{"id":222447,"date":"2019-09-09T00:01:00","date_gmt":"2019-09-08T22:01:00","guid":{"rendered":"https:\/\/www.borncity.com\/blog\/?p=222447"},"modified":"2019-09-08T23:46:55","modified_gmt":"2019-09-08T21:46:55","slug":"massen-scan-nach-pulse-secure-vpn-server","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2019\/09\/09\/massen-scan-nach-pulse-secure-vpn-server\/","title":{"rendered":"Massen-Scan nach Pulse Secure VPN-Server"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"https:\/\/borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" align=\"left\" height=\"47\"\/>Kurze Sicherheitsinformation f\u00fcr Administratoren von Pulse Secure VPN-Servern. Seit einigen Stunden l\u00e4uft ein Massen-Scan im Internet nach Pulse Secure VPN-Servern. <\/p>\n<p><!--more--><\/p>\n<p>Die Information habe ich gerade auf Twitter gefunden. Der Scan geht von der IP 5.101.181.111 aus und sucht nach angreifbaren Pulse Secure VPN-Servern. <\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">\u26a0\ufe0f  \u26a0\ufe0f<br \/>Mass scanning activity detected from 5.101.181.111 () attempting to exploit Pulse Secure VPN servers vulnerable to unauthenticated arbitrary file read (CVE-2019-11510) leading to disclosure of user passwords and private keys.<a href=\"https:\/\/twitter.com\/hashtag\/threatintel?src=hash&amp;ref_src=twsrc%5Etfw\">#threatintel<\/a> <a href=\"https:\/\/t.co\/aZuZkLHKtM\">pic.twitter.com\/aZuZkLHKtM<\/a><\/p>\n<p>\u2014 Bad Packets Report (@bad_packets) <a href=\"https:\/\/twitter.com\/bad_packets\/status\/1170571762955767808?ref_src=twsrc%5Etfw\">September 8, 2019<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>  <\/p>\n<p>Ich hatte Ende August im Blog-Beitrag <a href=\"https:\/\/borncity.com\/blog\/2019\/08\/27\/ungepatchte-pulse-secure-und-fortinet-ssl-vpns-angegriffen\/\">Angriffe auf ungepatchte Pulse Secure- und Fortinet SSL-VPNs<\/a> kurz \u00fcber die Schwachstelle in diesen Produkten berichtet. \u00dcber die Schwachstelle CVE-2019-11510 besteht f\u00fcr Angreifer die M\u00f6glichkeit, private Schl\u00fcssel und Nutzerkennw\u00f6rter auszulesen. Die Hersteller haben bereits vor Monaten Aktualisierungen f\u00fcr die Schwachstellen freigegeben. Wer also einen solchen Server administriert und diesen noch nicht gepatcht hat, sollte dies schleunigst nachholen. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kurze Sicherheitsinformation f\u00fcr Administratoren von Pulse Secure VPN-Servern. Seit einigen Stunden l\u00e4uft ein Massen-Scan im Internet nach Pulse Secure VPN-Servern.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[426],"tags":[4328],"class_list":["post-222447","post","type-post","status-publish","format-standard","hentry","category-sicherheit","tag-sicherheit"],"_links":{"self":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/222447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/comments?post=222447"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/222447\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/media?parent=222447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/categories?post=222447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/tags?post=222447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}