{"data":{"cases":[{"actions":{"de":["Prüfe unter Windows 2000 Server, ob IIS läuft: Der Webserver ist standardmäßig installiert. Die Lücke ist auch dann erreichbar, wenn niemand den Indexdienst nutzt.","Installiere Microsofts Patch **MS01-033** (KB Q300972) oder ein späteres Update, das ihn enthält, etwa **Windows 2000 Service Pack 3**.","Wenn du ihn nicht installieren kannst, entferne in IIS die **Skriptzuordnungen für .ida und .idq**.","Halte Server, auf denen noch Windows NT 4.0 oder Windows 2000 läuft, vom offenen Internet fern."],"en":["On Windows 2000 Server, check whether IIS is running: it is installed by default. The flaw can be reached even if nobody uses the indexing service.","Install Microsoft's fix **MS01-033** (KB Q300972) or a later update that contains it, such as **Windows 2000 Service Pack 3**.","If you cannot install it, remove the **.ida and .idq script mappings** in IIS.","Keep servers that still run Windows NT 4.0 or Windows 2000 off the open internet."]},"criteria":{"damage":{"de":"Die Kosten einschließlich späterer Versionen des Wurms werden auf mehr als 2,6 Milliarden US-Dollar geschätzt (Computer Economics, zitiert von CAIDA).","en":"The cost, including later versions of the worm, is estimated at more than USD 2.6 billion (Computer Economics, quoted by CAIDA).","met":true},"exploitation":{"de":"Code Red war ein Wurm: Jeder infizierte Server griff von selbst neue Server an (CAIDA).","en":"Code Red was a worm: every infected server attacked new ones on its own (CAIDA).","met":true},"reach":{"de":"Code Red infizierte am 19. Juli 2001 in weniger als 14 Stunden 359.104 Computer (CAIDA).","en":"Code Red infected 359,104 computers in less than 14 hours on July 19, 2001 (CAIDA).","met":true},"response":{"de":"Der Patch von Microsoft war seit dem 18. Juni 2001 verfügbar. Die Quellen belegen keine Maßnahmen über das übliche Patchen hinaus (Microsoft, CAIDA).","en":"Microsoft's fix had been out since June 18, 2001. The sources document no measures beyond routine patching (Microsoft, CAIDA).","met":false}},"cves":["CVE-2001-0500"],"cvss":10,"cvss_version":"2.0","cwe":"NVD-CWE-Other","dates":[{"date":"2001-06-18","key":"patched"},{"date":"2001-07-12","key":"exploited"},{"date":"2001-07-19","key":"outbreak"},{"date":"2001-08-01","de":"Code Red verbreitet sich erneut","en":"Code Red starts to spread again"},{"date":"2001-08-04","de":"CodeRedII, ein anderer Wurm, nutzt dieselbe Sicherheitslücke aus","en":"CodeRedII, a different worm, uses the same flaw"}],"de":{"credit":"eEye Digital Security","fixed":"Microsoft-Patch MS01-033 (18. Juni 2001); enthalten im Windows 2000 Service Pack 3","product":"Microsoft-IIS-Webserver","summary":"Ein sich selbst verbreitender Wurm nutzte eine Lücke in Microsofts Webserver-Software IIS aus. Microsoft hatte den Patch einen Monat zuvor veröffentlicht."},"disclosed":"2001-07-19","en":{"credit":"eEye Digital Security","fixed":"Microsoft patch MS01-033 (June 18, 2001); part of Windows 2000 Service Pack 3","product":"Microsoft IIS web servers","summary":"A self-spreading worm used a flaw in Microsoft's web server software IIS, a month after Microsoft had published the fix."},"figures":[{"de":"Computer in weniger als 14 Stunden infiziert","en":"computers infected in less than 14 hours","value":"359,104"},{"de":"Tage zwischen Microsofts Patch und dem massenhaften Ausbruch","en":"days between Microsoft's fix and the mass outbreak","value":"31"},{"de":"der infizierten Computer waren Rechner von Privatleuten und kleinen Firmen","en":"of the infected computers were home and small-business machines","value":"21 %"}],"key":"code-red","name":"Code Red","product":"Microsoft IIS","sources":[{"de":"CAIDA: Code-Red, eine Fallstudie zu Ausbreitung und Opfern eines Internet-Wurms (2002, PDF)","title":"CAIDA: Code-Red, a case study on the spread and victims of an Internet worm (2002, PDF)","url":"https://www.caida.org/publications/papers/2002/codered/codered.pdf"},{"de":"CAIDA: die Ausbreitung des Code-Red-Wurms (CRv2)","title":"CAIDA: the spread of the Code-Red worm (CRv2)","url":"https://www.caida.org/archive/code-red/coderedv2_analysis/"},{"de":"CAIDA: Archiv zu Code-Red, mit CodeRedII","title":"CAIDA: Code-Red archive, with CodeRedII","url":"https://www.caida.org/archive/code-red/"},{"de":"Microsoft-Sicherheitsbulletin MS01-033","title":"Microsoft security bulletin MS01-033","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033"},{"de":"NVD: CVE-2001-0500","title":"NVD: CVE-2001-0500","url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0500"},{"de":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF), mit Code Red zum Vergleich","title":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF), with Code Red for comparison","url":"https://css.csail.mit.edu/6.566/2018/readings/slammer.pdf"}],"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","year":2001},{"actions":{"de":["Installiere auf Servern mit IIS 4.0 oder 5.0 Microsofts kumulativen Patch **MS01-044** oder ein späteres Update, etwa das **Windows 2000 Service Pack 3**. Das schließt alle IIS-Lücken, die Nimda ausnutzte.","Aktualisiere den **Internet Explorer 5.01 oder 5.5** mit dem Patch aus **MS01-020** oder einem späteren kumulativen Patch oder steige auf IE 6 um. So können E-Mails Anhänge nicht mehr von selbst starten. Installiere IE 6 unter Windows 95, 98 und ME als typische oder vollständige Installation.","Betrachte den Computer als übernommen, wenn du Folgendes findest: eine Datei **root.exe** auf einem IIS-Server, eine **Admin.dll** im obersten Ordner von Laufwerk C:, D: oder E: oder unerwartete .eml- oder .nws-Dateien in vielen Ordnern. Formatiere dann das Systemlaufwerk und installiere das System von vertrauenswürdigen Medien neu.","Blockiere eingehenden Webverkehr auf **Port 80** zu Computern, die keine Webserver sein sollen. Sperre **TFTP (UDP-Port 69)** am Übergang deines Netzwerks zum Internet. Halte Computer, auf denen noch Windows NT 4.0 oder Windows 2000 läuft, vom offenen Internet fern."],"en":["On servers with IIS 4.0 or 5.0, install Microsoft's cumulative patch **MS01-044** or a later update, such as **Windows 2000 Service Pack 3**. This closes every IIS flaw that Nimda used.","Update **Internet Explorer 5.01 or 5.5** with the fix from **MS01-020** or a later cumulative patch, or move to IE 6. That way, e-mails can no longer start attachments on their own. On Windows 95, 98 and ME, install IE 6 with the Typical or Full option.","Treat the computer as taken over if you find a **root.exe** file on an IIS server, an **Admin.dll** in the top folder of drive C:, D: or E:, or unexpected .eml or .nws files in many folders. Then format the system drive and reinstall from trusted media.","Block incoming web traffic on **port 80** to computers that are not meant to be web servers. Block **TFTP (UDP port 69)** at the edge of your network. Keep computers that still run Windows NT 4.0 or Windows 2000 off the open internet."]},"criteria":{"damage":{"de":"Die einzige Gesamtzahl, eine Schätzung von Computer Economics, liegt bei 635 Millionen US-Dollar und damit unter der Schwelle. CERT/CC erhielt Meldungen über Ausfälle durch Überlastung (Denial of Service), doch die Quellen belegen keine Ausfälle kritischer Dienste (Computer Economics; CERT/CC).","en":"The only total is an estimate of USD 635 million by Computer Economics, below the threshold. CERT/CC received reports of denial of service, but the sources document no outage of critical services (Computer Economics; CERT/CC).","met":false},"exploitation":{"de":"Nimda war ein Wurm: Jeder infizierte Computer suchte nach IIS-Servern und infizierte sie von selbst. Binnen 12 Stunden versuchten 450.000 Internetadressen, ihn weiterzuverbreiten (CERT/CC; CAIDA).","en":"Nimda was a worm: every infected computer searched for IIS servers and infected them on its own. Within 12 hours, 450,000 internet addresses tried to spread it (CERT/CC; CAIDA).","met":true},"reach":{"de":"CAIDA zählte am 18. September 2001 auf dem Höhepunkt 160.000 infizierte Computer. Microsofts Webserver-Software lief in diesem Monat auf 27,46 % aller Websites (CAIDA; Netcraft).","en":"CAIDA counted 160,000 infected computers at the peak on September 18, 2001. That month, Microsoft's web server software ran 27.46 % of all websites (CAIDA; Netcraft).","met":true},"response":{"de":"Microsofts Patches waren seit mindestens vier Monaten verfügbar. Darüber hinaus belegen die Quellen nur Internetanbieter, die infizierte Kunden vom Netz nahmen oder den Webverkehr blockierten, sowie ein Hilfsprogramm von Microsoft (CAIDA; Microsoft).","en":"Microsoft's fixes had been out for at least four months. Beyond them, the sources document only internet providers that cut off infected customers or blocked web traffic, and a support program by Microsoft (CAIDA; Microsoft).","met":false}},"cves":["CVE-2001-0333","CVE-2000-0884","CVE-2001-0154"],"cvss":7.5,"cvss_version":"2.0","cwe":"NVD-CWE-Other","dates":[{"date":"2000-10-17","de":"Microsoft warnt vor der älteren IIS-Lücke; ein Patch vom August 2000 schließt sie bereits (MS00-078)","en":"Microsoft warns of the older IIS flaw; a patch from August 2000 already fixes it (MS00-078)"},{"date":"2001-03-29","de":"Microsoft schließt die Lücke im Internet Explorer, die E-Mail-Anhänge von selbst ausführt (MS01-020)","en":"Microsoft fixes the Internet Explorer flaw that runs e-mail attachments on its own (MS01-020)"},{"date":"2001-05-14","key":"patched"},{"date":"2001-08-04","de":"CodeRedII beginnt, sich zu verbreiten, und hinterlässt Hintertüren auf IIS-Servern","en":"CodeRedII begins to spread and leaves backdoors on IIS servers"},{"date":"2001-08-15","de":"Der kumulative Patch MS01-044 enthält die Fixes für alle IIS-Lücken, die Nimda später ausnutzt","en":"Cumulative patch MS01-044 contains the fixes for all IIS flaws that Nimda later uses"},{"date":"2001-09-18","key":"outbreak"},{"date":"2001-09-18","key":"peak"}],"de":{"credit":"NSFocus meldete Microsoft die Hauptlücke","fixed":"MS01-026 (14. Mai 2001) für die Hauptlücke; alle IIS-Lücken im kumulativen Patch MS01-044 (15. August 2001); die Lücke im Internet Explorer in MS01-020 (29. März 2001)","product":"Microsoft-IIS-Webserver und Windows-Computer mit Internet Explorer 5.01 oder 5.5","summary":"Ein Wurm griff Microsofts Webserver und Windows-PCs auf fünf Wegen zugleich an, von E-Mails bis zu Hintertüren von CodeRedII. In sieben Stunden infizierte er 160.000 Computer."},"disclosed":"2001-09-18","en":{"credit":"NSFocus reported the main flaw to Microsoft","fixed":"MS01-026 (May 14, 2001) for the main flaw; all IIS flaws in the cumulative patch MS01-044 (August 15, 2001); the Internet Explorer flaw in MS01-020 (March 29, 2001)","product":"Microsoft IIS web servers, and Windows computers with Internet Explorer 5.01 or 5.5","summary":"A worm attacked Microsoft's web servers and Windows PCs by five routes at once, from e-mail to backdoors left by CodeRedII. It infected 160,000 computers within seven hours."},"figures":[{"de":"Computer auf dem Höhepunkt infiziert, 7 Stunden nach Beginn des Ausbruchs","en":"computers infected at the peak, 7 hours after the outbreak began","value":"160,000"},{"de":"Tage zwischen Microsofts Patch für die Hauptlücke und dem Ausbruch","en":"days between Microsoft's fix for the main flaw and the outbreak","value":"127"},{"de":"Internetadressen versuchten in den ersten 12 Stunden, den Wurm zu verbreiten","en":"internet addresses tried to spread the worm within the first 12 hours","value":"450,000"},{"de":"aller Websites liefen mit Microsofts Webserver-Software, die der Wurm angriff","en":"of all websites ran on Microsoft's web server software, which the worm attacked","value":"27 %"}],"key":"nimda","name":"Nimda","product":"Microsoft IIS, Internet Explorer","sources":[{"de":"CERT/CC-Warnung CA-2001-26: Nimda Worm (in der SEI-Sammlung der Warnungen von 2001, PDF)","title":"CERT/CC advisory CA-2001-26: Nimda Worm (in the SEI collection of 2001 advisories, PDF)","url":"https://www.sei.cmu.edu/documents/508/2001_019_001_496192.pdf"},{"de":"CAIDA: Dynamic Graphs of Nimda, die Ausbreitung am 18. und 19. September 2001","title":"CAIDA: Dynamic Graphs of Nimda, the spread on September 18 and 19, 2001","url":"https://www-old.caida.org/dynamic/analysis/security/nimda/"},{"de":"How to 0wn the Internet in Your Spare Time, USENIX Security Symposium (2002), mit Messungen zu Nimda am LBNL","title":"How to 0wn the Internet in Your Spare Time, USENIX Security Symposium (2002), with measurements of Nimda at LBNL","url":"https://www.icir.org/vern/papers/cdc-usenix-sec02/"},{"de":"Netcraft Web Server Survey vom Oktober 2001, mit den Zahlen vom September (Kopie auf LWN.net)","title":"Netcraft Web Server Survey of October 2001, with the September figures (copy on LWN.net)","url":"https://static.lwn.net/2001/1108/a/netcraft1001.php3"},{"de":"Microsoft-Sicherheitsbulletin MS01-026: kumulativer Patch für IIS mit dem Fix für die Hauptlücke","title":"Microsoft security bulletin MS01-026: cumulative patch for IIS with the fix for the main flaw","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026"},{"de":"Microsoft-Sicherheitsbulletin MS00-078: Web Server Folder Traversal","title":"Microsoft security bulletin MS00-078: Web Server Folder Traversal","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078"},{"de":"Microsoft-Sicherheitsbulletin MS01-020: Internet Explorer führt E-Mail-Anhänge aus","title":"Microsoft security bulletin MS01-020: Internet Explorer runs e-mail attachments","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-020"},{"de":"Microsoft-Sicherheitsbulletin MS01-044: kumulativer Patch für IIS vom 15. August 2001","title":"Microsoft security bulletin MS01-044: cumulative patch for IIS of August 15, 2001","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-044"},{"de":"NVD: CVE-2001-0333","title":"NVD: CVE-2001-0333","url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0333"},{"de":"NVD: CVE-2000-0884","title":"NVD: CVE-2000-0884","url":"https://nvd.nist.gov/vuln/detail/CVE-2000-0884"},{"de":"NVD: CVE-2001-0154","title":"NVD: CVE-2001-0154","url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0154"},{"de":"CAIDA: Archiv zu Code-Red, mit CodeRedII","title":"CAIDA: Code-Red archive, with CodeRedII","url":"https://www.caida.org/archive/code-red/"},{"de":"Computer Economics (heute Teil von Avasant): wirtschaftliche Folgen von Schadcode im Jahr 2001, eine Schätzung","title":"Computer Economics (now part of Avasant): economic impact of malicious code in 2001, an estimate","url":"https://avasant.com/?p=250739"},{"de":"Microsoft: Strategic Technology Protection Program (3. Oktober 2001)","title":"Microsoft: Strategic Technology Protection Program (October 3, 2001)","url":"https://news.microsoft.com/source/2001/10/03/microsoft-aligns-company-resources-to-ensure-secure-customer-networks/"},{"de":"Microsoft Security Blog: 20 Jahre Trustworthy Computing, über Code Red und Nimda (2022)","title":"Microsoft Security Blog: 20 years of Trustworthy Computing, on Code Red and Nimda (2022)","url":"https://www.microsoft.com/en-us/security/blog/2022/01/21/celebrating-20-years-of-trustworthy-computing/"}],"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","year":2001},{"actions":{"de":["Installiere **SQL Server 2000 Service Pack 3** oder zumindest den Patch aus dem Microsoft-Bulletin **MS02-039** oder seinem Nachfolger MS02-061.","Such auch nach **MSDE 2000**: Die Datenbank steckt in anderen Produkten, etwa in Visual Studio und der Office Developer Edition, und braucht denselben Fix.","Sperre **UDP-Port 1434** in deiner Firewall, damit der Resolution Service aus dem Internet nicht erreichbar ist."],"en":["Install **SQL Server 2000 Service Pack 3** or at least the patch from Microsoft bulletin **MS02-039** or its successor MS02-061.","Look for **MSDE 2000** as well: it ships inside other products, such as Visual Studio and Office Developer Edition, and needs the same fix.","Block **UDP port 1434** at your firewall, so the Resolution Service cannot be reached from the internet."]},"criteria":{"damage":{"de":"Im Kernkraftwerk Davis-Besse war das Safety Parameter Display System 4 Stunden und 50 Minuten nicht verfügbar. Steuerung und Schutzfunktionen der Anlage waren nicht betroffen (US-NRC).","en":"At the Davis-Besse nuclear plant, the safety parameter display system was unavailable for 4 hours 50 minutes. Plant control and protection were not affected (US NRC).","met":true},"exploitation":{"de":"Slammer war ein sich selbst verbreitender Wurm, der in 10 Minuten mehr als 90 % der verwundbaren Computer infizierte (Inside the Slammer Worm, 2003).","en":"Slammer was a self-spreading worm that infected more than 90 % of vulnerable computers within 10 minutes (Inside the Slammer Worm, 2003).","met":true},"reach":{"de":"Gezählt wurden mindestens 75.000 infizierte Computer. Die tatsächliche Zahl kann höher liegen, doch keine Messung in den Quellen erreicht 100.000 (Inside the Slammer Worm, 2003).","en":"At least 75,000 infected computers were measured. The true number may be higher, but no measurement in the sources reaches 100,000 (Inside the Slammer Worm, 2003).","met":false},"response":{"de":"Der Patch von Microsoft war seit dem 24. Juli 2002 verfügbar. Darüber hinaus belegen die Quellen nur, dass Netzwerke UDP-Port 1434 sperrten (Microsoft, Inside the Slammer Worm).","en":"Microsoft's patch had been out since July 24, 2002. Beyond it, the sources document only networks blocking UDP port 1434 (Microsoft, Inside the Slammer Worm).","met":false}},"cves":["CVE-2002-0649"],"cvss":7.5,"cvss_version":"2.0","cwe":"CWE-119","dates":[{"date":"2002-07-24","key":"patched"},{"date":"2002-07-25","de":"Microsoft nimmt MSDE 2000 in sein Bulletin auf","en":"Microsoft adds MSDE 2000 to its bulletin"},{"date":"2003-01-25","key":"outbreak"},{"date":"2003-08-29","de":"Die US-Atomaufsicht NRC meldet den Wurm im Netzwerk des Kraftwerks Davis-Besse","en":"The US nuclear regulator NRC reports the worm in the network of the Davis-Besse plant"}],"de":{"credit":"NGSSoftware (Next Generation Security Software, Großbritannien)","fixed":"Microsoft-Patch MS02-039 (24. Juli 2002); enthalten im SQL Server 2000 Service Pack 3","product":"Datenbankserver Microsoft SQL Server 2000 und MSDE 2000","summary":"Ein nur 376 Byte großer Wurm verbreitete sich hundertmal schneller als Code Red und überflutete Netzwerke mit seinem Datenverkehr."},"disclosed":"2003-01-25","en":{"credit":"NGSSoftware (Next Generation Security Software, UK)","fixed":"Microsoft patch MS02-039 (July 24, 2002); part of SQL Server 2000 Service Pack 3","product":"Microsoft SQL Server 2000 and MSDE 2000 databases","summary":"A worm of just 376 bytes spread a hundred times faster than Code Red and flooded networks with its traffic."},"figures":[{"de":"bis mehr als 90 % der verwundbaren Server infiziert waren","en":"to infect more than 90 % of vulnerable servers","value":"10 min"},{"de":"fiel das Safety Parameter Display System im Kernkraftwerk Davis-Besse aus","en":"outage of the safety parameter display system at the Davis-Besse nuclear plant","value":"4 h 50 min"},{"de":"infizierte Computer mindestens, vielleicht erheblich mehr","en":"infected computers at least, perhaps considerably more","value":"75,000"}],"key":"sql-slammer","name":"SQL Slammer","product":"Microsoft SQL Server 2000","sources":[{"de":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF)","title":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF)","url":"https://css.csail.mit.edu/6.566/2018/readings/slammer.pdf"},{"de":"CAIDA: die Ausbreitung des Sapphire/Slammer-Wurms","title":"CAIDA: the spread of the Sapphire/Slammer worm","url":"https://www-old.caida.org/publications/papers/2003/sapphire/sapphire.html"},{"de":"Microsoft-Sicherheitsbulletin MS02-039","title":"Microsoft security bulletin MS02-039","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039"},{"de":"NVD: CVE-2002-0649","title":"NVD: CVE-2002-0649","url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0649"},{"de":"US-NRC, Information Notice 2003-14: Slammer im Netzwerk des Kernkraftwerks Davis-Besse (PDF)","title":"US NRC Information Notice 2003-14: Slammer in the network of the Davis-Besse nuclear plant (PDF)","url":"https://www.nrc.gov/docs/ML0324/ML032410430.pdf"}],"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","year":2003},{"actions":{"de":["Installiere Microsofts Update **MS03-039** (KB824146) auf jedem Computer, auf dem noch Windows NT 4.0, 2000, XP oder Server 2003 läuft. Es enthält den Fix aus MS03-026 und schließt drei weitere Lücken im selben Dienst.","Wenn du es nicht sofort installieren kannst, schalte **DCOM** ab, wie im Microsoft-Artikel KB825750 beschrieben. Programme, die DCOM über das Netzwerk nutzen, funktionieren dann nicht mehr.","Sperre die TCP-Ports **135, 139, 445 und 593** sowie die UDP-Ports 135, 137, 138 und 445 in deiner Firewall, damit niemand RPC aus dem Internet erreichen kann.","Ersetze diese alten Windows-Versionen: Sie erhalten keine regelmäßigen Sicherheitsupdates mehr."],"en":["On any computer that still runs Windows NT 4.0, 2000, XP or Server 2003, install Microsoft's update **MS03-039** (KB824146). It contains the fix from MS03-026 and closes three more flaws in the same service.","If you cannot install it at once, switch off **DCOM** as described in Microsoft article KB825750. Programs that use DCOM across the network then stop working.","Block TCP ports **135, 139, 445 and 593** and UDP ports 135, 137, 138 and 445 at your firewall, so that no one can reach RPC from the internet.","Replace these old Windows versions: they no longer receive regular security updates."]},"criteria":{"damage":{"de":"Die Quellen nennen keine Gesamtsumme des Schadens und belegen keine Ausfälle kritischer Dienste. Laut einer Umfrage unter 19 Forschungsuniversitäten gab jede im Schnitt 299.579 US-Dollar für die Bereinigung aus (The Blaster Worm: Then and Now, 2005).","en":"The sources give no total of the damage and document no outages of critical services. A survey of 19 research universities found that each spent an average of USD 299,579 to recover (The Blaster Worm: Then and Now, 2005).","met":false},"exploitation":{"de":"Blaster war ein Wurm: Jeder infizierte Computer suchte neue Opfer und infizierte sie selbstständig (CERT/CC; The Blaster Worm: Then and Now, 2005).","en":"Blaster was a worm: every infected computer searched for new victims and infected them on its own (CERT/CC; The Blaster Worm: Then and Now, 2005).","met":true},"reach":{"de":"Blaster infizierte in seiner ersten Woche mehr als 100.000 Windows-Computer. Am aktivsten Tag sah ein überwachter Adressblock, der 1/256 des Internets umfasst, etwa 106.000 infizierte Adressen (The Blaster Worm: Then and Now, 2005).","en":"Blaster infected more than 100,000 Windows computers in its first week. On its busiest day, a monitored address block covering 1/256 of the internet saw about 106,000 infected addresses (The Blaster Worm: Then and Now, 2005).","met":true},"response":{"de":"Microsoft stellte seinen Patch sogar für Windows-Versionen bereit, deren Support beendet war, und nahm die angegriffene Adresse windowsupdate.com aus dem DNS. Gemeinsam mit dem FBI, dem US Secret Service und Interpol setzte Microsoft 250.000 US-Dollar Belohnung für die Urheber aus (Microsoft; SANS Internet Storm Center; US Secret Service).","en":"Microsoft provided its fix even for Windows versions whose support had ended. It took the attacked address windowsupdate.com out of the DNS. Joined by the FBI, the US Secret Service and Interpol, it offered USD 250,000 for the authors (Microsoft; SANS Internet Storm Center; US Secret Service).","met":true}},"cves":["CVE-2003-0352"],"cvss":7.5,"cvss_version":"2.0","cwe":"NVD-CWE-Other","dates":[{"date":"2003-07-16","key":"patched"},{"date":"2003-07-26","de":"Funktionierender Angriffscode erscheint auf einer öffentlichen Mailingliste","en":"Working attack code appears on a public mailing list"},{"date":"2003-07-31","key":"exploited"},{"date":"2003-08-11","key":"outbreak"},{"date":"2003-08-15","de":"Microsoft entfernt windowsupdate.com, das Angriffsziel des Wurms, aus dem DNS","en":"Microsoft takes windowsupdate.com, the target of the worm's attack, out of the DNS"},{"date":"2003-08-18","de":"Ein zweiter Wurm, Welchia, auch Nachi genannt, nutzt dieselbe Sicherheitslücke aus","en":"Welchia, also called Nachi, a second worm, uses the same flaw"},{"date":"2003-09-10","de":"Microsoft behebt mit MS03-039 drei weitere Sicherheitslücken im selben Dienst","en":"Microsoft fixes three more flaws in the same service with MS03-039"},{"date":"2003-11-05","de":"Microsoft setzt gemeinsam mit dem FBI, dem US Secret Service und Interpol 250.000 US-Dollar Belohnung für die Urheber aus","en":"Microsoft, joined by the FBI, the US Secret Service and Interpol, offers USD 250,000 for the authors"}],"de":{"credit":"The Last Stage of Delirium Research Group","fixed":"Microsoft-Patch MS03-026, KB823980 (16. Juli 2003); ersetzt durch MS03-039, KB824146 (10. September 2003)","product":"Windows NT 4.0, 2000, XP und Server 2003, über den standardmäßig laufenden RPC-Dienst","summary":"Ein Wurm infizierte über eine Lücke in einem standardmäßig laufenden Windows-Dienst binnen einer Woche mehr als 100.000 Computer. Ein Jahr später verbreitete er sich noch immer."},"disclosed":"2003-08-11","en":{"credit":"The Last Stage of Delirium Research Group","fixed":"Microsoft patch MS03-026, KB823980 (July 16, 2003); replaced by MS03-039, KB824146 (September 10, 2003)","product":"Windows NT 4.0, 2000, XP and Server 2003, through the RPC service that runs by default","summary":"Through a flaw in a Windows service that runs by default, a worm infected more than 100,000 computers in a week. A year later, it was still spreading."},"figures":[{"de":"Windows-Computer in der ersten Woche infiziert","en":"Windows computers infected in the first week","value":"100,000+"},{"de":"Verdopplungszeit der Zahl infizierter Computer in den ersten Stunden","en":"doubling time of the number of infected computers in the first hours","value":"9 min"},{"de":"Adressen verbreiteten den Wurm ein Jahr später noch immer","en":"addresses were still spreading the worm a year later","value":"200,000+"},{"de":"US-Dollar gab jede von 19 Forschungsuniversitäten im Schnitt für die Bereinigung aus","en":"US dollars spent on average by each of 19 research universities to recover","value":"299,579"}],"key":"blaster","name":"Blaster","product":"Microsoft Windows","sources":[{"de":"Microsoft-Sicherheitsbulletin MS03-026","title":"Microsoft security bulletin MS03-026","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-026"},{"de":"Microsoft-Sicherheitsbulletin MS03-039, das MS03-026 ersetzt","title":"Microsoft security bulletin MS03-039, which replaces MS03-026","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-039"},{"de":"NVD: CVE-2003-0352","title":"NVD: CVE-2003-0352","url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0352"},{"de":"CERT/CC-Schwachstellenhinweis VU#568148","title":"CERT/CC vulnerability note VU#568148","url":"https://www.kb.cert.org/vuls/id/568148"},{"de":"CERT/CC-Sicherheitswarnungen von 2003, darunter CA-2003-19 und CA-2003-20 zu Blaster","title":"CERT/CC advisories of 2003, including CA-2003-19 and CA-2003-20 on Blaster","url":"https://www.sei.cmu.edu/library/2003-cert-advisories/"},{"de":"The Blaster Worm: Then and Now, IEEE Security \u0026 Privacy (2005, PDF)","title":"The Blaster Worm: Then and Now, IEEE Security \u0026 Privacy (2005, PDF)","url":"https://vhosts.eecs.umich.edu/fjgroup/pubs/blaster-ieeesp.pdf"},{"de":"Microsoft: Maßnahmen gegen Blaster und den erwarteten Angriff auf windowsupdate.com (15. August 2003)","title":"Microsoft: steps against Blaster and the expected attack on windowsupdate.com (August 15, 2003)","url":"https://news.microsoft.com/source/2003/08/15/microsoft-outlines-specific-steps-to-help-ensure-pc-security/"},{"de":"SANS Internet Storm Center: Microsoft löst windowsupdate.com nicht mehr auf (15. August 2003)","title":"SANS Internet Storm Center: Microsoft no longer resolves windowsupdate.com (August 15, 2003)","url":"https://isc.sans.edu/diary.html?storyid=27"},{"de":"US Secret Service: Microsofts Belohnungsprogramm mit den Strafverfolgungsbehörden, 250.000 US-Dollar für die Urheber von Blaster (November 2003)","title":"US Secret Service: Microsoft's reward program with law enforcement, USD 250,000 for the authors of Blaster (November 2003)","url":"https://www.secretservice.gov/press/releases/2003/11/microsoft-announces-anti-virus-reward-program-microsoft-teams-law"},{"de":"Microsoft: Allianz mit Internetanbietern und das Bereinigungstool für Blaster (Februar 2004)","title":"Microsoft: alliance with internet providers and the Blaster cleanup tool (February 2004)","url":"https://news.microsoft.com/source/2004/02/24/microsoft-builds-alliance-with-service-providers-to-advance-security-for-internet-users-worldwide/"},{"de":"Cisco-Sicherheitshinweis: Empfehlungen gegen den Nachi-Wurm (2003, Kopie aus einer Mailingliste)","title":"Cisco security notice: Nachi worm mitigation recommendations (2003, mailing-list copy)","url":"https://seclists.org/fulldisclosure/2003/Aug/1192"}],"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","year":2003},{"actions":{"de":["Betreibe eine DNS-Server-Version, die noch Updates bekommt: Seit den Fixes vom Juli 2008 wählen Resolver für jede Anfrage einen **zufälligen Quellport**.","Entferne feste Ports aus der Konfiguration des Resolvers, etwa eine Portnummer in der BIND-Option `query-source`: Ein fester Port schaltet die Zufallswahl ab.","Prüfe NAT-Router und Firewalls vor dem Resolver: Manche ersetzen die zufälligen Quellports durch vorhersagbare.","Lass deinen Resolver rekursive Anfragen nur aus deinem eigenen Netz beantworten. Schalte die **DNSSEC-Validierung** ein, die ISC die einzige endgültige Lösung nennt."],"en":["Run a DNS server version that still gets updates: since the fixes of July 2008, resolvers choose a **random source port** for every query.","Remove fixed ports from the resolver's configuration, such as a port number in BIND's `query-source` option: a fixed port switches the random choice off.","Check NAT routers and firewalls in front of the resolver: some replace the random source ports with predictable ones.","Let your resolver answer recursive queries only from your own network. Switch on **DNSSEC validation**, which ISC calls the only definitive solution."]},"criteria":{"damage":{"de":"Keine Quelle nennt eine Zahl zum Schaden. Weder Ausfälle kritischer Dienste noch große Datendiebstähle sind belegt.","en":"No source gives a figure for the damage, and no outage of critical services or large data theft is documented.","met":false},"exploitation":{"de":"Angriffscode war ab dem 23. Juli 2008 öffentlich. Im August 2008 fanden Forscher auf offenen Resolvern vergiftete Antworten für Domains von Banken und Websites, konnten sie dieser Lücke aber nicht zuordnen. Die Quellen belegen keine Massenangriffe (DNS-OARC; Recursive DNS Architectures and Vulnerability Implications, NDSS 2009).","en":"Attack code was public from July 23, 2008. In August 2008, researchers found poisoned answers for bank and web domains on open resolvers, but could not tie them to this flaw. The sources document no mass attacks (DNS-OARC; Recursive DNS Architectures and Vulnerability Implications, NDSS 2009).","met":false},"reach":{"de":"Fast alle DNS-Server im Internet waren verwundbar (CERT.at). Noch Monate nach den Fixes schickten etwa 57 % der 0,9 Millionen getesteten offenen Resolver jede Anfrage vom selben Port ab (Recursive DNS Architectures and Vulnerability Implications, NDSS 2009).","en":"Almost all DNS servers on the internet were vulnerable (CERT.at). Months after the fixes, about 57 % of 0.9 million open resolvers probed still sent every query from the same port (Recursive DNS Architectures and Vulnerability Implications, NDSS 2009).","met":true},"response":{"de":"Auf Betreiben von CERT/CC veröffentlichten fast alle Hersteller von DNS-Software ihre Fixes am selben Tag, dem 8. Juli 2008. Das österreichische CERT nannte das nahezu beispiellos. Später verwies die US-Regierung auf die Lücke, als sie um Stellungnahmen zur Signierung der DNS-Root-Zone mit DNSSEC bat (CERT/CC; CERT.at; NTIA).","en":"CERT/CC arranged for almost all makers of DNS software to publish fixes on the same day, July 8, 2008. The Austrian CERT called this almost unprecedented. The US government later cited the flaw when it asked for comments on signing the DNS root zone with DNSSEC (CERT/CC; CERT.at; NTIA).","met":true}},"cves":["CVE-2008-1447"],"cvss":6.8,"cvss_version":"3.1","cwe":"CWE-331","dates":[{"date":"2008-03-31","de":"Hersteller von DNS-Software treffen sich bei Microsoft, um die Lücke und ihren Fix zu besprechen","en":"Makers of DNS software meet at Microsoft to discuss the flaw and its fix"},{"date":"2008-07-08","key":"disclosed"},{"date":"2008-07-08","key":"patched"},{"date":"2008-07-21","de":"Details des Angriffs sickern vor dem geplanten Vortrag durch","en":"Details of the attack leak before the planned talk"},{"date":"2008-07-23","de":"Funktionierender Angriffscode wird veröffentlicht","en":"Working attack code is published"},{"date":"2008-07-30","de":"Berichte über einen vergifteten DNS-Server beim Provider AT\u0026T in Texas","en":"Reports of a poisoned DNS server at the provider AT\u0026T in Texas"},{"date":"2008-10-09","de":"Die US-Regierung bittet um Stellungnahmen zur Signierung der DNS-Root-Zone mit DNSSEC und verweist auf die Lücke","en":"The US government asks for comments on signing the DNS root zone with DNSSEC and cites the flaw"},{"date":"2010-07-15","de":"Resolver können jetzt die mit DNSSEC signierte Root-Zone prüfen","en":"Resolvers can now check the DNSSEC-signed root zone"}],"de":{"credit":"Dan Kaminsky, Sicherheitsforscher bei IOActive","fixed":"Abgestimmte Updates am 8. Juli 2008, darunter Microsoft MS08-037 und neue BIND-Versionen von ISC; Apple folgte am 31. Juli 2008","product":"DNS-Resolver wie BIND und Windows DNS, die für Nutzer Internetadressen nachschlagen","summary":"Eine Schwachstelle im DNS ließ Angreifer binnen Sekunden falsche Adressen für jede beliebige Domain in den Cache eines Resolvers schleusen. So konnten sie die Nutzer des Resolvers auf Server ihrer Wahl umleiten."},"disclosed":"2008-07-08","en":{"credit":"Dan Kaminsky, security researcher at IOActive","fixed":"Coordinated updates on July 8, 2008, among them Microsoft MS08-037 and new BIND versions from ISC; Apple followed on July 31, 2008","product":"DNS resolvers such as BIND and Windows DNS, which look up internet addresses for users","summary":"A weakness in the DNS let attackers plant false addresses for any domain in a resolver's cache within seconds. They could then send the resolver's users to servers of their choice."},"figures":[{"de":"der 0,9 Millionen getesteten offenen Resolver schickten Monate nach den Fixes noch jede Anfrage vom selben Port ab","en":"of 0.9 million open resolvers still sent every query from the same port months after the fixes","value":"57 %"},{"de":"Herstellern in der Liste von CERT/CC waren betroffen, von Microsoft bis zu Linux-Distributionen","en":"vendors listed by CERT/CC were affected, from Microsoft to Linux distributions","value":"37 of 91","value_de":"37 von 91"},{"de":"mögliche Abfrage-IDs waren vor dem Fix alles, was ein Angreifer erraten musste","en":"possible query IDs were all an attacker had to guess before the fix","value":"65,536"}],"key":"kaminsky-dns","name":"Kaminsky DNS","product":"DNS resolvers","sources":[{"de":"CERT/CC-Schwachstellenhinweis VU#800113","title":"CERT/CC vulnerability note VU#800113","url":"https://www.kb.cert.org/vuls/id/800113"},{"de":"US-CERT-Warnung TA08-190B vom 8. Juli 2008 (Archiv der Mailingliste)","title":"US-CERT alert TA08-190B of July 8, 2008 (mailing list archive)","url":"https://seclists.org/cert/2008/22"},{"de":"Microsoft-Sicherheitsbulletin MS08-037","title":"Microsoft security bulletin MS08-037","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-037"},{"de":"ISC: Sicherheitshinweis zu CVE-2008-1447 für BIND","title":"ISC: advisory on CVE-2008-1447 for BIND","url":"https://kb.isc.org/docs/aa-00924"},{"de":"FreeBSD-Sicherheitshinweis FreeBSD-SA-08:06.bind","title":"FreeBSD security advisory FreeBSD-SA-08:06.bind","url":"https://www.freebsd.org/security/advisories/FreeBSD-SA-08:06.bind.asc"},{"de":"Apple: Security Update 2008-005 vom 31. Juli 2008, mit dem Fix für BIND","title":"Apple: Security Update 2008-005 of July 31, 2008, with the BIND fix","url":"https://support.apple.com/en-us/104050"},{"de":"NVD: CVE-2008-1447","title":"NVD: CVE-2008-1447","url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1447"},{"de":"CERT.at: Patching Nameservers, Austria reacts to VU#800113 (24. Juli 2008, mit Update vom 28. Juli)","title":"CERT.at: Patching Nameservers, Austria reacts to VU#800113 (July 24, 2008, with an update of July 28)","url":"https://www.cert.at/en/downloads/papers/papers-0802"},{"de":"Recursive DNS Architectures and Vulnerability Implications, NDSS 2009 (PDF)","title":"Recursive DNS Architectures and Vulnerability Implications, NDSS 2009 (PDF)","url":"https://astrolavos.gatech.edu/articles/recursive_dns_architectures.pdf"},{"de":"The Measurement Factory: DNS-Erhebung vom Oktober 2008 im Auftrag von Infoblox","title":"The Measurement Factory: DNS survey of October 2008, commissioned by Infoblox","url":"http://dns.measurement-factory.com/surveys/200810.html"},{"de":"DNS-OARC: Informationen zu VU#800113, mit Zeitleiste","title":"DNS-OARC: information on VU#800113, with a timeline","url":"https://dns-oarc.net/node/107"},{"de":"SANS Internet Storm Center: Update zum DNS-Cache-Poisoning vom 30. Juli 2008","title":"SANS Internet Storm Center: DNS cache poisoning issue update of July 30, 2008","url":"https://isc.sans.edu/diary/4801"},{"de":"InfoWorld (Presse): der vergiftete DNS-Server von AT\u0026T in Texas","title":"InfoWorld (press): the poisoned AT\u0026T DNS server in Texas","url":"https://www.infoworld.com/article/2172504/dns-attack-writer-a-victim-of-his-own-creation-2.html"},{"de":"NTIA: Konsultation zu DNSSEC für die Root-Zone, Federal Register, 9. Oktober 2008","title":"NTIA: notice of inquiry on DNSSEC for the root zone, Federal Register, October 9, 2008","url":"https://www.govinfo.gov/content/pkg/FR-2008-10-09/html/E8-23974.htm"},{"de":"IANA: Statusmeldungen zur Signierung der Root-Zone (2010)","title":"IANA: status updates on signing the root zone (2010)","url":"https://www.iana.org/archive/root-dnssec-launch/launch-status-updates"}],"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","year":2008},{"actions":{"de":["Installiere Microsofts Update **KB958644** (Bulletin MS08-067) auf jedem Windows-Computer, dem es noch fehlt. Windows 2000, XP und Server 2003 lassen sich ohne Anmeldung angreifen.","Verwende starke Passwörter für freigegebene Ordner: Spätere Versionen des Wurms errieten schwache.","Sorge dafür, dass die Windows-Dateifreigabe auf **Port 445** aus dem Internet nicht erreichbar ist.","Behandle USB-Sticks von ungepatchten Windows-Computern als möglicherweise infiziert: Spätere Versionen kopierten sich auf sie."],"en":["Install Microsoft's update **KB958644** (bulletin MS08-067) on every Windows computer that still lacks it. Windows 2000, XP and Server 2003 can be attacked without a login.","Use strong passwords for shared folders: later versions of the worm guessed weak ones.","Do not let Windows file sharing on **port 445** be reached from the internet.","Treat USB sticks from unpatched Windows computers as possibly infected: later versions copied themselves onto them."]},"criteria":{"damage":{"de":"Keine Primärquelle nennt eine Zahl zum Schaden.","en":"No primary source gives a figure for the damage.","met":false},"exploitation":{"de":"Conficker war ein Wurm, der sich selbstständig von Computer zu Computer verbreitete (Conficker Working Group).","en":"Conficker was a worm that moved from computer to computer on its own (Conficker Working Group).","met":true},"reach":{"de":"Ein Jahr nach dem Erscheinen des Wurms waren zwischen 5 und 13 Millionen Computer infiziert (Conficker Working Group).","en":"Between 5 and 13 million computers were infected one year after the worm's release (Conficker Working Group).","met":true},"response":{"de":"Die Conficker Working Group stimmte sich mit mehr als 100 Ländern ab, um täglich mehr als 50.000 Domainnamen zu sperren (Conficker Working Group).","en":"The Conficker Working Group coordinated with more than 100 countries to block more than 50,000 domain names a day (Conficker Working Group).","met":true}},"cves":["CVE-2008-4250"],"cvss":10,"cvss_version":"2.0","cwe":"CWE-94","dates":[{"date":"2008-10-23","key":"patched"},{"date":"2008-11-21","key":"outbreak"},{"date":"2008-12-29","de":"Eine zweite Version des Wurms erscheint","en":"A second version of the worm is released"},{"date":"2009-02-12","de":"Microsoft kündigt ein gemeinsames Vorgehen mit der Branche und 250.000 US-Dollar Belohnung an","en":"Microsoft announces joint action with the industry and a USD 250,000 reward"},{"date":"2009-04-01","de":"Eine spätere Version stellt auf 50.000 Domainnamen pro Tag um","en":"A later version switches to 50,000 domain names a day"},{"date":"2026-05-20","key":"kev"}],"de":{"credit":"Nicht genannt; die Lücke wurde Microsoft vertraulich gemeldet","fixed":"Microsoft-Update MS08-067, KB958644 (23. Oktober 2008)","product":"Microsoft Windows, Serverdienst","summary":"Ein Windows-Wurm suchte täglich unter bis zu 50.000 neuen Domainnamen nach Updates. Verteidiger in über 100 Ländern sperrten diese Namen gemeinsam."},"disclosed":"2008-11-21","en":{"credit":"Not named; the flaw was reported privately to Microsoft","fixed":"Microsoft update MS08-067, KB958644 (October 23, 2008)","product":"Microsoft Windows, Server service","summary":"A Windows worm looked for updates at up to 50,000 new domain names a day. Defenders in over 100 countries worked together to block them."},"figures":[{"de":"Millionen Computer ein Jahr nach dem Ausbruch infiziert","en":"million computers infected one year after the outbreak","value":"5–13"},{"de":"Länder, mit denen sich die Verteidiger abstimmten, um die Domainnamen des Wurms zu sperren","en":"countries the defenders coordinated with to block the worm's domain names","value":"100+"},{"de":"der Windows-Computer waren im Januar 2009 noch nicht gepatcht (Schätzung von Qualys)","en":"of Windows computers were still unpatched in January 2009 (estimate by Qualys)","value":"30 %"}],"kev":"2026-05-20","key":"conficker","name":"Conficker","product":"Microsoft Windows","sources":[{"de":"Microsoft-Sicherheitsbulletin MS08-067","title":"Microsoft security bulletin MS08-067","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"},{"de":"NVD: CVE-2008-4250","title":"NVD: CVE-2008-4250","url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4250"},{"de":"Conficker Working Group: Lessons Learned (2010, PDF, Spiegelkopie)","title":"Conficker Working Group: Lessons Learned (2010, PDF, mirror copy)","url":"https://cyberwar.nl/d/Conficker_Working_Group_Lessons_Learned_17_June_2010_final.pdf"},{"de":"CAIDA: Conficker aus Sicht des UCSD Network Telescope","title":"CAIDA: Conficker as seen from the UCSD Network Telescope","url":"https://www.caida.org/archive/ms08-067/conficker/"},{"de":"Microsoft: Zusammenarbeit der Branche gegen Conficker und 250.000 US-Dollar Belohnung","title":"Microsoft: industry collaboration against Conficker and a USD 250,000 reward","url":"https://news.microsoft.com/2009/02/12/microsoft-collaborates-with-industry-to-disrupt-conficker-worm/"}],"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","year":2008},{"actions":{"de":["Aktualisiere ntpd auf die neueste Version der Reihe **4.2.8**: Seit der Entwicklungsversion 4.2.7p26 beantwortet ntpd keine monlist-Anfragen mehr.","Wenn du nicht aktualisieren kannst, ergänze in der ntp.conf die Zeilen `restrict default` für IPv4 und IPv6 um `noquery`, um alle Statusabfragen zu sperren. Füge sonst zumindest `disable monitor` hinzu, um monlist abzuschalten.","Teste deine öffentlichen Zeitserver von außerhalb deines Netzwerks, etwa mit dem Nmap-Skript `ntp-monlist`: Ein sicherer Server meldet einen Fehler oder antwortet gar nicht.","Prüfe auch Router, Firewalls und andere Geräte mit eingebautem Zeitserver. Sperre NTP-Anfragen aus dem Internet, wo kein Client von außen sie braucht.","Wenn du ein Netzwerk betreibst, verwirf an seinem Rand Pakete mit gefälschten Absenderadressen, wie in **BCP 38** beschrieben. So kann niemand in deinem Netzwerk solche Angriffe starten."],"en":["Update ntpd to the latest **4.2.8** release: since development version 4.2.7p26, ntpd no longer answers monlist requests.","If you cannot update, add `noquery` to the `restrict default` lines for IPv4 and IPv6 in ntp.conf to block all status queries. Otherwise, at least add `disable monitor` to switch off monlist.","Test your public time servers from outside your network, for example with the Nmap script `ntp-monlist`: a safe server returns an error or no reply.","Check routers, firewalls and other devices with a built-in time server too. Block NTP requests from the internet where no outside client needs them.","If you run a network, drop packets with forged sender addresses at its edge, as described in **BCP 38**. That way, nobody in your network can launch such attacks."]},"criteria":{"damage":{"de":"Eine Gesamtzahl zum Schaden gibt es nicht. Die Quellen belegen keinen Ausfall kritischer Dienste. Bei einem regionalen Netzbetreiber in Michigan steigerten die Angriffe den Datenverkehr um mehr als 2 % und erhöhten die Gebühren für seine eigene Internetanbindung (Taming the 800 Pound Gorilla, 2014).","en":"No total of the damage exists, and the sources document no outage of critical services. At a regional network in Michigan, the attacks added more than 2 % to its traffic and raised the fees it paid for its own internet connection (Taming the 800 Pound Gorilla, 2014).","met":false},"exploitation":{"de":"Binnen 15 Wochen trafen Angriffe 437.000 Adressen in 11.558 Netzwerken und 184 Ländern mit 2,92 Billionen Paketen (Taming the 800 Pound Gorilla, 2014).","en":"Within 15 weeks, attacks hit 437,000 addresses in 11,558 networks and 184 countries with 2.92 trillion packets (Taming the 800 Pound Gorilla, 2014).","met":true},"reach":{"de":"Wöchentliche Scans des gesamten Internets fanden 1.405.186 verwundbare NTP-Server am 10. Januar 2014 und 2.166.097 verschiedene Adressen in 15 Wochen (Taming the 800 Pound Gorilla, 2014).","en":"Weekly scans of the whole internet found 1,405,186 vulnerable NTP servers on January 10, 2014, and 2,166,097 different addresses over 15 weeks (Taming the 800 Pound Gorilla, 2014).","met":true},"response":{"de":"Forscher, CERTs und Netzbetreiber beteiligten sich länderübergreifend an den Aufräumarbeiten. Das ganze Internet wurde wöchentlich gescannt. Die Betreiber wurden über CERTs und direkt benachrichtigt. Zugleich sank die Zahl der verwundbaren Server binnen rund drei Monaten um 92 %. In jeder Weltregion fiel sie um 63–97 % (Taming the 800 Pound Gorilla, 2014). US-CERT und CERT/CC gaben Warnungen heraus (US-CERT, CERT/CC).","en":"Researchers, CERTs and network operators joined the cleanup across countries. Weekly internet-wide scans and notifications, through CERTs and directly to operators, accompanied a 92 % drop in vulnerable servers within about three months. Every region of the world saw a decline of 63–97 % (Taming the 800 Pound Gorilla, 2014). US-CERT and CERT/CC issued warnings (US-CERT, CERT/CC).","met":true}},"cves":["CVE-2013-5211"],"cvss":5,"cvss_version":"2.0","cwe":"CWE-20","dates":[{"date":"2010-04-24","key":"patched"},{"date":"2013-12-30","de":"Während einer Welle von DDoS-Angriffen erhält die Sicherheitslücke die Nummer CVE-2013-5211","en":"Amid a wave of DDoS attacks, the flaw receives the number CVE-2013-5211"},{"date":"2014-01-10","de":"Der erste wöchentliche Scan des Internets findet 1.405.186 verwundbare Server","en":"The first weekly scan of the internet finds 1,405,186 vulnerable servers"},{"date":"2014-01-13","de":"US-CERT warnt vor NTP-Verstärkungsangriffen","en":"US-CERT warns of NTP amplification attacks"},{"date":"2014-02-10","de":"Ein Angriff mit fast 400 Gbit/s von 4.529 NTP-Servern trifft ein Ziel im Netzwerk von Cloudflare","en":"An attack of almost 400 Gbps from 4,529 NTP servers hits a target in Cloudflare's network"},{"date":"2014-02-11","de":"Der NTP-Verkehr erreicht seinen Höchststand mit etwa 1 % des gesamten Internetverkehrs","en":"NTP traffic peaks at about 1 % of all internet traffic"},{"date":"2014-04-18","de":"Noch 106.445 verwundbare Server sind übrig, 92 % weniger als im Januar","en":"106,445 vulnerable servers are left, 92 % fewer than in January"},{"date":"2014-12-19","de":"ntp 4.2.8 ist die erste stabile Version ohne monlist","en":"ntp 4.2.8 is the first stable version without monlist"}],"de":{"credit":"Im Hinweis des NTP-Projekts nicht genannt; breite Aufmerksamkeit bekam die Lücke erst durch die Angriffe im Dezember 2013","fixed":"ntpd 4.2.7p26, eine Entwicklungsversion (24. April 2010); die erste stabile Version ohne monlist ist ntp 4.2.8 (19. Dezember 2014)","product":"ntpd, die Zeitserver-Software des NTP-Projekts, und Geräte, die sie nutzen","summary":"Ein Diagnosebefehl in NTP-Zeitservern beantwortete eine winzige Anfrage mit einer Liste von bis zu 600 Adressen. So konnten Angreifer mit gefälschten Absenderadressen mehr als eine Million Server als Verstärker für DDoS-Angriffe nutzen."},"disclosed":"2014-01-02","en":{"credit":"Not named in the NTP project's notice; the flaw drew wide attention only through the attacks of December 2013","fixed":"ntpd 4.2.7p26, a development version (April 24, 2010); the first stable version without monlist is ntp 4.2.8 (December 19, 2014)","product":"ntpd, the time server software of the NTP project, and devices that use it","summary":"A diagnostic command in NTP time servers answered a tiny request with a list of up to 600 addresses. This let attackers with forged sender addresses use more than a million servers as amplifiers for DDoS attacks."},"figures":[{"de":"verschiedene Adressen verwundbarer NTP-Server in 15 Wochen Scans","en":"different addresses of vulnerable NTP servers in 15 weeks of scans","value":"2,166,097"},{"de":"Adressen in 184 Ländern binnen 15 Wochen von Angriffen getroffen","en":"addresses hit by attacks within 15 weeks, in 184 countries","value":"437,000"},{"de":"des gesamten Internetverkehrs entfiel auf dem Höhepunkt im Februar 2014 auf NTP, nach 0,001 % im November 2013","en":"of all internet traffic was NTP at its peak in February 2014, up from 0.001 % in November 2013","value":"1 %"},{"de":"weniger verwundbare Server am 18. April 2014 als beim ersten Scan im Januar","en":"fewer vulnerable servers on April 18, 2014, than in the first scan in January","value":"92 %"}],"key":"ntp-monlist","name":"NTP monlist","product":"NTP (ntpd)","sources":[{"de":"Taming the 800 Pound Gorilla: The Rise and Decline of NTP DDoS Attacks, ACM Internet Measurement Conference (2014, PDF)","title":"Taming the 800 Pound Gorilla: The Rise and Decline of NTP DDoS Attacks, ACM Internet Measurement Conference (2014, PDF)","url":"https://conferences.sigcomm.org/imc/2014/papers/p435.pdf"},{"de":"NTP-Projekt: Sicherheitshinweis zu Bug 1532, Verstärkungsangriff über den Befehl monlist","title":"NTP project: security notice on bug 1532, amplification attack using the monlist command","url":"https://www.ntp.org/support/securitynotice/ntpbug1532/"},{"de":"NTP-Projekt: Zeitleiste der Veröffentlichungen, mit ntp 4.2.8 (19. Dezember 2014)","title":"NTP project: release timeline, with ntp 4.2.8 (December 19, 2014)","url":"https://www.ntp.org/dev/releasetimeline/"},{"de":"NVD: CVE-2013-5211","title":"NVD: CVE-2013-5211","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5211"},{"de":"Mailingliste oss-security: Anfrage nach einer CVE-Nummer für das monlist-DDoS-Problem (30. Dezember 2013)","title":"oss-security mailing list: request for a CVE number for the monlist DDoS issue (December 30, 2013)","url":"https://www.openwall.com/lists/oss-security/2013/12/30/6"},{"de":"Mailingliste oss-security: CVE-2013-5211 vergeben (30. Dezember 2013)","title":"oss-security mailing list: CVE-2013-5211 assigned (December 30, 2013)","url":"https://www.openwall.com/lists/oss-security/2013/12/30/7"},{"de":"CERT/CC-Schwachstellenhinweis VU#348126","title":"CERT/CC vulnerability note VU#348126","url":"https://www.kb.cert.org/vuls/id/348126"},{"de":"US-CERT-Warnung TA14-013A: NTP-Verstärkungsangriffe über CVE-2013-5211","title":"US-CERT alert TA14-013A: NTP amplification attacks using CVE-2013-5211","url":"https://www.cisa.gov/ncas/alerts/TA14-013A"},{"de":"US-CERT-Warnung TA14-017A: Verstärkungsangriffe über UDP","title":"US-CERT alert TA14-017A: UDP-based amplification attacks","url":"https://www.cisa.gov/ncas/alerts/TA14-017A"},{"de":"ICS-CERT-Hinweis ICSA-14-051-04: NTP-Reflexionsangriff","title":"ICS-CERT advisory ICSA-14-051-04: NTP reflection attack","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-051-04"},{"de":"Cloudflare: technische Details zu einem NTP-Verstärkungsangriff mit 400 Gbit/s (2014)","title":"Cloudflare: technical details behind a 400 Gbps NTP amplification DDoS attack (2014)","url":"https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack/"}],"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","year":2014},{"actions":{"de":["Aktualisiere OpenSSL von den Versionen 1.0.1 bis 1.0.1f auf **1.0.1g** oder neuer.","Wenn du nicht sofort aktualisieren kannst, kompiliere OpenSSL mit der Option `-DOPENSSL_NO_HEARTBEATS` neu.","Behandle Schlüssel, die mit einer verwundbaren Version erzeugt wurden, als gestohlen. Erzeuge einen **neuen privaten Schlüssel**, besorge ein neues Zertifikat und widerrufe das alte.","Prüfe auch Netzwerkgeräte und eingebettete Geräte: Viele wurden mit einer verwundbaren OpenSSL-Version ausgeliefert."],"en":["Update OpenSSL versions 1.0.1 to 1.0.1f to **1.0.1g** or newer.","If you cannot update at once, rebuild OpenSSL with the option `-DOPENSSL_NO_HEARTBEATS`.","Treat keys made with a vulnerable version as stolen. Create a **new private key**, get a new certificate and revoke the old one.","Check appliances and embedded devices too: many shipped with a vulnerable OpenSSL version."]},"criteria":{"damage":{"de":"Eine verlässliche Gesamtzahl gibt es nicht. Der Diebstahl von 900 Sozialversicherungsnummern bei der kanadischen Steuerbehörde Canada Revenue Agency ist nur aus der Presse bekannt (CTV News).","en":"No reliable total exists. The theft of 900 social insurance numbers from the Canada Revenue Agency is known only from the press (CTV News).","met":false},"exploitation":{"de":"Forscher zählten 5.948 Angriffsversuche auf 217 Ziele in vier überwachten Netzwerken. Die Quellen belegen keine Massenangriffe (The Matter of Heartbleed, 2014).","en":"Researchers counted 5,948 attack attempts against 217 targets at four monitored networks. The sources document no mass attacks (The Matter of Heartbleed, 2014).","met":false},"reach":{"de":"Anfangs waren 24–55 % der HTTPS-Server in der Alexa Top 1 Million verwundbar. Zwei Tage nach der Bekanntgabe waren noch etwa 2 Millionen HTTPS-Server verwundbar (The Matter of Heartbleed, 2014).","en":"At first, 24–55 % of HTTPS servers in the Alexa Top 1 Million were vulnerable. Two days after disclosure, about 2 million HTTPS servers were still vulnerable (The Matter of Heartbleed, 2014).","met":true},"response":{"de":"Schlüssel und Zertifikate mussten als kompromittiert gelten (US-CERT). Binnen drei Wochen ersetzten 23 % der HTTPS-Websites in der Alexa Top 1 Million ihre Zertifikate (The Matter of Heartbleed, 2014).","en":"Keys and certificates had to be treated as compromised (US-CERT). Within three weeks, 23 % of HTTPS sites in the Alexa Top 1 Million replaced their certificates (The Matter of Heartbleed, 2014).","met":true}},"cves":["CVE-2014-0160"],"cvss":7.5,"cvss_version":"3.1","cwe":"CWE-125","dates":[{"date":"2011-12-31","key":"introduced"},{"date":"2014-03-21","key":"discovered"},{"date":"2014-04-01","key":"reported"},{"date":"2014-04-07","key":"patched"},{"date":"2014-04-08","key":"exploited"},{"date":"2022-05-04","key":"kev"}],"de":{"credit":"Das Sicherheitsteam von Google und Codenomicon, unabhängig voneinander","fixed":"OpenSSL 1.0.1g (7. April 2014)","product":"OpenSSL, die Verschlüsselungssoftware hinter vielen HTTPS-Servern","summary":"Eine fehlende Prüfung in OpenSSL ließ Angreifer Teile des Serverspeichers auslesen, von Passwörtern bis zu privaten Schlüsseln, ohne Spuren in den normalen Logdateien."},"disclosed":"2014-04-07","en":{"credit":"Google's security team and Codenomicon, independently of each other","fixed":"OpenSSL 1.0.1g (April 7, 2014)","product":"OpenSSL, the encryption software behind many HTTPS servers","summary":"A missing check in OpenSSL let attackers read pieces of server memory, from passwords to private keys, without leaving a trace in normal logs."},"figures":[{"de":"der HTTPS-Server unter den eine Million meistbesuchten Websites waren anfangs verwundbar","en":"of HTTPS servers among the top million websites were vulnerable at first","value":"24–55 %"},{"de":"der eine Million meistbesuchten HTTPS-Websites ersetzten binnen drei Wochen ihre Zertifikate","en":"of the top million HTTPS sites replaced their certificates within three weeks","value":"23 %"},{"de":"Serverspeicher konnten mit jeder Anfrage abfließen","en":"of server memory could leak with each request","value":"64 KB"}],"kev":"2022-05-04","key":"heartbleed","name":"Heartbleed","product":"OpenSSL","sources":[{"de":"OpenSSL-Sicherheitshinweis vom 7. April 2014","title":"OpenSSL security advisory of April 7, 2014","url":"https://openssl-library.org/news/secadv/20140407.txt"},{"de":"Codenomicon: heartbleed.com, die Seite der Entdecker zum Fehler","title":"Codenomicon: heartbleed.com, the finders' page about the bug","url":"https://heartbleed.com/"},{"de":"The Matter of Heartbleed, ACM Internet Measurement Conference (2014, PDF)","title":"The Matter of Heartbleed, ACM Internet Measurement Conference (2014, PDF)","url":"https://nebelwelt.net/files/14IMC.pdf"},{"de":"NVD: CVE-2014-0160","title":"NVD: CVE-2014-0160","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0160"},{"de":"US-CERT-Warnung TA14-098A","title":"US-CERT alert TA14-098A","url":"https://www.cisa.gov/ncas/alerts/TA14-098A"},{"de":"CTV News (Presse): Laut CRA wurden 900 Sozialversicherungsnummern entwendet","title":"CTV News (press): CRA says 900 social insurance numbers were taken","url":"https://www.ctvnews.ca/canada/cra-says-900-social-insurance-numbers-taken-in-heartbleed-exploit-1.1774708"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","year":2014},{"actions":{"de":["Aktualisiere Bash über die Updates deines Systems: Bash 4.3 braucht die **Patches 025 bis 030**, ältere Versionen die entsprechenden Patches.","Prüfe eingebettete Geräte, etwa Geräte mit eingebautem Linux, die keine Updates mehr bekommen: Auf ihnen kann noch eine ungepatchte Bash laufen.","Schalte auf Webservern CGI-Skripte ab, die du nicht mehr brauchst: Über sie gelangte eine einzige präparierte Webanfrage bis zu Bash."],"en":["Update Bash through your system's updates: Bash 4.3 needs **patches 025 to 030**, older versions the matching patches.","Check embedded devices, such as appliances with built-in Linux, that no longer get updates: they may still run an unpatched Bash.","On web servers, switch off CGI scripts that you no longer need: a single crafted web request reached Bash through them."]},"criteria":{"damage":{"de":"Weder Schadenszahlen noch Ausfälle kritischer Dienste sind belegt. Die Angriffszahlen stammen aus Sensoren der Anbieter, nicht aus Schadensmeldungen.","en":"No damage figures and no outages of critical services are documented. The attack counts come from vendors' sensors, not from damage reports.","met":false},"exploitation":{"de":"Innerhalb von vier Tagen trafen Angriffe mehr als 4.115 von Imperva geschützte Websites. Im selben Zeitraum blockierte Cloudflare mehr als 1,1 Millionen Angriffe (Anbieterdaten von Imperva und Cloudflare).","en":"Within four days, attacks hit more than 4,115 websites protected by Imperva, and Cloudflare blocked more than 1.1 million attacks (vendor data from Imperva and Cloudflare).","met":true},"reach":{"de":"Bash gehört bei Linux und macOS zum Grundbestand des Betriebssystems (US-CERT). Auf Linux allein laufen heute 63,2 % aller Websites, deren Betriebssystem bekannt ist (W3Techs, 23. Oktober 2026).","en":"Bash is part of the base operating system of Linux and macOS (US-CERT). Today, Linux alone runs 63.2 % of all websites whose operating system is known (W3Techs, October 23, 2026).","met":true},"response":{"de":"In elf Tagen erschienen sechs Bash-Patches, aber keine Maßnahme über das übliche Patchen hinaus ist belegt (Patch-Archiv von GNU Bash, US-CERT).","en":"Six Bash patches came out in eleven days, but no measure beyond routine patching is documented (GNU Bash patch archive, US-CERT).","met":false}},"cves":["CVE-2014-6271","CVE-2014-7169","CVE-2014-7186","CVE-2014-7187","CVE-2014-6277","CVE-2014-6278"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-78","dates":[{"date":"2014-09-15","de":"Früheste belegte Meldung, im Bug-Tracker von Red Hat, noch geheim","en":"Earliest documented report, in Red Hat's bug tracker, still kept secret"},{"date":"2014-09-24","key":"disclosed"},{"date":"2014-09-24","key":"patched"},{"date":"2014-09-25","de":"Der erste Fix erweist sich als unvollständig; seine Umgehung erhält eine eigene CVE-Nummer","en":"The first fix proves incomplete; the way around it gets its own CVE"},{"date":"2014-09-26","de":"Die Angriffe erreichen in den Sensordaten von Cisco ihren Höhepunkt","en":"Attacks peak in Cisco's sensor data"},{"date":"2014-10-05","de":"Sechster und letzter Bash-Patch der Reihe","en":"Sixth and last Bash patch of the series"}],"de":{"credit":"Ein unabhängiger Unix- und Linux-Spezialist; die Folgelücken fanden andere Forscher","fixed":"Patches 025 bis 030 für Bash 4.3 (24. September bis 5. Oktober 2014) und entsprechende Patches für ältere Versionen","product":"GNU Bash, die Shell von Linux, Unix und macOS","summary":"Eine Lücke in Bash, der Shell von Linux und macOS, ließ Angreifer mit einer einzigen präparierten Anfrage Befehle auf Webservern ausführen."},"disclosed":"2014-09-24","en":{"credit":"An independent Unix and Linux specialist; follow-up flaws by other researchers","fixed":"Bash 4.3 patches 025 to 030 (September 24 to October 5, 2014) and matching patches for older versions","product":"GNU Bash, the command shell of Linux, Unix and macOS","summary":"A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with a single crafted request."},"figures":[{"de":"der Websites mit bekanntem Betriebssystem laufen heute auf Linux, bei dem Bash zum System gehört","en":"of websites with a known operating system run on Linux today, where Bash is part of the system","value":"63.2 %"},{"de":"Shellshock-Angriffe pro Sekunde zu Beginn, allein bei Cloudflare (Anbieterdaten)","en":"Shellshock attacks per second at first, at Cloudflare alone (vendor data)","value":"10–15"},{"de":"Bash-Patches in elf Tagen, weil die ersten Fixes unvollständig waren","en":"Bash patches in eleven days, because the first fixes were incomplete","value":"6"}],"kev":"2022-01-28","key":"shellshock","name":"Shellshock","product":"GNU Bash","sources":[{"de":"oss-security: der erste öffentliche Sicherheitshinweis zu CVE-2014-6271","title":"oss-security: the first public advisory on CVE-2014-6271","url":"https://www.openwall.com/lists/oss-security/2014/09/24/10"},{"de":"GNU-Projekt: die offiziellen Patches für Bash 4.3, mit Datum","title":"GNU project: the official Bash 4.3 patches, with their dates","url":"https://ftp.gnu.org/gnu/bash/bash-4.3-patches/"},{"de":"US-CERT-Warnung TA14-268A zu Shellshock","title":"US-CERT alert TA14-268A on Shellshock","url":"https://www.cisa.gov/news-events/alerts/2014/09/25/gnu-bourne-again-shell-bash-shellshock-vulnerability-cve-2014-6271"},{"de":"Red Hat Bugzilla: der Eintrag zu CVE-2014-6271, unter Embargo geführt","title":"Red Hat Bugzilla: the entry for CVE-2014-6271, tracked under embargo","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141597"},{"de":"NVD: CVE-2014-6271","title":"NVD: CVE-2014-6271","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6271"},{"de":"Cisco Talos: Shellshock-Angriffe im Netz (Anbieterdaten)","title":"Cisco Talos: Shellshock exploits in the wild (vendor data)","url":"https://blogs.cisco.com/security/talos/shellshock-exploits-in-the-wild"},{"de":"Cloudflare: Shellshock im Detail (Anbieterdaten)","title":"Cloudflare: Inside Shellshock (vendor data)","url":"https://blog.cloudflare.com/inside-shellshock"},{"de":"Imperva: die Folgen von Shellshock (Anbieterdaten)","title":"Imperva: The Shellshock Aftermath (vendor data)","url":"https://www.imperva.com/blog/?p=7791"},{"de":"W3Techs: Nutzungsstatistik von Linux","title":"W3Techs: usage statistics of Linux","url":"https://w3techs.com/technologies/details/os-linux"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2014},{"actions":{"de":["Installiere **MS17-010** oder ein späteres Windows-Update. Installiere unter Windows XP, Windows 8 oder Server 2003 den Notfall-Patch vom Mai 2017: Diese Versionen bekommen keine regulären Updates mehr.","Schalte **SMB Version 1** ab, das alte Protokoll für die Dateifreigabe, das der Wurm nutzte.","Blockiere Port 445 am Übergang deines Netzwerks zum Internet, damit niemand von außen die Windows-Dateifreigabe erreicht."],"en":["Install **MS17-010** or any later Windows update. On Windows XP, Windows 8 or Server 2003, install the emergency patch of May 2017: these versions no longer get regular updates.","Switch off **SMB version 1**, the old file-sharing protocol the worm used.","Block port 445 at the edge of your network, so that no one can reach Windows file sharing from the internet."]},"criteria":{"damage":{"de":"In England wurden etwa 19.494 Termine abgesagt und fünf Krankenhaus-Trusts mussten Rettungswagen umleiten. Die Kosten für den NHS werden auf etwa 92 Millionen Pfund geschätzt (National Audit Office; britisches Gesundheitsministerium).","en":"In England, about 19,494 appointments were cancelled and five hospital trusts had to divert ambulances. The cost to the NHS is estimated at about GBP 92 million (National Audit Office; Department of Health and Social Care).","met":true},"exploitation":{"de":"WannaCry war ein Wurm: Jeder infizierte Computer suchte in seinem Netzwerk und im Internet nach neuen Opfern und infizierte sie selbstständig (Cisco Talos).","en":"WannaCry was a worm: every infected computer searched its network and the internet for new victims and infected them on its own (Cisco Talos).","met":true},"reach":{"de":"Mehr als 200.000 Computer in mindestens 100 Ländern waren betroffen (britischer Rechnungshof, National Audit Office).","en":"More than 200,000 computers in at least 100 countries were affected (UK National Audit Office).","met":true},"response":{"de":"Microsoft veröffentlichte Notfall-Patches für Windows XP, Windows 8 und Windows Server 2003, die es nicht mehr unterstützte. NHS England rief eine nationale Großschadenslage aus (Microsoft; National Audit Office).","en":"Microsoft released emergency patches for Windows XP, Windows 8 and Windows Server 2003, which it no longer supported. NHS England declared a national major incident (Microsoft; National Audit Office).","met":true}},"cves":["CVE-2017-0144"],"cvss":8.8,"cvss_version":"3.1","dates":[{"date":"2017-03-14","key":"patched"},{"date":"2017-04-14","de":"Die Shadow Brokers veröffentlichen EternalBlue, ein der NSA gestohlenes Angriffswerkzeug","en":"The Shadow Brokers publish EternalBlue, an attack tool stolen from the NSA"},{"date":"2017-05-12","key":"outbreak"},{"date":"2017-05-12","de":"Am Abend aktiviert ein britischer Sicherheitsforscher den Kill-Switch","en":"In the evening, a UK security researcher activates the kill switch"},{"date":"2017-05-13","de":"Notfall-Patches für Windows XP, Windows 8 und Windows Server 2003","en":"Emergency patches for Windows XP, Windows 8 and Windows Server 2003"},{"date":"2017-05-19","de":"NHS England erklärt die nationale Großschadenslage für beendet","en":"NHS England stands down the national major incident"}],"de":{"credit":"Von Microsoft nicht genannt; das Angriffswerkzeug EternalBlue wurde dem US-Geheimdienst NSA gestohlen","fixed":"MS17-010 (14. März 2017); Notfall-Patches für Windows XP, Windows 8 und Windows Server 2003 (13. Mai 2017)","product":"Windows-Computer mit dem alten Dateifreigabe-Protokoll SMBv1","summary":"Ein Ransomware-Wurm traf mit einem geleakten NSA-Werkzeug und einer Windows-Lücke mehr als 200.000 Computer und störte Krankenhäuser in England."},"disclosed":"2017-05-12","en":{"credit":"Not named by Microsoft; the attack tool EternalBlue was stolen from the US NSA","fixed":"MS17-010 (March 14, 2017); emergency patches for Windows XP, Windows 8 and Windows Server 2003 (May 13, 2017)","product":"Windows computers with the old file-sharing protocol SMBv1","summary":"A ransomware worm used a leaked NSA tool and a Windows flaw to hit more than 200,000 computers, and it disrupted hospitals in England."},"figures":[{"de":"Computer in mindestens 100 Ländern getroffen","en":"computers hit in at least 100 countries","value":"200,000+"},{"de":"abgesagte NHS-Termine in England, nach Schätzung von NHS England","en":"NHS appointments cancelled in England, by NHS England's estimate","value":"19,494"},{"de":"Millionen Pfund: die geschätzten Kosten für den NHS","en":"million British pounds: the estimated cost to the NHS","value":"92"},{"de":"Lösegeldzahlungen weltweit bis zum 2. Oktober 2017, zusammen rund 86.000 US-Dollar wert","en":"ransom payments worldwide by October 2, 2017, worth about USD 86,000","value":"238"}],"kev":"2022-02-10","key":"wannacry","name":"WannaCry","product":"Microsoft Windows (SMBv1)","sources":[{"de":"Microsoft-Sicherheitsbulletin MS17-010","title":"Microsoft security bulletin MS17-010","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"},{"de":"Microsoft: die geleakten Angriffswerkzeuge und das Update, das sie unschädlich macht (April 2017)","title":"Microsoft: the leaked attack tools and the update that fixes them (April 2017)","url":"https://www.microsoft.com/en-us/msrc/blog/2017/04/protecting-customers-and-evaluating-risk"},{"de":"Microsoft: Hinweise für Kunden und Notfall-Patches zu WannaCrypt (Mai 2017)","title":"Microsoft: customer guidance and emergency patches for WannaCrypt (May 2017)","url":"https://www.microsoft.com/en-us/msrc/blog/2017/05/customer-guidance-for-wannacrypt-attacks"},{"de":"Microsoft: Die Exploits wurden der NSA gestohlen (Mai 2017)","title":"Microsoft: the exploits were stolen from the NSA (May 2017)","url":"https://blogs.microsoft.com/on-the-issues/2017/05/14/need-urgent-collective-action-keep-people-safe-online-lessons-last-weeks-cyberattack/"},{"de":"NVD: CVE-2017-0144","title":"NVD: CVE-2017-0144","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144"},{"de":"Britischer Rechnungshof: Untersuchung zu WannaCry und dem NHS","title":"UK National Audit Office: investigation into WannaCry and the NHS","url":"https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/"},{"de":"Britischer Rechnungshof: vollständiger Bericht zu WannaCry und dem NHS (PDF)","title":"UK National Audit Office: full report on WannaCry and the NHS (PDF)","url":"https://www.nao.org.uk/wp-content/uploads/2017/10/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf"},{"de":"Britisches Gesundheitsministerium: Fortschrittsbericht zur Cyber-Resilienz, mit der Kostenschätzung (PDF)","title":"UK Department of Health and Social Care: progress update on cyber resilience, with the cost estimate (PDF)","url":"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/747464/securing-cyber-resilience-in-health-and-care-september-2018-update.pdf"},{"de":"Bitcoin-Analyse der Lösegeldzahlungen an WannaCry und NotPetya (Computers \u0026 Security, 2018)","title":"Bitcoin analysis of WannaCry and NotPetya ransom payments (Computers \u0026 Security, 2018)","url":"https://arxiv.org/pdf/1804.01341"},{"de":"Cisco Talos: Analyse von WannaCry (Anbieterdaten)","title":"Cisco Talos: WannaCry analysis (vendor data)","url":"https://blog.talosintelligence.com/2017/05/wannacry.html"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","year":2017},{"actions":{"de":["Installiere **MS17-010** oder ein späteres Windows-Update auf jedem Computer. Schalte **SMB Version 1** ab.","Verwende nicht dasselbe Administratorpasswort auf vielen Computern: NotPetya verbreitete sich mit gestohlenen Passwörtern, was kein Patch verhindert.","Falls noch eine alte M.E.Doc-Installation vorhanden ist, entferne die Versionen 10.01.175–10.01.176, 10.01.180–10.01.181 und 10.01.188–10.01.189: Sie enthielten die Hintertür."],"en":["Install **MS17-010** or any later Windows update on every computer. Switch off **SMB version 1**.","Do not use the same administrator password on many computers: NotPetya spread with stolen passwords, which no patch prevents.","If an old M.E.Doc installation is still around, remove versions 10.01.175–10.01.176, 10.01.180–10.01.181 and 10.01.188–10.01.189: they carried the backdoor."]},"criteria":{"damage":{"de":"Die US-Regierung beziffert den Schaden in Europa, Asien und Amerika auf Milliarden US-Dollar (Weißes Haus). Allein Maersk rechnete mit 200–300 Millionen US-Dollar (Reuters, Pressebericht).","en":"The US government puts the damage at billions of dollars across Europe, Asia and the Americas (White House). Maersk alone expected USD 200–300 million (Reuters, press report).","met":true},"exploitation":{"de":"NotPetya verbreitete sich selbstständig durch Netzwerke und traf allein in der Ukraine über 2.000 Unternehmen (ukrainische Cyberpolizei über Cisco Talos).","en":"NotPetya spread through networks on its own and hit over 2,000 companies in Ukraine alone (Ukraine's Cyber Police via Cisco Talos).","met":true},"reach":{"de":"Die gemessenen Zahlen bleiben unter der Schwelle. Microsoft zählte mehr als 12.500 Rechner in der Ukraine und Infektionen in 64 weiteren Ländern (Microsoft). Getroffen wurden über 2.000 Unternehmen in der Ukraine (ukrainische Cyberpolizei über Cisco Talos).","en":"Measured counts stay below the threshold. Microsoft counted more than 12,500 machines in Ukraine and infections in 64 more countries (Microsoft). Over 2,000 companies in Ukraine were hit (Ukraine's Cyber Police via Cisco Talos).","met":false},"response":{"de":"Die Regierungen Großbritanniens und der USA machten das russische Militär verantwortlich (britisches Außenministerium; Weißes Haus). Einen Angreifer zu benennen schützt aber niemanden. Über den vorhandenen Patch hinaus ist keine Maßnahme belegt.","en":"The UK and US governments named the Russian military as responsible (UK Foreign Office; White House). But naming an attacker protects no one. No measure beyond the existing patch is documented.","met":false}},"cves":["CVE-2017-0144","CVE-2017-0145"],"cvss":8.8,"cvss_version":"3.1","dates":[{"date":"2017-03-14","key":"patched"},{"date":"2017-04-14","de":"Erstes M.E.Doc-Update mit einer versteckten Hintertür","en":"First M.E.Doc update with a hidden backdoor"},{"date":"2017-06-22","de":"Drittes und letztes M.E.Doc-Update mit der Hintertür","en":"Third and last M.E.Doc update with the backdoor"},{"date":"2017-06-27","key":"outbreak"},{"date":"2018-02-15","de":"Die Regierungen Großbritanniens und der USA machen das russische Militär verantwortlich","en":"The UK and US governments name the Russian military as responsible"}],"de":{"credit":"Analysiert von ESET, Cisco Talos und Microsoft","fixed":"MS17-010 (14. März 2017) für die SMB-Lücken; kein Patch verhindert die Ausbreitung mit gestohlenen Passwörtern. Die Daten ließen sich nicht wiederherstellen","product":"Windows-Netzwerke, erreicht über die ukrainische Buchhaltungssoftware M.E.Doc","summary":"Ein als Ransomware getarnter Wurm kam über ein gekapertes Software-Update, zerstörte Daten in der Ukraine und 64 weiteren Ländern und kostete Milliarden US-Dollar."},"disclosed":"2017-06-27","en":{"credit":"Analyzed by ESET, Cisco Talos and Microsoft","fixed":"MS17-010 (March 14, 2017) for the SMB flaws; no patch stops the spread with stolen passwords, and the data could not be recovered","product":"Windows networks, reached through the Ukrainian accounting software M.E.Doc","summary":"A worm posing as ransomware came through a hijacked software update, destroyed data in Ukraine and 64 more countries, and cost billions of dollars."},"figures":[{"de":"Millionen US-Dollar Kosten erwartete allein die Reederei Maersk (Pressebericht)","en":"million US dollars in costs expected by the shipping group Maersk alone (press report)","value":"200–300"},{"de":"Unternehmen allein in der Ukraine getroffen, bestätigt von der ukrainischen Cyberpolizei","en":"companies hit in Ukraine alone, as confirmed by Ukraine's Cyber Police","value":"2,000+"},{"de":"weitere Länder neben der Ukraine mit Infektionen in den Daten von Microsoft","en":"countries besides Ukraine with infections in Microsoft's data","value":"64"},{"de":"Lösegeldzahlungen bis zum 3. August 2017, zusammen 9.835,86 US-Dollar wert","en":"ransom payments by August 3, 2017, worth USD 9,835.86","value":"33"}],"kev":"2022-02-10","key":"notpetya","name":"NotPetya","product":"Microsoft Windows (SMBv1), M.E.Doc","sources":[{"de":"Microsoft: Neue Ransomware, alte Techniken – Petya kann sich jetzt als Wurm verbreiten","title":"Microsoft: New ransomware, old techniques: Petya adds worm capabilities","url":"https://www.microsoft.com/en-us/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/"},{"de":"ESET: Analyse der Hintertür in den M.E.Doc-Updates","title":"ESET: analysis of the backdoor in M.E.Doc updates","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"},{"de":"Cisco Talos: The MeDoc Connection, die Untersuchung des Update-Servers","title":"Cisco Talos: The MeDoc Connection, forensics of the update server","url":"https://blog.talosintelligence.com/2017/07/the-medoc-connection.html"},{"de":"NVD: CVE-2017-0144","title":"NVD: CVE-2017-0144","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144"},{"de":"Weißes Haus: Erklärung zu NotPetya (Februar 2018)","title":"White House: statement on NotPetya (February 2018)","url":"https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/"},{"de":"Britisches Außenministerium: Erklärung zu NotPetya (Februar 2018)","title":"UK Foreign Office: statement on NotPetya (February 2018)","url":"https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks"},{"de":"Bitcoin-Analyse der Lösegeldzahlungen an WannaCry und NotPetya (Computers \u0026 Security, 2018)","title":"Bitcoin analysis of WannaCry and NotPetya ransom payments (Computers \u0026 Security, 2018)","url":"https://arxiv.org/pdf/1804.01341"},{"de":"Reuters über Business Insurance: die erwarteten Kosten von Maersk (Presse)","title":"Reuters via Business Insurance: Maersk's expected cost (press)","url":"https://www.businessinsurance.com/article/20170816/NEWS06/912315214/Maersk-upbeat-on-shipping-outlook-faces-hefty-cyber-attack-bill"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","year":2017},{"actions":{"de":["Installiere die Updates deines Betriebssystems: Windows, Linux, macOS und iOS erhielten den Fix etwa im Januar 2018.","Bekommt das System eines alten Computers keine Updates mehr, führe darauf nur Programme aus, denen du vertraust: Jedes Programm kann den Speicher des Systems lesen.","Wenn du Server mietest oder Container betreibst, frag deinen Anbieter, ob der Host den Fix hat: Container und manche virtuellen Maschinen konnten den Speicher des Hosts lesen."],"en":["Install your operating system's updates: Windows, Linux, macOS and iOS received the fix around January 2018.","If an old computer's system no longer gets updates, run only programs you trust: any program can read the system's memory.","If you rent servers or run containers, ask your provider whether the host has the fix: containers and some virtual machines could read the host's memory."]},"criteria":{"damage":{"de":"Es ist kein Schaden dokumentiert.","en":"No damage has been documented.","met":false},"exploitation":{"de":"Es sind keine Angriffe in der Praxis bekannt und die Lücke steht nicht auf der CISA-Liste ausgenutzter Schwachstellen (Apple; NVD, Oktober 2026).","en":"No attacks in the wild are known, and the flaw is not on CISA's list of exploited vulnerabilities (Apple; NVD, October 2026).","met":false},"reach":{"de":"Potenziell ist jeder Intel-Prozessor mit Out-of-Order-Ausführung seit 1995 betroffen, außer Itanium und Atom vor 2013 (Website der Forscher). Der Fachartikel zeigt den Angriff auf Intel-Generationen seit 2010 (USENIX-Fachartikel).","en":"Potentially every Intel processor with out-of-order execution since 1995 is affected, except Itanium and Atom before 2013 (researchers' site). The paper shows the attack on Intel generations since 2010 (USENIX paper).","met":true},"response":{"de":"Windows, Linux und macOS trennten den Kernel-Speicher mit Updates rund um die Veröffentlichung ab, vorbereitet in 216 Tagen Geheimhaltung (Microsoft; Apple; Google Project Zero).","en":"Windows, Linux and macOS isolated kernel memory with updates around the disclosure, prepared during 216 days of secrecy (Microsoft; Apple; Google Project Zero).","met":true}},"cves":["CVE-2017-5754"],"cvss":5.6,"cvss_version":"3.0","cwe":"CWE-200","dates":[{"date":"2017-06-01","key":"reported"},{"date":"2018-01-03","key":"disclosed"},{"date":"2018-01-03","de":"Windows-Update mit dem Fix; Apple hatte seinen bereits ausgeliefert","en":"Windows update with the fix; Apple had already shipped its own"},{"date":"2018-08-15","de":"Die Forscher stellen den vollständigen Fachartikel auf der USENIX Security 2018 vor","en":"The researchers present the full paper at USENIX Security 2018"}],"de":{"credit":"Google Project Zero, die Technische Universität Graz und Cyberus Technology, unabhängig voneinander","fixed":"Betriebssystem-Updates rund um die Veröffentlichung: KPTI in Linux, Windows KB4056892 (3. Januar 2018), macOS 10.13.2 und iOS 11.2; neuere Prozessoren beheben die Lücke in der Hardware","product":"Die meisten Intel-Prozessoren und einige ARM-basierte Designs","summary":"Ein Designfehler der meisten Intel-Prozessoren ließ jedes Programm den geschützten Speicher des Betriebssystems lesen; Updates der Betriebssysteme schlossen die Lücke."},"disclosed":"2018-01-03","en":{"credit":"Google Project Zero, Graz University of Technology and Cyberus Technology, independently of each other","fixed":"Operating-system updates around the disclosure: KPTI in Linux, Windows KB4056892 (January 3, 2018), macOS 10.13.2 and iOS 11.2; newer processors fix it in hardware","product":"Most Intel processors and a few ARM-based designs","summary":"A design flaw in most Intel processors let any program read the operating system's protected memory; operating-system updates closed the hole."},"figures":[{"de":"Kilobyte pro Sekunde: So schnell las ein gewöhnliches Programm Kernel-Speicher, je nach Rechner","en":"kilobytes per second: how fast an ordinary program read kernel memory, depending on the machine","value":"3.2–503"},{"de":"Tage blieb die Lücke geheim, während Fixes vorbereitet wurden","en":"days the flaw was kept secret while fixes were prepared","value":"216"},{"de":"ist das Jahr, seit dem potenziell jeder Intel-Prozessor mit Out-of-Order-Ausführung betroffen ist, sagen die Forscher","en":"is the year since which potentially every Intel processor with out-of-order execution is affected, say the researchers","value":"1995"}],"key":"meltdown","name":"Meltdown","product":"Intel processors","sources":[{"de":"Google Project Zero: privilegierten Speicher über einen Seitenkanal lesen","title":"Google Project Zero: Reading privileged memory with a side-channel","url":"https://projectzero.google/2018/01/reading-privileged-memory-with-side.html"},{"de":"Website der Forscher zu Meltdown und Spectre","title":"The researchers' site on Meltdown and Spectre","url":"https://meltdownattack.com/"},{"de":"Meltdown: Kernel-Speicher aus dem Benutzerbereich lesen (USENIX Security 2018)","title":"Meltdown: Reading Kernel Memory from User Space (USENIX Security 2018)","url":"https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-lipp.pdf"},{"de":"NVD: CVE-2017-5754","title":"NVD: CVE-2017-5754","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5754"},{"de":"Intel-Sicherheitshinweis INTEL-SA-00088","title":"Intel security advisory INTEL-SA-00088","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00088.html"},{"de":"Microsoft: Windows-Update KB4056892 vom 3. Januar 2018","title":"Microsoft: Windows update KB4056892 of January 3, 2018","url":"https://support.microsoft.com/en-us/help/4056892"},{"de":"Microsoft: Leistungseinbußen durch die Fixes für Spectre und Meltdown unter Windows","title":"Microsoft: performance impact of the Spectre and Meltdown fixes on Windows","url":"https://www.microsoft.com/en-us/security/blog/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/"},{"de":"Apple: zu den Fixes für Meltdown und Spectre","title":"Apple: about the Meltdown and Spectre fixes","url":"https://support.apple.com/en-us/HT208394"},{"de":"Red Hat: Leistungseinbußen durch die Fixes für alle drei Varianten","title":"Red Hat: performance impact of the fixes for all three variants","url":"https://access.redhat.com/articles/3307751"}],"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","year":2018},{"actions":{"de":["Installiere alle Updates für dein Betriebssystem und deinen Browser: Sie enthalten den Schutz gegen Spectre.","Installiere Prozessor-Updates (Mikrocode), sobald dein Betriebssystem oder der Hersteller deines Geräts sie anbietet.","Lass die Schutzmaßnahmen eingeschaltet; Linux aktiviert sie auf anfälligen Prozessoren standardmäßig."],"en":["Install all updates for your operating system and browser: they include the protections against Spectre.","Install processor updates (microcode) when your operating system or device maker offers them.","Leave the protections switched on; Linux turns them on by default on vulnerable processors."]},"criteria":{"damage":{"de":"Schäden durch Angriffe sind nicht dokumentiert; die Kosten lagen in den Fixes, die manche Systeme langsamer machten.","en":"No damage from attacks has been documented; the cost lay in the fixes, which made some systems slower.","met":false},"exploitation":{"de":"Kein echter Angriff ist bestätigt und keine der beiden Spectre-CVEs steht auf der CISA-Liste ausgenutzter Schwachstellen (NVD, Oktober 2026).","en":"No attack in the wild has been confirmed, and neither Spectre CVE is on CISA's list of exploited vulnerabilities (NVD, October 2026).","met":false},"reach":{"de":"Die Lücke steckt in Prozessoren von Intel, AMD und Arm, die in Milliarden von Geräten arbeiten, vom Smartphone bis zum Cloud-Server (Spectre-Studie und Website der Forscher, 2018).","en":"The flaw sits in processors from Intel, AMD and Arm that are used in billions of devices, from smartphones to cloud servers (Spectre paper and researchers' site, 2018).","met":true},"response":{"de":"Fixes von Prozessorherstellern sowie für Betriebssysteme, Compiler und Browser zugleich, mit Windows-Patches für 41 von 45 Editionen binnen sechs Tagen (Microsoft, 9. Januar 2018).","en":"Fixes from processor makers, operating systems, compilers and browsers at once, with Windows patches for 41 of 45 editions within six days (Microsoft, January 9, 2018).","met":true}},"cves":["CVE-2017-5753","CVE-2017-5715"],"cvss":5.6,"cvss_version":"3.1","cwe":"CWE-203","dates":[{"date":"2017-06-01","key":"reported"},{"date":"2018-01-03","de":"Sechs Tage früher als geplant veröffentlicht, zusammen mit den ersten Updates","en":"Made public six days early, together with the first updates"},{"date":"2018-01-09","de":"Der ursprünglich geplante Termin; Windows-Patches für 41 von 45 Editionen verfügbar","en":"The originally planned date; Windows patches out for 41 of 45 editions"}],"de":{"credit":"Google Project Zero und, unabhängig davon, Forscher von Universitäten und Unternehmen","fixed":"Kein einzelner Fix: Updates für Betriebssysteme, Browser, Compiler und Prozessor-Mikrocode, ab dem 3. Januar 2018","product":"Prozessoren von Intel, AMD und Arm, in Milliarden von Geräten","summary":"Ein Designfehler in fast allen modernen Prozessoren ließ Programme auf Desktop-PCs, Laptops, Servern und Smartphones Speicher lesen, den sie nicht sehen dürften."},"disclosed":"2018-01-03","en":{"credit":"Google Project Zero and, independently, researchers from universities and companies","fixed":"No single fix: updates for operating systems, browsers, compilers and processor microcode, from January 3, 2018","product":"Processors from Intel, AMD and Arm, in billions of devices","summary":"A design flaw in almost all modern processors let programs read memory they should not see, on desktops, laptops, servers and smartphones."},"figures":[{"de":"Windows-Editionen brauchten Patches; für 41 gab es sie sechs Tage nach der Veröffentlichung","en":"Windows editions needed patches; 41 had them six days after disclosure","value":"45"},{"de":"Leistungsverlust mit allen Meltdown- und Spectre-Fixes in den von Red Hat getesteten Anwendungen, mit Retpoline","en":"slowdown with all Meltdown and Spectre fixes on Red Hat's tested workloads, with retpoline","value":"1–8 %"},{"de":"Tage vergingen von der Meldung an Intel, AMD und Arm bis zur Veröffentlichung","en":"days from the report to Intel, AMD and Arm until the flaw went public","value":"216"}],"key":"spectre","name":"Spectre","product":"Intel, AMD and Arm processors","sources":[{"de":"Google Project Zero: Auslesen von geschütztem Speicher über einen Seitenkanal","title":"Google Project Zero: reading privileged memory with a side channel","url":"https://projectzero.google/2018/01/reading-privileged-memory-with-side.html"},{"de":"Google Security Blog: die Prozessor-Schwachstelle und was du wissen musst","title":"Google Security Blog: today's CPU vulnerability and what you need to know","url":"https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html"},{"de":"Google Cloud: Schutz vor den neuen Schwachstellen ohne Leistungseinbußen","title":"Google Cloud: protecting customers from the new vulnerabilities without hurting performance","url":"https://cloud.google.com/blog/topics/inside-google-cloud/protecting-our-google-cloud-customers-new-vulnerabilities-without-impacting-performance"},{"de":"Website der Forscher zu Meltdown und Spectre, mit FAQ","title":"The researchers' site on Meltdown and Spectre, with FAQ","url":"https://spectreattack.com/"},{"de":"Die Spectre-Studie (arXiv, Januar 2018)","title":"The Spectre paper (arXiv, January 2018)","url":"https://arxiv.org/abs/1801.01203"},{"de":"NVD: CVE-2017-5753","title":"NVD: CVE-2017-5753","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5753"},{"de":"Microsoft: Leistungseinbußen durch die Spectre- und Meltdown-Fixes unter Windows","title":"Microsoft: performance impact of the Spectre and Meltdown fixes on Windows","url":"https://www.microsoft.com/en-us/security/blog/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/"},{"de":"Red Hat: Leistungseinbußen durch die Meltdown- und Spectre-Fixes","title":"Red Hat: performance impact of the Meltdown and Spectre fixes","url":"https://access.redhat.com/articles/3307751"},{"de":"Dokumentation des Linux-Kernels zu Spectre","title":"Linux kernel documentation on Spectre","url":"https://docs.kernel.org/admin-guide/hw-vuln/spectre.html"},{"de":"Ein Sicherheitsforscher über einen funktionierenden Spectre-Exploit auf VirusTotal (2021)","title":"A security researcher on a working Spectre exploit found on VirusTotal (2021)","url":"https://dustri.org/b/spectre-exploits-in-the-wild.html"}],"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","year":2018},{"actions":{"de":["Aktualisiere RouterOS mit **Check for updates** auf eine aktuelle Version. Alle Versionen von 6.29 bis 6.42 sind für diese Lücke offen. Behoben ist sie in **6.42.1** und **6.40.8**.","Ändere nach dem Update alle Router-Passwörter: Wenn Angreifer die Benutzerdatenbank vorher kopiert haben, sperrt das Update allein sie nicht aus.","Sorge dafür, dass Winbox (Port **8291**) aus dem Internet nicht erreichbar ist: Sperre den Port in der Firewall oder erlaube unter **IP \u003e Services** nur bekannte Adressen.","Prüfe die Konfiguration auf Einstellungen, die du nicht selbst vorgenommen hast: Scheduler-Aufgaben, die Skripte abrufen, einen eingeschalteten **SOCKS-Proxy**, einen laufenden Paket-Sniffer, unbekannte Benutzer oder VPN-Clients."],"en":["Update RouterOS to a current release with **Check for updates**. All versions from 6.29 to 6.42 are open to this flaw, which **6.42.1** and **6.40.8** fixed.","Change every router password after the update: if attackers copied the user database earlier, the update alone does not lock them out.","Keep Winbox (port **8291**) off the internet: block it in the firewall, or allow only known addresses under **IP \u003e Services**.","Check the configuration for settings you did not make: scheduler tasks that fetch scripts, an enabled **SOCKS proxy**, a running packet sniffer, unknown users or VPN clients."]},"criteria":{"damage":{"de":"Eine Zahl zum Schaden ist nicht dokumentiert. Laut MikroTik nutzte das Botnetz Mēris Router, die 2018 kompromittiert wurden. 2021 überflutete es Yandex mit 21,8 Millionen Anfragen pro Sekunde. Die Quellen nennen aber weder Kosten noch Ausfälle kritischer Dienste (Qrator Labs, MikroTik).","en":"No damage figure is documented. MikroTik says the Mēris botnet used routers compromised in 2018. In 2021, it flooded Yandex with 21.8 million requests per second. But the sources give no cost and no outage of critical services (Qrator Labs, MikroTik).","met":false},"exploitation":{"de":"Angreifer hatten auf 239.000 Geräten einen Proxy eingeschaltet und 7.500 Router dazu gebracht, den Datenverkehr ihrer Besitzer an sie weiterzuleiten (Netlab 360, 4. September 2018). Mehr als 170.000 Geräte trugen denselben Coinhive-Mining-Schlüssel (Trustwave, 2018).","en":"Attackers had switched on a proxy on 239,000 devices and made 7,500 routers send their owners' traffic to them (Netlab 360, September 4, 2018). More than 170,000 devices carried the same Coinhive mining key (Trustwave, 2018).","met":true},"reach":{"de":"Am 23. und 24. August 2018, vier Monate nach dem Patch, waren noch 370.000 MikroTik-Geräte verwundbar. Das waren 30,83 % der 1,2 Millionen Geräte, deren Winbox aus dem Internet erreichbar war (Netlab 360).","en":"On August 23–24, 2018, four months after the fix, 370,000 MikroTik devices were still vulnerable. That was 30.83 % of the 1.2 million found with Winbox open to the internet (Netlab 360).","met":true},"response":{"de":"MikroTik lieferte einen Patch und rief wiederholt zum Passwortwechsel auf. Im Dezember 2021 kam die Lücke auf die CISA-Liste ausgenutzter Schwachstellen. Eine Notfallanweisung oder die höchste nationale Warnstufe ist nicht dokumentiert (MikroTik, CISA).","en":"MikroTik released a fix and repeatedly urged password changes. In December 2021, CISA put the flaw on its list of exploited vulnerabilities. No emergency directive or highest national warning level is documented (MikroTik, CISA).","met":false}},"cves":["CVE-2018-14847"],"cvss":9.1,"cvss_version":"3.1","cwe":"CWE-22","dates":[{"date":"2018-04-23","key":"discovered"},{"date":"2018-04-23","key":"patched"},{"date":"2018-07-31","de":"Trustwave bemerkt eine Welle von Mining-Skripten, die MikroTik-Router in Brasilien ausliefern","en":"Trustwave notices a surge of mining scripts served by MikroTik routers in Brazil"},{"date":"2018-09-04","de":"Netlab 360 meldet 7.500 Router, die den Datenverkehr ihrer Besitzer an Angreifer weiterleiten","en":"Netlab 360 reports 7,500 routers that send their owners' traffic to attackers"},{"date":"2018-10-10","de":"Tenable zeigt, dass die Lücke Angreifern auch eine Root-Shell verschaffen kann","en":"Tenable shows that the flaw can also give attackers a root shell"},{"date":"2021-09-15","de":"Laut MikroTik nutzt das Botnetz Mēris für seine DDoS-Rekordangriffe Router, die 2018 kompromittiert wurden","en":"MikroTik says the Mēris botnet, behind record DDoS attacks, uses routers compromised in 2018"},{"date":"2021-12-01","key":"kev"}],"de":{"credit":"MikroTik selbst, nach eigenen Angaben; ein externer Entdecker wird nicht genannt","fixed":"RouterOS 6.42.1, 6.40.8 und 6.43rc4 (23. April 2018)","product":"MikroTik RouterOS, das Betriebssystem der MikroTik-Router, über seinen Verwaltungsdienst Winbox","summary":"Eine Lücke im Winbox-Dienst von MikroTik-Routern ließ jeden die Passwörter der Administratoren herunterladen. Monate nach dem Patch hatten Angreifer mehr als 200.000 Router gekapert."},"disclosed":"2018-04-23","en":{"credit":"MikroTik itself, by its own account; no outside finder is named","fixed":"RouterOS 6.42.1, 6.40.8 and 6.43rc4 (April 23, 2018)","product":"MikroTik RouterOS, the operating system of MikroTik routers, through its Winbox management service","summary":"A flaw in the Winbox service of MikroTik routers let anyone download the administrators' passwords. Months after the fix, attackers had hijacked more than 200,000 routers."},"figures":[{"de":"MikroTik-Geräte waren vier Monate nach dem Patch noch verwundbar (Netlab 360)","en":"MikroTik devices were still vulnerable four months after the fix (Netlab 360)","value":"370,000"},{"de":"Geräte betrieben einen Proxy, den Angreifer eingeschaltet hatten (gezählt nach IP-Adressen; Netlab 360)","en":"devices ran a proxy that attackers had switched on (counted by IP address; Netlab 360)","value":"239,000"},{"de":"Router schickten Kopien des Datenverkehrs ihrer Besitzer an Angreifer (Netlab 360)","en":"routers sent copies of their owners' traffic to attackers (Netlab 360)","value":"7,500"},{"de":"MikroTik-Geräte trugen denselben Coinhive-Mining-Schlüssel (mehr als; Trustwave, über Censys)","en":"MikroTik devices carried the same Coinhive mining key (more than; Trustwave, via Censys)","value":"170,000"}],"kev":"2021-12-01","key":"mikrotik","name":"MikroTik Winbox","product":"MikroTik RouterOS","sources":[{"de":"MikroTik-Sicherheitshinweis: Winbox-Schwachstelle (CVE-2018-14847)","title":"MikroTik security advisory: Winbox vulnerability (CVE-2018-14847)","url":"https://mikrotik.com/supportsec/winbox-vulnerability/"},{"de":"MikroTik-Forum: Warnung vom 23. April 2018, mit den korrigierten Versionen","title":"MikroTik forum: advisory of April 23, 2018, with the fixed versions","url":"https://forum.mikrotik.com/t/advisory-vulnerability-exploiting-the-winbox-port-solved/118771"},{"de":"MikroTik-Forum: Ein Botnetz nutzt die Winbox-Lücke aus (2. August 2018)","title":"MikroTik forum: a botnet exploits the Winbox flaw (August 2, 2018)","url":"https://forum.mikrotik.com/t/winbox-vulnerability-please-upgrade/122004"},{"de":"MikroTik: Stellungnahme zum Botnetz Mēris (15. September 2021)","title":"MikroTik: statement on the Mēris botnet (September 15, 2021)","url":"https://mikrotik.com/supportsec/meris-botnet/"},{"de":"NVD: CVE-2018-14847","title":"NVD: CVE-2018-14847","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14847"},{"de":"CISA: Katalog ausgenutzter Schwachstellen, Eintrag zu CVE-2018-14847","title":"CISA: Known Exploited Vulnerabilities Catalog, entry for CVE-2018-14847","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14847"},{"de":"Netlab 360: Mehr als 7.500 MikroTik-Router leiten den Datenverkehr ihrer Besitzer an Angreifer weiter (4. September 2018)","title":"Netlab 360: 7,500+ MikroTik routers are forwarding owners' traffic to the attackers (September 4, 2018)","url":"https://blog.netlab.360.com/7500-mikrotik-routers-are-forwarding-owners-traffic-to-the-attackers-how-is-yours-en/"},{"de":"Trustwave SpiderLabs: Masseninfektion von MikroTik-Routern, zuerst in Brasilien (2018, heute auf der Website von LevelBlue)","title":"Trustwave SpiderLabs: mass MikroTik router infection, first in Brazil (2018, now on the LevelBlue site)","url":"https://www.levelblue.com/en-us/resources/blogs/spiderlabs-blog/mass-mikrotik-router-infection-first-we-cryptojack-brazil-then-we-take-the-world/"},{"de":"Tenable: Sicherheitslücken in MikroTik RouterOS, hinter CVE-2018-14847 steckt mehr (10. Oktober 2018)","title":"Tenable: MikroTik RouterOS vulnerabilities, there's more to CVE-2018-14847 (October 10, 2018)","url":"https://www.tenable.com/blog/mikrotik-routeros-vulnerabilities-there-s-more-to-cve-2018-14847"},{"de":"Qrator Labs und Yandex: Das Botnetz Mēris auf Rekordkurs (9. September 2021)","title":"Qrator Labs and Yandex: Mēris botnet, climbing to the record (September 9, 2021)","url":"https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/"},{"de":"Microsoft: TrickBot nutzt MikroTik-Router, um seine Steuerserver zu verbergen (16. März 2022)","title":"Microsoft: TrickBot's use of MikroTik routers to hide its command servers (March 16, 2022)","url":"https://www.microsoft.com/en-us/security/blog/2022/03/16/uncovering-trickbots-use-of-iot-devices-in-command-and-control-infrastructure/"},{"de":"Cisco Talos: VPNFilter III, mit dem Winbox-Protokoll von MikroTik (26. September 2018)","title":"Cisco Talos: VPNFilter III, with MikroTik's Winbox protocol (September 26, 2018)","url":"https://blog.talosintelligence.com/vpnfilter-part-3"},{"de":"BleepingComputer (Presse): MikroTik schließt eine bereits angegriffene Zero-Day-Lücke in Rekordzeit (24. April 2018)","title":"BleepingComputer (press): MikroTik patches zero-day flaw under attack in record time (April 24, 2018)","url":"https://www.bleepingcomputer.com/news/security/mikrotik-patches-zero-day-flaw-under-attack-in-record-time"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","year":2018},{"actions":{"de":["Prüfe die Exim-Version auf deinen Mailservern mit `exim -bV`: Eine Version von **4.87 bis 4.91** ohne den Patch deiner Distribution vom Juni 2019 ist für diese Sicherheitslücke offen.","Aktualisiere Exim über die Sicherheitsupdates deiner Distribution oder auf die aktuelle Version **4.100.1** (Stand: 1. November 2026). Das Exim-Projekt betrachtet alle älteren Versionen als veraltet.","Wenn eine verwundbare Version aus dem Internet erreichbar war, such nach Spuren eines Angriffs: unbekannte Cronjobs, unbekannte SSH-Schlüssel für root, neue Benutzer mit Administratorrechten und geänderte Firewall-Regeln.","Durchsuche deine Mail-Logs nach Absender- oder Empfängeradressen, die `${run{` enthalten: Das sind Versuche, die Sicherheitslücke auszunutzen."],"en":["Check the Exim version on your mail servers with `exim -bV`: a version from **4.87 to 4.91** without your distribution's patch of June 2019 is open to this flaw.","Update Exim through your distribution's security updates or to the current release, **4.100.1** (as of November 1, 2026). The Exim project considers all older releases obsolete.","If a vulnerable version was reachable from the internet, look for signs of an attack: unknown cron jobs, unknown SSH keys for root, new users with admin rights and changed firewall rules.","Search your mail logs for sender or recipient addresses that contain `${run{`: they are attempts to exploit the flaw."]},"criteria":{"damage":{"de":"Eine Gesamtsumme des Schadens ist nicht dokumentiert. Die Behörden berichten von Krypto-Minern auf gekaperten Servern, von kanadischen Opfern noch im Mai 2020 und von Angriffen einer Hackergruppe des russischen Militärs, aber ohne Zahlen (NCSC; Canadian Centre for Cyber Security; CISA).","en":"No damage total is documented. The agencies report crypto miners on hijacked servers, Canadian victims as recently as May 2020 and attacks by a Russian military hacking group, without figures (NCSC; Canadian Centre for Cyber Security; CISA).","met":false},"exploitation":{"de":"Ein Wurm verbreitete sich selbstständig: Ein Skript auf gekaperten Servern durchsuchte das Internet nach verwundbaren Exim-Servern und griff sie an (Canadian Centre for Cyber Security, 14. Juni 2019). Microsoft bestätigte den aktiven Wurm am 13. Juni 2019 (Microsoft Security Response Center).","en":"A worm spread on its own: a script on hijacked servers searched the internet for vulnerable Exim servers and attacked them (Canadian Centre for Cyber Security, June 14, 2019). Microsoft confirmed the active worm on June 13, 2019 (Microsoft Security Response Center).","met":true},"reach":{"de":"Eine Shodan-Suche fand einen Tag nach dem Fix mehr als 4,1 Millionen Systeme mit Exim 4.87 bis 4.91, gegenüber 475.591 mit der korrigierten Version 4.92 (Tenable, Anbieterdaten, Juni 2019). Im Oktober 2019 waren allein in Großbritannien noch mehr als 174.000 Exim-Server für diese oder zwei spätere Exim-Lücken offen (NCSC).","en":"A Shodan search found more than 4.1 million systems with Exim 4.87 to 4.91 one day after the fix, against 475,591 with the fixed 4.92 (Tenable, vendor data, June 2019). In October 2019, more than 174,000 Exim servers in the UK alone were still open to this or two later Exim flaws (NCSC).","met":true},"response":{"de":"Behörden in den USA, in Großbritannien und in Kanada warnten. Das NCSC informierte betroffene britische Anbieter. Eine Notfallanweisung oder die höchste Warnstufe ist jedoch nicht dokumentiert (CISA; NCSC; Canadian Centre for Cyber Security).","en":"Agencies in the US, the UK and Canada warned, and the NCSC notified affected UK providers. But no emergency directive or highest warning level is documented (CISA; NCSC; Canadian Centre for Cyber Security).","met":false}},"cves":["CVE-2019-10149"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-78","dates":[{"date":"2016-04-06","de":"Exim 4.87 schaltet den fehlerhaften Code standardmäßig ein","en":"Exim 4.87 switches the flawed code on by default"},{"date":"2019-02-10","de":"Exim 4.92 behebt den Fehler, doch niemand bemerkt, dass er eine Sicherheitslücke war","en":"Exim 4.92 removes the flaw, but nobody notices that it was a security hole"},{"date":"2019-05-27","key":"reported"},{"date":"2019-06-03","de":"Exim warnt vor einem möglichen Angriff aus der Ferne, noch ohne Details","en":"Exim warns of a possible remote exploit, still without details"},{"date":"2019-06-05","key":"disclosed"},{"date":"2019-06-05","key":"patched"},{"date":"2019-06-09","key":"exploited"},{"date":"2019-06-13","de":"Microsoft bestätigt einen aktiven Wurm, der sich über die Sicherheitslücke verbreitet","en":"Microsoft confirms an active worm that spreads through the flaw"},{"date":"2019-08-23","de":"Ein fertiges Metasploit-Modul macht den Angriff leicht","en":"A ready-made Metasploit module makes the attack easy"},{"date":"2020-05-28","de":"Die NSA meldet, dass der russische Militärgeheimdienst die Sicherheitslücke seit mindestens August 2019 ausnutzt","en":"The NSA reports that Russia's military intelligence has exploited the flaw since at least August 2019"},{"date":"2022-01-10","key":"kev"}],"de":{"credit":"Qualys Research Labs","fixed":"Exim 4.92 (10. Februar 2019, unbemerkt); Patch für die Versionen 4.87 bis 4.91 (5. Juni 2019)","product":"Exim, ein Mailserver für Linux- und Unix-Systeme","summary":"Eine Sicherheitslücke im Mailserver Exim ließ Angreifer Befehle als root ausführen, die sie in eine E-Mail-Adresse schrieben. Binnen weniger Tage verbreitete sich ein Wurm über die Lücke."},"disclosed":"2019-06-05","en":{"credit":"Qualys Research Labs","fixed":"Exim 4.92 (February 10, 2019, unnoticed); patch for versions 4.87 to 4.91 (June 5, 2019)","product":"Exim, a mail server for Linux and Unix systems","summary":"A flaw in the Exim mail server let attackers run commands as root by writing them into an email address. Within days, a worm spread through it."},"figures":[{"de":"Millionen Systeme zeigten im Juni 2019 in den Suchergebnissen von Shodan eine verwundbare Exim-Version (mehr als; Daten von Tenable)","en":"million systems showed a vulnerable Exim version in Shodan search results in June 2019 (more than; Tenable data)","value":"4.1"},{"de":"Tage nach der Veröffentlichung warnte Microsoft vor einem aktiven Wurm","en":"days after disclosure, Microsoft warned of an active worm","value":"8"},{"de":"Tage vergingen zwischen dem unbemerkten Fix in Exim 4.92 und der Veröffentlichung der Sicherheitslücke","en":"days passed between the unnoticed fix in Exim 4.92 and the disclosure of the flaw","value":"115"},{"de":"Exim-Server allein in Großbritannien waren im Oktober 2019 noch für diese oder zwei spätere Exim-Lücken offen (mehr als; NCSC)","en":"Exim servers in the UK alone were still open to this or two later Exim flaws in October 2019 (more than; NCSC)","value":"174,000"}],"kev":"2022-01-10","key":"exim","name":"Exim","product":"Exim","sources":[{"de":"Qualys: The Return of the WIZard, der Sicherheitshinweis der Entdecker","title":"Qualys: The Return of the WIZard, the finders' advisory","url":"https://www.qualys.com/2019/06/05/cve-2019-10149/return-wizard-rce-exim.txt"},{"de":"Exim-Projekt: Hinweis und Zeitleiste zu CVE-2019-10149","title":"Exim project: notice and timeline for CVE-2019-10149","url":"https://www.exim.org/static/doc/security/CVE-2019-10149.txt"},{"de":"oss-security: Exim veröffentlicht den Fix vorzeitig, weil Details durchgesickert waren (5. Juni 2019)","title":"oss-security: Exim publishes the fix early because details leaked (June 5, 2019)","url":"https://www.openwall.com/lists/oss-security/2019/06/05/3"},{"de":"Debian-Sicherheitshinweis DSA-4456 (5. Juni 2019)","title":"Debian security advisory DSA-4456 (June 5, 2019)","url":"https://www.debian.org/security/2019/dsa-4456"},{"de":"NVD: CVE-2019-10149","title":"NVD: CVE-2019-10149","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10149"},{"de":"Tenable: Shodan-Zählung nach Exim-Version und erste Angriffe (Anbieterdaten)","title":"Tenable: Shodan counts by Exim version and first attacks (vendor data)","url":"https://www.tenable.com/blog/cve-2019-10149-critical-remote-command-execution-vulnerability-discovered-in-exim"},{"de":"Microsoft Security Response Center: Ein aktiver Linux-Wurm nutzt Exim aus (13. Juni 2019)","title":"Microsoft Security Response Center: an active Linux worm exploits Exim (June 13, 2019)","url":"https://www.microsoft.com/en-us/msrc/blog/2019/06/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149"},{"de":"Canadian Centre for Cyber Security: Warnung AL19-012 zum Wurm (14. Juni 2019)","title":"Canadian Centre for Cyber Security: alert AL19-012 on the worm (June 14, 2019)","url":"https://www.cyber.gc.ca/en/alerts/active-exploitation-exim-vulnerability-observed-wild"},{"de":"NCSC: Sicherheitshinweis zu Schwachstellen in Exim-Mailservern (4. Oktober 2019)","title":"NCSC: advisory on Exim mail server vulnerabilities (October 4, 2019)","url":"https://www.ncsc.gov.uk/news/exim-mail-server-vulnerabilities-advisory"},{"de":"CISA: NSA-Warnung zur Ausnutzung der Exim-Lücke durch Sandworm (28. Mai 2020)","title":"CISA: NSA advisory on Sandworm exploiting the Exim flaw (May 28, 2020)","url":"https://www.cisa.gov/news-events/alerts/2020/05/28/nsa-releases-advisory-sandworm-actors-exploiting-exim-vulnerability"},{"de":"NCSC: Stellungnahme zur Warnung der NSA (28. Mai 2020)","title":"NCSC: statement supporting the NSA advisory (May 28, 2020)","url":"https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"},{"de":"Canadian Centre for Cyber Security: Warnung AL20-017 zu anhaltenden Angriffen (3. Juni 2020)","title":"Canadian Centre for Cyber Security: alert AL20-017 on continued attacks (June 3, 2020)","url":"https://www.cyber.gc.ca/en/alerts-advisories/continued-exploitation-exim-vulnerability"},{"de":"Rapid7: Mailserver im Internet, 2020 (Anbieterdaten)","title":"Rapid7: internet exposure of mail servers, 2020 (vendor data)","url":"https://www.rapid7.com/blog/post/2020/10/02/nicer-protocol-deep-dive-internet-exposure-of-smtp/"},{"de":"Exim-Projekt: die aktuelle Version","title":"Exim project: the current version","url":"https://www.exim.org/"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2019},{"actions":{"de":["Nutze eine unterstützte NetScaler-Version wie **14.1** mit allen aktuellen Updates. Die betroffenen Versionen 10.5 bis 13.0 erhalten keine Sicherheitsupdates mehr; für 13.0 endete der Support am 15. Juli 2024.","Lief ein Gateway im Januar 2020 ohne den Fix oder den Workaround, lass es auf Spuren eines Angriffs prüfen: Ein Update entfernt keine Hintertür, die vorher eingeschleust wurde. Wurde es kompromittiert, setze es neu auf und ersetze seine Zertifikate.","Installiere Sicherheitsupdates für Fernzugriffs-Gateways binnen weniger Tage: Im Januar 2020 begannen die Massenangriffe binnen eines Tages nach der Veröffentlichung des Angriffscodes."],"en":["Run a supported NetScaler release such as **14.1** with all current updates. The affected versions 10.5 to 13.0 get no more security fixes; 13.0 reached its end of life on July 15, 2024.","If a gateway ran without the fix or the workaround in January 2020, have it checked for signs of attack: an update does not remove a backdoor planted before it. If it was compromised, set it up anew and replace its certificates.","Install security updates for remote access gateways within days: in January 2020, mass attacks began within a day of the attack code's release."]},"criteria":{"damage":{"de":"Angreifer, die über das Citrix-Gateway eingedrungen waren, verschlüsselten im September 2020 etwa 30 Server des Universitätsklinikums Düsseldorf (Justizministerium NRW, September 2020). Das Klinikum musste sich für 13 Tage von der Notfallversorgung abmelden (BSI, 2021).","en":"Attackers who had come in through the Citrix gateway encrypted about 30 servers of Düsseldorf University Hospital in September 2020 (NRW Ministry of Justice, September 2020). The hospital had to stay off emergency care for 13 days (BSI, 2021).","met":true},"exploitation":{"de":"Fox-IT fand bis Juni 2020 auf 3.332 Servern bekannte Spuren einer Kompromittierung (Fox-IT, Juli 2020). Behörden aus den USA, Großbritannien und Australien nannten die Lücke die am häufigsten ausgenutzte des Jahres 2020 (CISA-Warnung AA21-209A, Juli 2021).","en":"Fox-IT found known signs of compromise on 3,332 servers by June 2020 (Fox-IT, July 2020). Agencies of the US, the UK and Australia called it the most exploited flaw of 2020 (CISA advisory AA21-209A, July 2021).","met":true},"reach":{"de":"Ein weltweiter Scan fand im Dezember 2019 schätzungsweise 128.777 verwundbare Server (DIVD-Fallbericht, 2020).","en":"A worldwide scan in December 2019 found an estimated 128,777 vulnerable servers (DIVD case report, 2020).","met":true},"response":{"de":"Das niederländische NCSC stufte die Lücke auf die höchste Stufe hoch. Es forderte Regierung und Betreiber kritischer Dienste dringend auf, ihre Citrix-Server bis zum Fix abzuschalten (Brief der niederländischen Regierung an das Parlament, 23. Januar 2020).","en":"The Dutch NCSC raised its rating to the highest level. It urged the government and operators of vital services to switch off their Citrix servers until a fix existed (Dutch government's letter to parliament, January 23, 2020).","met":true}},"cves":["CVE-2019-19781"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-22","dates":[{"date":"2019-12-17","key":"disclosed"},{"date":"2020-01-11","key":"exploited"},{"date":"2020-01-17","de":"Das niederländische NCSC rät, Citrix-Server abzuschalten, bis es einen Fix gibt","en":"The Dutch NCSC advises switching off Citrix servers until a fix exists"},{"date":"2020-01-19","key":"patched"},{"date":"2020-01-24","de":"Mit Version 10.5 bekommt die letzte betroffene Version ihren Fix","en":"With version 10.5, the last affected version gets its fix"},{"date":"2020-09-10","de":"Ransomware, die über ein Citrix-Gateway eingedrungen ist, trifft das Universitätsklinikum Düsseldorf","en":"Ransomware that came in through a Citrix gateway hits Düsseldorf University Hospital"},{"date":"2021-07-28","de":"Behörden aus den USA, Großbritannien und Australien nennen sie die am häufigsten ausgenutzte Sicherheitslücke des Jahres 2020","en":"Agencies of the US, the UK and Australia name it the most exploited flaw of 2020"},{"date":"2021-11-03","key":"kev"}],"de":{"credit":"Positive Technologies","fixed":"Citrix ADC und Gateway 11.1 Build 63.15 und 12.0 Build 63.13 (19. Januar 2020), 12.1 Build 55.18 und 13.0 Build 47.24 (23. Januar), 10.5 Build 70.12 (24. Januar 2020)","product":"Citrix ADC und Citrix Gateway (heute wieder NetScaler genannt), Geräte für den Fernzugriff auf interne Netze","summary":"Eine Sicherheitslücke in den Fernzugriffs-Gateways von Citrix ließ jeden im Internet die Geräte ohne Passwort übernehmen. 33 Tage lang gab es nur einen Workaround."},"disclosed":"2019-12-17","en":{"credit":"Positive Technologies","fixed":"Citrix ADC and Gateway 11.1 build 63.15 and 12.0 build 63.13 (January 19, 2020), 12.1 build 55.18 and 13.0 build 47.24 (January 23), 10.5 build 70.12 (January 24, 2020)","product":"Citrix ADC and Citrix Gateway (today again called NetScaler), devices for remote access to internal networks","summary":"A flaw in Citrix's remote access gateways let anyone on the internet take them over without a password. For 33 days, only a workaround existed."},"figures":[{"de":"verwundbare Server weltweit im Dezember 2019 (Schätzung aus einem Scan; DIVD)","en":"vulnerable servers worldwide in December 2019 (estimate from a scan; DIVD)","value":"128,777"},{"de":"Server mit bekannten Spuren eines Angriffs bis Juni 2020 (Fox-IT)","en":"servers with known signs of attack by June 2020 (Fox-IT)","value":"3,332"},{"de":"Tage vergingen zwischen der Warnung von Citrix und den ersten Fixes","en":"days from Citrix's warning to the first fixes","value":"33"},{"de":"Tage in Folge war das Universitätsklinikum Düsseldorf von der Notfallversorgung abgemeldet (BSI)","en":"days in a row Düsseldorf University Hospital was off emergency care (BSI)","value":"13"}],"kev":"2021-11-03","key":"citrix-adc","name":"Citrix ADC","product":"Citrix ADC and Citrix Gateway","sources":[{"de":"Citrix-Sicherheitshinweis CTX267027 zu CVE-2019-19781","title":"Citrix security bulletin CTX267027 for CVE-2019-19781","url":"https://support.citrix.com/article/CTX267027"},{"de":"NVD: CVE-2019-19781","title":"NVD: CVE-2019-19781","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781"},{"de":"CERT/CC-Schwachstellenhinweis VU#619785, mit dem Workaround","title":"CERT/CC vulnerability note VU#619785, with the workaround","url":"https://www.kb.cert.org/vuls/id/619785"},{"de":"CISA-Warnung AA20-020A, mit den korrigierten Builds und ihren Daten","title":"CISA alert AA20-020A, with the fixed builds and their dates","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-020a"},{"de":"CISA-Warnung AA20-031A: kompromittierte Citrix-Geräte erkennen","title":"CISA alert AA20-031A: detecting compromised Citrix devices","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-031a"},{"de":"CISA, FBI, ACSC und NCSC-UK: die am häufigsten ausgenutzten Schwachstellen (28. Juli 2021)","title":"CISA, FBI, ACSC and NCSC-UK: top routinely exploited vulnerabilities (July 28, 2021)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a"},{"de":"DIVD: Fallbericht zu CVE-2019-19781, mit Scan-Ergebnissen","title":"DIVD: case report on CVE-2019-19781, with scan results","url":"https://www.divd.nl/newsroom/articles/b6f6e14afadc/"},{"de":"SANS Internet Storm Center: Exploits für Citrix ADC sind öffentlich und werden stark genutzt (11. Januar 2020)","title":"SANS Internet Storm Center: Citrix ADC exploits are public and heavily used (January 11, 2020)","url":"https://isc.sans.edu/diary/25700"},{"de":"FireEye (Mandiant): ein Angreifer, der andere Angreifer aussperrt, sich selbst aber eine Hintertür offenhält (15. Januar 2020)","title":"FireEye (Mandiant): an attacker that blocks other attackers but keeps a backdoor (January 15, 2020)","url":"https://cloud.google.com/blog/topics/threat-intelligence/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor/"},{"de":"Fox-IT: ein zweiter Blick auf CVE-2019-19781, mit der Zahl kompromittierter Server (1. Juli 2020)","title":"Fox-IT: a second look at CVE-2019-19781, with counts of compromised servers (July 1, 2020)","url":"https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/"},{"de":"Niederländische Regierung: Brief an das Parlament zur Citrix-Sicherheitslücke (23. Januar 2020, auf Niederländisch)","title":"Dutch government: letter to parliament on the Citrix flaw (January 23, 2020, in Dutch)","url":"https://zoek.officielebekendmakingen.nl/kst-26643-660.html"},{"de":"Niederländisches NCSC: Citrix-Systeme nach Möglichkeit abschalten (Januar 2020, auf Niederländisch)","title":"Dutch NCSC: switch off Citrix systems where possible (January 2020, in Dutch)","url":"https://www.ncsc.nl/actueel/nieuws/2020/januari/16/door-citrix-geadviseerde-mitigerende-maatregelen-niet-altijd-effectief"},{"de":"BSI: Aktive Ausnutzung der Citrix-Schwachstelle (16. Januar 2020)","title":"BSI: active exploitation of the Citrix flaw (January 16, 2020, in German)","url":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2020/Citrix_Schwachstelle_160120.html"},{"de":"BSI: Cyber-Angriff auf Uniklinik Düsseldorf, BSI warnt vor akuter Ausnutzung bekannter Schwachstelle (17. September 2020)","title":"BSI: cyber attack on Düsseldorf University Hospital, warning of the Citrix flaw (September 17, 2020, in German)","url":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2020/UKDuesseldorf_170920.html"},{"de":"BSI: Die Lage der IT-Sicherheit in Deutschland 2021, mit dem Fall des Klinikums auf Seite 15 (PDF)","title":"BSI: the state of IT security in Germany 2021, with the hospital case on page 15 (PDF, in German)","url":"https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2021.pdf?__blob=publicationFile\u0026v=3"},{"de":"Justizministerium NRW: Bericht an den Landtag zum Stand des Ermittlungsverfahrens zum Cyberangriff auf die Uniklinik Düsseldorf (September 2020, PDF)","title":"NRW Ministry of Justice: report to the state parliament on the attack on Düsseldorf University Hospital (September 2020, PDF, in German)","url":"https://www.landtag.nrw.de/portal/WWW/dokumentenarchiv/Dokument/MMV17-3855.pdf"},{"de":"Wissenschaftsministerium NRW: Bericht an den Landtag zum IT-Ausfall am Düsseldorfer Uniklinikum (September 2020, PDF)","title":"NRW Ministry of Culture and Science: report to the state parliament on the IT outage at the hospital (September 2020, PDF, in German)","url":"https://www.landtag.nrw.de/portal/WWW/dokumentenarchiv/Dokument/MMV17-3934.pdf"},{"de":"Justizministerium NRW: Stand der Ermittlungen, mit dem Ergebnis zum Tod einer Patientin (Januar 2021, PDF)","title":"NRW Ministry of Justice: status of the investigation, with the findings on the death of a patient (January 2021, PDF, in German)","url":"https://www.landtag.nrw.de/portal/WWW/dokumentenarchiv/Dokument/MMV17-4545.pdf"},{"de":"NetScaler: Release-Zyklus der Firmware, mit dem Supportende der Versionen","title":"NetScaler: firmware release cycle, with end-of-life dates","url":"https://support.citrix.com/external/article/CTX241500/netscaler-adc-firmware-release-cycle.html"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2019},{"actions":{"de":["Installiere die aktuellen Sicherheitsupdates für deinen Exchange Server; ein Server ohne die Updates vom März 2021 ist für diese Angriffe offen.","Prüfe den Server auch nach dem Update auf Webshells und andere Spuren eines Angriffs: Die Angriffe begannen im Januar 2021, zwei Monate vor dem Fix.","Wenn du den Server nicht binnen Tagen patchen kannst, zieh einen gehosteten Maildienst in Betracht; Microsofts Exchange Online war nicht betroffen."],"en":["Install the current security updates for your Exchange Server; a server without the March 2021 updates is open to these attacks.","Check the server for web shells and other signs of attack, even after updating: the attacks began in January 2021, two months before the fix.","If you cannot keep the server patched within days, consider a hosted mail service; Microsoft's Exchange Online was not affected."]},"criteria":{"damage":{"de":"Eine Gesamtsumme des Schadens oder der gestohlenen Postfächer ist nicht dokumentiert.","en":"No total of the damage or of the stolen mailboxes is documented.","met":false},"exploitation":{"de":"Angreifer legten Webshells auf mehr als 5.000 Mailservern in über 115 Ländern ab. Das ist nur das, was ein einziges Sicherheitsunternehmen sah (ESET, 10. März 2021).","en":"Attackers planted web shells on more than 5,000 email servers in over 115 countries, and that is only what one security company saw (ESET, March 10, 2021).","met":true},"reach":{"de":"Fast 400.000 Exchange-Server waren am Tag vor dem Fix online: gefährdete Systeme, nicht gehackte (RiskIQ-Daten über Microsoft, 12. März 2021).","en":"Nearly 400,000 Exchange servers were online the day before the fix: systems at risk, not hacked ones (RiskIQ data via Microsoft, March 12, 2021).","met":true},"response":{"de":"Die US-Behörde CISA erließ einen Tag nach dem Fix die Notfallanweisung 21-02 für Bundesbehörden (CISA, 3. März 2021).","en":"The US agency CISA issued Emergency Directive 21-02 to federal agencies one day after the fix (CISA, March 3, 2021).","met":true}},"cves":["CVE-2021-26855","CVE-2021-26857","CVE-2021-26858","CVE-2021-27065"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-918, CWE-502, CWE-22","dates":[{"date":"2020-12-10","key":"discovered"},{"date":"2021-01-03","key":"exploited"},{"date":"2021-01-05","key":"reported"},{"date":"2021-03-02","key":"patched"},{"date":"2021-03-03","de":"Die CISA erlässt die Notfallanweisung 21-02 für US-Bundesbehörden","en":"CISA issues Emergency Directive 21-02 to US federal agencies"}],"de":{"credit":"DEVCORE; Volexity und Dubex meldeten Teile der Angriffskette, die sie bei Angriffen beobachtet hatten","fixed":"Sicherheitsupdates vom 2. März 2021 für Exchange Server 2013, 2016 und 2019","product":"Microsoft Exchange Server 2013, 2016 und 2019, auf eigenen Servern einer Organisation betrieben","summary":"Vier Lücken in Microsoft Exchange ließen Angreifer ohne Passwort Postfächer lesen und Mailserver übernehmen, zwei Monate bevor es einen Fix gab."},"disclosed":"2021-03-02","en":{"credit":"DEVCORE; Volexity and Dubex reported parts of the attack chain seen in attacks","fixed":"Security updates of March 2, 2021 for Exchange Server 2013, 2016 and 2019","product":"Microsoft Exchange Server 2013, 2016 and 2019, run on an organization's own servers","summary":"Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password, two months before a fix existed."},"figures":[{"de":"Exchange-Server waren am Tag vor dem Fix gefährdet (knapp so viele; gehackt wurden nicht alle)","en":"Exchange servers at risk the day before the fix (nearly that many; not all were hacked)","value":"400,000"},{"de":"Tage lang liefen Angriffe, bevor es einen Fix gab","en":"days of attacks before a fix existed","value":"58"},{"de":"Server mit Webshells in über 115 Ländern (mehr als; ESET, 10. März 2021)","en":"servers with web shells in over 115 countries (more than; ESET, March 10, 2021)","value":"5,000"}],"kev":"2021-11-03","key":"proxylogon","name":"ProxyLogon","product":"Microsoft Exchange Server","sources":[{"de":"DEVCORE: ProxyLogon, mit vollständiger Zeitleiste","title":"DEVCORE: ProxyLogon, with the full timeline","url":"https://proxylogon.com/"},{"de":"Microsoft: HAFNIUM greift Exchange-Server an (2. März 2021)","title":"Microsoft: HAFNIUM targeting Exchange servers (March 2, 2021)","url":"https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"},{"de":"Microsoft Security Response Center: Sicherheitsupdates für Exchange Server","title":"Microsoft Security Response Center: security updates for Exchange Server","url":"https://www.microsoft.com/en-us/msrc/blog/2021/03/multiple-security-updates-released-for-exchange-server"},{"de":"Microsoft: Schutz für selbst betriebene Exchange-Server (12. März 2021)","title":"Microsoft: protecting on-premises Exchange servers (March 12, 2021)","url":"https://www.microsoft.com/en-us/security/blog/2021/03/12/protecting-on-premises-exchange-servers-against-recent-attacks/"},{"de":"Microsoft: Angriffe über die Exchange-Lücken (25. März 2021)","title":"Microsoft: attacks taking advantage of the Exchange flaws (March 25, 2021)","url":"https://www.microsoft.com/en-us/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/"},{"de":"Volexity: aktive Ausnutzung der Exchange-Zero-Days","title":"Volexity: active exploitation of the Exchange zero-days","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"de":"ESET: Exchange-Server unter Beschuss von mehr als zehn Angreifergruppen","title":"ESET: Exchange servers under siege from more than ten attacker groups","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"},{"de":"CISA-Notfallanweisung 21-02 (abgeschlossen)","title":"CISA Emergency Directive 21-02 (closed)","url":"https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities-closed"},{"de":"DIVD: Scan und Warnungen an Betreiber verwundbarer Exchange-Server","title":"DIVD: scan and warnings to owners of vulnerable Exchange servers","url":"https://csirt.divd.nl/cases/DIVD-2021-00001/"},{"de":"NVD: CVE-2021-26855, mit der Bewertung von Microsoft","title":"NVD: CVE-2021-26855, with Microsoft's score","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26855"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2021},{"actions":{"de":["Aktualisiere Log4j auf **2.17.1** oder neuer; unter Java 7 nimm **2.12.4**, unter Java 6 **2.3.2**.","Such Log4j auch in anderen Produkten: Die meisten Pakete binden es über andere Pakete ein. Frag deshalb deine Softwarehersteller, ob ihre Versionen behoben sind.","War eine alte Version jemals aus dem Internet erreichbar, prüfe Logs und Systeme auf Spuren eines Angriffs: Die ersten Versuche gab es am 1. Dezember 2021, bevor die Lücke öffentlich war."],"en":["Update Log4j to **2.17.1** or newer; on Java 7 use **2.12.4**, on Java 6 **2.3.2**.","Look for Log4j inside other products too: most packages include it through other packages. So ask your software vendors whether their versions are fixed.","If an old version was ever reachable from the internet, check logs and systems for signs of attack: the first attempts came on December 1, 2021, before the flaw was public."]},"criteria":{"damage":{"de":"Ein Gesamtschaden ist nicht dokumentiert. Laut dem US-amerikanischen Cyber Safety Review Board wurde die Lücke weniger ausgenutzt, als viele Fachleute vorhergesagt hatten (CSRB, Juli 2022).","en":"No total damage is documented, and the US Cyber Safety Review Board found exploitation lower than many experts had predicted (CSRB, July 2022).","met":false},"exploitation":{"de":"Angriffsversuche erreichten bis zum 20. Dezember 2021 mehr als 48 % der Unternehmensnetze weltweit (Herstellerdaten von Check Point).","en":"Attack attempts reached more than 48 % of corporate networks worldwide by December 20, 2021 (Check Point vendor data).","met":true},"reach":{"de":"35.863 Java-Pakete auf Maven Central, mehr als 8 % aller, nutzten den fehlerhaften Code (Google, 16. Dezember 2021). Das ist weniger als ein Zehntel. Eine Zahl betroffener Systeme ist nicht dokumentiert.","en":"35,863 Java packages on Maven Central, more than 8 % of all, used the flawed code (Google, December 16, 2021). That is short of a tenth. No count of affected systems is documented.","met":false},"response":{"de":"Das BSI stufte seine Warnung am 11. Dezember 2021 auf die Warnstufe Rot hoch (BSI). Die CISA erließ am 17. Dezember die Notfallanweisung 22-02 (CSRB-Bericht).","en":"Germany's BSI raised its warning to level red on December 11, 2021 (BSI). CISA issued Emergency Directive 22-02 on December 17 (CSRB report).","met":true}},"cves":["CVE-2021-44228","CVE-2021-45046","CVE-2021-45105","CVE-2021-44832"],"cvss":10,"cvss_version":"3.1","cwe":"CWE-917, CWE-20, CWE-674","dates":[{"date":"2021-11-24","key":"reported"},{"date":"2021-12-01","key":"exploited"},{"date":"2021-12-09","key":"disclosed"},{"date":"2021-12-10","key":"patched"},{"date":"2021-12-11","de":"Das BSI stuft seine Warnung auf die Warnstufe Rot hoch","en":"Germany's BSI raises its warning to level red"},{"date":"2021-12-17","de":"Die CISA erlässt die Notfallanweisung 22-02 für US-Bundesbehörden","en":"CISA issues Emergency Directive 22-02 to US federal agencies"}],"de":{"credit":"Alibaba Cloud Security Team","fixed":"Log4j 2.17.1, 2.12.4 (Java 7) und 2.3.2 (Java 6); erster Fix 2.15.0 am 10. Dezember 2021","product":"Apache Log4j 2, eine Logging-Bibliothek für Java-Programme","summary":"Eine Zeile Text in einem Log genügte, damit Server den Code von Angreifern ausführten. Die Lücke steckte in einer Java-Bibliothek, von der 35.863 Pakete abhingen."},"disclosed":"2021-12-09","en":{"credit":"Alibaba Cloud Security Team","fixed":"Log4j 2.17.1, 2.12.4 (Java 7) and 2.3.2 (Java 6); first fix 2.15.0 on December 10, 2021","product":"Apache Log4j 2, a logging library for Java programs","summary":"One line of text in a log was enough to make servers run attackers' code, through a Java library that 35,863 packages depended on."},"figures":[{"de":"Java-Pakete auf Maven Central nutzten den fehlerhaften Code, mehr als 8 % aller (Google)","en":"Java packages on Maven Central used the flawed code, more than 8 % of all (Google)","value":"35,863"},{"de":"der Unternehmensnetze weltweit sahen bis zum 20. Dezember 2021 Angriffsversuche (mehr als; Daten von Check Point)","en":"of corporate networks worldwide saw attack attempts by December 20, 2021 (more than; Check Point data)","value":"48 %"},{"de":"Minuten nach der Veröffentlichung sah Cloudflare den ersten Angriffsversuch","en":"minutes after the flaw went public, Cloudflare saw the first attack attempt","value":"9"},{"de":"Stunden wendete ein einziges US-Bundesministerium für seine Reaktion auf","en":"hours one US federal department spent on its response","value":"33,000"}],"kev":"2021-12-10","key":"log4shell","name":"Log4Shell","product":"Apache Log4j 2","sources":[{"de":"Apache Logging Services: Sicherheitsseite zu Log4j, mit Bewertungen und korrigierten Versionen","title":"Apache Logging Services: Log4j security page, with scores and fixed versions","url":"https://logging.apache.org/security.html"},{"de":"Versionshinweise zu Log4j","title":"Log4j release notes","url":"https://logging.apache.org/log4j/2.x/release-notes.html"},{"de":"NVD: CVE-2021-44228","title":"NVD: CVE-2021-44228","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"},{"de":"CVE-Eintrag CVE-2021-44832, mit den korrigierten Versionen","title":"CVE record CVE-2021-44832, with the fixed versions","url":"https://www.cve.org/CVERecord?id=CVE-2021-44832"},{"de":"US Cyber Safety Review Board: Untersuchung des Log4j-Vorfalls (Juli 2022, PDF)","title":"US Cyber Safety Review Board: review of the Log4j event (July 2022, PDF)","url":"https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf"},{"de":"Google: das Ausmaß der Log4j-Lücke","title":"Google: understanding the impact of the Log4j flaw","url":"https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html"},{"de":"Cloudflare: Ausnutzung von Log4Shell vor der Veröffentlichung","title":"Cloudflare: exploitation of Log4Shell before its disclosure","url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/"},{"de":"Check Point: die Zahlen hinter den Log4j-Angriffen (Herstellerdaten)","title":"Check Point: the numbers behind the Log4j attacks (vendor data)","url":"https://blog.checkpoint.com/security/the-numbers-behind-a-cyber-pandemic-detailed-dive/"},{"de":"BSI: Warnstufe Rot wegen Log4Shell (11. Dezember 2021)","title":"BSI: warning level red for Log4Shell (December 11, 2021, in German)","url":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html"},{"de":"Sonatype: verwundbare Log4j-Downloads im Jahr 2025","title":"Sonatype: vulnerable Log4j downloads in 2025","url":"https://www.sonatype.com/blog/unnecessary-risk-the-persistence-of-open-source-vulnerabilities"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","year":2021},{"actions":{"de":["Aktualisiere MOVEit Transfer auf eine aktuelle, unterstützte Version; alle Versionen vor den Fixes von Mai bis Juli 2023 haben bekannte kritische Lücken.","Lief auf dem Server 2023 eine ältere Version, prüfe ihn auf Spuren eines Angriffs: eine Datei namens **human2.aspx**, Benutzerkonten, die du nicht angelegt hast, und große Downloads.","Frag deine Dienstleister, ob sie MOVEit Transfer nutzen: Manche Opfer wurden über den Server eines Dienstleisters getroffen."],"en":["Update MOVEit Transfer to a current, supported version; all releases before the fixes of May to July 2023 contain known critical flaws.","If the server ran an older version in 2023, check it for signs of attack: a file named **human2.aspx**, user accounts you did not create, and large downloads.","Ask your service providers whether they use MOVEit Transfer: some victims were hit through a provider's server."]},"criteria":{"damage":{"de":"Meldungen von Datenpannen betreffen die Daten von 95.788.491 Menschen; manche sind womöglich doppelt gezählt (Emsisoft, 28. Juni 2024).","en":"Breach notices cover the data of 95,788,491 people; some may be counted twice (Emsisoft, June 28, 2024).","met":true},"exploitation":{"de":"Die Angriffe trafen 2.773 Organisationen, direkt oder über einen Dienstleister, der MOVEit nutzte (Emsisoft, 28. Juni 2024).","en":"The attacks hit 2,773 organizations, directly or through a service provider that used MOVEit (Emsisoft, June 28, 2024).","met":true},"reach":{"de":"Rund 2.500 MOVEit-Transfer-Server waren aus dem Internet erreichbar, weit unter 100.000 (Rapid7, 31. Mai 2023).","en":"Roughly 2,500 MOVEit Transfer servers were reachable from the internet, far below 100,000 (Rapid7, May 31, 2023).","met":false},"response":{"de":"CISA und FBI veröffentlichten eine gemeinsame Warnung. Die CISA setzte die Lücke auf ihre Liste ausgenutzter Schwachstellen. Weder eine Notfallanweisung noch die höchste nationale Warnstufe sind dokumentiert (CISA, Juni 2023).","en":"CISA and the FBI issued a joint warning, and CISA put the flaw on its list of exploited vulnerabilities. No emergency directive or highest national warning level is documented (CISA, June 2023).","met":false}},"cves":["CVE-2023-34362","CVE-2023-35036","CVE-2023-35708"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-89","dates":[{"date":"2023-05-27","key":"exploited"},{"date":"2023-05-31","de":"Progress warnt seine Kunden und veröffentlicht korrigierte Versionen","en":"Progress warns its customers and releases fixed versions"},{"date":"2023-06-06","de":"Cl0p bekennt sich auf seiner Leak-Seite zu den Angriffen","en":"Cl0p claims the attacks on its leak site"},{"date":"2023-06-07","de":"CISA und FBI veröffentlichen eine gemeinsame Warnung","en":"CISA and the FBI publish a joint warning"},{"date":"2023-06-09","de":"Fix für eine zweite Lücke, gefunden bei einer Code-Prüfung","en":"Fix for a second flaw, found in a code review"},{"date":"2023-07-06","de":"Ein Service Pack schließt drei weitere Lücken","en":"A service pack closes three more flaws"}],"de":{"credit":"Kein Entdecker genannt: Die Lücke kam durch die Angriffe ans Licht","fixed":"MOVEit Transfer 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 und 2023.0.1 (31. Mai 2023); weitere Fixes im Juni und Juli 2023","product":"Progress MOVEit Transfer, ein Server für den Dateiaustausch mit Partnern","summary":"Die Bande Cl0p nutzte eine unbekannte Lücke im Dateiserver MOVEit Transfer, um Daten von 2.773 Organisationen zu stehlen."},"disclosed":"2023-05-31","en":{"credit":"No finder named: the flaw came to light through the attacks","fixed":"MOVEit Transfer 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1 (May 31, 2023); more fixes in June and July 2023","product":"Progress MOVEit Transfer, a server for exchanging files with partners","summary":"The Cl0p gang used an unknown flaw in the MOVEit Transfer file server to steal data from 2,773 organizations."},"figures":[{"de":"Millionen Menschen, deren Daten betroffen waren, laut Meldungen von Datenpannen (Emsisoft)","en":"million people whose data was affected, according to breach notices (Emsisoft)","value":"95.8"},{"de":"Organisationen getroffen, direkt oder über einen Dienstleister (Emsisoft)","en":"organizations hit, directly or through a service provider (Emsisoft)","value":"2,773"},{"de":"Tage lang liefen Angriffe, bevor es einen Fix gab","en":"days of attacks before a fix was out","value":"4"},{"de":"MOVEit-Transfer-Server waren aus dem Internet erreichbar (ungefähr; Rapid7, 31. Mai 2023)","en":"MOVEit Transfer servers reachable from the internet (roughly; Rapid7, May 31, 2023)","value":"2,500"}],"kev":"2023-06-02","key":"moveit","name":"MOVEit Transfer","product":"Progress MOVEit Transfer","sources":[{"de":"CVE-Eintrag CVE-2023-34362, mit den betroffenen Versionen","title":"CVE record CVE-2023-34362, with the affected versions","url":"https://www.cve.org/CVERecord?id=CVE-2023-34362"},{"de":"NVD: CVE-2023-34362","title":"NVD: CVE-2023-34362","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362"},{"de":"CISA und FBI: gemeinsame Warnung zu Cl0p und MOVEit (7. Juni 2023)","title":"CISA and FBI: joint advisory on Cl0p and MOVEit (June 7, 2023)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a"},{"de":"Mandiant: Zero-Day in MOVEit Transfer für Datendiebstahl genutzt","title":"Mandiant: zero-day in MOVEit Transfer used for data theft","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft"},{"de":"Rapid7: Ausnutzung der Lücke in MOVEit Transfer, mit Nachträgen bis August 2023","title":"Rapid7: exploitation of the MOVEit Transfer flaw, updated to August 2023","url":"https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"},{"de":"Emsisoft: Statistik zum MOVEit-Datenleck, letzter Stand 28. Juni 2024","title":"Emsisoft: MOVEit breach statistics, last count June 28, 2024","url":"https://emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysis/"},{"de":"SecurityWeek (Presse): Emsisofts Zählung vom 24. August 2023","title":"SecurityWeek (press): Emsisoft's count of August 24, 2023","url":"https://www.securityweek.com/nearly-1000-organizations-60-million-individuals-impacted-by-moveit-hack/"},{"de":"Help Net Security (Presse): mehr als 2.000 betroffene Organisationen, September 2023","title":"Help Net Security (press): more than 2,000 victim organizations, September 2023","url":"https://www.helpnetsecurity.com/2023/09/26/moveit-victim-number/"},{"de":"BleepingComputer (Presse): Krolls Hinweise auf Tests seit 2021","title":"BleepingComputer (press): Kroll's finding of tests since 2021","url":"https://www.bleepingcomputer.com/news/security/clop-ransomware-likely-testing-moveit-zero-day-since-2021/"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2023},{"actions":{"de":["Aktualisiere PHP auf **8.5.12, 8.4.27, 8.3.36 oder 8.2.35** oder neuer, je nach Zweig.","Starte Apache, PHP-FPM und alle dauerhaft laufenden PHP-Prozesse neu, damit die alte Version nicht mehr im Speicher ist.","Mit PHP 8.1 oder älter: Wechsle auf einen unterstützten Zweig. Für diese Versionen gibt es kein offizielles Update.","Mit einem Hosting-Paket: Frag deinen Hoster, ob das Update installiert ist. Vergleiche deine PHP-Version mit der Tabelle auf dieser Seite."],"en":["Update PHP to **8.5.12, 8.4.27, 8.3.36 or 8.2.35**, or newer, depending on your branch.","Restart Apache, PHP-FPM and every long-running PHP worker, so that the old version is no longer in memory.","On PHP 8.1 or older, move to a supported branch: there is no official release for these versions.","With a hosting plan, ask your host whether the update is installed. Compare your PHP version with the table on this page."]},"affected_from":"5.4","backports":["7.4","8.0","8.1"],"criteria":{"damage":{"de":"Bisher ist kein Schaden gemeldet.","en":"No damage has been reported so far.","met":false},"exploitation":{"de":"Am 23. Oktober 2026 waren keine Angriffe bekannt; die CISA stufte die Ausnutzung als „keine“ ein.","en":"No attacks in the wild were known on October 23, 2026; CISA rated exploitation as “none”.","met":false},"reach":{"de":"PHP läuft auf 69,3 % aller Websites, deren Serversprache bekannt ist (W3Techs, 23. Oktober 2026).","en":"PHP runs on 69.3 % of all websites whose server language is known (W3Techs, October 23, 2026).","met":true},"response":{"de":"Updates für vier PHP-Zweige zugleich, Quellcode-Patches für drei nicht mehr unterstützte Zweige und Schutzregeln, die mit Google, AWS, Microsoft, Cloudflare und anderen vorbereitet wurden.","en":"Fixed releases for four PHP branches at once, source patches for three branches that are no longer supported, and protection rules prepared with Google, AWS, Microsoft, Cloudflare, and others.","met":true}},"cves":["CVE-2026-109618","CVE-2026-109619"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-416, CWE-755, CWE-824, CWE-1325","dates":[{"date":"2026-08-11","key":"reported"},{"date":"2026-08-24","de":"Wiz Research meldet unabhängig davon weitere Fehler","en":"Wiz Research reports further bugs, independently"},{"date":"2026-09-18","de":"OpenAI meldet weitere Angriffswege","en":"OpenAI reports further attack paths"},{"date":"2026-10-20","de":"Die CVE-Nummern werden vorab bekannt, mit dem falschen Wert 10,0","en":"The CVE numbers leak online, with a wrong score of 10.0"},{"date":"2026-10-21","key":"patched"}],"de":{"credit":"Calif, Wiz Research und OpenAI, unabhängig voneinander","fixed":"PHP 8.5.12, 8.4.27, 8.3.36 und 8.2.35 (21. Oktober 2026)","product":"PHP, die Sprache hinter den meisten Websites","summary":"Zwei Fehler in PHP selbst erlauben Angreifern, Webserver mit WordPress, Drupal, Joomla und vielen anderen Anwendungen ohne Passwort zu übernehmen."},"disclosed":"2026-10-21","en":{"credit":"Calif, Wiz Research and OpenAI, independently of each other","fixed":"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 21, 2026)","product":"PHP, the language behind most websites","summary":"Two flaws in PHP itself let attackers take over web servers without a password, on WordPress, Drupal, Joomla and many other applications."},"figures":[{"de":"der Websites mit bekannter Serversprache laufen mit PHP","en":"of websites with a known server language run on PHP","value":"69.3 %"},{"de":"Anwendungen von den Entdeckern übernommen, darunter WordPress","en":"applications taken over by the finders, WordPress among them","value":"11"}],"fixed_versions":[{"branch":"8.5","version":"8.5.12"},{"branch":"8.4","version":"8.4.27"},{"branch":"8.3","version":"8.3.36"},{"branch":"8.2","version":"8.2.35"}],"key":"php2shell","name":"PHP2Shell","product":"PHP","sources":[{"de":"PHP-Projekt: Sicherheits-Updates vom 21. Oktober 2026","title":"PHP project: security releases of October 21, 2026","url":"https://www.php.net/archive/2026.php"},{"de":"PHP Foundation: das Sicherheits-Update von heute","title":"PHP Foundation: today's PHP security release","url":"https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/"},{"de":"Calif: Analyse und Zeitleiste zu PHP2Shell","title":"Calif: PHP2Shell research and timeline","url":"https://calif.io/php2shell/"},{"de":"Wiz Research: PHP2Shell","title":"Wiz Research: PHP2Shell","url":"https://www.wiz.io/blog/php2shell-php-rce"},{"de":"Gemeinsame Seite der Entdecker, mit Demo-Videos","title":"The finders' joint page, with demonstration videos","url":"https://www.php2shell.com/"},{"de":"Sicherheitshinweis des PHP-Projekts zu CVE-2026-109618","title":"PHP security advisory for CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"de":"Sicherheitshinweis des PHP-Projekts zu CVE-2026-109619","title":"PHP security advisory for CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"de":"NVD: CVE-2026-109618","title":"NVD: CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},{"de":"CVE-Eintrag CVE-2026-109619, mit Einschätzung der CISA","title":"CVE record CVE-2026-109619, with CISA's assessment","url":"https://www.cve.org/CVERecord?id=CVE-2026-109619"},{"de":"W3Techs: Nutzungsstatistik von PHP","title":"W3Techs: usage statistics of PHP","url":"https://w3techs.com/technologies/details/pl-php"},{"de":"OpenAI: Patch the Planet, das Programm, in dem Calif PHP prüfte","title":"OpenAI: Patch the Planet, the program under which Calif audited PHP","url":"https://openai.com/index/patch-the-planet/"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2026}],"excluded":[{"cve":"CVE-2024-3094","de":"Entdeckt, bevor die Hintertür in stabile Versionen der großen Linux-Distributionen gelangte; keine bekannten Angriffe, kein Schaden. Erfüllt nur das Kriterium Reaktion: ein Beinahe-Fall.","en":"Found before it reached stable releases of the major Linux distributions; no known attacks, no damage. It meets only the response criterion: a near miss.","name":"xz Utils backdoor","year":2024},{"cve":"CVE-2024-3661","de":"Erlaubt einem Angreifer im selben lokalen Netz, Datenverkehr am VPN vorbeizuleiten; keine Massenangriffe, kein gemeldeter Schaden, keine außergewöhnliche Reaktion.","en":"Lets an attacker in the same local network route traffic around a VPN; no mass attacks, no reported damage, no extraordinary response.","name":"TunnelVision","year":2024}],"industrial_attacks":[{"access":["usb"],"actor":"Not officially attributed","category":"destruction","dates":[{"date":"2010-06-17","key":"disclosed"},{"date":"2010-07-19","de":"Siemens untersucht Infektionen seiner Steuerungssoftware","en":"Siemens investigates infections of its control software"},{"date":"2010-09-30","de":"Symantec veröffentlicht seine vollständige Analyse des Wurms","en":"Symantec publishes its full analysis of the worm"},{"date":"2010-11-12","de":"Forscher identifizieren die Frequenzumrichter als das eigentliche Ziel","en":"Researchers identify the frequency-converter drives as the real target"},{"date":"2010-12-22","de":"Ein Institut schätzt, dass in Natanz etwa 1.000 Zentrifugen außer Betrieb genommen wurden","en":"An institute estimates that about 1,000 centrifuges were lost at Natanz"},{"date":"2012-06-01","de":"Presseberichte beschreiben eine gemeinsame Operation der USA und Israels","en":"Press reports describe a joint US-Israeli operation"}],"de":{"actor":"Nicht offiziell zugeordnet","actor_note":"Keine Regierung hat dies bestätigt; die Zuordnung stützt sich auf Presseberichte","story":"Stuxnet wurde im Juni 2010 entdeckt und ist die erste bekannte Malware, die physische Maschinen beschädigt hat. Der Wurm verbreitete sich auf etwa 100.000 Computer in mehr als 150 Ländern. Schaden sollte er aber nur einem Ziel: einer iranischen Urananreicherungsanlage, die Forscher mit Natanz in Verbindung brachten. Weil das Steuerungsnetz der Anlage keine Internetverbindung hatte, wurde der Wurm höchstwahrscheinlich auf einem Wechseldatenträger eingeschleust. Danach verbreitete er sich selbstständig über vier unbekannte Windows-Lücken und die Projektdateien der Siemens-Engineering-Software Step 7.\n\nEr lud versteckten Code auf Siemens-S7-300-Steuerungen und ließ die Motoren der Zentrifugen weit außerhalb ihres normalen Drehzahlbereichs laufen. Gleichzeitig spielte er den Bedienern normale Messwerte vor, sodass sie nichts bemerkten. Ein Institut schätzte, dass etwa 1.000 der 8.692 installierten Zentrifugen außer Betrieb genommen wurden. Der Zusammenhang mit Stuxnet ist nicht bewiesen. Presseberichte beschreiben eine gemeinsame Operation der USA und Israels. Keine Regierung hat bestätigt, wer den Wurm entwickelt hat.\n","summary":"Ein Wurm, der sich weltweit verbreitete, aber eine einzige iranische Urananlage sabotieren sollte. Er zerstörte Zentrifugen, während die Bediener normale Messwerte sahen.","systems":"Siemens-S7-300-Steuerungen und deren Frequenzumrichter, über die Software Step 7 und WinCC","target":"Eine Urananreicherungsanlage im Iran, die von Forschern mit Natanz in Verbindung gebracht wird"},"disclosed":"2010-06-17","en":{"actor_note":"No government has confirmed it; the attribution rests on press reports","story":"Stuxnet, found in June 2010, is the first malware known to have damaged physical machines. It spread to about 100,000 computers in more than 150 countries. But it was built to harm one target: an Iranian uranium-enrichment plant that researchers linked to Natanz. Because the plant's control network had no internet connection, the worm was most likely carried in on a removable drive. Then it spread on its own, using four unknown Windows flaws and the project files of Siemens Step 7 engineering software.\n\nIt loaded hidden code onto Siemens S7-300 PLCs and drove centrifuge motors far outside their normal speed. At the same time it replayed normal readings, so operators saw nothing wrong. An institute estimated that about 1,000 of 8,692 installed centrifuges were taken out of service, though the link to Stuxnet is unproven. Press reports describe a joint US-Israeli operation. No government has confirmed who built it.\n","summary":"A worm that spread worldwide but was built to sabotage one Iranian uranium plant, wrecking centrifuges while operators saw normal readings.","systems":"Siemens S7-300 controllers and their frequency-converter drives, via Step 7 and WinCC software","target":"A uranium-enrichment plant in Iran, linked by researchers to Natanz"},"figures":[{"de":"in Natanz außer Betrieb genommene Zentrifugen (Schätzung von ISIS)","en":"centrifuges taken out of service at Natanz (ISIS estimate)","value":"~1,000"},{"de":"weltweit infizierte Computer bis September 2010","en":"computers infected worldwide by September 2010","value":"100,000"},{"de":"der infizierten Computer befanden sich im Iran","en":"of the infected computers were in Iran","value":"60 %"},{"de":"bis dahin unbekannte Windows-Sicherheitslücken für die Verbreitung","en":"previously unknown Windows flaws used to spread","value":"4"}],"key":"stuxnet","name":"Stuxnet","names":[{"name":"Stuxnet"},{"by":"VirusBlokAda","name":"Rootkit.TmpHider"},{"by":"Symantec","name":"W32.Temphid"}],"names_sources":["https://attack.mitre.org/software/S0603/"],"protocols":["Profibus","Siemens S7"],"sources":[{"de":"Symantec: W32.Stuxnet Dossier (technische Analyse)","title":"Symantec: W32.Stuxnet Dossier (technical analysis)","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"},{"de":"Symantec: Stuxnet 0.5, das fehlende Glied","title":"Symantec: Stuxnet 0.5, the missing link","url":"https://community.broadcom.com/symantecenterprise/viewdocument/stuxnet-05-the-missing-link?CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68\u0026tab=librarydocuments"},{"de":"CISA ICS-CERT: Stuxnet-Warnmeldung","title":"CISA ICS-CERT: Stuxnet advisory","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-10-272-01"},{"de":"CISA ICS-CERT: USB-Malware, die auf Steuerungssoftware von Siemens abzielt","title":"CISA ICS-CERT: USB malware targeting Siemens control software","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-10-201-01c"},{"de":"ISIS: Hat Stuxnet 1.000 Zentrifugen in Natanz außer Betrieb gesetzt?","title":"ISIS: did Stuxnet take out 1,000 centrifuges at Natanz?","url":"https://isis-online.org/isis-reports/did-stuxnet-take-out-1000-centrifuges-at-the-natanz-enrichment-plant/"},{"de":"ISIS: Stuxnet zielt auf Frequenzumrichter ab","title":"ISIS: Stuxnet targets frequency-converter drives","url":"https://isis-online.org/isis-reports/stuxnet-worm-targets-automated-systems-for-frequency-converters-is-irans-ce"},{"de":"Control Global: Wie der Stuxnet-Code einen Controller gekapert hat","title":"Control Global: how the Stuxnet code hijacked a controller","url":"https://www.controlglobal.com/control/plcs-pacs/article/11381080/industrial-controller-how-to-hijack-a-controller-control-global"},{"de":"RFE/RL: Bericht über die Operation „Olympic Games“","title":"RFE/RL: report on the 'Olympic Games' operation","url":"https://www.rferl.org/a/obama-stepped-up-iran-cyberattacks/24601136.html"}],"stages":["weaponize","target","deliver","exploit","install","develop","deliver2","install2","execute"],"year":2010},{"access":["phishing","watering","supplychain"],"actor":"FSB (Russia)","category":"espionage","dates":[{"date":"2014-06-24","de":"Ein Sicherheitsunternehmen berichtet, dass Havex es auf Steuerungssysteme abgesehen hat","en":"A security firm reports that Havex is targeting control systems"},{"date":"2014-06-25","key":"disclosed"},{"date":"2014-06-30","de":"Symantec veröffentlicht seinen Dragonfly-Bericht","en":"Symantec publishes its Dragonfly report"},{"date":"2014-07-31","de":"Kaspersky meldet weltweit mehr als 2.800 Opfer","en":"Kaspersky reports more than 2,800 victims worldwide"},{"date":"2014-10-27","de":"Forscher listen die mit Trojanern verseuchten Installationsprogramme der Anbieter auf","en":"Researchers list the trojanized vendor installers"},{"date":"2022-03-24","de":"Die US-Regierung macht den russischen FSB für die Kampagne verantwortlich","en":"The US government attributes the campaign to Russia's FSB"}],"de":{"actor":"FSB (Russland)","actor_note":"Im Jahr 2014 vermuteten Sicherheitsfirmen einen staatlichen Akteur; die USA nannten 2022 den russischen FSB als Verantwortlichen","story":"Havex war eine Spionagekampagne gegen den Energiesektor. Sie wurde im Juni 2014 bekannt und wird auch unter den Namen Dragonfly oder Energetic Bear verfolgt. Ihre Opfer erreichte sie auf drei Wegen: über Phishing-E-Mails mit manipulierten PDF-Dateien, über präparierte Websites, die Besucher infizierten, und vor allem über gehackte Download-Seiten. Bei mindestens drei kleinen Herstellern von Industriesoftware wurden die Installationsprogramme durch Versionen ersetzt, die zusätzlich Havex enthielten. Kaspersky zählte weltweit mehr als 2.800 Opfer.\n\nHavex war eine Hintertür, die sich bei den Angreifern meldete und weitere Module nachlud. Ein Modul suchte im Netzwerk nach OPC-Servern, also nach der Windows-Middleware, mit der Programme Live-Daten vieler Steuerungen lesen können. Es schickte die Angaben zu diesen Servern an die Angreifer. Schon das Scannen ließ einige Server abstürzen. Havex stahl Informationen, hatte aber keine Sabotagefunktion. 2014 waren sich Analysten über die Herkunft uneinig. 2022 schrieb die US-Regierung die Kampagne dem russischen FSB zu.\n","summary":"Spione versahen die Downloads kleiner ICS-Softwarehersteller mit Schadcode. Über die Hintertür kartierten sie dann Industrienetze im gesamten Energiesektor.","systems":"OPC-Server, die Windows-Middleware, die Live-Anlagendaten für andere Software bereitstellt","target":"Energieunternehmen und Hersteller von Industrieanlagen, vor allem in den USA und Europa"},"disclosed":"2014-06-25","en":{"actor_note":"In 2014 vendors saw a likely state actor; the US named Russia's FSB in 2022","story":"Havex, made public in June 2014 and also tracked as Dragonfly or Energetic Bear, was a spying campaign against the energy sector. It reached victims three ways: phishing emails with booby-trapped PDF files, websites rigged to infect visitors, and, most notably, hacked download pages. At least three small makers of industrial software had their installers swapped for versions that also carried Havex. Kaspersky counted more than 2,800 victims worldwide.\n\nHavex was a backdoor that called home and downloaded extra modules. One module searched the network for OPC servers, the Windows middleware that lets software read live data from many controllers. It copied their details back to the attackers. The scanning alone crashed some servers. Havex stole information but had no sabotage payload. In 2014 analysts disagreed on the source; in 2022 the US government attributed the campaign to Russia's FSB.\n","summary":"Spies poisoned the downloads of small ICS software makers, then used the backdoor to map industrial networks across the energy sector.","systems":"OPC servers, the Windows middleware that exposes live plant data to other software","target":"Energy companies and makers of industrial equipment, mostly in the US and Europe"},"figures":[{"de":"bekannte Opfer weltweit (Kaspersky)","en":"known victims worldwide (Kaspersky)","value":"2,800+"},{"de":"namentlich genannte Opferorganisationen","en":"victim organizations identified by name","value":"101"},{"de":"Downloads eines mit einem Trojaner infizierten ICS-Installationsprogramms vor dessen Entdeckung","en":"downloads of one trojanized ICS installer before discovery","value":"250"},{"de":"Hersteller von Industriesoftware, deren Installationsprogramme mit Trojanern versehen waren","en":"makers of industrial software whose installers were trojanized","value":"3"}],"key":"havex","name":"Havex","names":[{"name":"Havex"},{"by":"Symantec","name":"Backdoor.Oldrea"}],"names_sources":["https://en.wikipedia.org/wiki/Havex"],"protocols":["OPC"],"sources":[{"de":"CISA ICS-CERT-Warnung: Auf ICS ausgerichtete Malware (Havex)","title":"CISA ICS-CERT alert: ICS-focused malware (Havex)","url":"https://www.cisa.gov/news-events/ics-alerts/ics-alert-14-176-02a"},{"de":"CISA: Vorgehensweisen der angeklagten russischen FSB-Akteure","title":"CISA: tactics of indicted Russian FSB actors","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-083a"},{"de":"Symantec: Dragonfly – westliche Energieunternehmen in Gefahr","title":"Symantec: Dragonfly, Western energy companies under threat","url":"https://www.security.com/threat-intelligence/dragonfly-energy-companies-sabotage"},{"de":"Kaspersky: Energetic Bear – eher ein Crouching Yeti","title":"Kaspersky: Energetic Bear, more like a Crouching Yeti","url":"https://securelist.com/energetic-bear-more-like-a-crouching-yeti/65240/"},{"de":"Kaspersky: Spionagekampagne Crouching Yeti mit 2.800 Zielen","title":"Kaspersky: Crouching Yeti spying campaign with 2,800 targets","url":"https://www.kaspersky.com/about/press-releases/crouching-yeti-an-ongoing-spying-campaign-with-2-800-highly-valuable-targets-worldwide"},{"de":"SecurityWeek: Angreifer setzen die Havex-RAT gegen Steuerungssysteme ein","title":"SecurityWeek: attackers using the Havex RAT against control systems","url":"https://www.securityweek.com/attackers-using-havex-rat-against-industrial-control-systems/"},{"de":"Netresec: Vollständige Offenlegung der Havex-Trojaner","title":"Netresec: full disclosure of the Havex trojans","url":"https://netresec.com/?b=14ABDA4"}],"stages":["weaponize","target","deliver","exploit","install","c2","act"],"year":2014},{"access":["phishing","credentials","vpn"],"actor":"Sandworm (GRU)","category":"disruption","dates":[{"date":"2014-05-12","de":"Eine Phishing-E-Mail erreicht eines der späteren Opfer","en":"A phishing email reaches one of the later victims"},{"date":"2015-12-23","key":"outbreak"},{"date":"2016-01-04","de":"Ein Sicherheitsunternehmen bringt BlackEnergy und den KillDisk-Wiper mit dem Ausfall in Verbindung","en":"A security firm links BlackEnergy and the KillDisk wiper to the outage"},{"date":"2016-02-25","de":"US-Ermittler veröffentlichen ihren Bericht über den Angriff","en":"US investigators publish their report on the attack"},{"date":"2022-04-20","de":"Die US-Regierung schreibt den Angriff Sandworm (GRU) zu","en":"The US government attributes the attack to Sandworm (GRU)"}],"de":{"actor_note":"Zuschreibung durch die US-Regierung; Anfang 2016 konnten Analysten die Verantwortlichen noch nicht benennen","story":"Am 23. Dezember 2015 verloren drei regionale Energieversorger in der Ukraine innerhalb von etwa einer halben Stunde die Kontrolle über ihre Stromnetze. Rund 225.000 Kunden waren ohne Strom (ESET zählte etwa 230.000 Menschen). Es ist der erste bestätigte Stromausfall durch einen Cyberangriff. Monate zuvor hatten Spear-Phishing-E-Mails mit makrohaltigen Office-Dateien die BlackEnergy-Malware in die Büronetze eingeschleust.\n\nDie Angreifer sammelten Zugangsdaten und gelangten dann mit den eigenen VPN- und Fernsteuerungstools der Versorger in die SCADA-Systeme. Dort öffneten sie von Hand Leistungsschalter in mehr als 50 Umspannwerken. Sie deaktivierten Seriell-zu-Ethernet-Konverter, löschten PCs mit KillDisk und überlasteten ein Callcenter. Deshalb musste die Stromversorgung vor Ort wiederhergestellt werden, was etwa sechs Stunden dauerte. Die US-Regierung schrieb den Angriff später Sandworm zu, einer Einheit des russischen GRU.\n","summary":"Angreifer drangen per Phishing in ukrainische Energieversorger ein. Mit deren eigener Fernsteuerung schalteten sie Umspannwerke ab. Rund 225.000 Kunden waren ohne Strom.","systems":"SCADA-Steuerungssysteme, erreicht über Fernzugriffstools; Seriell-zu-Ethernet-Konverter in Umspannwerken","target":"Drei regionale Stromverteilungsunternehmen in der Ukraine"},"disclosed":"2016-01-04","en":{"actor_note":"US government attribution; in early 2016 analysts could not yet name the operators","story":"On December 23, 2015, three Ukrainian regional power companies lost control of their grids within about half an hour of each other. About 225,000 customers lost power (ESET counted around 230,000 people). It is the first blackout confirmed to have been caused by a cyberattack. Months earlier, spear-phishing emails with macro-laden Office files had planted the BlackEnergy malware on the office networks.\n\nThe attackers harvested credentials, then used the utilities' own VPN and remote-control tools to reach the SCADA systems. There they opened breakers at more than 50 substations by hand. They disabled serial-to-Ethernet converters, wiped PCs with KillDisk, and flooded a call center. As a result, power had to be restored on site, which took about six hours. The US government later attributed the attack to Sandworm, a unit of Russia's GRU.\n","summary":"Attackers phished into Ukrainian power companies, then used the operators' own remote controls to switch off substations, cutting power to about 225,000 customers.","systems":"SCADA control systems reached by remote-access tools; substation serial-to-Ethernet converters","target":"Three regional power distribution companies in Ukraine"},"figures":[{"de":"Kunden ohne Strom (US-Heimatschutzministerium)","en":"customers lost power (US DHS)","value":"225,000"},{"de":"bis zur manuellen Wiederherstellung der Stromversorgung (INL)","en":"to restore power by hand (INL)","value":"~6 h"},{"de":"Umspannwerke, deren Leistungsschalter geöffnet wurden (INL)","en":"substations where breakers were opened (INL)","value":"50+"},{"de":"Stromversorger, innerhalb von rund 30 Minuten getroffen","en":"power companies hit within about 30 minutes","value":"3"}],"key":"blackenergy","name":"BlackEnergy","protocols":[],"sources":[{"de":"DHS ICS-CERT: Cyberangriff auf kritische Infrastruktur in der Ukraine","title":"DHS ICS-CERT: cyberattack against Ukrainian critical infrastructure","url":"https://www.cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01"},{"de":"CISA ICS-CERT-Warnung: BlackEnergy in Mensch-Maschine-Schnittstellen","title":"CISA ICS-CERT alert: BlackEnergy in human-machine interfaces","url":"https://www.cisa.gov/news-events/ics-alerts/ics-alert-14-281-01e"},{"de":"CISA: Bedrohungsprofil Sandworm (GRU)","title":"CISA: Sandworm (GRU) threat profile","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a"},{"de":"Idaho National Laboratory: Fallstudie zur Ukraine 2015","title":"Idaho National Laboratory: Ukraine 2015 case study","url":"https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_Ukraine-2015.pdf"},{"de":"ESET: BlackEnergy und die Backdoor SSHBearDoor","title":"ESET: BlackEnergy and the SSHBearDoor backdoor","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"},{"de":"ESET: Der Trojaner BlackEnergy schlägt erneut zu","title":"ESET: BlackEnergy trojan strikes again","url":"https://www.welivesecurity.com/2016/01/04/blackenergy-trojan-strikes-again-attacks-ukrainian-electric-power-industry/"},{"de":"ESET: Was wir wirklich über den Stromausfall in der Ukraine wissen","title":"ESET: what we really know about the Ukrainian power outage","url":"https://www.welivesecurity.com/2016/01/11/blackenergy-and-the-ukrainian-power-outage-what-we-really-know/"},{"de":"ESET: Sandworm – eine Geschichte von Störungen, neu erzählt","title":"ESET: Sandworm, a tale of disruption told anew","url":"https://www.welivesecurity.com/2022/03/21/sandworm-tale-disruption-told-anew/"}],"stages":["deliver","install","c2","act","develop","deliver2","install2","execute"],"year":2015},{"access":["unknown"],"actor":"Sandworm (GRU)","category":"disruption","dates":[{"date":"2016-12-17","key":"outbreak"},{"date":"2016-12-20","de":"In einigen Samples findet sich ein zweites Aktivierungsdatum","en":"A second activation date is found in some samples"},{"date":"2017-06-12","key":"disclosed"},{"date":"2022-04-20","de":"Die US-Regierung schreibt den Angriff Sandworm (GRU) zu","en":"The US government attributes the attack to Sandworm (GRU)"}],"de":{"actor_note":"Zuschreibung durch die US-Regierung; ESET nahm 2017 keine Zuordnung vor","story":"Am 17. Dezember 2016 fiel in Teilen von Kiew etwa eine Stunde lang der Strom aus. Die Malware dahinter wurde 2017 analysiert. ESET nannte sie Industroyer, Dragos CRASHOVERRIDE. Es war die erste Malware, die Netztechnik direkt ansteuerte. Statt eines Menschen, der sich durch Fernsteuerungstools klickte, öffneten ihre eigenen Module die Leistungsschalter automatisch. Dafür nutzten sie die Standardprotokolle des Netzes: IEC 60870-5-101, IEC 60870-5-104, IEC 61850 und OPC DA. Wie die Angreifer anfangs eindrangen, wurde nie geklärt.\n\nEin Launcher startete den Schadcode zu einem festgelegten Zeitpunkt. Ein bis zwei Stunden später zerstörte ein Wiper Dateien und Einstellungen, um die Wiederherstellung zu verlangsamen. Ein separates Tool konnte Siemens-SIPROTEC-Schutzrelais deaktivieren. Die US-Regierung schreibt den Angriff Sandworm (dem russischen GRU) zu. Dragos führt die Gruppe dahinter unter dem Namen ELECTRUM. ESET fand 2017 keine Code-Überschneidungen mit BlackEnergy und schrieb den Angriff niemandem zu.\n","summary":"Die erste Malware, die Netztechnik direkt über deren eigene Protokolle ansteuert. Sie schnitt einen Teil von Kiew etwa eine Stunde lang vom Strom ab.","systems":"Leistungsschalter und Relais in Umspannwerken, über die Netzprotokolle IEC 60870-5-101/104, IEC 61850 und OPC DA","target":"Ein ukrainischer Übertragungsnetzbetreiber; Teile von Kiew waren ohne Strom"},"disclosed":"2017-06-12","en":{"actor_note":"US government attribution; ESET did not attribute it in 2017","story":"On December 17, 2016, part of Kyiv lost power for about an hour. The malware behind it, analyzed in 2017, was named Industroyer by ESET and CRASHOVERRIDE by Dragos. It was the first malware built to control grid equipment directly. Instead of a person clicking through remote-control tools, its own modules opened circuit breakers automatically. They spoke the grid's standard protocols: IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA. How the attackers first got in was never established.\n\nA launcher set off the payload at a chosen time. One to two hours later, a wiper destroyed files and settings to slow recovery. A separate tool could disable Siemens SIPROTEC protection relays. The US government attributes the attack to Sandworm (Russia's GRU); Dragos tracks the operators as ELECTRUM. In 2017, ESET found no code overlap with BlackEnergy and did not attribute it.\n","summary":"The first malware built to control grid equipment directly in its own protocols, used to cut power to part of Kyiv for about an hour.","systems":"Substation breakers and relays, via the grid protocols IEC 60870-5-101/104, IEC 61850 and OPC DA","target":"A Ukrainian electrical transmission company; part of Kyiv lost power"},"figures":[{"de":"Stromausfall in Teilen von Kiew (ESET)","en":"power cut to part of Kyiv (ESET)","value":"~1 h"},{"de":"Netzprotokolle, die die Schadsoftware beherrschte","en":"grid protocols the malware could speak","value":"4"}],"key":"industroyer","name":"Industroyer / CRASHOVERRIDE","names":[{"by":"ESET","name":"Industroyer"},{"by":"Dragos","name":"CRASHOVERRIDE"}],"names_sources":["https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-17-206-01"],"protocols":["IEC 60870-5-101","IEC 60870-5-104","IEC 61850","OPC DA"],"sources":[{"de":"ESET: Technische Analyse von Win32/Industroyer","title":"ESET: Win32/Industroyer technical analysis","url":"https://web-assets.esetstatic.com/wls/2017/06/Win32_Industroyer.pdf"},{"de":"ESET: Industroyer – die größte Bedrohung für Steuerungssysteme seit Stuxnet","title":"ESET: Industroyer, biggest threat to control systems since Stuxnet","url":"https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/"},{"de":"US-CERT: Warnung vor der Malware CrashOverride (TA17-163A)","title":"US-CERT: CrashOverride malware alert (TA17-163A)","url":"https://www.cisa.gov/news-events/alerts/2017/06/12/crashoverride-malware"},{"de":"Dragos: Die Bedrohungsgruppe ELECTRUM","title":"Dragos: the ELECTRUM threat group","url":"https://www.dragos.com/threat/electrum/"},{"de":"CISA: Bedrohungsprofil Sandworm (GRU)","title":"CISA: Sandworm (GRU) threat profile","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a"},{"de":"ESET: Industroyer2, Industroyer neu aufgelegt","title":"ESET: Industroyer2, Industroyer reloaded","url":"https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/"}],"stages":["install","c2","develop","deliver2","install2","execute"],"year":2016},{"access":["unknown"],"actor":"TsNIIKhM (Russian state institute)","category":"destruction","dates":[{"date":"2017-12-14","key":"disclosed"},{"date":"2018-10-23","de":"FireEye bringt den Angriff mit einer staatlichen russischen Einrichtung in Verbindung","en":"FireEye ties the attack to a Russian state institute"},{"date":"2020-10-23","de":"Die USA verhängen Sanktionen gegen dieses Institut (TsNIIKhM)","en":"The US sanctions that institute (TsNIIKhM)"},{"date":"2022-03-24","de":"US-Behörden veröffentlichen die Techniken des Angriffs im Detail","en":"US agencies publish the attack's techniques in detail"}],"de":{"actor":"TsNIIKhM (russisches staatliches Institut)","actor_note":"In den US-Sanktionen wird dieses Institut namentlich genannt; Dragos führt die Gruppe als XENOTIME; FireEye kam mit hoher Sicherheit zu diesem Schluss","story":"2017 gelangten Angreifer in das Sicherheitssystem einer petrochemischen Anlage im Nahen Osten. Seine unabhängigen Steuerungen sollen einen Prozess in einen sicheren Zustand versetzen, bevor er gefährlich wird. Die Malware, bekannt als TRISIS oder TRITON, war eigens für die Triconex-Steuerungen von Schneider Electric gebaut. Sie nutzte TriStation, das undokumentierte Protokoll der Steuerungen, das die Angreifer rückentwickelt hatten. Sie schrieb eine versteckte Hintertür in den Speicher einer Steuerung, um deren Sicherheitslogik zu verändern.\n\nWie die Angreifer zuerst eindrangen, haben US-Behörden nicht mitgeteilt. Im Netz der Anlage erreichten sie den Arbeitsplatzrechner, von dem aus die Steuerungen programmiert werden. Dort starteten sie ein Tool, das als Software des Herstellers getarnt war. Während der Aktion lösten einige Steuerungen eine Sicherheitsabschaltung aus und legten die Anlage mehrere Tage lang still. So wurde die Malware entdeckt. FireEye sah 2018 mit hoher Sicherheit eine Verbindung zum russischen Staatsinstitut TsNIIKhM. Die USA verhängten 2020 Sanktionen gegen das Institut. Dragos führt die Gruppe dahinter unter dem Namen XENOTIME.\n","summary":"Malware, die die Sicherheitssteuerungen einer Anlage im Nahen Osten ausschalten sollte. Ein Fehler legte die Anlage tagelang still.","systems":"Sicherheitssteuerungen von Schneider Electric Triconex (ein sicherheitsgerichtetes System, kurz SIS) über das undokumentierte TriStation-Protokoll","target":"Ein petrochemisches Werk im Nahen Osten (US-Behörden sprechen nur von „einer ausländischen Ölraffinerie“)"},"disclosed":"2017-12-14","en":{"actor_note":"US sanctions name this institute; Dragos tracks the operator as XENOTIME; FireEye assessed it with high confidence","story":"In 2017, attackers reached the safety system of a petrochemical plant in the Middle East. Its independent controllers are meant to force a process into a safe state before it turns dangerous. The malware, known as TRISIS or TRITON, was built for the plant's Schneider Electric Triconex controllers. It spoke TriStation, their undocumented protocol, which the attackers had reverse-engineered. It wrote a hidden backdoor into a controller's memory to alter its safety logic.\n\nUS agencies have not said how the attackers first broke in. Once inside, they reached the engineering workstation that programs the controllers and ran a tool disguised as the vendor's own software. During the operation some controllers tripped and shut the plant down for several days, which is how the malware was found. In 2018 FireEye tied the intrusion to a Russian state institute, TsNIIKhM, with high confidence. The US sanctioned the institute in 2020. Dragos tracks the operator as XENOTIME.\n","summary":"Malware built to disable the safety controllers of a Middle East plant; a mistake tripped the plant into a days-long shutdown.","systems":"Schneider Electric Triconex safety controllers (a safety instrumented system, or SIS), via the undocumented TriStation protocol","target":"A petrochemical plant in the Middle East (US agencies say only 'a foreign oil refinery')"},"figures":[{"de":"Stillstand der angegriffenen Raffinerie (CISA)","en":"that the targeted refinery was shut down (CISA)","value":"several days","value_de":"mehrere Tage"},{"de":"US-Stromversorger, 2019 von denselben Angreifern ausgekundschaftet (US-Finanzministerium)","en":"US electric utilities the same actors probed in 2019 (Treasury)","value":"20"}],"key":"trisis","name":"TRISIS / TRITON","names":[{"by":"Dragos","name":"TRISIS"},{"by":"FireEye","name":"TRITON"},{"by":"DHS NCCIC","name":"HatMan"}],"names_sources":["https://www.securityweek.com/dhs-warns-malware-targeting-industrial-safety-systems/"],"protocols":["TriStation"],"sources":[{"de":"Mandiant: Angreifer setzen neues ICS-Angriffs-Framework namens TRITON ein","title":"Mandiant: Attackers Deploy New ICS Attack Framework TRITON","url":"https://cloud.google.com/blog/topics/threat-intelligence/attackers-deploy-new-ics-attack-framework-triton/"},{"de":"FireEye: TRITON wird einer russischen staatlichen Einrichtung zugeschrieben","title":"FireEye: TRITON attribution to a Russian state institute","url":"https://cloud.google.com/blog/topics/threat-intelligence/triton-attribution-russian-government-owned-lab-most-likely-built-tools/"},{"de":"US-Finanzministerium: Sanktionen gegen TsNIIKhM wegen des Triton-Angriffs","title":"US Treasury: sanctions on TsNIIKhM over the Triton attack","url":"https://home.treasury.gov/news/press-releases/sm1162"},{"de":"CISA-Warnmeldung AA22-083A: TRITON-Techniken und die Stilllegung der Raffinerie","title":"CISA advisory AA22-083A: TRITON techniques and the refinery shutdown","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-083a"},{"de":"CISA-ICS-Warnmeldung: Schneider Electric Triconex Tricon","title":"CISA ICS advisory: Schneider Electric Triconex Tricon","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-18-107-02"},{"de":"Dragos: die Hackergruppe XENOTIME (TRISIS)","title":"Dragos: the XENOTIME threat group (TRISIS)","url":"https://www.dragos.com/threat/xenotime/"}],"stages":["act","develop","deliver2","install2","execute"],"year":2017},{"access":["unknown"],"actor":"Not attributed","category":"ransomware","dates":[{"date":"2020-02-03","de":"Dragos veröffentlicht die erste Analyse und prägt den Namen EKANS","en":"Dragos publishes the first analysis and names EKANS"},{"date":"2020-02-24","de":"FireEye veröffentlicht eine eigene Analyse (SNAKEHOSE)","en":"FireEye publishes its own analysis (SNAKEHOSE)"},{"date":"2020-06-26","de":"Die Unit 42 von Palo Alto Networks veröffentlicht eine Bedrohungsanalyse","en":"Palo Alto Networks Unit 42 publishes a threat assessment"},{"date":"2020-07-01","de":"Fortinet analysiert Varianten, die nur innerhalb des Zielnetzwerks laufen","en":"Fortinet analyzes variants that run only inside the target network"}],"de":{"actor":"Nicht zugeordnet","actor_note":"Kriminelle Ransomware; weder eine Regierung noch ein Sicherheitsunternehmen hat einen Betreiber benannt","story":"EKANS (das Wort „snake“ rückwärts) ist eine Ransomware, die 2020 auftauchte. Sie läuft auf gewöhnlichen Windows-Computern. Die Steuerungen der Maschinen kann sie daher nicht umprogrammieren. Stattdessen greift sie die Windows-PCs an, mit denen Bediener eine Anlage überwachen und steuern. Dazu gehören Bedienoberflächen (HMIs), Verlaufsdatenbanken (Historians) und Lizenzserver. Bevor sie die Dateien verschlüsselt, beendet sie eine fest einprogrammierte Liste von Programmen. So sind die Dateien nicht mehr gesperrt.\n\nLaut dem Sicherheitsunternehmen FireEye umfasst die Liste über 1.000 Prozesse, darunter Industriesoftware von Herstellern wie General Electric und Honeywell. EKANS löscht zudem die von Windows gespeicherten Sicherungskopien. Wie die Angreifer zuerst eindrangen, wurde nie öffentlich bekannt. EKANS ist die Schadsoftware, die am Ende abgelegt wird. Weder eine Gruppe noch ein Staat wurde benannt. MITREs ATT\u0026CK bringt unter Berufung auf Presseberichte eine EKANS-Infektion mit einem vorübergehenden Produktionsausfall in einem Honda-Werk im Juni 2020 in Verbindung.\n","summary":"Ransomware, die erst Industriesoftware beendet und dann die Windows-PCs einer Anlage verschlüsselt. Die Steuerungen kann sie nicht verändern, aber die Produktion stoppen.","systems":"Windows-PCs der Leitwarte – Bedienoberflächen (HMIs), Verlaufsdatenbanken (Historians) und Lizenzserver –, nicht die Steuerungen selbst","target":"Industrieunternehmen in verschiedenen Branchen, von der Energiewirtschaft bis zur verarbeitenden Industrie (Unit 42)"},"disclosed":"2020-02-03","en":{"actor_note":"Criminal ransomware; no government or security firm has named an operator","story":"EKANS (the word 'snake' backwards) is ransomware that appeared in 2020. It runs on ordinary Windows computers, so it cannot reprogram the controllers that run machinery. Instead it goes after the Windows PCs operators use to watch and command a plant. These include the screens known as HMIs, the databases called historians, and license servers. Before encrypting their files, it stops a hard-coded list of programs so the files are no longer locked.\n\nThe security firm FireEye found that the list targets over 1,000 processes. Some of them are industrial software from vendors such as General Electric and Honeywell. EKANS also deletes the backup copies Windows keeps. How operators were first breached was never made public. EKANS is the payload dropped at the end. No group or state has been named. MITRE's ATT\u0026CK, citing press reports, links an EKANS infection to a temporary production loss at a Honda plant in June 2020.\n","summary":"Ransomware that stops industrial software before encrypting the Windows PCs that run a plant; it cannot touch controllers, but it can halt production.","systems":"Windows PCs that run the control room — HMIs, historians and license servers — not the controllers themselves","target":"Industrial organizations in several sectors, from energy to manufacturing (Unit 42)"},"figures":[{"de":"Windows-Prozesse auf der Kill-Liste, darunter auch einige industrielle (FireEye)","en":"Windows processes on the kill list, some of them industrial (FireEye)","value":"1,000+"},{"de":"Branchen, die Unit 42 nennt – von Energie bis Gesundheitswesen","en":"sectors Unit 42 named, from energy to healthcare","value":"5"}],"key":"ekans","name":"EKANS / Snake","names":[{"by":"Dragos","name":"EKANS"},{"name":"Snake"}],"names_sources":["https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"],"protocols":[],"sources":[{"de":"MITRE ATT\u0026CK: EKANS (S0605)","title":"MITRE ATT\u0026CK: EKANS (S0605)","url":"https://attack.mitre.org/software/S0605/"},{"de":"Palo Alto Networks Unit 42: Bedrohungsanalyse zur EKANS-Ransomware","title":"Palo Alto Networks Unit 42: EKANS ransomware threat assessment","url":"https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/"},{"de":"Fortinet: Die EKANS-Ransomware zielt auf OT-/ICS-Systeme ab","title":"Fortinet: EKANS ransomware targeting OT/ICS systems","url":"https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems"},{"de":"FireEye/Mandiant: Ransomware Against the Machine","title":"FireEye/Mandiant: Ransomware Against the Machine","url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-against-machine-learning-to-disrupt-industrial-production/"}],"stages":["develop","execute"],"year":2020},{"access":["unknown"],"actor":"Sandworm","category":"disruption","dates":[{"date":"2022-03-23","de":"Die Angreifer kompilieren Industroyer2 für genau diesen einen Energieversorger","en":"The attackers compile Industroyer2 for this one utility"},{"date":"2022-04-08","de":"Sie spielen es aus und planen den Stromausfall; Einsatzkräfte stoppen es","en":"They deploy it and schedule the power cut; responders stop it"},{"date":"2022-04-12","de":"ESET und CERT-UA veröffentlichen den Fall","en":"ESET and CERT-UA publish the case"}],"de":{"actor_note":"CERT-UA führt dies auf Sandworm (UAC-0082) zurück; ESET kommt mit hoher Sicherheit zum selben Schluss","story":"Am 8. April 2022 versuchte die Gruppe Sandworm, einen Teil des ukrainischen Stromnetzes abzuschalten. Ihr Tool, von der Sicherheitsfirma ESET Industroyer2 getauft, war ein abgespeckter Nachfolger der Malware Industroyer von 2016. Es nutzte nur ein Industrieprotokoll, IEC 104. Die Adressen der Ziel-Umspannwerke und die Schaltbefehle steckten direkt im Programm. Es war also für einen bestimmten Energieversorger gebaut. Eine separate „Wiper“-Malware sollte gleichzeitig die Windows-, Linux- und Solaris-Server des Energieversorgers zerstören.\n\nWie die Angreifer zuerst eindrangen, ist nicht öffentlich bekannt. Sie hatten aber schon Administratorrechte und verteilten die Malware über die Windows-Gruppenrichtlinien. Eine geplante Aufgabe sollte sie am selben Abend starten. CERT-UA, das ukrainische Team für Cybervorfälle, gibt an, dass das Netzwerk mindestens seit Februar 2022 kompromittiert war. Laut CERT-UA wurde der Angriff rechtzeitig gestoppt und es kam zu keinem Ausfall. CERT-UA führt den Angriff auf Sandworm (UAC-0082) zurück; ESET kommt mit hoher Sicherheit zum selben Schluss.\n","summary":"Sandworms Tool, das einer ukrainischen Region den Strom abschalten sollte. Zeitgleich sollte Malware Festplatten löschen. Einsatzkräfte entfernten das Tool, bevor es lief.","systems":"Anlagen in Hochspannungs-Umspannwerken, gesteuert über das IEC-104-Protokoll","target":"Ein ukrainischer Stromversorger; dessen Hochspannungs-Umspannwerke"},"disclosed":"2022-04-12","en":{"actor_note":"CERT-UA attributes it to Sandworm (UAC-0082); ESET assesses this with high confidence","story":"On April 8, 2022, the group Sandworm tried to switch off part of Ukraine's power grid. Its tool, named Industroyer2 by the security firm ESET, was a stripped-down successor to the Industroyer malware from 2016. It spoke only one industrial protocol, IEC 104. The target substations' addresses and switching commands sat inside the program itself, so it was built for one specific utility. Separate 'wiper' malware was lined up to destroy the utility's Windows, Linux and Solaris servers at the same time.\n\nHow the attackers first entered is not public, but they already held administrator access. They pushed the malware out through Windows Group Policy and set a scheduled task to run it that evening. CERT-UA, Ukraine's incident team, says the network had been compromised since at least February 2022. It also says the plan was stopped in time and no outage occurred. CERT-UA attributes the attack to Sandworm (UAC-0082); ESET assesses this with high confidence.\n","summary":"Sandworm's tool to switch off a Ukrainian region's power, timed with disk-wiping malware; responders removed it before it ran.","systems":"High-voltage substation equipment, commanded over the IEC 104 protocol","target":"A Ukrainian electricity utility; its high-voltage substations"},"figures":[{"de":"Stromausfälle – der Angriff wurde rechtzeitig gestoppt (CERT-UA)","en":"power outages — the attack was stopped in time (CERT-UA)","value":"0"},{"de":"verwendetes Industrieprotokoll – in der Version von 2016 waren es noch vier (ESET)","en":"industrial protocol it used, down from four in the 2016 version (ESET)","value":"1"},{"de":"Betriebssysteme, auf die die begleitenden Wiper abzielten: Windows, Linux, Solaris (ESET)","en":"operating systems the paired wipers targeted: Windows, Linux, Solaris (ESET)","value":"3"}],"key":"industroyer2","name":"Industroyer2","names":[{"by":"ESET","name":"Industroyer2"},{"by":"Mandiant","name":"INDUSTROYER.V2"}],"names_sources":["https://cloud.google.com/blog/topics/threat-intelligence/industroyer-v2-old-malware-new-tricks/"],"protocols":["IEC 104"],"sources":[{"de":"ESET: Industroyer2 – Industroyer neu aufgelegt","title":"ESET: Industroyer2, Industroyer reloaded","url":"https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/"},{"de":"CERT-UA#4435: der Angriff auf eine ukrainische Energieanlage","title":"CERT-UA#4435: the attack on a Ukrainian energy facility","url":"https://cert.gov.ua/article/39518"}],"stages":["act","develop","deliver2"],"year":2022},{"access":["unknown"],"actor":"CHERNOVITE (state-sponsored)","category":"disruption","dates":[{"date":"2022-04-13","de":"Vier US-Behörden und Mandiant machen das Toolkit öffentlich (AA22-103A)","en":"Four US agencies and Mandiant make the toolkit public (AA22-103A)"},{"date":"2022-04-28","de":"Dragos veröffentlicht seine detaillierte PIPEDREAM-Analyse","en":"Dragos publishes its detailed PIPEDREAM analysis"}],"de":{"actor":"CHERNOVITE (staatlich unterstützt)","actor_note":"So nennt Dragos den Entwickler; ein Land wurde nicht genannt; Mandiant bezeichnete die Verbindungen zu Russland als Indizien","story":"PIPEDREAM ist ein Fall ohne Opfer. Anfang 2022 analysierten die Sicherheitsfirmen Dragos und Mandiant ein komplettes Angriffs-Toolkit. Eine staatlich unterstützte Gruppe hatte es gebaut, um industrielle Steuerungen aufzuspüren und zu übernehmen. Dragos nannte es PIPEDREAM, Mandiant INCONTROLLER. Am 13. April 2022 veröffentlichten vier US-Behörden eine gemeinsame Warnmeldung, AA22-103A. Nach Dragos' Zählung ist es die siebte bekannte ICS-spezifische Schadsoftware und die erste, die vor einem Angriff entdeckt wurde.\n\nDas Toolkit ist modular. Einige Teile fassen unter Windows Fuß und erhalten über einen signierten, aber fehlerhaften Treiber tiefen Zugriff. Andere nutzen die Industrieprotokolle CODESYS, Modbus, OPC UA und Omron FINS. Damit können sie Steuerungen scannen, sich dort anmelden, sie umprogrammieren oder zum Absturz bringen. Das Toolkit brachte Module für Geräte von Schneider Electric und Omron mit. Dragos geht mit hoher Sicherheit von einem staatlichen Entwickler aus und nennt ihn CHERNOVITE. Ein Land wurde nicht genannt. Mandiant bezeichnete die Verbindungen zu Russland als Indizien.\n","summary":"Ein staatlich entwickeltes Toolkit, das industrielle Steuerungen verschiedener Hersteller aufspürt, übernimmt und zum Absturz bringt. Es wurde entdeckt, bevor es je zum Einsatz kam.","systems":"SPS und Servoantriebe von Schneider Electric und Omron sowie beliebige OPC-UA-Server; über CODESYS, Modbus, OPC UA und Omron FINS","target":"Kein reales Opfer; wahrscheinliche Ziele waren laut Dragos Anlagen für Flüssigerdgas (LNG) und Strom"},"disclosed":"2022-04-13","en":{"actor_note":"Dragos's name for the developer; no country has been named; Mandiant called links to Russia circumstantial","story":"PIPEDREAM is a case with no victim. In early 2022 the security firms Dragos and Mandiant analyzed a complete attack toolkit. A state-backed group had built it to find and take over industrial controllers. Dragos called it PIPEDREAM, Mandiant INCONTROLLER. On April 13, 2022, four US agencies published a joint advisory, AA22-103A. By Dragos's count it is the seventh known piece of ICS-specific malware, and the first found before an attack.\n\nThe toolkit is modular. Some parts get a foothold on Windows and gain deep access through a signed-but-flawed driver. Others speak the industrial protocols CODESYS, Modbus, OPC UA and Omron FINS to scan, log into, reprogram or crash controllers. It came with modules for Schneider Electric and Omron equipment. Dragos assesses with high confidence that a state built it and tracks the developer as CHERNOVITE. No country was named, and Mandiant called its links to Russia circumstantial.\n","summary":"A state-built toolkit to find, hijack and crash industrial controllers from several makers, caught before it was ever used.","systems":"Schneider Electric and Omron PLCs and servo drives, and any OPC UA server; via CODESYS, Modbus, OPC UA and Omron FINS","target":"No real victim; Dragos assessed likely targets as liquefied-natural-gas and electricity sites"},"figures":[{"de":"Einsätze – das Toolkit wurde entdeckt, bevor es zu einem Angriff kam (Dragos)","en":"times it was used — the toolkit was found before any attack (Dragos)","value":"0"},{"de":"die siebte bekannte ICS-spezifische Schadsoftware, laut Dragos","en":"the seventh known piece of ICS-specific malware, by Dragos's count","value":"7"},{"de":"Industrieprotokolle, die seine Module beherrschten: CODESYS, Modbus, OPC UA, Omron FINS","en":"industrial protocols its modules spoke: CODESYS, Modbus, OPC UA, Omron FINS","value":"4"}],"key":"pipedream","name":"PIPEDREAM / INCONTROLLER","names":[{"by":"Dragos","name":"PIPEDREAM"},{"by":"Mandiant","name":"INCONTROLLER"}],"names_sources":["https://en.wikipedia.org/wiki/Pipedream_(toolkit)"],"protocols":["CODESYS","Modbus","OPC UA","Omron FINS"],"sources":[{"de":"Gemeinsame Warnmeldung von US-Behörden (AA22-103A): APT-Tools gegen ICS-/SCADA-Geräte","title":"Joint US advisory AA22-103A: APT tools targeting ICS/SCADA devices","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-103a"},{"de":"Dragos-Whitepaper: PIPEDREAM, die ICS-Malware von CHERNOVITE","title":"Dragos whitepaper: PIPEDREAM, CHERNOVITE's ICS malware","url":"https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"},{"de":"Dragos-Blog: CHERNOVITEs PIPEDREAM","title":"Dragos blog: CHERNOVITE's PIPEDREAM","url":"https://www.dragos.com/blog/industry-news/chernovite-pipedream-malware-targeting-industrial-control-systems/"},{"de":"Dragos: die Hackergruppe CHERNOVITE","title":"Dragos: the CHERNOVITE threat group","url":"https://www.dragos.com/threat/chernovite/"},{"de":"Mandiant: INCONTROLLER, staatlich geförderte ICS-Angriffstools","title":"Mandiant: INCONTROLLER state-sponsored ICS attack tools","url":"https://cloud.google.com/blog/topics/threat-intelligence/incontroller-state-sponsored-ics-tool/"},{"de":"MITRE ATT\u0026CK: INCONTROLLER (S1045)","title":"MITRE ATT\u0026CK: INCONTROLLER (S1045)","url":"https://attack.mitre.org/software/S1045/"}],"stages":["develop"],"year":2022},{"access":["unknown"],"actor":"Blackjack","category":"destruction","dates":[{"date":"2024-04-09","de":"Blackjack veröffentlicht seine Behauptungen zum Angriff auf Moscollector","en":"Blackjack publishes its claims against Moscollector"},{"date":"2024-04-12","de":"Claroty Team82 veröffentlicht eine unabhängige Analyse","en":"Claroty Team82 publishes an independent analysis"},{"date":"2024-04-15","de":"Claroty aktualisiert die Analyse mit den überarbeiteten Gateway-Zahlen der Angreifer","en":"Claroty updates it with the attackers' revised gateway figures"}],"de":{"actor_note":"Claroty berichtet, Blackjack stehe vermutlich dem ukrainischen Geheimdienst nahe; keine Regierung hat dies bestätigt","story":"Im April 2024 gab eine Gruppe namens Blackjack bekannt, sie habe Moscollector lahmgelegt. Das Moskauer Unternehmen überwacht das unterirdische Wasser- und Abwassernetz der Stadt. Die Malware, die die Angreifer Fuxnet nannten, lief auf den Sensor-Gateways des Netzes. Diese kleinen Linux-Computer sammeln über einen seriellen Standard namens M-Bus die Messwerte von Tausenden unterirdischen Sensoren. Auf jedem Gateway unterbrach die Malware den Fernzugriff, löschte Teile des Dateisystems und überschrieb den Flash-Speicher, bis er ausfiel.\n\nAußerdem überflutete sie die M-Bus-Verkabelung mit Datenmüll, in der Hoffnung, auch die Sensoren zu beschädigen. Wie Blackjack zuerst eindrang, ist nicht dokumentiert. Die Gruppe gab an, seit Juni 2023 Zugriff zu haben. Die Angreifer behaupteten, 87.000 Sensoren zerstört und 30 Terabyte Daten gelöscht zu haben. Das Sicherheitsunternehmen Claroty analysierte die Malware und die durchgesickerten Daten. Es schätzt, dass nur etwas mehr als 500 Gateways unbrauchbar gemacht wurden und die Sensoren wahrscheinlich intakt blieben. Claroty berichtet, Blackjack stehe vermutlich dem ukrainischen Geheimdienst nahe. Keine Regierung hat das bestätigt.\n","summary":"Malware, die die Gateways für die unterirdischen Sensoren eines Moskauer Versorgers unbrauchbar machte. Die Angreifer gaben weit größeren Schaden an, als Analysten bestätigen konnten.","systems":"Linux-Sensor-Gateways (MPSB und TMSB) sowie ein 3G-Router, über das serielle M-Bus-Protokoll mit den Sensoren verbunden","target":"Moscollector, ein Moskauer Unternehmen, das die unterirdische Wasser- und Abwasserinfrastruktur überwacht"},"disclosed":"2024-04-12","en":{"actor_note":"Claroty reports Blackjack as believed linked to Ukrainian intelligence; no government has confirmed this","story":"In April 2024 a group calling itself Blackjack said it had wrecked Moscollector. The Moscow company monitors the city's underground water and sewage network. The malware, which the attackers called Fuxnet, ran on the network's sensor gateways. These small Linux computers gather readings from thousands of underground sensors over a serial standard called M-Bus. On each gateway it cut off remote access, deleted parts of the file system, and rewrote the flash memory until it failed.\n\nIt also flooded the M-Bus wiring with junk, hoping to damage the sensors too. How Blackjack first got in is not documented. The group claimed access since June 2023. The attackers claimed 87,000 destroyed sensors and 30 terabytes wiped. The security firm Claroty analyzed the malware and the leaked data. It estimates that only a little over 500 gateways were bricked and that the sensors likely survived. Claroty reports that Blackjack is believed to be linked to Ukrainian intelligence. No government has confirmed this.\n","summary":"Malware that bricked the gateways relaying a Moscow utility's underground sensors; the attackers claimed far more damage than analysts could confirm.","systems":"Linux sensor gateways (MPSB and TMSB) and a 3G router, linked to sensors over the M-Bus serial protocol","target":"Moscollector, a Moscow company that monitors underground water and sewage infrastructure"},"figures":[{"de":"unbrauchbar gemachte Sensor-Gateways – Schätzung von Claroty (Angreifer gaben etwa 1.700 an)","en":"sensor gateways bricked — Claroty's estimate (attackers claimed about 1,700)","value":"500+"},{"de":"Sensoren, die die Angreifer zerstört haben wollen; Claroty hält sie für wahrscheinlich intakt","en":"sensors the attackers claimed destroyed; Claroty believes they likely survived","value":"87,000"},{"de":"Daten, die die Angreifer angeblich löschten, einschließlich Backups (unbestätigt)","en":"data the attackers claimed to wipe, including backups (unverified)","value":"30 TB"}],"key":"fuxnet","name":"Fuxnet","names":[{"by":"Blackjack","name":"Fuxnet"}],"names_sources":["https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"],"protocols":["M-Bus"],"sources":[{"de":"Claroty Team82: eine Analyse der Fuxnet-Malware der Blackjack-Gruppe","title":"Claroty Team82: Unpacking the Blackjack group's Fuxnet malware","url":"https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"}],"stages":["act","develop","deliver2","install2","execute"],"year":2024},{"access":["router","credentials"],"actor":"Not attributed","category":"disruption","dates":[{"date":"2024-07-23","de":"Dragos macht den Angriff öffentlich bekannt","en":"Dragos discloses the attack publicly"}],"de":{"actor":"Nicht zugeordnet","actor_note":"Dragos stellte Verbindungen zu Adressen in Moskau fest, schreibt den Angriff aber niemandem zu","story":"Im Januar 2024 fiel bei Minusgraden in mehr als 600 Wohngebäuden einer ukrainischen Stadt fast zwei Tage lang die Heizung aus. Laut Dragos war es Lwiw. Die Malware hinter dem Ausfall, später FrostyGoop genannt, ist ein kleines Programm, das über Modbus TCP mit den Heizungsreglern kommuniziert. Dieses einfache, weit verbreitete Protokoll sendet Befehle über Port 502, meist ohne Passwort. FrostyGoop las und änderte die Halteregister der Regler, also die Speicher für ihre Einstellungen. Außerdem setzte es ihre Software auf eine ältere Version zurück, sodass sie ihren Status nicht mehr melden konnten.\n\nDadurch hatten die Betreiber keinen klaren Überblick, während die Regler mit falschen Werten arbeiteten. Dragos rekonstruiert den wahrscheinlichen Einstieg. Monate zuvor nutzten die Angreifer eine Schwachstelle in einem mit dem Internet verbundenen Router aus. Sie richteten einen über Tor erreichbaren Webtunnel ein und stahlen Windows-Anmeldedaten. Weil das Netzwerk flach war und nichts die Regler abschottete, waren sie direkt erreichbar. Dragos schreibt den Angriff niemandem zu und verweist nur auf Verbindungen zu Adressen in Moskau während des Vorfalls.\n","summary":"Malware, die die Heizungsregler einer ukrainischen Stadt falsche Werte melden ließ. Über 600 Gebäude blieben im Winter fast zwei Tage ohne Heizung.","systems":"ENCO-Heizungsregler, erreichbar über Modbus TCP auf Port 502","target":"Ein Fernwärmeunternehmen in Lwiw, Ukraine"},"disclosed":"2024-07-23","en":{"actor_note":"Dragos saw connections to Moscow-based addresses but does not attribute the attack","story":"In January 2024, during a sub-zero winter, more than 600 apartment buildings in a Ukrainian city lost heating for almost two days. According to Dragos, the city was Lviv. The malware behind the outage, later named FrostyGoop, is a small program that talks to heating controllers over Modbus TCP. This plain, widely used protocol sends commands on port 502, usually without a password. FrostyGoop read and changed the controllers' holding registers, the memory slots that hold their settings. It also downgraded their software so they could no longer report their status.\n\nThat left operators without a clear view while the controllers ran on wrong information. Dragos reconstructs the likely entry. Months earlier, the attackers exploited a flaw in an internet-facing router, planted a web tunnel reached over Tor, and stole Windows credentials. The network was flat, with nothing separating the controllers, so they could be reached directly. Dragos does not attribute the attack. It notes only connections to Moscow-based addresses during the incident.\n","summary":"Malware that made a Ukrainian city's heating controllers misreport and cut heat to over 600 buildings in winter, for nearly two days.","systems":"ENCO heating controllers, reached over Modbus TCP on port 502","target":"A district heating company in Lviv, Ukraine"},"figures":[{"de":"Wohngebäude ohne Heizung (Dragos)","en":"apartment buildings left without heating (Dragos)","value":"600+"},{"de":"ohne Heizung bei Minusgraden (Dragos)","en":"that the heating stayed off, in sub-zero cold (Dragos)","value":"~2 days","value_de":"~2 Tage"},{"de":"die neunte bekannte ICS-spezifische Schadsoftware, laut Dragos","en":"the ninth known piece of ICS-specific malware, by Dragos's count","value":"9"}],"key":"frostygoop","name":"FrostyGoop / BUSTLEBERM","names":[{"by":"Dragos","name":"FrostyGoop"},{"by":"Mandiant","name":"BUSTLEBERM"}],"names_sources":["https://www.forescout.com/blog/ics-malware-frostygoopbustleberm-insights-others-missed","https://malpedia.caad.fkie.fraunhofer.de/details/win.frostygoop"],"protocols":["Modbus TCP"],"sources":[{"de":"Dragos-Lagebericht: die ICS-Malware FrostyGoop","title":"Dragos intelligence brief: FrostyGoop ICS malware","url":"https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"},{"de":"Dragos-Blog: FrostyGoop nimmt Betriebstechnik (OT) ins Visier","title":"Dragos blog: FrostyGoop targeting operational technology","url":"https://www.dragos.com/blog/protect-against-frostygoop-ics-malware-targeting-operational-technology/"}],"stages":["exploit","install","c2","act","develop","deliver2","execute"],"year":2024}],"pages":[{"description":"In July 2001, the Code Red worm infected more than 359,000 computers running Microsoft's web server in under 14 hours, a month after the fix came out.","title":"Code Red: the worm that infected 359,000 servers within 14 hours","url":"https://crackthe.net/security/vulnerabilities/code-red/"},{"description":"In September 2001, the Nimda worm spread by e-mail, infected websites and attacks on web servers at once. Within 7 hours, 160,000 computers were infected.","title":"Nimda: the worm that infected 160,000 computers in 7 hours","url":"https://crackthe.net/security/vulnerabilities/nimda/"},{"description":"In January 2003, a worm of just 376 bytes infected more than 90 % of vulnerable Microsoft SQL servers within 10 minutes. How it spread, and what it hit.","title":"SQL Slammer: the worm that hit 90 % of its targets in 10 minutes","url":"https://crackthe.net/security/vulnerabilities/sql-slammer/"},{"description":"In August 2003, the Blaster worm infected more than 100,000 Windows computers in its first week. How it spread, why it attacked Microsoft and why it stayed.","title":"Blaster: the worm that hit 100,000 Windows PCs in a week","url":"https://crackthe.net/security/vulnerabilities/blaster/"},{"description":"In July 2008, a DNS flaw let attackers plant false addresses for any domain within seconds. How it worked and how vendors fixed it on a single day.","title":"Kaminsky DNS flaw: the trick that could hijack any domain","url":"https://crackthe.net/security/vulnerabilities/kaminsky-dns/"},{"description":"Within a year of November 2008, Conficker infected 5 to 13 million Windows computers. How it spread and how over 100 countries joined the defense.","title":"Conficker: the worm that infected millions of Windows computers","url":"https://crackthe.net/security/vulnerabilities/conficker/"},{"description":"From December 2013, attackers abused a diagnostic command in NTP time servers to multiply their attack traffic. How it worked, and how the internet cleaned up.","title":"NTP monlist: how time servers amplified DDoS attacks","url":"https://crackthe.net/security/vulnerabilities/ntp-monlist/"},{"description":"In April 2014, an OpenSSL flaw let attackers read the memory of 24–55 % of popular HTTPS servers. How it worked and why patching alone was not enough.","title":"Heartbleed: the flaw that let attackers read server memory","url":"https://crackthe.net/security/vulnerabilities/heartbleed/"},{"description":"A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with one request. How it worked, the attacks, the fix.","title":"Shellshock: the Bash flaw that let one web request run commands","url":"https://crackthe.net/security/vulnerabilities/shellshock/"},{"description":"A worm used a leaked NSA attack tool and a Windows flaw to lock more than 200,000 computers. How it spread, what it cost the NHS, and the fix.","title":"WannaCry: the ransomware worm that hit the NHS","url":"https://crackthe.net/security/vulnerabilities/wannacry/"},{"description":"A hijacked update of a Ukrainian accounting program released a worm that posed as ransomware, destroyed data and caused billions of dollars in damage.","title":"NotPetya: the destructive worm hidden in a software update","url":"https://crackthe.net/security/vulnerabilities/notpetya/"},{"description":"A design flaw in most Intel processors let any program read the operating system's protected memory. Why it scores only 5.6, and how the fix works.","title":"Meltdown: the processor flaw that opened protected memory","url":"https://crackthe.net/security/vulnerabilities/meltdown/"},{"description":"A design flaw in processors from Intel, AMD and Arm let programs read memory they should never see. How it works, what the fixes cost, and what to do now.","title":"Spectre: when the speed tricks of processors leak secrets","url":"https://crackthe.net/security/vulnerabilities/spectre/"},{"description":"A 2018 flaw let attackers copy the passwords of MikroTik routers. Four months after the fix, 370,000 were still open and over 200,000 had been hijacked.","title":"MikroTik Winbox: the flaw that gave away router passwords","url":"https://crackthe.net/security/vulnerabilities/mikrotik/"},{"description":"In 2019, a flaw in the Exim mail server let attackers run commands as root by hiding them in an email address. How it worked, the worm, the fix.","title":"Exim: the email address that took over mail servers","url":"https://crackthe.net/security/vulnerabilities/exim/"},{"description":"In December 2019, a flaw in Citrix's remote access gateways let attackers in without a password, with no fix for 33 days. How it worked, who was hit.","title":"Citrix ADC: the gateway flaw that opened internal networks","url":"https://crackthe.net/security/vulnerabilities/citrix-adc/"},{"description":"Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password. How it worked, who was hit, what to do now.","title":"ProxyLogon: the Exchange flaws that opened mail servers","url":"https://crackthe.net/security/vulnerabilities/proxylogon/"},{"description":"A flaw in Log4j, a logging library for Java, let attackers take over servers with one line of text. How it worked, how far it reached, what to do now.","title":"Log4Shell: when a line in a log runs the attacker's code","url":"https://crackthe.net/security/vulnerabilities/log4shell/"},{"description":"A flaw in the file transfer server MOVEit Transfer let the Cl0p gang steal data from 2,773 organizations. How it worked, who was hit, and what to do now.","title":"MOVEit: the file transfer flaw that Cl0p used to steal data","url":"https://crackthe.net/security/vulnerabilities/moveit/"},{"description":"Two flaws in PHP itself let attackers take over web servers without a password. The fixed PHP versions, the applications affected, and what to do now.","title":"PHP2Shell: the flaws in PHP that put most websites at risk","url":"https://crackthe.net/security/vulnerabilities/php2shell/"}]},"description":"From Code Red to PHP2Shell: the vulnerabilities that changed IT security, with severity, timeline from report to attack, and the figures.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/data/method/","source":"https://crackthe.net/","text":"How to read the cases Each article starts with the record of the vulnerability. It lists the CVE number, the score from the US National Vulnerability Database, and the dates from the first report to the fix and the first attacks. Below that, the article explains how the flaw worked and what happened next. Charts show the figures from public reports.\nThe CVSS score rates how severe a vulnerability is, from 0 to 10. It does not say how often it was used in attacks. Some of the most damaging cases here have medium scores.\nHow a vulnerability gets on this list This list is not a database of every vulnerability: tens of thousands receive a CVE number each year. It keeps only the cases that shook the whole system. A vulnerability is listed only if it meets all three basic conditions and at least two of the four magnitude criteria.\nBasic conditions\nA specific flaw in a widely used product or component, with a public record: a CVE number or a vendor advisory. Malware counts through the flaw it used. Many independent operators affected, in many countries, not the customers of a single company. Documented by primary sources: vendor advisories, government agencies, or measurement studies. Magnitude criteria (at least two)\nCriterionMet when Reachmeasurements found at least 100,000 affected systems, or the flaw sits in a component that runs on at least a tenth of all systems of its kind, such as processors, web servers, or websites Mass exploitationattacks in the wild hit at least 1,000 organizations or 100,000 systems, or a worm spread on its own Damagedocumented damage of at least one billion US dollars, outages of critical services such as hospitals, power, or transport, or data of at least ten million people Extraordinary responsemeasures beyond routine patching: the highest warning level of a national cyber agency, a government emergency directive, fixes in all major operating systems at once, or coordination across industries and countries A high severity score alone is not enough. Meltdown has a CVSS score of 5.6 and is on the list; many flaws with a score of 10 are not. Each case page shows which criteria the case meets and why.","title":"Timeline of the biggest vulnerabilities that crack the net","url":"https://crackthe.net/security/vulnerabilities/"}