper|nashriyot=Symantec|kirish sanasi=23-noyabr 2014-yil|arxivsana=7-sentabr 2019-yil|arxivurl=https://web.archive.org/web/20190907005119/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf}}<cite class="citation web cs1" data-ve-ignore="true">[https://web.archive.org/web/20190907005119/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf „Regin White Paper“] <span class="cs1-format">(PDF)</span>. Symantec. Archived from [http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf the original] <span class="cs1-format">(PDF)</span> on 7 September 2019<span class="reference-accessdate">. Retrieved <span class="nowrap">23 November</span> 2014</span>.</cite></ref>.

=== Nomlash ===
Symantecning aytishicha, u ham, Kasperskiy ham zararli dasturni ''Backdoor Reggin'' deb aniqlagan<ref name="symantecblog"/>. Aksariyat antivirus dasturlari, shu jumladan Kasperskiy (2015-yil oktabr holatiga koʻra) The Intercept tomonidan chiqarilgan Regin namunasini zararli dastur sifatida aniqlamaydi<ref>[https://www.virustotal.com/en/file/4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be/analysis/ Virustotal: Detection ratio: 21 / 56 ]</ref>. 2011-yil 9-martda Microsoft zararli dasturlar ensiklopediyasiga tegishli yozuvlarni qoʻshadi<ref>[http://www.microsoft.com/security/portal/mmpc/default.aspx Microsoft Malware Protection Center, click button "Malware Encyclopedia]</ref><ref>[http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3AWinNT%2FRegin.A#tab=1 Microsoft Protection Center: Trojan:WinNT/Regin.A]</ref>. Keyinroq yana ikkita variant, ''Regin.'' ''B'' va ''Regin.'' ''C'' qoʻshiladi. Microsoft Regin ''Prax-ning 64-bitli variantlarini chaqiradi.'' ''A'' va ''Prax.'' ''B''. Microsoft yozuvlarida hech qanday texnik maʼlumot yoʻq<ref name="intercept20041124">{{Veb manbasi|url=https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/|ism=Morgan|muallif=Marquis-Boire|sarlavha=Secret Malware in European Union Attack Linked to U.S. and British Intelligence|nashriyot=The Intercept|sana=24-noyabr 2014-yil|qaralgan sana=2022-06-17|arxivsana=2015-07-29|arxivurl=https://web.archive.org/web/20150729041344/https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq}}<cite class="citation web cs1" data-ve-ignore="true" id="CITEREFMarquis-BoireGuarnieriGallagher2014">Marquis-Boire, Morgan; Guarnieri, Claudio; Gallagher, Ryan (24 November 2014). [https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/ „Secret Malware in European Union Attack Linked to U.S. and British Intelligence“] {{Webarxiv|url=https://web.archive.org/web/20150729041344/https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq |date=2015-07-29 }}. The Intercept.</cite></ref>. Kasperskiy ham, Symantec ham zararli dastur haqida bilib olgan maʼlumotlari bilan oq qogʻozlarni nashr etishadi<ref name="whitepapers"/><ref name="whitepaperk">{{Veb manbasi|url=https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf|sarlavha=Regin White Paper|nashriyot=Kaspersky Lab|kirish sanasi=24-noyabr 2014-yil}}<cite class="citation web cs1" data-ve-ignore="true">[https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf „Regin White Paper“] <span class="cs1-format">(PDF)</span>. Kaspersky Lab<span class="reference-accessdate">. Retrieved <span class="nowrap">24 November</span> 2014</span>.</cite></ref>.

== Maʼlum hujumlar va zararli dasturlarning yaratuvchisi ==
Germaniyaning ''Der Spiegel'' nashri 2013-yil iyun oyida AQSh [[Intellekt|razvedka xizmati]] Milliy xavfsizlik agentligi (NSA) [[Yevropa Ittifoqi]] (Yevropa Ittifoqi) fuqarolari va Yevropa Ittifoqi institutlari ustidan onlayn kuzatuv oʻtkazgani haqida xabar berdi. Maʼlumotlar NSA sobiq xodimi [[Edward Snowden|Edvard Snouden]] tomonidan olingan maxfiy hujjatlardan olingan. ''Der Spiegel'' ham, ''The Intercept'' ham 2010-yilgi NSA maxfiy hujjatidan iqtibos keltirgan holda, u oʻsha yili foydalanilgan zararli dasturni koʻrsatmasdan, Yevropa Ittifoqining [[Vashington (shahar)|Vashingtondagi]] diplomatik vakolatxonalari va uning [[Birlashgan millatlar tashkiloti|Birlashgan Millatlar Tashkilotidagi]] vakolatxonalariga kiberhujumlar uyushtirgani haqida taʼkidlaydi<ref name="intercept20041124"/><ref name="spiegel">{{Veb manbasi|url=http://www.spiegel.de/international/europe/nsa-spied-on-european-union-offices-a-908590.html|sarlavha=Attacks from America: NSA Spied on European Union Offices|ism=Laura|muallif=Poitras|nashriyot=Der Spiegel|sana=29-iyun 2013-yil}}</ref>. Regin sifatida ishlatiladigan dasturiy taʼminotni identifikatsiya qiluvchi belgilar infektsiyalangan mashinalarda tergovchilar tomonidan topilgan.

''The Intercept'' xabar berishicha, 2013-yilda Buyuk Britaniyaning GCHQ Belgiyaning eng yirik telekommunikatsiya kompaniyasi Belgacomga hujum qilgan<ref name="intercept20041124"/>. Ushbu hujumlar Reginning xavfsizlik kompaniyalari eʼtiboriga tushishiga olib kelgan boʻlishi mumkin. IT-xavfsizlik boʻyicha Fox IT firmasi tomonidan oʻtkazilgan tahlillarga asoslanib, ''Der Spiegel'' 2014-yil noyabr oyida Regin Buyuk Britaniya va AQSh razvedka agentliklarining asbobi ekanligini maʼlum qildi. Fox IT oʻz mijozlaridan birining kompyuterlarida Reginni topdi va ularning tahliliga koʻra Regin qismlari NSA ANT katalogida „Straitbizarre“ va „Unitedrake“ nomlari ostida qayd etilgan. Fox IT mijozning ismini aytmadi, ammo ''Der Spiegel'' Fox IT mijozlari orasida Belgacom ham borligini eslatib oʻtdi va Fox IT rahbari Ronald Prinsning Belgacom tarmogʻida topganlari haqida gapirishga ruxsat berilmaganligini taʼkidlaydi<ref name="nsa-und-gchq"/>.

2014-yil dekabr oyida Germaniyaning ''[[Bild]]'' gazetasi Regin kansler [[Angela Merkel|Angela Merkelning]] xodimi ishlatgan [[USB|USB flesh-diskdan]] topilganini xabar qiladi. Germaniya kanslerligidagi barcha yuqori himoyalangan noutbuklarni tekshirishda qoʻshimcha infeksiyalar aniqlanmaydi<ref>{{Yangiliklar manbasi |date=29-dekabr 2014-yil |title=German government denies falling victim to cyber attack |work=Deutsche Welle |url=http://www.dw.de/german-government-denies-falling-victim-to-cyber-attack/a-18158951}}</ref>.

Regin 2018-yilning oktabr va noyabr oylarida [[Yandex|Yandex’ning]] tadqiqot va ishlanmalar boʻlinmasini buzish uchun ishlatilgan<ref name="MoscowTimes">{{Yangiliklar manbasi |date=27-iyun 2019-yil |title=Western Intelligence Hacked 'Russia's Google' Yandex to Spy on Accounts |agency=Reuters |url=https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194 |archive-url=https://web.archive.org/web/20190629085027/https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194 |archive-date=29-iyun 2019-yil}}</ref>.

== Yana qarang ==

* Kengaytirilgan doimiy tahdid
* [[Qo'shma Shtatlardagi kiberurush]]
* [[NSA ANT katalogi]]
* [[Stuxnet]]
* [[Warrior pride]]

== Manbalar ==
{{Manbalar|30em|}}
[[Turkum:Kompyuter viruslari]]
[[Turkum:Kompyuter qurtlari]]