{"id":9980,"date":"2020-03-05T13:27:07","date_gmt":"2020-03-05T12:27:07","guid":{"rendered":"https:\/\/www.boc.de\/watchguard-info-portal\/?p=9980"},"modified":"2020-03-05T13:27:07","modified_gmt":"2020-03-05T12:27:07","slug":"threat-landscape-auswertung-februar-2020","status":"publish","type":"post","link":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/2020\/03\/threat-landscape-auswertung-februar-2020\/","title":{"rendered":"Threat Landscape Auswertung Februar 2020"},"content":{"rendered":"<p>WatchGuards Threat Lab ist eine Gruppe von Bedrohungsforschern, die sich mit der Analyse und Aufbereitung der letzten Malware- und Netzwerk-Attacken besch\u00e4ftigen. Sie greifen dabei auf die Daten zur\u00fcck, die sie vom WatchGuard Firebox Feed bekommen, aber auch aus internen und externen Threat Intelligences und einem Forschungs-Honeynet. Daraus werden Analysen und praktische Sicherheitshinweise \u00fcber die gr\u00f6\u00dften Gefahren und Bedrohungen abgeleitet.<br \/>\n<!--more--><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4963 alignright\" src=\"https:\/\/www.boc.de\/watchguard-info-portal\/wp-content\/uploads\/2018\/09\/threat-landscape.png\" alt=\"WatchGuard Threat Landscape\" width=\"506\" height=\"96\" \/><\/p>\n<h5>Malware-Attacken:<\/h5>\n<p>Wie die <a href=\"https:\/\/www.secplicity.org\/threat-landscape\/?s=2020-02-01&amp;e=2020-02-29&amp;type=all&amp;region=amer+emea+apac\" target=\"_blank\" rel=\"noopener\">Threat Landscape<\/a> von WatchGuard zeigt, wurden alleine im Monat Februar 2020 \u00fcber <strong>11,75 Millionen Malware-Attacken<\/strong> weltweit von den WatchGuard-L\u00f6sungen geblockt:<br \/>\n<div class=\"su-list\" style=\"margin-left:0px\">\n<ul>\n<li><i class=\"sui sui-chevron-circle-right\" style=\"color:#333\"><\/i> t\u00e4glich 405.206 geblockte Angriffe<\/li>\n<li><i class=\"sui sui-chevron-circle-right\" style=\"color:#333\"><\/i> 49,82% aller von WatchGuard geblockten Attacken in EMEA<\/li>\n<li><i class=\"sui sui-chevron-circle-right\" style=\"color:#333\"><\/i> alleine in Deutschland \u00fcber 1,33 Millionen geblockte Angriffe<\/li>\n<\/ul>\n<\/div>\nVon den \u00fcber 11,75 Millionen geblockten Malware-Attacken waren 58% Zero-Day Malware. Da diese Attacken nicht von dem Gateway Antivirus erkannt werden, empfehlen wir als zus\u00e4tzliche Sicherheitsschicht den\u00a0<a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/produktinfos\/watchguard-security-services-und-suites\/watchguard-apt-blocker\/\" target=\"_blank\" rel=\"noopener\">APT Blocker<\/a>,\u00a0<a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/produktinfos\/watchguard-security-services-und-suites\/watchguard-threat-detection-and-response\/\" target=\"_blank\" rel=\"noopener\">Threat Detection and Response (TDR)<\/a>\u00a0sowie\u00a0<a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/produktinfos\/watchguard-security-services-und-suites\/watchguard-intelligentav\/\" target=\"_blank\" rel=\"noopener\">IntelligentAV<\/a>\u00a0zu aktivieren. Alle drei Services sind in der Total Security Suite enthalten. Sollten Sie noch keine Lizenz f\u00fcr die Total Security Suite erworben haben, empfehlen wir Ihnen auf diese zu upgraden. Eine \u00dcbersicht der von WatchGuard angebotenen Suiten und den dazugeh\u00f6rigen Services finden Sie in unserem Infoportal unter\u00a0<a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/produktinfos\/watchguard-security-services-und-suites\/\" target=\"_blank\" rel=\"noopener\">Security Services und Suites<\/a>\u00a0und <a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/vertriebsinfos\/basic-security-suite-vs-total-security-suite\/\" target=\"_blank\" rel=\"noopener\">Basic Security Suite vs. Total Security Suite<\/a>.<\/p>\n<h5>Netzwerk-Attacken:<\/h5>\n<p>Neben den Malware-Attacken wurden im Februar 2020 auch \u00fcber <strong>562.235 Netzwerkangriffe<\/strong> von WatchGuard Firebox Appliances blockiert:<br \/>\n<div class=\"su-list\" style=\"margin-left:0px\">\n<ul>\n<li><i class=\"sui sui-chevron-circle-right\" style=\"color:#333\"><\/i> t\u00e4glich 19.387 geblockte Angriffe<\/li>\n<li><i class=\"sui sui-chevron-circle-right\" style=\"color:#333\"><\/i> 48,74% aller von WatchGuard geblockten Attacken in EMEA<\/li>\n<li><i class=\"sui sui-chevron-circle-right\" style=\"color:#333\"><\/i> alleine in Deutschland 102.749 geblockte Angriffe<\/li>\n<\/ul>\n<\/div>\n<p>Weitere Informationen finden Sie im letzten\u00a0<a href=\"https:\/\/www.boc.de\/watchguard-info-portal\/2019\/11\/internet-security-report-q2-2019\/\" target=\"_blank\" rel=\"noopener\">Internet Security Report &#8211; Q2 2019<\/a>.<\/p>\n<p><!--more--><\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>Top 10 Malware-Angriffe<\/strong><\/td>\n<td width=\"50%\"><strong>Top 10 Netzwerk-Angriffe<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Win32\/Heri<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1059160\" target=\"_blank\" rel=\"noopener\">WEB SQL injection attempt -33<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Exploit.CVE-2017-11882.Gen<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1133407\" target=\"_blank\" rel=\"noopener\">WEB Brute Force Login -1.1021<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Win32\/Heim.D<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1133451\" target=\"_blank\" rel=\"noopener\">WEB Cross-site Scripting -36<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Gen:Variant.Application.Graftor.291176<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1133762\" target=\"_blank\" rel=\"noopener\">WEB URI Handler Buffer Overflow &#8211; GET -7<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Application.GenericKD.4498570<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1057664\" target=\"_blank\" rel=\"noopener\">WEB Nginx ngx_http_parse_chunked Buffer Overflow -1 (CVE-2013-2028)<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Trojan.GenericKD.30649454<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1130122\" target=\"_blank\" rel=\"noopener\">DB Drupal Core database.inc expandArguments SQL Injection -1 (CVE-2014-3704)<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">malicious<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1056282\" target=\"_blank\" rel=\"noopener\">WEB Ruby on Rails Where Hash SQL Injection (CVE-2012-2695)<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Gen:Variant.Application.RemoteAdmin.18<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1055065\" target=\"_blank\" rel=\"noopener\">WEB SQL Injection Attempt -4<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Gen:Variant.Application.Hacktool.Mimikatz.1<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1055396\" target=\"_blank\" rel=\"noopener\">WEB Cross-site Scripting -9<\/a><\/td>\n<\/tr>\n<tr>\n<td>\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">\n<div class=\"col-sm-9 topTenLabel\">Exploit.OLE.Gen.3<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/td>\n<td><a href=\"https:\/\/www.watchguard.com\/SecurityPortal\/ThreatDetail.aspx?rule_id=1054837\" target=\"_blank\" rel=\"noopener\">WEB Remote File Inclusion \/etc\/passwd<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WatchGuards Threat Lab ist eine Gruppe von Bedrohungsforschern, die sich mit der Analyse und Aufbereitung der letzten Malware- und Netzwerk-Attacken besch\u00e4ftigen. Sie greifen dabei auf die Daten zur\u00fcck, die sie vom WatchGuard Firebox Feed bekommen, aber auch aus internen und externen Threat Intelligences und einem Forschungs-Honeynet. Daraus werden Analysen und praktische Sicherheitshinweise \u00fcber die gr\u00f6\u00dften Gefahren und Bedrohungen abgeleitet.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[445],"tags":[472],"class_list":["post-9980","post","type-post","status-publish","format-standard","hentry","category-aktuelle-nachrichten","tag-threat-landscape"],"_links":{"self":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/9980"}],"collection":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/comments?post=9980"}],"version-history":[{"count":2,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/9980\/revisions"}],"predecessor-version":[{"id":9989,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/9980\/revisions\/9989"}],"wp:attachment":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/media?parent=9980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/categories?post=9980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/tags?post=9980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}