Security Note

資安事件新聞週報 2022/6/13 ~ 2022/6/17

noreply@blogger.com (Unknown) — Fri, 17 Jun 2022 16:03:00 +0000

資安事件新聞週報 2022/6/13 ~ 2022/6/17

1.重大弱點漏洞/後門/Exploit/Zero Day
Sophos防火牆3月底的漏洞修補，傳出中國駭客在此之前就已經著手濫用
https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/

中國駭客攻擊Sophos防火牆漏洞
https://www.ithome.com.tw/news/151493

Chinese Hackers Exploited Sophos Firewall Zero-Day Flaw to Target South Asian Entity
https://thehackernews.com/2022/06/chinese-hackers-exploited-sophos.html

F5重大資安漏洞已陸續出現嚴重攻擊，請盡快修補及管控
https://www.cc.ntu.edu.tw/chinese/cert/cert20220616.asp

Splunk重大漏洞恐被攻擊者用於執行任意程式碼
https://www.securityweek.com/critical-code-execution-vulnerability-patched-splunk-enterprise?

Citrix ADM重大漏洞可讓攻擊者重設管理員密碼
https://support.citrix.com/article/CTX460016/citrix-application-delivery-management-security-bulletin-for-cve202227511-and-cve202227512

SAP修補嚴重的NetWeaver漏洞
https://onapsis.com/blog/sap-security-patch-day-june-2022-improper-access-control-can-compromise-your-systems

電子郵件系統Zimbra漏洞恐讓攻擊者竊取用戶明文密碼
https://blog.sonarsource.com/zimbra-mail-stealing-clear-text-credentials-via-memcache-injection/

思科修補電子郵件防護系統可被用於繞過身分驗證的漏洞
https://www.bleepingcomputer.com/news/security/cisco-secure-email-bug-can-let-attackers-bypass-authentication/

IE瀏覽器淘汰了！微軟宣佈6/16停止支援
https://times.hinet.net/news/23967750

曾全球市占率第一！微軟今淘汰IE　仍有近3千萬人仍死守
https://www.setn.com/News.aspx?NewsID=1131089

資安業者指控微軟對Azure Synapse Analytics漏洞回應不夠積極
https://www.theregister.com/2022/06/14/security_azure_patch/

微軟修補MSDT零時差漏洞
https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2022-patch-tuesday-fixes-1-zero-day-55-flaws/

快更新Windows！微軟終於修復Follina漏洞、阻斷中國駭客攻擊
https://3c.ltn.com.tw/news/49667

俄羅斯駭客Sandworm疑在2個月前開始利用Follina漏洞攻擊烏克蘭
https://cert.gov.ua/article/160530

Microsoft 推出 2022 年 6 月 Patch Tuesday 資安更新包，修復Follina 等 55 個漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9920

Patch Tuesday: Microsoft Issues Fix for Actively Exploited 'Follina' Vulnerability
https://thehackernews.com/2022/06/patch-tuesday-microsoft-issues-fix-for.html

Technical Details Released for 'SynLapse' RCE Vulnerability Reported in Microsoft Azure
https://thehackernews.com/2022/06/technical-details-released-for-synlapse.html

Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities
https://www.ibm.com/support/pages/node/6595755?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security bulletin: Security Bulletin: IBM Security QRadar Event and Flow Exporter App is vulnerable to using components with known vulnerabilities (CVE-2021-31535, CVE-2020-17541)
https://www.ibm.com/support/pages/node/6595743?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security bulletin: Security Bulletin: Nanoid as used by IBM QRadar Use Case Manager App is vulnerable to information disclosure (CVE-2021-23566)
https://www.ibm.com/support/pages/node/6595741?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security bulletin: Security Bulletin: Apache Kafka as used by IBM QRadar SIEM is vulnerable to information disclosure (CVE-2021-38153, CVE-2018-17196)
https://www.ibm.com/support/pages/node/6595739?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security bulletin: Security Bulletin: Pip as used by IBM QRadar Advisor With Watson is vulnerable to multiple vulnerabilities (CVE-2019-20916, CVE-2021-3572, CVE-2018-20225)
https://www.ibm.com/support/pages/node/6595273?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

High-Severity RCE Vulnerability Reported in Popular Fastjson Library
https://thehackernews.com/2022/06/high-severity-rce-vulnerability.html

研究人員揭露Intel與AMD處理器的旁路攻擊漏洞
https://times.hinet.net/news/23969647

x86 CPU 最新漏洞，駭客可遠端竊取金鑰，Intel 全部處理器受影響
https://vitomag.com/tech/oyoprq.html

研究人員揭露Intel、AMD處理器旁路攻擊手法Hertzbleed
https://www.hertzbleed.com/

New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs
https://thehackernews.com/2022/06/new-hertzbleed-side-channel-attack.html

Unpatched Travis CI API Bug Exposes Thousands of Secret User Access Tokens
https://thehackernews.com/2022/06/unpatched-travis-ci-api-bug-exposes.html

駭客還在利用3年前的Telerik UI漏洞以植入Cobalt Strike與挖礦軟體
https://www.ithome.com.tw/news/151464

多款瀏覽器外掛程式錢包存在安全性漏洞，目前MetaMask及Phantom已修復
https://www.techbang.com/posts/97208-browser-plugin-wallets

WordPress表單外掛程式Ninja Forms漏洞已遭利用
https://www.wordfence.com/blog/2022/06/psa-critical-vulnerability-patched-in-ninja-forms-wordpress-plugin/

Over a Million WordPress Sites Forcibly Updated to Patch a Critical Plugin Vulnerability
https://thehackernews.com/2022/06/over-million-wordpress-sites-forcibly.html

研究人員揭露攻擊蘋果M1晶片的手法PACMAN
https://pacmanattack.com/

研究人員發現可擊破M1晶片最後防線、執行程式碼的PACMAN漏洞
https://www.ithome.com.tw/news/151404

不能只看CVSS分數！從商業風險判斷弱點管理的優先程度
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9917

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
NordVPN: 台灣信用卡資料於暗網市場售價是全球平均2倍
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9904

從第一銀行遭駭客入侵盜領案論述刑法對資安保障
https://twnewshub.com/archives/30752

創業3年獲Gogolook策略投資，日本金融廳、紐約金融署都青睞的鏈奇科技什麼來頭
https://meet.bnext.com.tw/articles/view/49186

第一金強化經營韌性；擬穩健擴張海外業務
https://www.ttv.com.tw/finance/view/062022171131C9E85CFD56344C73A509DABD761CD0A0C470/587

強化資安元大金五子公司通過個資管理制度驗證
https://money.udn.com/money/story/5613/6386377?from=edn_newestlist_cate_side

元大金旗下5家子公司通過個資管理制度驗證
https://turnnewsapp.com/livenews/finance/A95634002022061415484577

元大金五子公司通過PIMS驗證
https://wantrich.chinatimes.com/news/20220615900087-420101

完善法令遵循及內控內稽制度　銀行進入全面法令遵循體制
https://news.tvbs.com.tw/money/1817384

精誠資訊「智慧金融軟體學院」開跑歡迎新鮮人加入
https://www.1111.com.tw/news/jobns/146068

國泰金控公司治理評鑑6度挺進前5% 旗下國泰人壽推業界首創眼睛保險
https://reurl.cc/7DqrEk

職員：銀行系統顯示已發出 OTP或遭駭客刪除
https://reurl.cc/anD9b4

上海解封又一亂象! 不會行動支付、ATM又故障老年人凌晨兩點就去銀行排隊
https://reurl.cc/p1RgeQ

享受購物更要精打細算聯卡中心讓分期付款變聰明了
https://reurl.cc/j1e80D

全台首張萬事達卡推數位優先卡
https://www.chinatimes.com/newspapers/20220613000269-260208?chdtv

淡海輕軌新「發現」　感應信用卡就能入站
https://www.cardu.com.tw/news/detail.php?46379

3.電子支付/行動支付/pay/資安
投資趨勢！國泰數位支付服務ETF熱門
https://reurl.cc/VDoEbY

發卡機構首推視障人士「共融卡」　配備凸字壓印、點字助電子支付原文網址: 發卡機構首推視障人士「共融卡」　配備凸字壓印、點字助電子支付 | 香港01 https://www.hk01.com/sns/article/782520
https://reurl.cc/NAorK9

91APP、Atome 拓先買後付市場
https://reurl.cc/zZkena

國泰投信：數位支付服務商機引爆
https://wantrich.chinatimes.com/news/20220615900092-420401

LINE Pay、一卡通分手，誰是贏家
https://www.bnext.com.tw/article/69965/line-pay-ipass-note

南韓廢除硬幣、瑞典無現金社會！法人：全球加速邁向「Pay 經濟」
https://technews.tw/2022/06/14/cashless/

Pay經濟崛起迎數位支付百兆商機
https://money.udn.com/money/story/5636/6391214

臉書買芒果遭偷設定第三方支付 2小時被盜刷8次共19萬
https://news.pts.org.tw/article/584624

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Create NFT Market Place without any libraries like openZeppelin (part 1)
https://amirdiafi.medium.com/create-nft-market-place-without-any-libraries-like-openzeppelin-part-1-7c3bbc04c23f

波場聯合儲備宣布已斥資1億USDC購買TRX
https://news.cnyes.com/news/id/4892593

比特幣大騙局:竊盜、駭客、投機者，加密貨幣交易所Mt. Gox的腐敗運作與破產真相
https://ebook.hyread.com.tw/bookDetail.jsp?id=294921

安全團隊：BlockSec成功攔截針對FSWAP 的駭客攻擊
https://news.cnyes.com/news/id/4892969

Celsius暫停出金第四日，執行長首度發言狂跳針：感謝最強大的Celsius社群
https://news.cnyes.com/news/id/4893309

Fei Labs：不支持通過 FEI PCV 來償還 Fuse 平台的用戶損失
https://news.cnyes.com/news/id/4893227

三箭資本將超1.4萬枚stETH轉換為約1366萬枚USDT
https://news.cnyes.com/news/id/4894154

比特幣重挫！薩爾瓦多一夕蒸發16億　總統透露還要繼續買
https://news.tvbs.com.tw/world/1822161

「這群人」與幣安合作推NFT，作品經典元素、內容、台詞以盲盒出售
https://www.bnext.com.tw/article/69957/tgop-binance-nft

Meta Quest 2 適用的 Horizon Home 虛擬實境社群服務將於下週推出擴展元宇宙應用發展
https://www.cool3c.com/article/178421

華碩雲端總經理吳漢章：相信台灣第一個元宇宙醫院很快就會誕生
https://news.sina.com.tw/article/20220613/42013766.html

Coinbase 宣布將裁員超過 1000 人！加密冬天真的來了
https://buzzorange.com/techorange/2022/06/15/cryptocurrency-bear-coinbase/

Optimism駭客已歸還1700萬枚OP
https://news.cnyes.com/news/id/4890007

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
18款 Windows 防毒軟體大PK！8款掃毒防護獲評為最佳
https://3c.ltn.com.tw/news/49549

Qbot 惡意軟體現正利用 Windows MSDT 0-day 漏洞發動釣魚攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9908

勒索軟體BlackCat透過ProxyLogon漏洞入侵受害組織
https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/

勒索軟體BlackCat架設個資外洩查詢網站，疑透過員工向受害組織施壓
https://www.bleepingcomputer.com/news/security/ransomware-gang-creates-site-for-employees-to-search-for-their-stolen-data/

行動裝置後門程式SeaFlower竊取加密貨幣錢包的通關密語
https://blog.confiant.com/how-seaflower-%E8%97%8F%E6%B5%B7%E8%8A%B1-installs-backdoors-in-ios-android-web3-wallets-to-steal-your-seed-phrase-d25f0ccdffce

Atlassian Confluence重大漏洞也被勒索軟體駭客利用
https://www.bleepingcomputer.com/news/security/confluence-servers-hacked-to-deploy-avoslocker-cerber2021-ransomware/

伊朗駭客利用DNS後門程式對能源組織下手
https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor

駭客組織Black Basta鎖定虛擬化平臺發展勒索軟體、攻擊者利用微軟Office重大漏洞對烏克蘭下手
https://reurl.cc/Erv2dK

中國駭客組織散布WinDealer惡意軟體有新手法，已具旁觀者攻擊手法能力
https://reurl.cc/0peDA6

非洲最大連鎖超市Shoprite遭勒索軟體RansomHouse攻擊
https://times.hinet.net/news/23971812

安卓用戶快刪這5款APP！木馬病毒入侵照片編輯軟體「個資盜光光」，200萬名用戶恐受害
https://www.storm.mg/lifestyle/4383846

P2P殭屍網路Panchan鎖定教育單位的Linux伺服器而來
https://www.akamai.com/blog/security/new-p2p-botnet-panchan

駭客組織8220也利用Atlassian Confluence伺服器挖礦
https://blog.checkpoint.com/2022/06/09/crypto-miners-leveraging-atlassian-zero-day-vulnerability/

Cerber2021 Ransomware Back in Action
https://blog.cyble.com/2022/06/17/cerber2021-ransomware-back-in-action

Panchan’s Mining Rig: New Golang Peer-to-Peer Botnet Says “Hi!”
https://www.akamai.com/blog/security/new-p2p-botnet-panchan

Analysis of a secret theft attack against multiple institutions in South Korea
https://www-freebuf-com.translate.goog/articles/paper/329379.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=zh-TW

F5 Labs Investigates MaliBot
https://www.f5.com/labs/articles/threat-intelligence/f5-labs-investigates-malibot

GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool
https://unit42.paloaltonetworks.com/pingpull-gallium/

Telerik UI exploitation leads to cryptominer, Cobalt Strike infections
https://news.sophos.com/en-us/2022/06/15/telerik-ui-exploitation-leads-to-cryptominer-cobalt-strike-infections/
https://github.com/sophoslabs/IoCs/blob/master/Troj-Miner-AED.csv

Linux蠕蟲程式Syslogk於受害主機載入後門程式
https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/

Linux Threat Hunting: Syslogk a kernel rootkit found under development in the wild
https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/

New Syslogk Linux Rootkit Lets Attackers Remotely Command It Using "Magic Packets"
https://thehackernews.com/2022/06/new-syslogk-linux-rootkit-lets.html

Malware Android Software Spread by Sidewinder (APT-Q-39) Using Google Play
https://mp-weixin-qq-com.translate.goog/s/LaWE4R24D7og-d7sWvsGyg?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

Exposing HelloXD Ransomware and x4k
https://unit42.paloaltonetworks.com/helloxd-ransomware/

微軟：勒索軟體駭客經常以盜來的憑證或Exchange漏洞入侵組織
https://www.ithome.com.tw/news/151425

BlackCat Ransomware Gang Targeting Unpatched Microsoft Exchange Servers
https://thehackernews.com/2022/06/blackcat-ransomware-gang-targeting.html

A Microsoft Office 365 Feature Could Help Ransomware Hackers Hold Cloud Files Hostage
https://thehackernews.com/2022/06/a-microsoft-office-365-feature-could.html

MaliBot: A New Android Banking Trojan Spotted in the Wild
https://thehackernews.com/2022/06/malibot-new-android-banking-trojan.html

Panchan: A New Golang-based Peer-To-Peer Botnet Targeting Linux Servers
https://thehackernews.com/2022/06/panchan-new-golang-based-peer-to-peer.html

Researchers Detail PureCrypter Loader Cyber Criminals Using to Distribute Malware
https://thehackernews.com/2022/06/researchers-detail-purecrypter-loader.html

中國駭客組織Gallium開始利用新的PingPull木馬
https://www.ithome.com.tw/news/151426

中國駭客Gallium利用木馬程式PingPull攻擊電信業者、金融與政府單位
https://unit42.paloaltonetworks.com/pingpull-gallium/

Chinese 'Gallium' Hackers Using New PingPull Malware in Cyberespionage Attacks
https://thehackernews.com/2022/06/chinese-gallium-hackers-using-new.html

Researchers Disclose Rooting Backdoor in Mitel IP Phones for Businesses
https://thehackernews.com/2022/06/researchers-disclose-rooting-backdoor.html

勒索軟體Hello XD不只加密電腦檔案，還會植入後門
https://unit42.paloaltonetworks.com/helloxd-ransomware/

HelloXD Ransomware Installing Backdoor on Targeted Windows and Linux Systems
https://thehackernews.com/2022/06/hello-xd-ransomware-installing-backdoor.html

美國紐澤西州學校因遭勒索軟體攻擊取消期末考
https://therecord.media/new-jersey-school-district-forced-to-cancel-final-exams-amid-ransomware-recovery-effort/

Researchers Uncover 'Hermit' Android Spyware Used in Kazakhstan, Syria, and Italy
https://thehackernews.com/2022/06/researchers-uncover-hermit-android.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
通行密鑰 Passkeys是什麼？Apple為何要推無密碼登錄技術
https://mrmad.com.tw/apple-passkeys

Chinese Hackers Distribute Backdoored Web3 Wallets for iOS and Android Users
https://thehackernews.com/2022/06/chinese-hackers-distribute-backdoored.html

點擊 App 太慢了！Google 官方推薦 5 款超實用 Android 「桌面小工具」
https://3c.ltn.com.tw/news/49669

精誠攜手互動資通跨入EIM企業即時通訊協作市場提升營運績效
http://www.ctimes.com.tw/DispNews-tw.asp?O=HK66F9BYCE0SAA00NC

多人會議同時講話也不怕聽不清！微軟如何靠 AI 技術打造更好的通話體驗
https://buzzorange.com/techorange/2022/06/15/microsoft-teams-ai/

iOS 16和Android 13的更新，到底將為你的手機帶來什麼改變
https://www.techbang.com/posts/97042-ios16-android13

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
網絡安全專家：小心被駭別用公共Wi-Fi付賬
https://reurl.cc/Lmo0Oy

資安規範建立是場公司營運大挑戰，領導者沒有時間慢慢熬了
https://buzzorange.com/techorange/2022/06/13/2022-data-security-management/

IT 部門為何變成財務黑洞？除了工程師不善溝通，還有這些問題要面對
https://www.managertoday.com.tw/columns/view/65312

公有雲業者仍在客戶VM下暗中安裝軟體
https://times.hinet.net/news/23967517

任天堂駭客團夥策劃者：他賺了幾十億我偷點又何妨
https://reurl.cc/QLo7K9

46% 資深高階資安人員因駭侵防範壓力大增而萌生辭意
https://www.twcert.org.tw/tw/cp-104-6223-bc820-1.html

臺資安業者揭露國內AD防護現況，盤點AD攻擊路徑與管理者帳號是當務之急
https://www.ithome.com.tw/news/151458

Smilodon駭客組織鎖定WordPress網站發動側錄攻擊
https://blog.sucuri.net/2022/06/smilodon-credit-card-skimming-malware-shifts-to-wordpress.html

捲土重來的 AlphaBay，將再次稱霸暗網市場
https://www.inside.com.tw/article/28035-alphabay-is-taking-over-the-dark-web-again

電商業者的人財兩失殺手：彈出式廣告劫持
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9912

美國網安公司：中國駭客攻擊澳洲與東南亞達10年
https://udn.com/news/story/7331/6386546?from=udn-catebreaknews_ch2

中國傲琴龍駭攻亞太國家10年
https://news.ltn.com.tw/news/world/paper/1523092

中共駭客攻擊以色列、伊朗、沙烏地阿拉伯以獲取商業和技術機密
https://gnews.org/post/p1463054

中國電商公司兩名員工離職報復公司：將所有商品改為一折
https://www.techbang.com/posts/97110-the-change-of-goods-to-a-one-fold-discount-led-to-a-loss-of

香港傳真社停運涉國安否創辦人：沒資料聲明稱財政穩健未交代停運原因
https://reurl.cc/6ZRaRd

駭客洩露新疆集中營內的大量檔
https://gnews.org/post/p2599493

俄羅斯駭客Sandworm疑在2個月前開始利用Follina漏洞攻擊烏克蘭
https://cert.gov.ua/article/160530

美警示中國駭客攻擊電信業態勢，16個網路設備已知漏洞最常被鎖定
https://www.ithome.com.tw/tech/151476

美國網路「觸角」伸向俄烏戰場或導致俄烏衝突升級和擴大
https://reurl.cc/6ZRy15

美國情報機構加強鎖定中國華裔擔憂遭殃
https://udn.com/news/story/6809/6393280

美國情報總監辦公室：情報收集聚焦中國而不是華裔或亞裔美國人
https://www.voacantonese.com/a/spy-agencies-focus-on-china-could-snare-chinese-americans-20220615/6618662.html

大規模HTTPS流量DDoS攻擊鎖定Cloudflare免費用戶下手
https://blog.cloudflare.com/26m-rps-ddos/

Cloudflare Saw Record-Breaking DDoS Attack Peaking at 26 Million Request Per Second
https://thehackernews.com/2022/06/cloudflare-saw-record-breaking-ddos.html

資通訊人才先卡位，中華電今年釋出近千職缺需求
https://technews.tw/2022/06/17/cht-3/

中華電衝刺5G創新應用　釋近千名基層ICT職缺
https://www.ftvnews.com.tw/news/detail/2022617W0087

5L新光人壽-資訊安全管理師(有相關經驗、證照者從優核敘)
https://www.skfh.com.tw/hr/job_detail.aspx?id=20489

Java Engineer
https://hunter.104.com.tw/en/job/FG00005641

資安技術顧問助理_台北
https://www.104.com.tw/job/7nvua

資安產品經理
https://www.104.com.tw/job/7nvjb

REQ_2204632 AW0130資安技術工程師
https://www.104.com.tw/jobs/apply/analysis/7l7qk?channel=104rpt&jobsource=apply_analyze

未來十年，這 30 個高薪職位最缺工！根據美國勞工局預測
https://www.managertoday.com.tw/articles/view/65256

資安助理顧問
https://www.104.com.tw/job/7iyxw?jobsource=jolist_c_date

資安鑑識支援工程師-ACSI
https://www.linkedin.com/jobs/view/%E8%B3%87%E5%AE%89%E9%91%91%E8%AD%98%E6%94%AF%E6%8F%B4%E5%B7%A5%E7%A8%8B%E5%B8%AB-acsi-at-acer-3124895080/?originalSubdomain=tw

技術副理-ACSI
https://www.linkedin.com/jobs/view/%E6%8A%80%E8%A1%93%E5%89%AF%E7%90%86-acsi-at-acer-3124888995/?originalSubdomain=tw

資安管理師
https://www.104.com.tw/job/7nydp

資訊安全工程師
https://www.104.com.tw/job/7o047

【資訊】雲端資安工程師
https://www.yourator.co/companies/cathaybk/jobs/24754

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
地下市場最常見 10 大「外洩密碼」別再用！免費工具 1 秒就破解
https://3c.ltn.com.tw/news/49664

別再用這10組密碼！駭客用免費工具秒破解　加「1符號」提高安全度
https://www.ftvnews.com.tw/news/detail/2022616W0158

免費VPN服務疑資料庫配置不當，曝露2,500萬筆記錄
https://cybernews.com/security/25-million-free-vpn-user-records-exposed/

【部分錯誤】網傳「BT網站能夠免費下載電影、軟體、電玩，十年前因沒有金錢交易，純自己觀賞，上傳下載的人都不違法，現在這個下載方式被改變，會自動上傳，變成犯法」
https://tfc-taiwan.org.tw/articles/7679

【基輔連線】用真實來打這場俄國資訊戰烏克蘭查核組織《Vox Check》
https://tfc-taiwan.org.tw/articles/7674

疫情宅家上網釀個資破口　狂接投資詐騙電話...刑大曝3招防詐
https://www.ettoday.net/news/20220613/2271885.htm

資安零信任防詐先查證
https://times.hinet.net/news/23965247

Messenger 點擊網址詐騙達高峰！數百萬用戶FB 帳密遭盜洩個資
https://3c.ltn.com.tw/news/49590

網購芒果遭假小編騙個資盜刷19萬
https://news.ebc.net.tw/news/society/321873

網路購物平台易淪洩漏個資管道刑大提醒慎選投資標的
https://www.chinatimes.com/realtimenews/20220613002038-260402?chdtv

真有老大哥在背後監視我們？專家破解 21 個關於國家資料隱私的傳言
https://buzzorange.com/techorange/2022/06/16/hoozbook-i-have-nothing-to-hide/

個資外洩名人經驗慘專家：送修前鎖硬碟｜#鏡新聞
https://reurl.cc/vdxq8l

軟體開發測試平臺Travis CI恐曝露數千個GitHub、AWS、Docker憑證
https://blog.aquasec.com/travis-ci-security

投資詐騙局中局中市4被害人遭扒2次皮
https://reurl.cc/GxYmYW

被騙金錢能追回？網紅親砸12萬為粉絲買教訓　直呼：別再2次上當
https://www.ftvnews.com.tw/news/detail/2022611W0128

E.研究報告/工具
python駭客攻防入門下載-Python鍵盤鉤取的自我理解
https://tw.pythontechworld.com/article/detail/ZeAw4IpJ7SM8

123個hacker必備的Python工具
https://tw.pythontechworld.com/article/detail/eidD1gnQHN3I

網路資安溯源 (cyber attribution),只是單純找出幕後駭客而已嗎
https://blog.trendmicro.com.tw/?p=72744

假投資詐騙橫行北市警提醒注意網路安全
https://udn.com/news/story/7320/6384973

開源工具減輕維運負擔　從頭示範如何安裝、設定及使用 Icinga2自動監控　隨時掌控系統網路服務
https://www.netadmin.com.tw/netadmin/zh-tw/technology/8B9958055B1E4BC7BE5ED3EACD383D10

The Latest .NET 7 Features Will Change the Way You Code
https://medium.com/dotnetsafer/the-latest-net-7-features-will-change-the-way-you-code-b62b2611b910

Security Notice: Extension Disk Encryption Issue
https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863

Going Behind the Scenes of Foursquare’s Places API
https://medium.com/foursquare-direct/going-behind-the-scenes-of-foursquares-places-api-bed74f8f1d14

What is LaMDA and What Does it Want
https://cajundiscordian.medium.com/what-is-lamda-and-what-does-it-want-688632134489

Stop using Alpine Docker images
https://medium.com/inside-sumup/stop-using-alpine-docker-images-fbf122c63010

Automatic Feature Selection in python
https://danilzherebtsov.medium.com/automatic-feature-selection-in-python-f72ec69215fe

How I Found a company’s internal S3 Bucket with 41k Files
https://infosecwriteups.com/how-i-found-a-companys-internal-s3-bucket-with-41k-files-94b453e588b5

The Do’s and Don’ts of Try-Catch in JavaScript
https://javascript.plainenglish.io/the-dos-and-don-ts-of-try-catch-in-javascript-75c4e8c82200

Advanced Interactive Dashboard in Python
https://medium.com/@jairotunior/advanced-interactive-dashboards-in-python-cc2927dcde07

Difference Between Agent-Based and Network-Based Internal Vulnerability Scanning
https://thehackernews.com/2022/06/difference-between-agent-based-and.html

Quick and Simple: BPFDoor Explained
https://thehackernews.com/2022/06/quick-and-simple-bpfdoor-explained.html

Reimagine Hybrid Work: Same CyberSec in Office and at Home
https://thehackernews.com/2022/06/reimagine-hybrid-work-same-cybersec-in.html

F.商業
趨勢科技：石油及天然氣產業遭受工業設備網路攻擊損失最嚴重
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9907

攻擊停留時間平均超過10天！IAB「隱形」入侵讓多個攻擊者可能鎖定同一目標
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9909

Fortinet 發布新產品 FortiNDR，以人工智慧偵測並回應威脅攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9903

Check Point Harmony Mobile 4.0整合三星安全平台 Samsung Knox
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9905

NetApp 簡化混合雲操作，因應勒索軟體威脅，協助加速 VMware 工作負載上雲
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9906

傳聞美國國防承包商L3Harris有意買下以色列駭客公司NSO Group
https://times.hinet.net/news/23969443

全球企業憂心數位受攻擊面控管問題將影響資安風險
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000637455_WVW5RLEV4MW0J66UI9MY3

再創佳績！蓋亞資訊連續兩年獲頒IMPERVA年度全球傑出業務獎
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000637350_4ZY2P27C6QP8K3LOHOK6M

軟體供應鏈必學資安課題，如何拉近開發與資安的距離
https://buzzorange.com/techorange/2022/06/17/gss-checkmarx/

趨勢科技推出TMMNS方案落實5G專網點對點聯合防禦
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=13&cat=80&id=0000637288_3IN1N2B890QFYU7E51B6E

F5發表NGINX for Microsoft Azure提供安全高效能的應用交付
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9914

A10 Networks資安系統降低DDoS攻擊
https://www.mem.com.tw/a10-networks%E8%B3%87%E5%AE%89%E7%B3%BB%E7%B5%B1%E9%99%8D%E4%BD%8E/

平衡才是王道！後疫時代下企業關注資安防禦和商業敏捷性的平衡
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9918

美國Fintech業者併購臺灣資安新創Cybavo
https://www.ithome.com.tw/news/151406

微軟併購外國網路威脅情資業者Miburo
https://blogs.microsoft.com/blog/2022/06/14/microsoft-to-acquire-miburo/

宏碁集團也搶儲能商機旗下智頻、展碁國際聯手布局
https://news.cnyes.com/news/id/4890167?exp=a

魚與熊掌可兼得！AWS 助資安長打造可兼顧企業效率的資安架構
https://buzzorange.com/techorange/2022/06/13/aws-cso/

趨勢科技最新研究顯示：可視性與控管上的漏洞正在侵蝕企業資安
https://www.techbang.com/posts/96980-trendmicro-research-reveals-struggle-control-cyber-risks

Google Cloud計算出π小數點位後第100兆位數，再次打破世界紀錄
https://www.ithome.com.tw/news/151400

Google、SAP 都有！為員工爭取幸福的 CHO，為何在近年格外重要
https://www.managertoday.com.tw/articles/view/65257

G.政府
員工罵恩爸「塔綠班」新北市府封網禁上PTT
https://www.youtube.com/watch?v=V3dqDl5EYf0

網紅四叉貓指新北封PTT 市府：正常網管作為
https://newtalk.tw/news/view/2022-06-13/769764

口罩國家隊疑遭網軍攻擊　她被控操控「24帳號」誹謗結果出爐
https://www.ettoday.net/news/20220616/2274244.htm

學習歷程檔案遺失「虛擲8千萬公帑」　監察院糾正國教署：要究責
https://www.ettoday.net/news/20220617/2274889.htm

台北通取得ISO 27701認證首創三項資安及個資保護認證市政APP
https://doit.gov.taipei/News_Content.aspx?n=4B2B1AB4B23E7EA8&sms=72544237BBE4C5F6&s=9E612EF2ACE463DD

林佳龍提北市政見「元宇宙、NFT入列」　4年投100億拚觀光
https://www.mirrormedia.mg/story/20220613edi016/

設置智慧與綠能產業服務共創基地　桃市府攜手北科大簽署MOU
https://reurl.cc/p1RgKd

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
智慧監控效益不打折威剛工控「軟硬兼施」為場域安全把關
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000637276_LT11N4AK8DCPEW5WWKIX7

豐田遭「羅賓漢」網路攻擊汽車生產受影響
https://ec.ltn.com.tw/article/breakingnews/3960957

豐田車廂感知系統運用毫米波雷達偵測車內生物
https://www.digitimes.com.tw/iot/article.asp?cat=158&id=0000637241_GRX12UAF5O01MZ0MTMZUX

DEKRA德凱攜手趨勢科技子公司VicOne打造車用資安認證整合服務
https://zeekmagazine.com/archives/174999

工業設備網路攻擊造成企業數百萬美元損失
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000637456_43258QSJ4ESBBK74V4RVX

TXOne EdgeIPS Pro 216 為中小型製造業確保營運安全不中斷
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/27BAD4503BFD47C59CBD5A76BB339241

趨勢旗下VicOne、德凱推車用資安認證
https://wantrich.chinatimes.com/amp/news/20220617900037-420501

催生超低功耗邊緣AI應用　tinyML賦予MCU產業新契機
https://www.eettaiwan.com/20220617nt31-tinyml-gives-mcu-industry-new-opportunities/

法國FIC論壇示警：產業OT資安遠遠落後於資訊科技
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=4b8db8dc-f3f9-4c7d-85f5-352848748a79

意法/AWS合作開發IoT AWS雲端連接方案
https://www.mem.com.tw/%E6%84%8F%E6%B3%95-aws%E5%90%88%E4%BD%9C%E9%96%8B%E7%99%BCiot-aws%E9%9B%B2%E7%AB%AF%E9%80%A3%E6%8E%A5%E6%96%B9%E6%A1%88/

台日工控資安交流捷而思分享身份認證再進化
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000636966_VLIL0J0K5AKD6M7C42OB0

製造業做淨零，只能手抄機台數據、再鍵入電腦？一個聰明的新方法
https://www.businessweekly.com.tw/carbon-reduction/blog/3009982

華碩建構OT資安工控，鞏固智慧製造防護網
https://www.techbang.com/posts/96972-asus-builds-ot-information-security-industrial-control

I.教育訓練
物聯網時代的15堂資安基礎必修課 (Practical Iot Hacking: The Definitive Guide to Attacking the Internet of Things)
https://www.tenlong.com.tw/products/9786263241756?list_name=p-r-zh_tw

中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

資安學習路上-滲透測試實務4
https://www.potatomedia.co/post/4191e744-64f3-4d33-af69-e3591adc2ed0

6.近期資安活動及研討會
科技力x內容力 5G Craft 菁英挑戰賽號召各路英雄 2022/6/15
https://tomorrowsci.com/technology/20225g0526/

經濟部工業局沙崙資安服務基地 - 智慧製造的痛-駭客攻擊與勒索軟體威脅 2022/6/16
https://www.cisanet.org.tw/Course/Detail/2836

【滲透與入侵 - 供應鏈資安威脅】資安跨域交流活動 2022/6/20
https://www.tca.org.tw/exhibit_info1.php?n=1716

經濟部工業局沙崙資安服務基地 - 日誌大數據分析實戰 2022/6/23
https://bit.ly/3sJWjmp

資安沙龍-「把科技力量化為智慧製造供應鏈安全的靠山」 2022/6/27
http://www.twcloud.org.tw/xmevent/cont?xsmsid=0I194031315298462880&sid=0M167435346971609077

資訊安全管理(週日班) 2022/7/3 ~ 2022/8/28
https://mymcu.mcu.edu.tw/zh-hant/product/e022205151

工控資安環境認知課程 2022/7/5
https://www.acw.org.tw/News/Detail.aspx?id=3228

創科資訊②⓪②②軟體開發實戰訓練營➠線上實習說明會 2022/7/6
https://trunk-studio.kktix.cc/events/monosparta-code-camp-2022-9

關鍵基礎設施實作課程(含攻防演練實作) 2022/7/11
https://www.acw.org.tw/News/Detail.aspx?id=3229

工控資安環境認知課程 2022/7/12
https://www.acw.org.tw/News/Detail.aspx?id=3228

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

關鍵基礎設施實作課程(含攻防演練實作) 2022/7/25
https://www.acw.org.tw/News/Detail.aspx?id=3229

關鍵基礎設施實作課程(含攻防演練實作) 2022/8/1
https://www.acw.org.tw/News/Detail.aspx?id=3229

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

關鍵基礎設施實作課程(含攻防演練實作) 2022/9/27
https://www.acw.org.tw/News/Detail.aspx?id=3229

資安事件新聞週報 2022/6/6 ~ 2022/6/10

noreply@blogger.com (Unknown) — Fri, 10 Jun 2022 16:33:00 +0000

資安事件新聞週報 2022/6/6 ~ 2022/6/10

1.重大弱點漏洞/後門/Exploit/Zero Day
已修補的SAP商用軟體漏洞遭到濫用
https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs

Even the Most Advanced Threats Rely on Unpatched Systems
https://thehackernews.com/2022/06/even-most-advanced-threats-rely-on.html

Windows又有新零時差漏洞DogWalk
https://times.hinet.net/news/23959255

研究人員揭露另一個MSDT零時差漏洞DogWalk
https://twitter.com/j00sean/status/1533889445027536899

繼 Follina 之後，又出現另一個微軟 MSDT 零時差漏洞「DogWalk」
https://technews.tw/2022/06/10/dogwalk-another-microsoft-ignored-msdt-vulnerability-like-follina-gets-unofficial-patch/

有人利用微軟Office的MSHTML、MSDT重大漏洞，在烏克蘭散布Cobalt Strike
https://cert.gov.ua/article/40559

MSDT零時差漏洞再度遭到利用，TA570用於散布惡意軟體QBot
https://www.bleepingcomputer.com/news/security/qbot-malware-now-uses-windows-msdt-zero-day-in-phishing-attacks/

Researchers Warn of Unpatched "DogWalk" Microsoft Windows Vulnerability
https://thehackernews.com/2022/06/researchers-warn-of-unpatched-dogwalk.html

Unpatched Critical Flaws Disclosed in U-Boot Bootloader for Embedded Devices
https://thehackernews.com/2022/06/unpatched-critical-flaws-disclosed-in-u.html

CISA Warned About Critical Vulnerabilities in Illumina's DNA Sequencing Devices
https://thehackernews.com/2022/06/cisa-warned-about-critical.html

Security bulletin: Security Bulletin: Apache Commons as used by IBM QRadar SIEM
is vulnerable to denial of service (CVE-2021-35515, CVE-2021-35516, CVE-2021-36090, CVE-2021-35517)
https://reurl.cc/8oOMN7

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
金融業是烏克蘭現代化的成敗關鍵
https://news.cnyes.com/news/id/4886569

強化資安彰銀加入F-ISAC會員
https://reurl.cc/8oOMMM

天天與駭客諜對諜，他靠「孫子兵法」守護銀行資產
https://money.udn.com/money/story/5613/6350661

純網銀出新招樂天銀行行動支付回饋2%
https://www.epochtimes.com/b5/22/6/10/n13756739.htm

3.電子支付/行動支付/pay/資安
LINE Pay 服務新推「信用卡」平台，輕鬆比較 LINE Points、現金回饋
https://technews.tw/2022/06/07/add-credit-cards-to-line-pay/

LINE Pay新功能上線回饋超多網嗨翻
https://reurl.cc/b2y8Ky

網好奇「還有人沒用過行動支付的嗎？」回應超兩極
https://reurl.cc/Eral5v

交通違規線上申辦及行動支付安全省時方便
https://reurl.cc/QLOAKq

疫情刺激國人行動支付使用率逾75％
https://ec.ltn.com.tw/article/breakingnews/3950809

「現金v.s.數位支付」哪種最常用？超過千萬人有戶頭口碑第一名是它
https://reurl.cc/moN5KW

電子支付使用南北大不同便民優先！專家建議整合系統
https://reurl.cc/g2Ey5R

梅驊出任街口電子支付新任董事長
https://www.inside.com.tw/article/27855-jkos-new-chairman

第三方支付淪詐騙漏洞籲標註警語
https://reurl.cc/3oZEV9

國泰全球數位支付ETF 搶占Pay經濟
https://reurl.cc/VDqOVA

央行預告修正「電子支付機構管理條例」
https://reurl.cc/n1Rd81

第三方支付有漏洞一組OTP密碼竟盜刷8次
https://reurl.cc/vd8OZL

網購芒果遇詐騙女申請第三方支付遭盜刷19萬
https://reurl.cc/j1OZnZ

蘋果瘋先買後付／央行教戰BNPL　示警潛在風險
https://finance.ettoday.net/news/2267338

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
標普發布穩定幣監督報告：未來有望成為「加密貨幣」與「法定貨幣」價值穩定的重要工具
https://www.thenewslens.com/article/167842

The ultimate NFT guide
https://medium.com/learn-bitcoin-blockchain/blockchain-project-report-6407b22bbfc3

Researchers Detail How Cyber Criminals Targeting Cryptocurrency Users
https://thehackernews.com/2022/06/researchers-detail-how-cyber-criminals.html

DeFi駭客識別協議Lossless Protocol上線Fantom
https://news.cnyes.com/news/id/4888402

Optimism駭客通過鏈上消息表示將歸還1800萬枚OP
https://news.cnyes.com/news/id/4889811

1年創下15億筆交易，成為以太坊最大勁敵！為何大家都用BSC轉帳？專家說給你聽
https://www.storm.mg/article/4370931

駭客利用 Osmosis 交易所漏洞竊取超 500 萬美元
https://www.btcc.com/zh-TW/coin-news/events/osmosis-exchange-hacked

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
駭客藉由各種假冒的破解軟體遞送惡意程式，以竊取機密資訊及加密貨幣
https://www.ithome.com.tw/news/151377

多個殭屍網路加入利用Atlassian Confluence漏洞的行列
https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/

勒索軟體Cuba採取雙重勒索策略，要求受害者3天內進行談判
https://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html

最怕碰上勒索病毒「賠了夫人又折兵」！該怎麼徹底防範
https://www.bnext.com.tw/article/69877/hacker-virus--jie-kao

駭客組織Black Basta發展Linux版勒索軟體，鎖定VMware ESXi而來
https://www.bleepingcomputer.com/news/security/linux-version-of-black-basta-ransomware-targets-vmware-esxi-servers/

TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)
https://isc.sans.edu/diary/rss/28728

Qbot 惡意軟體現正利用 Windows MSDT 0-day 漏洞發動釣魚攻擊
https://www.twcert.org.tw/tw/cp-104-6204-0bc04-1.html

攻擊者透過Office檔案屬性投放惡意軟體SVCReady，進一步在受害電腦部署竊密程式RedLine
https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/

搜尋引擎搜出假冒網站廣告！ OBS Project 指下載軟件可能含有惡意軟件
https://www.pcmarket.com.hk/fake-obs-studio-website-ad-found-in-search-engine/

近期LockBit 2.0危害全球加劇，全球1到4月超過300名受害者，近期臺廠也傳接連遇害
https://www.ithome.com.tw/tech/151368

殭屍網路病毒XLoader隱匿C2伺服器難以追蹤
https://research.checkpoint.com/2022/xloader-botnet-find-me-if-you-can/

勒索軟體WannaFriendMe要求受害者從線上遊戲Roblox市集購買解密金鑰
https://www.bleepingcomputer.com/news/security/bizarre-ransomware-sells-decryptor-on-roblox-game-pass-store/

義大利巴勒莫市營運中斷疑勒索軟體Vice Society所為
https://www.bleepingcomputer.com/news/security/vice-society-ransomware-claims-attack-on-italian-city-of-palermo/

惡意軟體Symbiote濫用BPF元件隱匿攻擊意圖
https://blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat

Symbiote: A New, Nearly-Impossible-to-Detect Linux Threat
https://www.intezer.com/blog/research/new-linux-threat-symbiote/

Symbiote: A Stealthy Linux Malware Targeting Latin American Financial Sector
https://thehackernews.com/2022/06/symbiote-stealthy-linux-malware.html

Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years
https://reurl.cc/VDqvyn

Shining the Light on Black Basta
https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/

MakeMoney malvertising campaign adds fake update template
https://blog.malwarebytes.com/threat-intelligence/2022/06/makemoney-malvertising-campaign-adds-fake-update-template/

Gamaredon activity - Second Quarter 2022
https://twitter.com/500mk500/status/1534799900147339267
https://twitter.com/500mk500/status/1534804600246648832

Bumblebee Loader on The Rise
https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/

Attackers Exploit MSDT Follina Bug to Drop RAT, Infostealer
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/follina-msdt-exploit-malware

Kinsing & Dark.IoT botnet among threats targeting CVE-2022-26134
https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/

FakeCrack: Crypto stealing campaign spread via fake cracked software
https://blog.avast.com/fakecrack-campaign

CVE-2022-26134 Threat Brief: Atlassian Confluence RCE Vulnerability
https://unit42.paloaltonetworks.com/cve-2022-26134-atlassian-code-execution-vulnerability/

Operation Tejas: A dying elephant curled up in the Kunlun Mountains
https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg

From the Front Lines | Another Rebrand? Mindware and SFile Ransomware Technical Breakdown
https://www.sentinelone.com/blog/from-the-front-lines-another-rebrand-mindware-and-sfile-ransomware-technical-breakdown/

Closing the Door: DeadBolt Ransomware Locks Out Vendors With Multitiered Extortion Scheme
https://www.trendmicro.com/en_us/research/22/f/closing-the-door-deadbolt-ransomware-locks-out-vendors-with-mult.html

Will the Real Msiexec Please Stand Up? Exploit Leads to Data Exfiltration
https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/

Spam Email Containing a Very Large ISO file
https://isc.sans.edu/diary/rss/28712

Outbreak of Follina in Australia
https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia/

Cyber attack on state organizations of Ukraine using the malicious program Cobalt Strike Beacon and exploits to vulnerabilities CVE-2021-40444 and CVE-2022-30190
https://cert.gov.ua/article/40559

殭屍網路Emotet企圖竊取Chrome用戶的信用卡資料
https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-credit-cards-from-google-chrome-users/

New Emotet Variant Stealing Users' Credit Card Information from Google Chrome
https://thehackernews.com/2022/06/new-emotet-variant-stealing-users.html

Evil Corp Cybercrime Group Shifts to LockBit Ransomware to Evade Sanctions
https://thehackernews.com/2022/06/evil-corp-cybercrime-group-shifts-to.html

Researchers Warn of Spam Campaign Targeting Victims with SVCReady Malware
https://thehackernews.com/2022/06/researchers-warn-of-spam-campaign.html

10 Most Prolific Banking Trojans Targeting Hundreds of Financial Apps with Over a Billion Users
https://thehackernews.com/2022/06/10-most-prolific-banking-trojans.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
疑網購年貨下載APP遭駭商人欲24次盜提3小時虧10萬
https://reurl.cc/9GQNvY

10 Things To Do Instead of Scrolling Through Your Smartphone
https://medium.com/personal-growth-lab/10-things-to-do-instead-of-scrolling-through-your-smartphone-df9a17f1c7db

Apple's New Feature Will Install Security Updates Automatically Without Full OS Update
https://thehackernews.com/2022/06/apples-new-feature-will-install.html

Apple 於 2021 年拒絕近 16 萬種可能有資安疑慮的 App 上架
https://www.twcert.org.tw/tw/cp-104-6196-065a5-1.html

手機資安合格？NCC抽測僅i12過初測
https://times.hinet.net/news/23957446

手機資安抽測15款全過關 NCC今年擬擴大規模
https://reurl.cc/VDqOnn

NCC抽測15款手機資安　不只中國廠牌、4大暢銷品牌都靠「補考」過關
https://tw.appledaily.com/life/20220608/5Z2A3HMP7RE6ZM7XQJTRABVGO4/

中國紫光展銳晶片存在重大漏洞，全球一成手機用戶曝險
https://research.checkpoint.com/2022/vulnerability-within-the-unisoc-baseband/

手機上網、內建App如何防範個資遭外洩？NCC 傳授「三不五要」撇步
https://3c.ltn.com.tw/news/49526

蘋果iOS 16偷學對手？外媒點名iPhone這些新功能安卓早就有
https://3c.ltn.com.tw/news/49541

HTC手機新品6月底發表將與VIVERSE元宇宙平台整合
https://www.sogi.com.tw/articles/htc_viverse_smartphone/6258022

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
調查：企業遭網攻中斷營運平均損失逾8千萬
https://ec.ltn.com.tw/article/breakingnews/3956404

網路環境危機四伏！全球 6 成企業自認資安存在盲點
https://buzzorange.com/techorange/2022/06/08/cyber-security-trend/

趨勢科技：可視性與控管上的漏洞正在侵蝕企業資安
https://technews.tw/2022/06/08/security-2/

新型態資安攻防戰開打，面對 APT 攻擊該如何主動防禦
https://buzzorange.com/techorange/2022/06/09/teamt5-cyber-security/

數位攻擊難控管全球企業憂影響資安風險
https://turnnewsapp.com/livenews/tech/A07657002022060910104803

港媒《傳真社》宣布停止運作　上月才遭駭客入侵
https://www.ettoday.net/news/20220610/2270243.htm

FBI、NSA警告：北京支持的駭客攻擊全球電信公司
https://reurl.cc/OAe3Mv

美國公布中國駭客攻擊電信業者與ISP所使用的連網設備漏洞
https://www.cisa.gov/uscert/ncas/alerts/aa22-158a

美國國務卿布林肯宣布成立的「國務院中國組」是什麼樣的團隊？能否有效應對中國挑戰
https://www.storm.mg/article/4373450?page=1

歐盟網路安全演練本月登場，聚焦醫療領域
https://www.ithome.com.tw/news/151346

烏軍活用民間無人機能量強化戰力
https://www.upmedia.mg/news_info.php?Type=2&SerialNo=146375

中國駭客組織Aoqin Dragon鎖定東南亞與澳洲而來
https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/

【兩岸論壇】中共「帶路建設」助長組織犯罪
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1505246&type=forum

Hacking Scenarios: How Hackers Choose Their Victims
https://thehackernews.com/2022/06/hacking-scenarios-how-hackers-choose.html

A Decade-Long Chinese Espionage Campaign Targets Southeast Asia and Australia
https://thehackernews.com/2022/06/a-decade-long-chinese-espionage.html

U.S. Agencies Warn About Chinese Hackers Targeting Telecoms and Network Service Providers
https://thehackernews.com/2022/06/us-agencies-warn-about-chinese-hackers.html

FBI Seizes 'SSNDOB' ID Theft Service for Selling Personal Info of 24 Million People
https://thehackernews.com/2022/06/fbi-seizes-ssndob-id-theft-service-for.html

資安工程師(台南科工廠)
https://www.104.com.tw/job/7kv9h?jobsource=m104

電動車系統資安工程師-E131
https://www.104.com.tw/job/7nryn

資安網管工程師/助理工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=12752&HIRE_ID=11238121

網路資安工程師
https://www.104.com.tw/job/7nsfc

台灣資安人才現缺口！DEVCORE 擴大開啟資安人才培育計畫
https://www.techbang.com/posts/96818-devcore-expands-information-security-talent-cultivation-program

職場金飯碗/十大新興工作讓你未來20年職涯不被淘汰
https://money.udn.com/money/story/122329/6377766

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
機靈女森耍詐諞集團10分鐘　大嬸爆氣跳針吼：快關閉
https://www.setn.com/News.aspx?NewsID=1128376

遇投資詐騙報警又陷「局中局」4人見46萬飛了超崩潰
https://www.chinatimes.com/realtimenews/20220610002497-260402?chdtv

假冒電子錢包職員套資料　過百人受害失近$150萬　警拘10男女原文網址: 假冒電子錢包職員套資料　過百人受害失近$150萬　警拘10男女 | 香港01 https://www.hk01.com/sns/article/780222
https://reurl.cc/b2y8mo

又見求職詐騙！網假冒外送平台收會費盜個資
https://www.ftvnews.com.tw/video/detail/Let42lmX8sI

限12種犯罪才能調個資臉書有安全盲點
https://reurl.cc/vd8O81

看中遲遲未修復的微軟「Follina」漏洞，國家贊助駭客鎖定歐美政府機構發動釣魚攻擊
https://technews.tw/2022/06/09/state-backed-hackers-exploit-microsoft-follina-bug-to-target-entities-in-europe-and-u-s/

網傳影片「總統先生你好！烏克蘭百姓對總統“澤連斯基”確有一番特別感情、為他著想、百姓勸降：你打不過他們的，投降吧，不要反抗了......！澤連斯基！我考慮下」
https://tfc-taiwan.org.tw/articles/7652

資安專家發現透過 Facebook Messenger 進行的大型釣魚攻擊活動
https://www.twcert.org.tw/tw/cp-104-6206-75457-1.html

老招數假親友真詐騙龜山行員警方合力阻詐
https://www.epochtimes.com/b5/22/6/9/n13755508.htm

詐騙被害人不限學經歷　中研院副院長、政務委員都上當
https://www.ctwant.com/article/187118

迪卡儂被駭客入侵
https://ptthito.com/gossiping/m-1654427949-a-e8d/

Microsoft Seizes 41 Domains Used in Spear-Phishing Attacks by Bohrium Hackers
https://thehackernews.com/2022/06/microsoft-seizes-41-domains-used-in.html

E.研究報告/工具
企業資安不容百密一疏！如何串連資料保護與資訊安全，杜絕駭客攻擊、啟動全面防護策略
https://buzzorange.com/techorange/2022/06/10/acronis/

$1000: How I could have Hack any account and become a billionaire overnight👑Top Crypto-Trading Platform
https://infosecwriteups.com/1000-how-i-could-have-hack-any-account-and-become-a-billionaire-overnight-top-crypto-trading-ff0e25b6013c

5 Advanced JavaScript concepts that will make you a better developer
https://levelup.gitconnected.com/5-advanced-javascript-concepts-that-will-make-you-a-better-developer-5d04292107a1

Software Architecture & System Design: I wish I had known about this earlier…
https://medium.com/@olgamitroshyna/software-architecture-i-wish-i-had-known-about-this-earlier-4df43eae57db

(Free) 6 Cyber Security Certification 2022.
https://medium.com/technology-hits/free-cyber-security-certifications-2022-75f13432cbff

Feature that are accepted for PHP 8.2
https://medium.com/@parvej.code/feature-that-are-accepted-for-php-8-2-f01722b5a658

Hibernate vs JPA vs Spring Data JPA
https://blog.devgenius.io/hibernate-vs-jpa-vs-spring-data-jpa-ff4485aaa780

Multi-factor Authentication In-The-Wild bypass methods
https://medium.com/proferosec-osm/multi-factor-authentication-in-the-wild-bypass-methods-689f53f0b62b

What I learned from reading 126* Information Disclosure Writeups
https://medium.com/@Sm9l/what-i-learnt-from-reading-126-information-disclosure-writeups-d896c5d5a2a4

DON’T sell your old laptops
https://ethr.me/dont-sell-your-old-laptops-2589fc97277e

Best DevOps tool in Demand 2022
https://blog.devgenius.io/best-devops-tool-in-demand-2022-6e902b64c434

Why Vim is better than VSCode
https://sean-warman.medium.com/why-vim-is-better-than-vscode-d09e2355eb37

How I “HACKED” my college site
https://a-rshukla.medium.com/how-i-hacked-my-college-site-5b759bbb04dc

Researchers Disclose Critical Flaws in Industrial Access Control System from Carrier
https://thehackernews.com/2022/06/researchers-disclose-critical-flaws-in.html

Be Proactive! Shift Security Validation Left
https://thehackernews.com/2022/06/be-proactive-shift-security-validation.html

F.商業
Google保護軟體供應鏈、倡議零信任並改善安全性作業
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9890

Palo Alto Networks：零信任加 SASE助金融機構面對資安挑戰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9887

Sophos最新行業調查報告《2022 年醫療保健行業勒索軟體現況》 2021 年勒索軟體對醫療機構的攻擊增加94%
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9892

Check Point Software推出反勒索軟體中心
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000636810_TCX7KJ9Z296G75L0WF729

是方兩路並進邁向東亞數位匯流中心
https://wantrich.chinatimes.com/news/20220608900054-420301

Fortinet 新產品 FortiNDR 以人工智慧偵測並回應威脅攻擊
https://ctee.com.tw/industrynews/automation/656491.html

攜手三竹資訊東聯化學引進CoLine南北跨區協作效率增
https://www.1111.com.tw/news/jobns/145967

以Trend Micro One全方位網路資安平台為中樞強化資安風險應變治理
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=50&id=0000636934_LQYLV4A521OMB45TFJTV0

Hewlett Packard Enterprise為中華開發金控提供雲端轉型建議
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9902

思科打造Cisco Security Cloud開放的安全雲端平台
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9901

突破網路限制、保障線上安全 NordVPN 6大特點介紹
https://www.storm.mg/stylish/4370374

A10 Networks：零信任、雲端和遠距工作加速企業數位化
https://n.yam.com/Article/20220610561486

DOE與Dragos多重合作推出關鍵基礎設施資安集體防禦平台
https://iknow.stpi.narl.org.tw/Post/Read.aspx?PostID=19242

Mlytics推Origin Shield解決方案保障客戶雲端資產
https://turnnewsapp.com/livenews/finance/@@www.chinatimes.com--realtimenews--20220605000947-260410

G.政府
金管會通過修正草案，上市櫃企業設立資安長成為當務之急
https://news.sina.com.tw/article/20220610/42004328.html

新北被爆「演給恩恩爸看」資安專家痛批：離譜劇本！
https://news.ltn.com.tw/news/society/breakingnews/3953132

換發身分證拒載父母姓名獲部分勝訴內政部：將提上訴
https://www.youtube.com/watch?v=MNcc3RA6rOY

台灣身分證「雙親+配偶欄」　外國人：揭露過多資訊
https://www.setn.com/News.aspx?NewsID=1128578

國海院與內政部地政司攜手合作加速完備我國海域基礎調查
https://times.hinet.net/news/23960371

宣戰選舉假訊息調查局資安站首派秘書、17人異動
https://news.ltn.com.tw/news/society/breakingnews/3956343

疾管署出包！全台竟「22815人」染疫亡莊人祥急回
https://reurl.cc/55EWy7

前幕僚揭11組IP疑北市養網軍資訊局：北市僅用4組
https://www.cna.com.tw/news/aloc/202206050135.aspx

柯文哲前幕僚指北市府11組IP疑養網軍　資訊局：錯誤訊息
https://www.ftvnews.com.tw/news/detail/2022605W0156

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
TXOne Networks 發表全新EdgeIPS Pro 216 聚焦中小型製造業
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9885

戴爾科技集團擴展多雲體驗，橫跨Cyber Recovery、數據分析及合作夥伴生態系
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9893

VMware 協助全球雲端服務廠商滿足客戶的主權雲服務需求
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9895

New Privacy Framework for IoT Devices Gives Users Control Over Data Sharing
https://thehackernews.com/2022/06/new-privacy-framework-for-iot-devices.html

宇瞻、華碩雲端合推工控資安方案封裝廠測試過關
http://www.ksnews.com.tw/index.php/news/contents_page/0001614817

新工作型態興旺資安產業 ——兼論工業電腦廠廣積
https://www.businesstoday.com.tw/article/category/183025/post/202206080043/

華碩建構OT資安工控鞏固智慧製造防護網
https://stock.pchome.com.tw/news/cat8/20220607/65460613034607224003.html

物聯網所面臨的資安威脅
https://blog.twnic.tw/2022/06/10/23311/

I.教育訓練
物聯網時代的15堂資安基礎必修課 (Practical Iot Hacking: The Definitive Guide to Attacking the Internet of Things)
https://www.tenlong.com.tw/products/9786263241756?list_name=p-r-zh_tw

中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

資安學習路上-滲透測試實務4
https://www.potatomedia.co/post/4191e744-64f3-4d33-af69-e3591adc2ed0

6.近期資安活動及研討會
醫療資安女力論壇 2022/6/11
https://isipevent.kktix.cc/events/e58d0573-copy-1

科技力x內容力 5G Craft 菁英挑戰賽號召各路英雄 2022/6/15
https://tomorrowsci.com/technology/20225g0526/

經濟部工業局沙崙資安服務基地 - 智慧製造的痛-駭客攻擊與勒索軟體威脅 2022/6/16
https://www.cisanet.org.tw/Course/Detail/2836

【滲透與入侵 - 供應鏈資安威脅】資安跨域交流活動 2022/6/20
https://www.tca.org.tw/exhibit_info1.php?n=1716

經濟部工業局沙崙資安服務基地 - 日誌大數據分析實戰 2022/6/23
https://bit.ly/3sJWjmp

資訊安全管理(週日班) 2022/7/3 ~ 2022/8/28
https://mymcu.mcu.edu.tw/zh-hant/product/e022205151

創科資訊②⓪②②軟體開發實戰訓練營➠線上實習說明會 2022/7/6
https://trunk-studio.kktix.cc/events/monosparta-code-camp-2022-9

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/5/30 ~ 2022/6/3

noreply@blogger.com (Unknown) — Sat, 04 Jun 2022 11:20:00 +0000

資安事件新聞週報 2022/5/30 ~ 2022/6/3

1.重大弱點漏洞/後門/Exploit/Zero Day
逾360萬臺MySQL伺服器曝露於網際網路，恐成為攻擊目標
https://www.shadowserver.org/news/over-3-6m-exposed-mysql-servers-on-ipv4-and-ipv6/

Microsoft 已發布安全更新，以解決服務診斷工具（MSDT）中的弱點
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190

Windows搜尋通訊協定存在零時差漏洞
https://www.bleepingcomputer.com/news/security/new-windows-search-zero-day-added-to-microsoft-protocol-nightmare/

Office零時差漏洞讓駭客執行惡意指令，關閉巨集也不見得擋得了
https://www.ithome.com.tw/news/151211

研究人員揭露Office零時差漏洞，駭客可藉由RTF檔案觸發
https://www.bleepingcomputer.com/news/security/new-microsoft-office-zero-day-used-in-attacks-to-execute-powershell/

中共國TA413 APT駭客組織正在利用微軟Follina漏洞進行瘋狂攻擊
https://gnews.org/zh-hant/2655908/

CVE-2022-30190: Microsoft Support Diagnostic Tool (MSDT) RCE Vulnerability “Follina”
https://www.fortinet.com/blog/threat-research/analysis-of-follina-zero-day

Follina — a Microsoft Office code execution vulnerability
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

Windows 11、Server 2022功能更新恐導致部分趨勢端點防護軟體功能失常
https://success.trendmicro.com/dcx/s/solution/000291066

Watch Out! Researchers Spot New Microsoft Office Zero-Day Exploit in the Wild
https://thehackernews.com/2022/05/watch-out-researchers-spot-new.html

Zero-Day Exploitation of Atlassian Confluence
https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/

Microsoft Releases Workarounds for Office Vulnerability Under Active Exploitation
https://thehackernews.com/2022/05/microsoft-releases-workarounds-for.html

Analyzing AsyncRAT distributed in Colombia
https://jstnk9.github.io/jstnk9/research/AsyncRAT-Analysis/

VMware identity_manager 多款產品存在授權問題弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22972
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22973

Security Bulletin: IBM QRadar Data Synchronization App for
IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (2022.05.31)
https://www.ibm.com/support/pages/node/6590981?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Citrix 發布多個產品的安全更新
https://support.citrix.com/article/CTX457048

Hackers Exploiting Unpatched Critical Atlassian Confluence Zero-Day Vulnerability
https://thehackernews.com/2022/06/hackers-exploiting-unpatched-critical.html

Critical 'Pantsdown' BMC Vulnerability Affects QCT Servers Used in Data Centers
https://thehackernews.com/2022/05/critical-pantsdown-bmc-vulnerability.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
全球民調／泰國數位科技盛行　78%民眾會使用數位金融、38%覺得科技使人迷茫
https://reurl.cc/QLNm7o

6月股東會旺季到集保設戰情室掌握視訊連線狀況
https://news.cnyes.com/news/id/4881335

臨櫃改採預約制！國泰世華銀鎖定4大業務　即日啟動
https://finance.ettoday.net/news/2263798

3.電子支付/行動支付/pay/資安
電子支付從街口、一卡通Money雙雄走向百家爭鳴！重點玩家版圖一次看
https://www.bnext.com.tw/article/69561/2022-taiwans-e-payment-web-only-banking-industry-map

LINE Pay從電子支付App走向金融平台！最新改版有這三大亮點
https://www.techbang.com/posts/96568-line-pay-from-electronic-payment-app-to-financial-platform-the

鈔票變薄用「嗶」較不痛？ Q1電子支付交易額年增21.3%
https://udn.com/news/story/7239/6357120

梅驊出任街口電子支付董事長
https://reurl.cc/6ZXeLb

央行預告修正「電子支付機構管理條例」
https://www.chinatimes.com/realtimenews/20220602005023-260410?chdtv

FinTech基金可長抱
https://fund.udn.com/fund/story/5858/6357737

手機感應收款服務「Mobile Tap」登場　全港數百輛的士亦可用
https://reurl.cc/ErYaX0

數位經濟來臨，你Pay了沒？法人：數位支付服務產業，將引爆下一個科技大趨勢
https://www.storm.mg/stylish/4362400

碰一下就付款，蘋果訪客中心開始接受 Tap To Pay
https://technews.tw/2022/05/17/tap-to-pay/

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Terra 2.0 — LUNA Airdrop Calculation Logic
https://medium.com/terra-money/terra-2-0-luna-airdrop-calculation-logic-3eb752c25837

炸傷幣圈的Terra穩定幣　20%利息為何變「龐氏騙局」
https://www.cw.com.tw/article/5121383

幣圈不怕暴跌、詐騙，就怕交易所被盜！這家曾遭駭失血，為何反而吸引更多用戶
https://www.storm.mg/lifestyle/4359372

安全公司：年初至今Web3由駭客攻擊等造成的損失約17.6億美元
https://news.cnyes.com/news/id/4882566

針對Bitfinex被盜案中涉嫌加密洗錢夫婦的聽證會將被推遲至8月2日
https://news.cnyes.com/news/id/4883021

Moonbeam和Moonriver通過緊急升級已解決白帽駭客披露的安全問題
https://news.cnyes.com/news/id/4882601

加密貨幣採礦蓬勃衝擊德州電網
https://www.worldjournal.com/wj/story/121279/6358640

Balancer現已上線Optimism
https://news.cnyes.com/news/id/4883822

穩定幣協議Beanstalk將於6月6日啟動籌款活動以挽回駭客攻擊損失
https://news.cnyes.com/news/id/4883886

CertiK爆 : 微軟 Office 有零時差漏洞！可駭入 Metamask、建議改用冷錢包
https://www.blocktempo.com/because-office-bug-certik-warns-crypto-users-are-among-the-most-at-risk/

CertiK：微軟高危零日漏洞可執行任意代碼，建議用戶使用硬體錢包
https://news.cnyes.com/news/id/4883952

Terra 2.0 — LUNA Airdrop
https://medium.com/terra-money/terra-2-0-luna-airdrop-cd08a6d9cfcd

What is Web3.0 — A Deep dive, beginner level explanation of Web3.0 and Dapps
https://medium.com/coinmonks/what-is-web3-0-a-deep-dive-beginner-level-explanation-of-web3-0-and-dapps-2f372efd69ef

Web3 新創資安「才剛起步」！區塊鏈中隱含了哪些資安危機
https://buzzorange.com/techorange/2022/05/30/web3-security/

女研究員在元宇宙遭性侵　網絡人身安全議題惹關注
https://www.pcmarket.com.hk/womans-avatar-has-been-sexually-assaulted-in-the-metaverse/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
BazarBackdoor 惡意軟體經由CSV文件感染 - 該如何預防
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9868

Google 警告 Predator 間諜惡意軟體，利用多個 0-day 漏洞感染 Android 裝置
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9876

全球勒索軟體攻擊次數年增 14%，Check Point Software 推出反勒索軟體中心
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9881

WannaCry 爆發 5 周年勒索軟體攻擊更猖狂！不只鎖定單一企業，連供應鏈夥伴、客戶都要一起拉下水
https://buzzorange.com/techorange/2022/06/01/ransomware-2022/

哥斯大黎加衛生機關遭勒索軟體Hive攻擊
https://www.bleepingcomputer.com/news/security/costa-rica-s-public-health-agency-hit-by-hive-ransomware/

逾4.7萬個惡意WordPress外掛程式出現於2.4萬個網站
https://www.usenix.org/conference/usenixsecurity22/presentation/kasturi

1,200個Elasticsearch資料庫遭到勒索
https://www.secureworks.com/blog/unsecured-elasticsearch-data-replaced-with-ransom-note

勒索軟體LockBit聲稱竊得富士康墨西哥工廠資料
https://www.securityweek.com/ransomware-group-claims-have-breached-foxconn-factory

鴻海墨西哥廠遭駭要求11日前支付贖款
https://ctee.com.tw/news/tech/654161.html

鴻海墨西哥廠遭勒索病毒攻擊營運漸恢復影響不大
https://money.udn.com/money/story/5599/6362378?from=edn_newest_index

墨西哥廠遭勒索病毒攻擊鴻海：產能可調整因應
https://ec.ltn.com.tw/article/breakingnews/3948989

安卓惡意軟體FluBot遭到歐美執法單位圍剿
https://www.bleepingcomputer.com/news/security/flubot-android-malware-operation-shutdown-by-law-enforcement/

惡意軟體EnemyBot針對VMware、F5 BIG-IP重大漏洞下手
https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers

駭客鎖定視窗作業系統的WSL元件，散布Linux惡意軟體
https://blog.lumen.com/windows-subsystem-for-linux-wsl-threats/

勒索軟體駭客REvil疑發動DDoS攻擊
https://www.akamai.com/blog/security/revil-resurgence-or-copycat

勒索軟體Clop疑捲土重來，1個月出現21個受害組織
https://newsroom.nccgroup.com/news/ncc-group-monthly-threat-pulse-april-2022-448500

賽門鐵克提示Clipminer加密劫持惡意軟體風險：駭客至少已賺取170萬美元
https://news.cnyes.com/news/id/4884024

新種 Linux 勒贖軟體 Cheers，鎖定 VMware ESXi 伺服器發動攻擊
https://www.twcert.org.tw/tw/cp-104-6181-cdeb1-1.html

Popping Eagle: How Global Analytics Uncovered a Stealthy Threat Actor
https://unit42.paloaltonetworks.com/popping-eagle-malware/

Threat Actors Prey on Eager Travelers
https://www.fortinet.com/blog/threat-research/threat-actors-prey-on-eager-travelers

WinDealer dealing on the side
https://securelist.com/windealer-dealing-on-the-side/105946/

Clipminer Botnet Makes Operators at Least $1.7 Million
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

OPERATION DARKCASINO: IN-DEPTH ANALYSIS OF RECENT ATTACKS BY APT GROUP EVILNUM
http://blog.nsfocus.net/darkcasino-apt-evilnum/

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage
https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/

InfoSec Handlers Diary Blog - SANS Internet Storm Center
https://isc.sans.edu/diary/rss/28698

Hazard Token Grabber
https://blog.cyble.com/2022/06/01/hazard-token-grabber/?utm_source=Social&utm_medium=Twitter&utm_campaign=Stealer&utm_id=Stealer

Distributing AppleSeed disguised as Internet router installation file
https://asec.ahnlab.com/ko/34883/

OceanLotus Indicators - May'22
https://twitter.com/BaoshengbinCumt/status/1531167884273414145

Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network
https://thehackernews.com/2022/06/researchers-uncover-malware-controlling.html

Conti Leaks Reveal Ransomware Gang's Interest in Firmware-based Attacks
https://thehackernews.com/2022/06/conti-leaks-reveal-ransomware-gangs.html

Researchers Demonstrate Ransomware for IoT Devices That Targets IT and OT Networks
https://thehackernews.com/2022/06/researchers-demonstrate-ransomware-for.html

YODA Tool Found ~47,000 Malicious WordPress Plugins Installed in Over 24,000 Sites
https://thehackernews.com/2022/06/yoda-tool-found-47000-malicious.html

New XLoader Botnet Version Using Probability Theory to Hide its C&C Servers
https://thehackernews.com/2022/06/new-xloader-botnet-version-using.html

Latest Mobile Malware Report Suggests On-Device Fraud is on the Rise
https://thehackernews.com/2022/05/latest-mobile-malware-report-suggests.html

Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks
https://thehackernews.com/2022/05/interpol-nabs-3-nigerian-scammers.html

EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities
https://thehackernews.com/2022/05/enemybot-linux-botnet-now-exploits-web.html

New 'GoodWill' Ransomware Forces Victims to Donate Money and Clothes to the Poor
https://thehackernews.com/2022/05/new-goodwill-ransomware-forces-victims.html

The Myths of Ransomware Attacks and How To Mitigate Risk
https://thehackernews.com/2022/05/the-myths-of-ransomware-attacks-and-how.html

Experts Warn of Rise in ChromeLoader Malware Hijacking Users' Browsers
https://thehackernews.com/2022/05/experts-warn-of-rise-in-chromeloader.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Apple Watch Series 8 Will Be Revolutionary
https://medium.com/macoclock/apple-watch-series-8-will-be-revolutionary-f3eda693596a

美國新法擬要求iPhone「開放側載」庫克怒了：乾脆去用安卓手機啊！
https://udn.com/news/story/7098/6351579

蘋果申請realityOS新專利！AR/VR頭戴裝置有望在開發大會亮相
https://newtalk.tw/news/view/2022-05-30/762627

美民主黨議員 Apple 應開放第三方應用商店　Tim Cook 反駁 : 直接去用 Android 手機吧
https://www.pcmarket.com.hk/u-s-democrats-apple-should-open-up-third-party-app-stores/

安卓惡意軟體Ermac 2.0假冒餐點外送平臺App，竊取467個軟體帳密
https://www.bleepingcomputer.com/news/security/new-ermac-20-android-malware-steals-accounts-wallets-from-467-apps/

安卓手機又被攻擊！駭客在467個APP中竊取重要個資
https://today.line.me/tw/v2/article/QwVL2yG

微軟新發現一個 Android 漏洞，展示如何將預裝系統應用程式作為攻擊媒介
https://www.kocpc.com.tw/archives/443564

駭客濫用Telegram匿名部落格服務進行網釣攻擊
https://www.inky.com/en/blog/fresh-phish-phishers-take-advantage-of-telegraphs-loose-governance

行動應用程式框架存在嚴重漏洞，兩大平臺手機恐曝險
https://www.microsoft.com/security/blog/2022/05/27/android-apps-with-millions-of-downloads-exposed-to-high-severity-vulnerabilities/

Messenger 服務「通話」功能成為獨立分頁用戶使用更方便先針對 Android 平台 App 調整
https://www.cool3c.com/article/178041

加州真實身分證進展緩手機行動ID試行
https://reurl.cc/o1mXgj

Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones
https://thehackernews.com/2022/06/critical-unisoc-chip-vulnerability.html

SideWinder Hackers Use Fake Android VPN Apps to Target Pakistani Entities
https://thehackernews.com/2022/06/sidewinder-hackers-use-fake-android-vpn.html

FluBot Android Spyware Taken Down in Global Law Enforcement Operation
https://thehackernews.com/2022/06/flubot-android-spyware-taken-down-by.html

Is 3rd Party App Access the New Executable File
https://thehackernews.com/2022/05/is-3rd-party-app-access-new-executable.html

Attackers Can Use Electromagnetic Signals to Control Touchscreens Remotely
https://thehackernews.com/2022/05/attackers-can-use-electromagnetic.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
臺灣聯隊DEF CON CTF搶旗賽線上初賽獲第二名，八月進軍賭城實體較勁
https://www.ithome.com.tw/news/151209

三立2離職員工扮駭客入侵影音平台刪資料下場曝光
https://www.chinatimes.com/realtimenews/20220531003602-260402?chdtv

三立雲端付費影音被刪光　竟是離職工程師聯手幹的！賠110萬下場出爐
https://www.appledaily.com.tw/local/20220601/AU4H2YWNDNGZZANBMKC4MMHCSE/

資安月報揭露機關電子郵件密碼「鍵盤排序」易遭駭客破解
https://m.match.net.tw/pc/news/politics/20220604/6585168

「點我免費獲得 $ 150 元手搖飲」駭客如何得知你愛喝飲料，還精心為你客製化誘餌
https://buzzorange.com/techorange/2022/05/30/why-information-security-is-important/

義大利受駭客攻擊威脅惟短缺10萬名網路資安專家
https://reurl.cc/9G00mO

巴西里約機場受駭螢幕播起色情片網嘲「有很多人要錯過飛機」
https://www.worldjournal.com/wj/story/121261/6353785

開綠燈！白宮：任何對俄網攻都不算直接介入戰爭
https://news.ltn.com.tw/news/world/breakingnews/3947382

美國波士頓兒童醫院去年險遭伊朗駭客網攻 FBI解危
https://reurl.cc/9G0xpv

美國連日表態對台灣支持　軍事專家：習近平也會顧慮這點
https://www.setn.com/News.aspx?NewsID=1124222

美國共和黨推新法案！禁止蘋果及Google以數位人民幣交易
https://newtalk.tw/news/view/2022-05-30/762779

美國承認軍方駭客駭進俄羅斯以支援烏克蘭
https://www.ithome.com.tw/news/151281

美國｢對俄作戰｣支援烏克蘭!美軍上將證實：手段是戰略性地說出真相
https://times.hinet.net/news/23949458

美國FBI局長揭露中共網攻內幕關注台海安全
https://reurl.cc/k19krd

美國FBI局長談網路戰　指中國正研究俄烏戰事以強化攻台阻美能力
https://www.ftvnews.com.tw/news/detail/2022602W0017

美：中共研究俄烏戰模擬侵臺
https://reurl.cc/0pkQ99

立志走向全球的大陸網路安全公司罕見披露美國國安局駭客攻擊細節
https://money.udn.com/money/story/122381/6355268?from=edn_bloomberg_index_side

聯合國特使訪中BBC揭「新疆警察文件」德拒為福斯投資陸擔保
https://reurl.cc/lonnAl

新疆警察文件流出網紅怒批中共：血債得還
https://reurl.cc/3oyylX

新疆警察文件流出！網紅秀上千「犯人照」　怒批洪秀柱為中共洗白
https://www.ftvnews.com.tw/video/detail/YbxNtRIfuU4

聯合國人權專員17年首訪惹議　中國要對新疆議題做兩個準備原文網址: 聯合國人權專員17年首訪惹議　中國要對新疆議題做兩個準備 | 香港01 https://www.hk01.com/sns/article/776544
https://reurl.cc/3oyR5V

中國駭客假冒藏人政府機構，利用Office零時差漏洞Follina發動攻擊
https://www.bleepingcomputer.com/news/security/windows-msdt-zero-day-now-exploited-by-chinese-apt-hackers/

護網安即護國安　香港立法擬年底諮詢
https://www.wenweipo.com/a/202206/02/AP6297fb5ee4b033218a4fe30e.html

經濟學人：中國情報常突槌對台工作易誤判
https://ec.ltn.com.tw/article/breakingnews/3947987

美國「前進防禦」網路戰略落實與變革
https://indsr.org.tw/focuslist?uid=3&typeId=18

Karakurt Data Extortion Group
https://www.cisa.gov/uscert/ncas/alerts/aa22-152a

Homeland Security Agent Reveals UAP Encounters and Video
https://medium.com/on-the-trail-of-the-saucers/homeland-security-agents-reveal-uap-encounters-and-video-ab7ec73273a6

Chinese LuoYu Hackers Using Man-on-the-Side Attacks to Deploy WinDealer Backdoor
https://thehackernews.com/2022/06/chinese-luoyu-hackers-using-man-on-side.html

Chinese Hackers Begin Exploiting Latest Microsoft Office Zero-Day Vulnerability
https://thehackernews.com/2022/05/chinese-hackers-begin-exploiting-latest.html

Microsoft Blocks Iran-linked Lebanese Hackers Targeting Israeli Companies
https://thehackernews.com/2022/06/microsoft-blocks-iran-linked-lebanese.html

ExpressVPN Removes Servers in India After Refusing to Comply with Government Order
https://thehackernews.com/2022/06/expressvpn-removes-servers-in-india.html

SideWinder Hackers Launched Over a 1,000 Cyber Attacks Over the Past 2 Years
https://thehackernews.com/2022/05/sidewinder-hackers-launched-over-1000.html

FBI Warns About Hackers Selling VPN Credentials for U.S. College Networks
https://thehackernews.com/2022/05/fbi-warns-about-hackers-selling-vpn.html

台資安人口現缺口，DEVCORE 將擴大開啟資安人才培育計畫
https://technews.tw/2022/06/01/devcore-security/

挖掘直播人才 17LIVE攜手國發會開辦技術大賽
https://www.cna.com.tw/news/ait/202206010104.aspx

新手網路資安工程師
https://www.518.com.tw/job-yERA6Z.html

【資安所】系統分析規劃師
https://www.104.com.tw/job/7nfoh

資安網路工程師
https://www.518.com.tw/job-yYDaK3.html

資深網路管理/資安管理工程師
https://www.104.com.tw/job/7nguj

【諮詢服務】資安架構/技術顧問 - Staff Level
https://reurl.cc/GxgDoZ

業務代表 - 資安網路系統 (新竹)
https://www.518.com.tw/job-GxzAlx.html

元大金控萬人海選計畫-資安工程師
https://www.cakeresume.com/companies/yuanta-tw/jobs/616a66?locale=vi

矽品擴大徵才薪上看70K　多元招募履歷投起來
https://www.1111.com.tw/news/jobns/145851

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC – Part II
https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware-part-two

實錄片！新手媽接詐騙電話開啟「玩弄模式」　給假帳號對方瞬間爆走
https://www.ftvnews.com.tw/news/detail/2022531W0151

逾千萬用戶的Chrome視訊共享外掛程式Screencastify恐曝露用戶隱私
https://palant.info/2022/05/23/hijacking-webcams-with-screencastify/

帶你洞悉世界級駭客的思維！如何在隱私權成奢侈品的時代，拿下這樁勝利
https://buzzorange.com/techorange/2022/06/01/hoozbook-the-art-of-invisibility/

英國食物銀行遭網釣攻擊
https://blog.malwarebytes.com/scams/2022/05/double-whammy-attack-follows-fake-covid-alert-with-a-bogus-bank-call/

土耳其航空公司因AWS儲存桶配置不當，曝露6.5 TB內部資料
https://www.safetydetectives.com/news/pegasus-leak-report/

不明簡訊別亂點飆股老師「攏係假」中市警提供辨別假網址小撇步
https://www.appledaily.com.tw/local/20220602/DA33FKDOAFAAXHXFMWO4BKC7EU/

【借鏡烏俄戰爭的3堂必修課】從茫然失措到善用科技反擊烏克蘭對俄羅斯的假訊息抗戰之路
https://tfc-taiwan.org.tw/articles/7628

網傳南部車站4千確診警:惡意散布假消息
https://news.cts.com.tw/cts/local/202205/202205302081434.html

檢調鎖定農場文！5大熱門粉專疑中國管理員
https://www.setn.com/News.aspx?NewsID=1123533

警查25內容農場　遭爆亂源來自馬國大榴槤網站
https://www.setn.com/News.aspx?NewsID=1123754

網路用戶可以要求從 Google 搜索結果中刪除他們的個人資料
https://blog.twnic.tw/2022/06/03/23152/

疑個資洩！友收到訂購蛋糕遭詐噴13萬
https://news.ebc.net.tw/news/society/320406

E.研究報告/工具
什麼是入侵分析鑽石模型? 對資安防禦的重要性是
https://teamt5.org/tw/posts/what-is-diamond-model-of-intrusion-analysis/

Fetch API 沒有傳送 cookies
https://reurl.cc/A7X9z8

為什麼身分安全應該成為零信任架構策略的核心
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9884

加密新技術 PGPP 能打破「有方便沒安全」的資安難題嗎
https://buzzorange.com/techorange/2022/05/31/pretty-good-phone-privacy-pgpp/

駭客攻擊了解多少，你不可不知的社交工程
https://open.firstory.me/story/cl3tr0ef4084e0109fo7fepep

駭客後滲透基礎 – 將檔案從Linux傳輸至Windows常見方法 | File Transfer for Windows
https://hackercat.org/pentesting/how-to-transfer-file-from-linux-to-windows

翻滾吧！駭客女孩
https://vocus.cc/girlsletscode/tagTab/5d3edc75fd897800013acc8a

網軍跟駭客是一樣的嗎
https://www.pttweb.cc/bbs/Gossiping/M.1654224653.A.906

請君入甕假造可攻擊目標　反客為主積極守護資訊安全設蜜罐陷阱引誘駭客上鉤　藉Shodan現形入侵手法
https://www.netadmin.com.tw/netadmin/zh-tw/technology/E092AD9FA72044BD9AB0FA0279F7CAE0

Analysis of SideWinder's new infrastructure and tool that narrows their reach to Pakistan
https://blog.group-ib.com/sidewinder-antibot

ViewModel: One-off event antipatterns
https://medium.com/androiddevelopers/viewmodel-one-off-event-antipatterns-16a1da869b95

SQL Injection in Harvard’s Subdomain
https://medium.com/pentesternepal/sql-injection-in-harvards-subdomain-c3148f8be156

Create an Interactive Web App with PyScript and Pandas
https://towardsdatascience.com/create-an-interactive-web-app-with-pyscript-and-pandas-3918ad2dada1

Micro Apps in Flutter, does it make sense
https://medium.com/bancolombia-tech/micro-apps-in-flutter-does-it-makes-sense-d86cd0838b47

10 JavaScript hacks that developers should know
https://medium.com/xtechportugal/10-javascript-hacks-that-developers-should-know-40657b8be180

Building a Threat Intelligence Feed using the Twitter API and a bit of code
https://grimminck.medium.com/building-a-threat-intelligence-feed-using-the-twitter-api-and-a-bit-of-code-5787808e32ef

VulnHub: DeathNote: 1
https://al1z4deh.medium.com/vulnhub-deathnote-1-f81b0794bea2

Learning Python
https://selinyazicioglu99.medium.com/learning-python-905c9070553d

Learning Python 3
https://selinyazicioglu99.medium.com/learning-python-3-e02360697358

How Git truly works
https://towardsdatascience.com/how-git-truly-works-cd9c375966f6

100% Accurate Forecaster Tells Us Where Bitcoin is Headed
https://scottdebevic.medium.com/100-accurate-forecaster-tells-us-where-bitcoin-is-headed-7a8333695a0a

CSS: Absolutely positioning things relatively
https://canvatechblog.com/css-absolutely-positioning-things-relatively-964898de886b

“Stop” using state management libraries
https://medium.com/flutter-community/stop-using-state-management-libraries-48a81ed7979d

Reset the Password for Vulnerability
https://medium.com/@sathvika03/reset-the-password-for-vulnerability-b0805f7adf9c

Determining Bull & Bear Market Trends Programmatically (Python)
https://medium.com/@chris_42047/determining-bull-bear-market-trends-programmatically-python-e68f1ec18f28

Spring Cloud Stream Application for Google Cloud Storage
https://paras301.medium.com/spring-cloud-stream-application-for-google-cloud-storage-631abd30ac9f

Methods to Bypass two-factor Authentication
https://infosecwriteups.com/methods-to-bypass-two-factor-authentication-bc2bd35bd44e

Check and locate phone number in OSINT
https://medium.com/@ibederov_en/check-and-locate-phone-number-in-osint-8beb8af50d5e

Witness the power of Intel® iGPU with Azure IoT Edge for Linux on Windows(EFLOW) & OpenVINO™ Toolkit
https://medium.com/openvino-toolkit/witness-the-power-of-intel-igpu-with-azure-iot-edge-for-linux-on-windows-eflow-openvino-f1520d60b19e

F.商業
Fortinet攜手中華資安國際提供零信任安全驅動網路服務
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9877

博通將以約 610 億美元的現金和股票收購 VMware
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9883

AI 技術成資安險利器，奧義智慧與日本 Digital Data Solution策略合作
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9880

DDoS攻擊日增 Mlytics助小三美日25分鐘內恢復營運
https://money.udn.com/money/story/5612/6354355?from=edn_newest_index

趨勢科技舉辦Pwn2Own 駭客大賽突破創新極限
https://www.techbang.com/posts/96650-trend-micro-announces-pwn2own-hacking-competition

Cybersixgill推威脅情資調查平臺，可橫跨深網、暗網查詢
https://times.hinet.net/topic/23949444

已知漏洞才是遭駭大宗，【TOPIA漏洞管理解決方案】協助企業有效率修補漏洞，阻止可能的資安攻擊
http://www.pcdiy.com.tw/detail/24030

資安病毒零容忍 IBM如何幫助企業更快從惡意攻擊復原
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=80&id=0000636615_ZMI7UCAC02Y00Y6VRHHSS

引進中華資安國際的SOC服務彌補資安人才不足缺口融合MDR等多項創新技術迅速回應威脅避免受駭
https://www.chtsecurity.com/news/2ebaab38-2303-4685-b94d-2095b2b4808a

大宇資跨足資安，入主安瑞-KY力拼明年開始獲利
https://reurl.cc/41Y8VX

G.政府
沙崙資安暨智慧科研專區2期動土
https://reurl.cc/55XVn7

科技部TTA南部據點攜手農食新創圈掀科技革命
https://news.sina.com.tw/article/20220602/41969802.html

數位發展部最快7月掛牌初期將分2地辦公
https://www.cna.com.tw/news/aipl/202206030063.aspx

數位發展部最快7月掛牌唐鳳積極籌備
https://news.ltn.com.tw/news/politics/breakingnews/3948543

唐鳳可望接數位發展部部長簡宏偉申請退休獲准
https://news.ltn.com.tw/news/politics/breakingnews/3948976

郵政物流中心施工進度逾九成　最快今年第四季啟用
https://news.housefun.com.tw/news/article/149520337039.html

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
Siemens SICAM P850和SICAM P855 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-29873

導入NVIDIA DGX A100專屬系統，軟硬整合加速落地雲科大 IRIS 中心助產業 AI 化　客製專案搞定場域痛點
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/C04DED349C6F49929E92B9C7B186E151

半導體的資訊安全
https://money.udn.com/money/story/5629/6355065?from=edn_maintab_cate

裝置/系統資安不輕忽　邊緣運算力助工廠智慧化
https://www.mem.com.tw/%E8%A3%9D%E7%BD%AE-%E7%B3%BB%E7%B5%B1%E8%B3%87%E5%AE%89%E4%B8%8D%E8%BC%95%E5%BF%BD%E3%80%80%E9%82%8A%E7%B7%A3%E9%81%8B%E7%AE%97%E5%8A%9B%E5%8A%A9%E5%B7%A5%E5%BB%A0%E6%99%BA%E6%85%A7%E5%8C%96/

從網路層圍堵勒索病毒威脅—Check Point
https://www.netadmin.com.tw/netadmin/zh-tw/video/094CDC5BBB854BC794B171E9F0DA4884

Zyxel Issues Patches for 4 New Flaws Affecting AP, API Controller, and Firewall Devices
https://thehackernews.com/2022/05/zyxel-issues-patches-for-4-new-flaws.html

農業機械遭駭會甩態停擺？食品商雙手奉上鉅額贖金，糧食危機再添一擊
https://buzzorange.com/techorange/2022/05/30/cyber-security-agricultural/

I.教育訓練
物聯網時代的15堂資安基礎必修課 (Practical Iot Hacking: The Definitive Guide to Attacking the Internet of Things)
https://www.tenlong.com.tw/products/9786263241756?list_name=p-r-zh_tw

中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

資安學習路上-滲透測試實務4
https://www.potatomedia.co/post/4191e744-64f3-4d33-af69-e3591adc2ed0

6.近期資安活動及研討會
駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

HITCON FreeTalk 2022 - 烏俄網路戰 & CTF 經驗分享 2022/6/6
https://hitcon.kktix.cc/events/hitcon-freetalk-2022

經濟部工業局沙崙資安服務基地 - 手把手帶你玩資安攻防 2022/6/9
https://bit.ly/38t2aWp

經濟部工業局沙崙資安服務基地 - 新世代資安防禦-網路威脅與防禦趨勢 2022/6/9
https://www.accupass.com/event/2205240207565477386890

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

醫療資安女力論壇 2022/6/11
https://isipevent.kktix.cc/events/e58d0573-copy-1

科技力x內容力 5G Craft 菁英挑戰賽號召各路英雄 2022/6/15
https://tomorrowsci.com/technology/20225g0526/

經濟部工業局沙崙資安服務基地 - 智慧製造的痛-駭客攻擊與勒索軟體威脅 2022/6/16
https://www.cisanet.org.tw/Course/Detail/2836

經濟部工業局沙崙資安服務基地 - 日誌大數據分析實戰 2022/6/23
https://bit.ly/3sJWjmp

資訊安全管理(週日班) 2022/7/3 ~ 2022/8/28
https://mymcu.mcu.edu.tw/zh-hant/product/e022205151

創科資訊②⓪②②軟體開發實戰訓練營➠線上實習說明會 2022/7/6
https://trunk-studio.kktix.cc/events/monosparta-code-camp-2022-9

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/5/23 ~ 2022/5/27

noreply@blogger.com (Unknown) — Fri, 27 May 2022 11:19:00 +0000

資安事件新聞週報 2022/5/23 ~ 2022/5/27

1.重大弱點漏洞/後門/Exploit/Zero Day
Critical 'Pantsdown' BMC Vulnerability Affects QCT Servers Used in Data Centers
https://thehackernews.com/2022/05/critical-pantsdown-bmc-vulnerability.html

雲達修補存在3年的伺服器BMC韌體漏洞Pantsdown
https://eclypsium.com/2022/05/26/quanta-servers-still-vulnerable-to-pantsdown/

Google：Cytrox開採5個零時差漏洞以植入Predator間諜程式
https://www.ithome.com.tw/news/151066

思科修補的IOS XR路由器作業系統軟體零時差漏洞，已出現攻擊行動
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK

Zyxel修補防火牆、無線基地臺、AP控制器漏洞
https://www.zyxel.com/tw/zh/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml

VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)
https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/

Security bulletin: Security Bulletin: Node.js as used by IBM Security QRadar Analyst Workflow App
for IBM QRadar SIEM is vulnerable to multiple vulnerabilities
https://www.ibm.com/support/pages/node/6589581?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security bulletin: Security Bulletin: IBM QRadar Deployment Intelligence app for
IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
https://www.ibm.com/support/pages/node/6589583?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

IBM QRadar SIEM and Apache log4j version 1 usage
https://www.ibm.com/support/pages/node/6561889?myns=swgother&mynp=OCSSBQAC&mynp=OCSSKMKU&mync=E&cm_sp=swgother-_-OCSSBQAC-OCSSKMKU-_-E

Tails OS Users Advised Not to Use Tor Browser Until Critical Firefox Bugs are Patched
https://thehackernews.com/2022/05/tails-os-users-advised-not-to-use-tor.html

「火狐」用戶注意！Firefox 推出緊急更新修漏洞
https://3c.ltn.com.tw/news/49299

Mozilla 修復於 Pwn2Own 大賽中遭發現的 Firefox、Thunderbird 0-day 漏洞
https://www.twcert.org.tw/tw/cp-104-6167-fe6b8-1.html

Firefox修補惡意JavaScript執行的重大漏洞（CVE-2022-1802 、CVE-2022-1529）
https://www.klcg.gov.tw/tw/education/3522-255498.html

漏洞挖掘競賽Pwn2Own溫哥華賽事落幕，參賽者找出Windows 11、Ubuntu、特斯拉汽車漏洞
https://www.zerodayinitiative.com/blog/2022/5/18/pwn2own-vancouver-2022-the-results

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
台新人壽強化資安獲PIMS認證
https://www.smartcpa.tw/news/content/4BFDA667ED1895CFB24499EEDC0FDE4E

證券商資安作業說明
https://reurl.cc/anx40D

我見我思－防制詐騙應列入金融業ESG重要項目
https://reurl.cc/Yv301O

銀行公會理事長雷仲達呼聲高
https://wantrich.chinatimes.com/news/20220527900030-420101

每天查戶頭也被盜提未接OTP逾萬元被轉走
https://reurl.cc/OAmjv3

金控祭高薪獵人頭高階資安警爆出走潮
https://reurl.cc/vdL621

萬事達卡推臉部辨識付款安全隱憂再成話題
https://reurl.cc/7DV7XD

趁刷卡消費側錄內碼 KTV計時人員涉盜刷
https://reurl.cc/8o90Gy

一機在手輕鬆報稅列舉扣除也適用
https://times.hinet.net/news/23936836

3.電子支付/行動支付/pay/資安
New Unpatched Bug Could Let Attackers Steal Money from PayPal Users
https://thehackernews.com/2022/05/paypal-pays-hacker-200000-for.html

PayPal漏洞可被駭客用於點擊劫持攻擊，挾持用戶帳號與金錢
https://reurl.cc/ZAN9OW

台灣的支付、銀行APP要我在手機上裝防毒軟體，真有用嗎
https://www.bnext.com.tw/article/69226/appsec-mobile-security-antivirus-cell-phone-ios-android

綠色行動支付好享學元大銀攜一卡通MONEY推無現金校園
https://udn.com/news/story/7239/6342359

LINE Pay App 迎來更新！舊版 5/31 將退場，想用一卡通支付要從 LINE 錢包開啟才行
https://agirls.aotter.net/post/60761

偽卡綁Apple Pay行動支付　至咖啡連鎖門市盜刷換現金
https://www.mirrormedia.mg/story/20220518soc004/

瑞典人在台見「這現象」直呼落後網嘆：國情不同
https://fnc.ebc.net.tw/fncnews/life/150897

LINE Pay App 1.2.0 更新釋出：優化 3 大付款功能，付款體驗更佳
https://www.kocpc.com.tw/archives/442357

Pi拍錢包推出BNPL服務，最高上限五萬元！看PChome的金融科技野心
https://www.bnext.com.tw/article/69335/pi-bnpl

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
重振LUNA幣有望？Terra 2.0 新區塊鏈將上線
https://www.techbang.com/posts/96662-community-passpass-the-new-terra-blockchain-will-go-live-on

虛幣老手錢包被盜、黑客一晚拋售41顆以太幣：千祈唔好做呢個動作！
https://www.edigest.hk/353928/?utm_campaign=ED_ContentCopy&utm_source=Web-inventory&utm_medium=Content-Copy_ED

SpaceX 發射首顆加密衛星 Crypto1，Cryptosat 創辦人：駭客很難攻擊
https://technews.tw/2022/05/27/cryptosat-and-spacex-launch-first-encrypted-satellite/

嚴防駭客！SpaceX發射首顆加密貨幣衛星Crypto1
https://times.hinet.net/news/23937298

元宇宙與NFT大勢來襲淺析NFT交易風險與糾紛
https://reurl.cc/9Gn4qa

無聊猿應用爭議｜新加坡男子為借貸上法院、演員Seth Green使用版權拍節目後被盜
https://news.cnyes.com/news/id/4879661

錢包被盜了該怎麼辦
https://vocus.cc/article/6289a1a0fd89780001d45fdc

Beeple推特賬號攻擊者竊取43.8萬美元的加密貨幣和NFT
https://news.cnyes.com/news/id/4877197

DeFi駭客識別與激勵協議Lossless將於5月26日部署至Avalanche
https://news.cnyes.com/news/id/4878196?exp=a

BTC&ETH因為資金問題繼續與納指偏離流通量枯竭繼續加重
https://reurl.cc/rDY6o4

在一次駭客攻擊中29個Moonbirds NFT被盜，損失達150萬美元
https://news.cnyes.com/news/id/4878428

沒有結局的故事，MetaMask用戶遇駭損失41顆以太幣，苦思仍不知被駭原因
https://www.abmedia.io/20220526-metamask-wallets-got-hacked-and-drained

Lunaray安全團隊正式推出安全賞金服務
https://news.cnyes.com/news/id/4877710

Pizza Hut必勝客聯名設計CoolWallet Pro冷錢包組合開箱動手玩
https://zeekmagazine.com/archives/173053

三箭資本地址轉出13,435枚ETH至Bitmex
https://news.cnyes.com/news/id/4879719

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Sysrv-K 殭屍網路以 Windows、Linux 為目標
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9866

全球勒索軟體攻擊年增14%！ Check Point Software推全新反勒索軟體中心
https://reurl.cc/g2YDEV

攻擊者以提供Windows 11更新的名義散布竊密軟體Vidar
https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing

印度廉價航空SpiceJet遭勒索軟體攻擊，導致航班延誤起飛
https://www.bleepingcomputer.com/news/security/spicejet-airline-passengers-stranded-after-ransomware-attack/

史上「最奇耙」勒索軟體現蹤！開條件「解3任務」取代贖金才解鎖文件
https://3c.ltn.com.tw/news/49327

劫富濟貧？以慈善之名道德勒索被攻擊者？勒索軟體GoodWill要求受害者向貧民捐輸，以換取解密金鑰
https://cloudsek.com/threatintelligence/goodwill-ransomware-forces-victims-to-donate-to-the-poor-and-provides-financial-assistance-to-patients-in-need/

電腦中毒了怎麼辦?有何症狀?如何預防?
https://blog.trendmicro.com.tw/?p=72258

Linux勒索軟體Cheerscrypt鎖定VMware ESXi而來
https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html

後門程式BPFDoor利用Solaris漏洞取得root權限
https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/

Conti關門大吉、化身成數個新勒索軟體
https://www.ithome.com.tw/news/151058

勒索軟體Conti停止營運，駭客成立多個組織，另起爐灶
https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape

研究人員警告小心夾帶惡意Word檔的PDF
https://www.ithome.com.tw/news/151069

攻擊者利用PDF檔案散布惡意程式Snake Keylogger
https://threatresearch.ext.hp.com/pdf-malware-is-not-yet-dead/

TeamT5於亞洲黑帽安全大會發布最新研究
https://www.techbang.com/posts/96365-teamt5-releases-latest-research-at-black-hat-asia

臺灣資安業者TeamT5於黑帽大會上揭露新的中國木馬程式
https://www.blackhat.com/asia-22/briefings/schedule/#the-next-gen-plugxshadowpad-a-dive-into-the-emerging-china-nexus-modular-trojan-pangolinrat-25950

惡意PyPI套件pymafka對Windows、macOS、Linux電腦下手
https://blog.sonatype.com/new-pymafka-malicious-package-drops-cobalt-strike-on-macos-windows-linux

網路間諜公司在2021年利用5個零時差漏洞對安卓手機植入惡意軟體
https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/

別以為概念性驗證程式不會對電腦造成危害！有駭客用來散布惡意軟體
https://blog.cyble.com/2022/05/20/malware-campaign-targets-infosec-community-threat-actor-uses-fake-proof-of-concept-to-deliver-cobalt-strike-beacon/

駭客釋出惡意Windows概念性驗證攻擊程式，企圖感染資安社群
https://www.ithome.com.tw/news/151093

俄羅斯駭客Sandworm利用惡意軟體Arguepatch變種，投放作案工具
https://www.welivesecurity.com/2022/05/20/sandworm-ukraine-new-version-arguepatch-malware-loader/

鎖定Linux主機的殭屍網路病毒Mirai變種顯著增加
https://www.crowdstrike.com/blog/linux-mirai-malware-double-on-stronger-chips/

Android 系統曝零日漏洞遭駭利用散播惡意間諜軟體！Google發出警告
https://3c.ltn.com.tw/news/49283

New malware Campaign delivers Android RAT
https://blog.cyble.com/2022/05/26/new-malware-campaign-delivers-android-rat

Grandoreiro Banking Malware Resurfaces for Tax Season
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/grandoreiro-banking-malware-resurfaces-for-tax-season/

SocGholish Campaigns and Initial Access Kit
https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee

Use of Obfuscated Beacons in ‘pymafka’ Supply Chain Attack Signals a New Trend in macOS Attack TTPs
https://www.sentinelone.com/labs/use-of-obfuscated-beacons-in-pymafka-supply-chain-attack-signals-a-new-trend-in-macos-attack-ttps/

Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices
https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/

Emotet Botnet Rises Again
https://www.bitsight.com/blog/emotet-botnet-rises-again
https://github.com/bitsight-research/threat_research/blob/main/emotet/emotet.csv

ERMAC Back In Action
https://reurl.cc/n1YDoe

PDF Malware Is Not Yet Dead
https://threatresearch.ext.hp.com/pdf-malware-is-not-yet-dead/

TURLA’s new phishing-based reconnaissance campaign in Eastern Europe
https://blog.sekoia.io/turla-new-phishing-campaign-eastern-europe/

New Nokoyawa Variant Catching Up to Peers with Blatant Code Reuse
https://www.fortinet.com/blog/threat-research/nokoyawa-variant-catching-up

ctx Python Library Updated with "Extra" Features
https://isc.sans.edu/diary/rss/28678

Yashma Ransomware, Tracing the Chaos Family Tree
https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree

Spoofed Saudi Purchase Order Drops GuLoader
https://www.fortinet.com/blog/threat-research/spoofed-saudi-purchase-order-drops-guloader

Experts Warn of Rise in ChromeLoader Malware Hijacking Users' Browsers
https://thehackernews.com/2022/05/experts-warn-of-rise-in-chromeloader.html

Hackers Increasingly Using Browser Automation Frameworks for Malicious Activities
https://thehackernews.com/2022/05/hackers-increasingly-using-browser.html

Researchers Find New Malware Attacks Targeting Russian Government Entities
https://thehackernews.com/2022/05/researchers-find-new-malware-attacks.html

New Chaos Ransomware Builder Variant "Yashma" Discovered in the Wild
https://thehackernews.com/2022/05/new-chaos-ransomware-builder-variant.html

Conti Ransomware Operation Shut Down After Splitting into Smaller Groups
https://thehackernews.com/2022/05/conti-ransomware-gang-shut-down-after.html

Microsoft Warns of Web Skimmers Mimicking Google Analytics and Meta Pixel Code
https://thehackernews.com/2022/05/microsoft-warns-of-web-skimmers.html

Fronton: Russian IoT Botnet Designed to Run Social Media Disinformation Campaigns
https://thehackernews.com/2022/05/fronton-russian-iot-botnet-designed-to.html

Researchers Find Backdoor in School Management Plugin for WordPress
https://thehackernews.com/2022/05/researchers-find-backdoor-in-school.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
美國新法擬讓iPhone開放「側載」！蘋果反彈：恐危害隱私
https://reurl.cc/p1Y6V4

知道你在哪，讓我心安還是更不安？使用定位app的台灣年輕人
https://theinitium.com/article/20220526-taiwan-zenly/

Zoom修補可讓攻擊者任意傳送訊息的漏洞
https://www.ithome.com.tw/news/151131

資安疑慮美參議員擬法案禁止蘋果等應用程式接受數位人民幣支付
https://ec.ltn.com.tw/article/breakingnews/3941174

高通8+ Gen 1問世　這些手機將搭載、特色搶先看
https://www.setn.com/News.aspx?NewsID=1119780

引進低軌衛星服務中華電：2023年有希望
https://newtalk.tw/news/view/2022-05-27/761774

「電信平民化」立意甚佳　資訊安全防護萬不可輕忽製造業自建5G專網　小心資安風險隨之而來
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/1FE918FBE28845ADAEBE9F6F1154B867

手機鍵盤「預測字詞」功能完美重現助記詞，資安從業者籲清除緩存、關閉預測功能
https://news.cnyes.com/news/id/4877354

駭客利用零日漏洞攻擊安卓用戶　Google示警注意「短網址」
https://www.ettoday.net/news/20220524/2258163.htm

專偷帳密個資！Facestealer 惡意軟體挾著 200 款 App 再度圍攻 Google Play Store
https://technews.tw/2022/05/22/delete-these-android-apps-before-they-steal-your-facebook-password-and-crypto/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
SpaceX星鏈全球用戶突破40萬擬擴展服務｜財經100秒
https://reurl.cc/e3kDRQ

WEF聚焦綠能.加密.資安分析台自保關鍵
https://reurl.cc/9Gn49a

她用膠帶封電腦鏡頭保隱私一票網友認同「防駭客遠端操控」
https://udn.com/news/story/7086/6339698

零時差漏洞遭濫用數量再創新高，Mandiant認為間諜駭客、中國最常這麼做
https://reurl.cc/OAmjzX

111 家公司年底前要有CISO、資安部門！除了懂技術，資安人才需要什麼本事
https://today.line.me/tw/v2/article/9mDOomK

微博微信強制標註IP屬地意外催生灰色產業
https://reurl.cc/6ZqQNd

駭客入侵智慧農業勒索高額贖金
https://news.pchome.com.tw/living/awakening/20220522/index-16532049409819943009.html

俄羅斯駭客Killnet攻擊義大利政府多個機關的網站
https://www.infosecurity-magazine.com/news/pro-russian-hackers-italy/

俄羅斯駭客Turla對愛沙尼亞、奧地利進行偵察
https://blog.sekoia.io/turla-new-phishing-campaign-eastern-europe/

加拿大數家醫院數據庫遭駭客入侵
https://gnews.org/zh-hant/2609299/

中資收購英最大晶片廠「心好累」！英政府出大絕：交易完成一年可回溯取消
https://technews.tw/2022/05/26/nexperia-newport-wafer-fab/

這公司有做戰機雷達系統！中資收購英最大晶片廠英政府：將展開國安調查
https://newtalk.tw/news/view/2022-05-26/760739

軍工產業神祕面紗5》伊諾瓦加密晶片技術被相中意外成了美軍祕密夥伴
https://www.wealth.com.tw/articles/570d9e5c-e038-4114-8373-2e4b7c0cdfda

「提升整體作戰優勢」五角大廈攜手商用衛星公司強化情蒐
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1504304&type=vision

新成立中資公司購入安225機殘骸購買瓦良格號航母情境翻版
https://reurl.cc/NAxy9m

美國務院澄清拜登「保衛台灣」言論：台灣感謝美方重申承諾，中國舉行軍演警告美台
https://www.storm.mg/article/4351209

令人震驚檔德人權專家:撕開了北京宣傳的外衣
https://www.secretchina.com/news/b5/2022/05/27/1007498.html

駭客侵入中國政府內網，竊取「新疆警方檔案」！大量「再教育營」細節流出，學者研判「習近平知情且直接介入」
https://toutiaoqushi.com/archives/115948

新疆警察｢不需教師爺頤指氣使｣中國急安排習近平與聯合國專員對話
https://newtalk.tw/news/view/2022-05-26/760688

黑客成功解密中共反人類罪證 5000像照片流出
https://lihkg.com/thread/3016235/page/1

「新疆警察檔案」揭露維吾爾集中營的恐怖：留鬍子會被關、逃跑的人可以開槍打死
https://www.thenewslens.com/article/167308

海量新疆警局文件被駭陳全國下槍決令
https://www.secretchina.com/news/b5/2022/05/25/1007370.html

習下令打壓新疆維族殘暴鐵證被駭出
https://news.ltn.com.tw/news/world/paper/1519405

一名駭客潛入新疆再教育營，揭露真實情況：反抗者可擊斃
https://news.discuss.com.hk/viewthread.php?tid=30594364

中方駁新疆警察文件「造謠說謊」外媒事實查核打臉了
https://news.ltn.com.tw/news/world/breakingnews/3941014

【拍案驚奇】想多幹幾年這麼難習麻煩不斷
https://www.epochtimes.com/b5/22/5/25/n13745170.htm

新疆警察檔案外洩震驚世界德總理：不該忽視中國迫害人權
https://news.ltn.com.tw/news/world/breakingnews/3940592

中國軍事學者指俄國出兵理由站不住腳微信速刪
https://money.udn.com/money/story/5603/6332375

笑裡藏刀中共駭客利用俄烏戰爭對俄下手
https://reurl.cc/6ZqQ7M

美國司法部表明不會控訴研究資安技術與漏洞的白帽駭客行為
https://reurl.cc/e3kdXb

外國網路攻擊日增！普丁：強化俄 IT 資安，將降低使用他國軟硬設備
https://www.inside.com.tw/article/27770-putin-warns-cyber-aggression-against-russia-promises-security-shakeup

北韓駭客隱瞞身分求職，美國政府警告僱主或需面臨法律制裁
https://technews.tw/2022/05/24/u-s-warns-against-inadvertently-hiring-north-korean-it-workers/

北韓駭客曝光！靠1招偷遍全球機密全被拿去做這件事
https://wantrich.chinatimes.com/news/20220524900362-420101

美、南韓合作對抗北韓網路攻擊
https://times.hinet.net/topic/23930775

中國駭客間諜全球入侵
http://www.ksnews.com.tw/index.php/news/contents_page/0001608766

提防中國剽竊！日本要求大學加強對留學生背景審查
https://news.ltn.com.tw/news/world/breakingnews/3936835

歐洲第二版資安指令NIS 2即將發布，更多重要中大型產業納入規範
https://www.ithome.com.tw/news/151044

Chinese "Twisted Panda" Hackers Caught Spying on Russian Defense Institutes
https://thehackernews.com/2022/05/chinese-twisted-panda-hackers-caught.html

資安產品FAE工程師
https://www.104.com.tw/job/7lc5v?jobsource=job_same_b

【運維】資訊安全工程師
https://www.104.com.tw/job/7lna1?jobsource=jolist_a_relevance

資安工程師
https://www.104.com.tw/job/7naxx

資安主管(內湖)
https://www.104.com.tw/job/7n8bo

醫療資訊室(資訊組)院聘資訊工程師(資安)
https://www.1111.com.tw/job/98791075/

資訊安全工程師
https://www.linkedin.com/jobs/view/%E8%B3%87%E8%A8%8A%E5%AE%89%E5%85%A8%E5%B7%A5%E7%A8%8B%E5%B8%AB-at-%E9%9B%84%E7%8D%85%E8%B3%87%E8%A8%8A%E7%A7%91%E6%8A%80%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8-3085773477/?originalSubdomain=tw

資訊安全分析師(初/中/高)級 Security Analyst (T1/T2/T3)
https://www.104.com.tw/job/79u7l?jobsource=jolist_c_date

【諮詢服務】資安架構/技術顧問 - Staff Level
https://www.104.com.tw/job/7n6wp

資安工程師（台南）
https://www.yourator.co/companies/freedom/jobs/24279

PChome 釋出上百職缺，招聘 3 大核心領域 AI 專才
https://technews.tw/2022/05/23/pchome-2022-recruitment-plan/

中華電信大招募集團徵才逾2,000人
https://money.udn.com/money/story/5612/6345968?from=edn_newest_index

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
FTC控Twitter以誤導資訊取得用戶電話號碼最終結果出爐
https://udn.com/news/story/7086/6343555

中國駭客發起多次釣魚郵件攻擊，意圖對俄羅斯散布木馬程式
https://blog.malwarebytes.com/malwarebytes-news/2022/05/unknown-apt-group-has-targeted-russia-repeatedly-since-ukraine-invasion/

心血險付諸流水！頻道遭盜深夜放送「吸金詐片」　他自嘲：好險粉絲少
https://www.ftvnews.com.tw/news/detail/2022527W0204

熊熊10年臉書帳號被盜！怒譙駭客：真的有病
https://today.line.me/tw/v2/article/ZaEPME7

美國通用汽車顧客發生個人資料遭竊事件，約 5,000 人個資外洩
https://www.twcert.org.tw/tw/cp-104-6168-59e74-1.html

美高梅度假村外洩1.4億筆資料出現在Telegram頻道供人下載
https://www.vpnmentor.com/blog/mgm-leaked-on-telegram/

【錯誤】網傳「美海軍研究所雜誌《議事錄》5月刊載一篇文章，作者鼓吹大陸收台時，
美軍應當對台灣進行轟炸、破壞！讓大陸花錢重建。台灣媒體徹底封鎖這新聞」
https://tfc-taiwan.org.tw/articles/7588

【錯誤】網傳新聞影片「日本的核廢水要運到台灣來，民進黨官員說可以喝，這是什麼政府」
https://tfc-taiwan.org.tw/articles/7583

一支手機偷走我的人生｜電信商變詐騙破口！全球每年恐被偷走1.4兆
https://www.businessweekly.com.tw/focus/indep/6007336

數字藝術家Beeple推特帳戶疑似遭遇駭客攻擊，置頂釣魚鏈接
https://news.cnyes.com/news/id/4876980

Apple、Google 和 Microsoft 聯手擴大支援無密碼登入，打造更安全的網路世界
https://reurl.cc/p1Y56x

通訊部週日也上班？曾繁翀機警揭詐騙電話
https://reurl.cc/QLaZg0

俄烏戰爭也可騙？假警政署長簽名英文公文　詐3500英鎊
https://www.setn.com/News.aspx?NewsID=1119447

清境民宿旅客個資遭盜　資安專家接到詐騙電話
https://reurl.cc/loY78A

小心DeepFake詐騙！加密貨幣平台冒名馬斯克進行宣傳
https://times.hinet.net/news/23931066

Interpol Arrests Leader of SilverTerrier Cybercrime Gang Behind BEC Attacks
https://thehackernews.com/2022/05/interpol-arrest-leader-of-silverterrier.html

How Secrets Lurking in Source Code Lead to Major Breaches
https://thehackernews.com/2022/05/how-secrets-lurking-in-source-code-lead.html

Learn How Hackers Can Hijack Your Online Accounts Even Before You Create Them
https://thehackernews.com/2022/05/learn-how-hackers-can-hijack-your.html

SIM-based Authentication Aims to Transform Device Binding Security to End Phishing
https://thehackernews.com/2022/05/sim-based-authentication-aims-to.html

E.研究報告/工具
CVE-2022-26923：Active Directory網域權限提升漏洞修補分析
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9870

Sophos 揭密流動性挖礦 CryptoCrime 的手法
https://www.docutek.com.tw/newsDetail.php?id=460

用K8s解決維運負擔
https://www.netadmin.com.tw/netadmin/zh-tw/market/99E5FDED4C274E4EBAE14E568E50D055

CentOS7.6下快速部署k8s
https://pccicblog.wordpress.com/2022/05/27/centos7-6%E4%B8%8B%E5%BF%AB%E9%80%9F%E9%83%A8%E7%BD%B2k8s/

Lapsus$ 教會我的兩件事
https://hennge.com/tw/blog/two-lessons-lapsus$-taught-us.html

John the Ripper (JTR) 密碼暴力破解工具
https://hackercat.org/hacker-tools/john-the-ripper

Python駭客攻防（十三）構建SSH殭屍網路
https://tw.pythontechworld.com/article/detail/s47CXgBXi2Zd

掌握數據等同掌控未來？解構數據時代關鍵職位，資料科學家、分析師成未來趨勢！
https://buzzorange.com/techorange/2022/05/23/become-a-data-scientist/

資安學習路上-滲透測試實務2
https://ithelp.ithome.com.tw/articles/10285284?sc=rss.qu

資安學習路上-滲透測試實務3
https://www.potatomedia.co/post/8494b9fa-56a9-47d0-818b-81f9bd0b147a

Kali Linux 升級跟版本確認
https://amingosec.blog/kali-linux-upgrade-and-check-version/

An overview of Threat Intelligence in Cybersecurity
https://4noobies.medium.com/an-overview-of-threat-intelligence-in-cybersecurity-f48ecf37c323

Flutter best practices for Improve Performance
https://inficial.medium.com/flutter-best-practices-for-improve-performance-7e21e14efebb

Edge Computing Security: Device Attestation Through A Certificate Hierarchy Approach
https://medium.com/the-edge-of-things/edge-computing-security-device-attestation-through-a-certificate-hierarchy-approach-b7a5846c7d80

Developing a Money-Making Telegram Bot on Python. Part 1
https://medium.com/codex/developing-a-money-making-telegram-bot-on-python-pt-1-a19fae54d3f

How to make real money with Python and YouTube
https://medium.com/geekculture/how-to-make-real-money-with-python-and-youtube-494bb34ca9ac

rajini++: The Superstar Programming Language
https://towardsdatascience.com/rajini-the-superstar-programming-language-db5187f2cc71

Configuring Elasticsearch Cross Cluster Search(CCS)
https://medium.com/orion-innovation-turkey/elasticsearch-cross-cluster-search-ba75825332b0

Hacking Smart Contracts: Beginners Guide
https://learn.block6.tech/hacking-smart-contracts-beginners-guide-9c84e9de7194

5 Cool Python 3.10 Features
https://medium.com/@gilharomri/5-cool-python-3-10-features-c0003d8fb218

The Email Scam That Nearly Worked On Me
https://clivethompson.medium.com/the-email-scam-that-nearly-worked-on-me-ade645bd90bc

Web3 learning platforms — Earn While You Learn
https://medium.com/@itsrakesh/web3-learning-platforms-earn-while-you-learn-b158d1ca3115

How I became a Web3 dev in just 7 days and got my first 8000$ Web3 contract
https://blog.cryptostars.is/how-i-became-a-web3-dev-in-just-7-days-and-got-my-first-8000-web3-contract-8f554bcb5352

Chat App System Design
https://medium.com/@BalajiSA/whatsapp-system-design-3d8566bb2e6c

Kotlin — Delegate Properties to Validate Value of Your Class
https://randy-arba.medium.com/kotlin-delegate-properties-to-validate-value-of-your-class-431ab976b787

How Your Metamask Got Hacked (Probably)
https://medium.com/coinmonks/how-your-metamask-got-hacked-probably-795abca4534a

How Object Recognition Is Revolutionizing the CCTV Camera industry
https://medium.com/visionary-hub/how-object-recognition-is-revolutionizing-the-cctv-camera-industry-250ade3659f7

$1000: How I could have Hack any account and become a billionaire overnight👑Top Crypto-Trading Platform
https://infosecwriteups.com/1000-how-i-could-have-hack-any-account-and-become-a-billionaire-overnight-top-crypto-trading-ff0e25b6013c

SQL Injection in Harvard’s Subdomain
https://medium.com/pentesternepal/sql-injection-in-harvards-subdomain-c3148f8be156

Mobile App Development Frameworks For 2022
https://medium.com/@salmaali2515/mobile-app-development-frameworks-for-2022-5b7b6469f3b5

10 Python Automation Scripts for Your Daily Problems
https://python.plainenglish.io/10-python-automation-scripts-for-your-daily-problems-aefb502969e2

The Added Dangers Privileged Accounts Pose to Your Active Directory
https://thehackernews.com/2022/05/the-added-dangers-privileged-accounts.html

Malware Analysis: Trickbot
https://thehackernews.com/2022/05/malware-analysis-trickbot.html

F.商業
Palo Alto Networks呼籲採用零信任、零例外 ZTNA 2.0
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9864

芬-安全企業版發佈全新品牌 WithSecure 「唯思安全」
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9873

突圍雲地資安風險，AWS提三大混合雲防護關鍵
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9863

震撼彈！博通以610億美元收購雲端運算業者VMware，創晶片業最大的購併案
https://www.bnext.com.tw/article/69500/broadcom-to-accquire-vmware-comfirmed-2022

微軟放緩部分招聘，因經濟不確定性增加
https://reurl.cc/o1Y73Q

看好台灣AI技術日本DDS宣布與奧義智慧合作
https://ctee.com.tw/industrynews/technology/649407.html

臺灣AI技術成資安險利器日本Digital Data Solution與奧義智慧展開策略合作
https://turnnewsapp.com/livenews/tech/A07657002022052610171349

中華資安國際獲首屆Best Choice Award資安服務獎
https://www.taiwannews.com.tw/ch/news/4551485

Adobe 剖析 CIO 如何透過「超級自動化」增強體驗
https://technews.tw/2022/05/26/adobe-cio/

智慧客服委外廠商程曦資訊今登戰略新板
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=d20ab4b1-2d40-4769-8165-371e11c84316

精誠資訊：今年聚焦自有雲應用生態平台
https://news.cnyes.com/news/id/4879606

聯電新加坡新廠動工 30年土地租金約9.54億元
https://www.1111.com.tw/news/jobns/145763

中華資安國際榮獲CIO Taiwan「傑出品牌」獎
https://www.chtsecurity.com/news/5cf5489e-77fa-4c40-bbff-803d0e749522

已知漏洞才是遭駭大宗，【TOPIA漏洞管理解決方案】協助企業有效率修補漏洞，阻止可能的資安攻擊
https://reurl.cc/M0zy7m

安碁搶當政府資安守門人　施宣輝邀李紀珠當獨董
https://www.mirrormedia.mg/story/20220527fin005/

遠程工作資安風險增 NordVPN 保障企業數據安全
https://www.businessweekly.com.tw/business/indep/1002408

芬-安全企業版發佈全新品牌WithSecure 並以「唯思安全」為品牌中文命名
http://n.yam.com/Article/20220522300124

VMware Carbon Black _害怕勒索病毒？眾多駭客攻擊手法如何防禦？端點安全沒有Total Solution
https://www.sysage.com.tw/news/products/339

基於Snapdragon XR2平台，Qualcomm推出更輕薄的擴增實境裝置參考設計
https://mashdigi.com/qualcomm-introduces-thinner-augmented-reality-device-reference-design-based-on-snapdragon-xr2-platform/

助企業24小時抓網路害蟲！美國資安公司Arctic Wolf Networks估值飆破1263億
https://today.line.me/tw/v2/article/eLV76MO

G.政府
調查局清流雙月刊NO.37節錄(期別111年1月)：生活中的資安
https://www.mjib.gov.tw/eBooks/eBooks_Detail?CID=3&BookID=2065

國家資通安全科技中心公有財產管理使用收益辦法
https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=H0160062&kw=%E5%85%AC%E6%9C%89%E8%B2%A1%E7%94%A2

誰任數發部長？行政院：還未確定
https://reurl.cc/yrA7Va

郭耀煌准辭回校任教政院：暫無內閣異動規劃
https://www.rti.org.tw/news/view/id/2134041

郭耀煌月底歸建成功大學政委人事將全面規畫
https://www.cna.com.tw/news/aipl/202205260249.aspx

數據應用研發中心啟用運用5G發展三網
https://www.epochtimes.com/b5/22/5/26/n13745877.htm

NCC擴大列管！OTT專法草案出爐 Netflix、Line TV也在內
https://news.ebc.net.tw/news/living/319250

資安人才招募困難立委促法務部研議提升專業加給
https://www.rti.org.tw/news/view/id/2133669

網路犯罪日趨嚴重立委促增加資安人員人才誘因
https://www.chinatimes.com/realtimenews/20220523002463-260407?chdtv

學者：政府資安外部稽核權力應交由監察院行使
https://www.cna.com.tw/news/aipl/202205230103.aspx

台學者：防侵害數位人權資安稽核應由監院執行
https://www.epochtimes.com/b5/22/5/23/n13743647.htm

國安法重罰重大軍品採購不法行為學者：產生嚇阻力
https://news.ltn.com.tw/news/politics/paper/1518469

唐鳳出手更新居隔單系統　侯友宜：終於看到中央有動作
https://news.housefun.com.tw/news/article/171588335809.html

李德財：俄烏戰爭烏克蘭的作為值得台灣借鏡
https://www.wealth.com.tw/articles/a6307acc-4015-4b18-81fa-098ff6a05bcf

最高檢查賄中心今掛牌嚴查虛擬貨幣、遊戲點數、行動支付賄選
https://reurl.cc/NAx4ak

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
Lumos System Can Find Hidden Cameras and IoT Devices in Your Airbnb or Hotel Room
https://thehackernews.com/2022/05/lumos-system-can-find-hidden-cameras.html

IT 與 OT 資安的融合挑戰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9871

智慧醫材的網路安全風險評估8大重點
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9867

AI數據分析改寫維運監控
https://www.netadmin.com.tw/netadmin/zh-tw/market/26FB9DE5B65544D0A9368DAAFB411D30

物聯網與工控設備資料自動化處理平臺OAS重大漏洞恐造成資訊洩露、服務停擺
https://blog.talosintelligence.com/2022/05/vuln-spotlight-open-automation-platform.html

Silicon Labs實現物聯網人工智慧邊緣應用
https://www.ctimes.com.tw/DispNews/tw/%E8%97%8D%E7%89%99/Silicon-Labs/%E8%97%8D%E8%8A%BD/BlueTooth/2205251817AZ.shtml

瞄準資訊安全大趨勢打造工廠製造業數位轉型新場景
https://reurl.cc/x936Z5

車用資訊娛樂系統元件恐成駭客遠端鎖定目標
https://www.sinotrade.com.tw/richclub/news/628f3a8d30569fe1ee86baea

半導體業成勒索病毒頭號目標！做好快照加備份降低停機損失
https://www.inside.com.tw/article/27757-ransom-ware

以邊緣AI實現低成本IoT終端節點
https://www.eettaiwan.com/20220523ta71-artificial-intelligence-on-the-edge/

運用微分段、虛擬補丁及白名單管控捍衛工控環境零信任資安
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000635865_FHO7IJY97W1IQJ4BDAKGK

迎向AI產業化浪潮資安與資料運用成為當前兩大課題
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=41&id=0000635905_D3ELM41BLS31S369IOQLT

全球供應鏈波動大，新創公司用AI預測風險，降低時局干擾搶商機
https://reurl.cc/Lmn6ox

2022年人工智慧五大趨勢　HPC/自動化/醫療帶旺AI
https://www.mem.com.tw/2022%E5%B9%B4%E4%BA%BA%E5%B7%A5%E6%99%BA%E6%85%A7%E4%BA%94%E5%A4%A7%E8%B6%A8%E5%8B%A2%E3%80%80hpc-%E8%87%AA%E5%8B%95%E5%8C%96-%E9%86%AB%E7%99%82%E5%B8%B6%E6%97%BAai/

I.教育訓練
物聯網時代的15堂資安基礎必修課 (Practical Iot Hacking: The Definitive Guide to Attacking the Internet of Things)
https://www.tenlong.com.tw/products/9786263241756?list_name=p-r-zh_tw

中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

資安學習路上-滲透測試實務4
https://www.potatomedia.co/post/4191e744-64f3-4d33-af69-e3591adc2ed0

6.近期資安活動及研討會
駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

【公益資訊安全講座】－【非營利組織的個資與資安防護觀念建立】 2022/06/01
https://taiwanngo.tw/Post/81845

經濟部工業局沙崙資安服務基地 - 零信任(Zero Trust)-從意識到行動的資安防護變革 2022/6/2
https://www.accupass.com/event/2205240207565477386890

HITCON FreeTalk 2022 - 烏俄網路戰 & CTF 經驗分享 2022/6/6
https://hitcon.kktix.cc/events/hitcon-freetalk-2022

經濟部工業局沙崙資安服務基地 - 手把手帶你玩資安攻防 2022/6/9
https://bit.ly/38t2aWp

經濟部工業局沙崙資安服務基地 - 新世代資安防禦-網路威脅與防禦趨勢 2022/6/9
https://www.accupass.com/event/2205240207565477386890

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

醫療資安女力論壇 2022/6/11
https://isipevent.kktix.cc/events/e58d0573-copy-1

科技力x內容力 5G Craft 菁英挑戰賽號召各路英雄 2022/6/15
https://tomorrowsci.com/technology/20225g0526/

經濟部工業局沙崙資安服務基地 - 智慧製造的痛-駭客攻擊與勒索軟體威脅 2022/6/16
https://www.cisanet.org.tw/Course/Detail/2836

經濟部工業局沙崙資安服務基地 - 日誌大數據分析實戰 2022/6/23
https://bit.ly/3sJWjmp

資訊安全管理(週日班) 2022/7/3 ~ 2022/8/28
https://mymcu.mcu.edu.tw/zh-hant/product/e022205151

創科資訊②⓪②②軟體開發實戰訓練營➠線上實習說明會 2022/7/6
https://trunk-studio.kktix.cc/events/monosparta-code-camp-2022-9

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/5/16 ~ 2022/5/20

noreply@blogger.com (Unknown) — Fri, 20 May 2022 15:25:00 +0000

資安事件新聞週報 2022/5/16 ~ 2022/5/20

1.重大弱點漏洞/後門/Exploit/Zero Day
Oracle Security Alert for CVE-2022-21500
https://www.oracle.com/security-alerts/alert-cve-2022-21500.html

SonicWall修補SSL VPN設備的高風險漏洞
https://www.sonicwall.com/support/knowledge-base/security-notice-sma-1000-series-unauthenticated-access-control-bypass/220510172939820/

Microsoft 推出 2022 年 5 月 Patch Tuesday 資安更新修補包
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9861

微軟發佈5月份安全性公告
https://msrc.microsoft.com/update-guide/deployments

三個月前修補的SharePoint漏洞被研究人員繞過，微軟再度進行修補
https://starlabs.sg/blog/2022/05/new-wine-in-old-bottle-microsoft-sharepoint-post-auth-deserialization-rce-cve-2022-29108/

Windows Local Security Authority(LSA) 存在高風險漏洞(CVE-2022-26925)
https://www.klcg.gov.tw/tw/education/3522-255125.html

Adobe 已發布安全更新，以解決多個 Adobe 產品中的弱點
https://www.cisa.gov/uscert/ncas/current-activity/2022/05/12/adobe-releases-security-updates-multiple-products

High-Severity Bug Reported in Google's OAuth Client Library for Java
https://thehackernews.com/2022/05/high-severity-bug-reported-in-googles.html

VMware Releases Patches for New Vulnerabilities Affecting Multiple Products
https://thehackernews.com/2022/05/vmware-releases-patches-for-new.html

VMware修補旗下產品的身分驗證繞過漏洞，美國要求公部門限期完成修補
https://www.bleepingcomputer.com/news/security/vmware-patches-critical-auth-bypass-flaw-in-multiple-products/

WordPress外掛程式Tatsu Builder漏洞遭到鎖定，出現近6百萬次攻擊
https://www.wordfence.com/blog/2022/05/millions-of-attacks-target-tatsu-builder-plugin/

WordPress外掛程式JupiterX、Junipter存在重大漏洞，恐被駭客用來接管網站
https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/

黑客覆寫靭體！超過 200 款型號出事！ HP 推出 BIOS 更新籲用戶立即安裝
https://www.pcmarket.com.hk/bios-security-vulnerabilities-has-been-founded-in-over-200-models-hp-pc/

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
駭客利用惡意PHP程式碼截取網站的信用卡資料
https://www.zdnet.com/article/fbi-hackers-used-malicious-php-code-to-grab-credit-card-data/

Cyber Actors Scrape Credit Card Data from US Business' Online Checkout Page and Maintain Persistence by Injecting Malicious PHP Code
https://www.ic3.gov/Media/News/2022/220516.pdf

遭批遇到富邦就轉彎金管會：兩年開罰富邦金逾3000萬元
https://news.cnyes.com/news/id/4874704?exp=a

不怕保單之亂！　染疫警專案申請理賠「備妥個人文件即可」
https://www.mirrormedia.mg/story/20220518soc003/

微笑揮手就能結帳？Mastercard 卡「生物辨識支付」便利性挑戰隱私權
https://www.inside.com.tw/article/27713-mastercard-biometric-payment

萬事達卡推臉部辨識付款安全隱憂再成爭議
https://reurl.cc/QLRzz2

台銀「三駕馬車」戰略發威前4月稅前淨利54億元
https://www.cna.com.tw/news/afe/202205200157.aspx

法規雖逐步鬆綁仍較他國嚴謹　海外經驗可作為參考案例開放上雲引躍躍欲試　人才法遵成金融業挑戰
https://www.netadmin.com.tw/netadmin/zh-tw/trend/0918A23BDC774E8A91614D2F3F5FEB57

第一金台灣核心戰略建設基金熱募
https://wantrich.chinatimes.com/news/20220517900116-420101

將來銀行帳務系統出包　發3700筆錯誤簡訊給客戶
https://tw.appledaily.com/property/20220520/N46SPH4DJND33GDILX2VPJLLYQ/

信用卡也能享有跨行交易免手續費優惠
https://www.cardu.com.tw/message/detail.php?46959

富邦媒砸3.75億元參與LINE BANK私募案
https://udn.com/news/story/7241/6328181?from=udn-catelistnews_ch2

北富銀參與LINE Bank減增資，持股比重增至27.18%
https://reurl.cc/b2VM2o

3.電子支付/行動支付/pay/資安
美國行動支付，為什麼不如中國普遍
https://www.cw.com.tw/article/5121132

偽卡綁Apple Pay行動支付至咖啡連鎖門市盜刷換現金
https://reurl.cc/XjGolR

Google 錢包和 Google Pay 有什麼區別
https://reurl.cc/NAQ3Z9

碰一下就付款，蘋果訪客中心開始接受 Tap To Pay
https://technews.tw/2022/05/17/tap-to-pay/

不打補貼戰降虧損！歐付寶結盟綠界整合支付版圖，下步搶攻移工商機
https://www.bnext.com.tw/article/69248/opay-2022

小米為日本當地電子票卡需求，在日本提供具備 FeliCa 的 Redmi Note 11 Pro 5G
https://reurl.cc/7D0OeD

遠東有錢卡收攤不玩　10月底終止走入歷史
https://www.cardu.com.tw/news/detail.php?46139

網購數位科技調查　消費者最重視電子支付
https://www.eettaiwan.com/20220517nt21-online-shopping/

英國政府計劃將穩定幣納入電子支付監管範圍
https://news.cnyes.com/news/id/4873238

你支持不用鈔票更方便嗎？全球現金戰爭開打：那些率先走向無現金交易的國家，後來呢
https://www.businesstoday.com.tw/article/category/183017/post/202205040077/

第二階段消費券　改寫本地電子支付版圖
https://www.pcmarket.com.hk/2nd-phase-consumption-voucher-will-rewriting-the-local-electronic-payment-landscape/

歐付寶擬串連綠界科技收款店家
https://reurl.cc/n1Nk16

電支去年無人獲利　又有新兵殺進搶市
https://www.wealth.com.tw/articles/af1b47f4-b7e9-4547-a60a-e2878fded3d3

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Create NFT Market Place without any libraries like openZeppelin (part 1)
https://amirdiafi.medium.com/create-nft-market-place-without-any-libraries-like-openzeppelin-part-1-7c3bbc04c23f

虛擬貨幣是什麼？加密貨幣有哪些？加密貨幣種類、特色、風險
https://reurl.cc/x9anG4

習酒發布NFT數字藏品
https://news.cnyes.com/news/id/4875740

BTC拉升後部分高位套牢籌碼離場 ETH匯率處於較低水平 – 2022.5.20
https://reurl.cc/k1OD93

500億美元的一堂課　從UST崩盤看穩定幣的三道防線
https://www.cw.com.tw/article/5121284

LINE推出DOSI Wallet 攻全球市場NFT交易平台、註冊流程更簡化
https://udn.com/news/story/122837/6320207?from=udn-catelistnews_ch2

用社群帳號就能註冊！LINE 推「DOSI Wallet」錢包搶攻NFT商機
https://3c.ltn.com.tw/news/49179

數碼港元│零售央行數碼貨幣與現有電子支付方式有何分別
https://reurl.cc/55ve5v

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
鎖定macOS的惡意軟體UpdateAgent出現變種，被用來投放更多惡意程式
https://www.jamf.com/blog/updateagent-adapts-again/

製作勒索軟體Jigsaw、Thanos的駭客被起底
https://www.justice.gov/usao-edny/pr/hacker-and-ransomware-designer-charged-use-and-sale-ransomware-and-profit-sharing

Conti勒索軟體威脅推翻哥斯大黎加政府
https://www.ithome.com.tw/news/150993

知名勒索軟體Jigsaw、Thanos作者竟是55歲心臟科醫生，客服有口碑堪稱勒索界「絕命毒師」
https://www.techbang.com/posts/96375-in-addition-to-treating-patients-55-year-old-cardiologists

中國駭客鎖定俄羅斯航太產業下手，植入多種惡意軟體
https://www.bleepingcomputer.com/news/security/chinese-space-pirates-are-hacking-russian-aerospace-firms/

日經新聞遭到勒索軟體攻擊
https://asia.nikkei.com/Announcements/Nikkei-unit-in-Singapore-hit-by-ransomware

鎖定Linux主機的殭屍網路XorDDoS近半年攻擊次數增2.5倍
https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/

勒索軟體Chaos破壞受害電腦檔案，並表達力挺俄羅斯的訴求
https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia

航空液壓設備製造商傳出遭勒索軟體Conti攻擊
https://www.bleepingcomputer.com/news/security/engineering-firm-parker-discloses-data-breach-after-ransomware-attack/

威聯通針對近期出現的勒索軟體DeadBolt攻擊行動提出警告
https://www.qnap.com/zh-tw/security-news/2022/%E7%AB%8B%E5%8D%B3%E6%8E%A1%E5%8F%96%E8%B3%87%E5%AE%89%E9%98%B2%E8%AD%B7%E8%A1%8C%E5%8B%95%E6%9B%B4%E6%96%B0-qts-%E8%87%B3%E6%9C%80%E6%96%B0%E7%89%88%E6%9C%AC

駭客一口氣散布3種無檔案惡意軟體，意圖竊取受害電腦資料
https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware

變種Facestealer竊密程式鎖定手機用戶，截取臉書帳密或假藉挖礦服務洗劫加密貨幣錢包
https://trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials--crypto-related-keys.html

駭客利用Windows事件記錄機制埋藏惡意軟體行蹤
https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/

Why Remediation Alone Is Not Enough When Infected by Malware
https://asec.ahnlab.com/en/34549/

Vidar distributed through backdoored Windows 11 downloads and abusing Telegram
https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing

Dridex Infection Chain Case Studies
https://unit42.paloaltonetworks.com/excel-add-ins-dridex-infection-chain/
https://github.com/pan-unit42/iocs/blob/master/Dridex%20Infection%20Chain%20Case%20Studies

CrateDepression | Rust Supply-Chain Attack Infects Cloud CI Pipelines with Go Malware
https://www.sentinelone.com/labs/cratedepression-rust-supply-chain-attack-infects-cloud-ci-pipelines-with-go-malware/

Twisted Panda: Chinese APT espionage operation against Russian’s state-owned defense institutes
https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/

Bumblebee Malware from TransferXL URLs
https://isc.sans.edu/diary/rss/28664

Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control
https://www.cisa.gov/uscert/ncas/alerts/aa22-138b

Info-stealer Campaign targets German Car Dealerships and Manufacturers - Check Point Software
https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/

Briefing on the latest APT-C-24 Rattlesnake attack activity
https://mp-weixin-qq-com.translate.goog/s/qsGxZIiTsuI7o-_XmiHLHg?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

SYK Crypter Distributing Malware Families Via Discord
https://blog.morphisec.com/syk-crypter-discord

Falcon OverWatch Detects Novel IceApple Post-Exploitation Framework
https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf
https://www.crowdstrike.com/blog/falcon-overwatch-detects-iceapple-framework/
https://therecord.media/iceapple-post-exploitation-malware-microsoft-crowdstrike/

Custom PowerShell RAT targets Germans seeking information about the Ukraine crisis
https://blog.malwarebytes.com/threat-intelligence/2022/05/custom-powershell-rat-targets-germans-seeking-information-about-the-ukraine-crisis/

Operation RestyLink: APT campaign targeting Japanese companies
https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies

Network Footprints of Gamaredon Group
https://blogs.cisco.com/security/network-footprints-of-gamaredon-group

Space Pirates: analyzing the tools and connections of a new hacker group
https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/

Emotet Summary: November 2021 Through January 2022
https://unit42.paloaltonetworks.com/emotet-malware-summary-epoch-4-5/

How to Protect Your Data When Ransomware Strikes
https://thehackernews.com/2022/05/how-to-protect-your-data-when.html

UpdateAgent Returns with New macOS Malware Dropper Written in Swift
https://thehackernews.com/2022/05/updateagent-returns-with-new-macos.html

U.S. Charges Venezuelan Doctor for Using and Selling Thanos Ransomware
https://thehackernews.com/2022/05/us-charges-venezuelan-doctor-for-using.html

New Sysrv Botnet Variant Hijacking Windows and Linux with Crypto Miners
https://thehackernews.com/2022/05/new-sysrv-botnet-variant-hijacking.html

Researchers Warn of "Eternity Project" Malware Service Being Sold via Telegram
https://thehackernews.com/2022/05/researchers-warn-of-eternity-project.html

New Saitama backdoor Targeted Official from Jordan's Foreign Ministry
https://thehackernews.com/2022/05/new-saitama-backdoor-targeted-official.html

Iranian Hackers Leveraging BitLocker and DiskCryptor in Ransomware Attacks
https://thehackernews.com/2022/05/iranian-hackers-leveraging-bitlocker.html

Microsoft Warns Rise in XorDdos Malware Targeting Linux Devices
https://thehackernews.com/2022/05/microsoft-warns-rise-in-xorddos-malware.html

Cytrox's Predator Spyware Targeted Android Users with Zero-Day Exploits
https://thehackernews.com/2022/05/cytroxs-predator-spyware-target-android.html

Hackers Exploiting VMware Horizon to Target South Korea with NukeSped Backdoor
https://thehackernews.com/2022/05/hackers-exploiting-vmware-horizon-to.html

Hackers Trick Users with Fake Windows 11 Downloads to Distribute Vidar Malware
https://thehackernews.com/2022/05/hackers-trick-users-with-fake-windows.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
iPhone關機也沒用！駭客一樣能藉低功耗模式入侵手機
https://3c.ltn.com.tw/news/49162

iPhone關機也被駭！有心人士竟藉「內建這模式」入侵手機
https://reurl.cc/9Gv25x

研究人員發現可濫用iPhone低耗電模式的漏洞
https://arxiv.org/pdf/2205.06114.pdf

修補 iPhone 近30個資安漏洞！蘋果釋出 iOS 15.5 更新
https://3c.ltn.com.tw/news/49153

預防惡意攻擊！蘋果和Google急刪150萬個2年未更新App
https://newtalk.tw/news/view/2022-05-18/756572

3款APP有毒！一掃QR Code就被駭存款直接被偷光
https://news.ebc.net.tw/news/living/317972

惡意App盜銀行帳密　日常健身、掃QR Code就被駭
https://www.ettoday.net/news/20220518/2253666.htm

安卓用戶快刪除！7款App 暗藏變種版惡意間諜軟體「偷」手機個資
https://3c.ltn.com.tw/news/49161

快檢查手機！這6款App竊你個資
https://reurl.cc/b2V03y

手機續航測試出爐　這款入門新機續航超卓越
https://www.ettoday.net/news/20220519/2254476.htm

惡意App盜銀行帳密　日常健身、掃QR Code就被駭
https://www.ettoday.net/news/20220518/2253666.htm?from=rss

這款APP快刪除！入侵帳戶秒扣3000元荷包恐全空
https://news.ebc.net.tw/news/living/318129

訊診看病需求暴增醫聯網開發「視訊診療系統」協助抗疫
https://udn.com/news/story/7240/6326127?from=udn-ch1_breaknews-1-cate6-news

社交軟體看病好方便？醫聯網：恐有資安風險
https://reurl.cc/ErjEVv

iOS 15.6 beta 1 更新釋出！又帶來哪些新功能
https://mrmad.com.tw/apple-ios-15-6-beta-1-releases

加拿大跟進盟邦 5G網路將禁用華為、中興通訊設備
https://times.hinet.net/news/23924457

Twitter員工遭偷拍！內幕消息外洩，員工反對馬斯克收購，稱他患有亞斯伯格症
https://news.cnyes.com/news/id/4875298

遠傳5G遠距診療取得美國HIPAA認證，強化資安接軌國際
https://reurl.cc/9Gv2dj

Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys
https://www.trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials--crypto-related-keys.html

How to make Android Studio look Awesome
https://blog.protein.tech/how-to-make-android-studio-look-awesome-ee19e3719a59

Over 200 Apps on Play Store Caught Spying on Android Users Using Facestealer
https://thehackernews.com/2022/05/over-200-apps-on-play-store-caught.html

Researchers Find Potential Way to Run Malware on iPhone Even When it's OFF
https://thehackernews.com/2022/05/researchers-find-way-to-run-malware-on.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
臺灣積極發展資安職務地圖，促進產官學溝通對焦，新興資安產業版首登場
https://www.ithome.com.tw/news/151029

全球企業資安人才狂缺！哪些國際專業證照可以讓你身價狂飆
https://buzzorange.com/techorange/2022/05/20/isaca-certificate/

挖礦攻擊對 DevOps 團隊的衝擊
https://blog.trendmicro.com.tw/?p=72313

多國警告 MSP 面臨網路安全威脅
https://technews.tw/2022/05/18/government-agencies-warn-of-increase-in-cyberattacks-targeting-msps/

駭客也分黑白機器人帳號目的是什麼網路安全工程師解惑網友疑問
https://reurl.cc/A7jodp

Axie Infinity、Moonbirds、RTFKT …多個項目 Discord 遭駭客攻擊
https://www.blocktempo.com/several-nft-discords-were-compromised-including-axie-moonbirds-rtfkt/

北韓駭客潛伏國際為發展核武籌資
https://anntw.com/articles/20220518-bJsG

北韓派出數千名IT開發者潛伏於全球企業以替北韓政府賺錢
https://www.ithome.com.tw/news/150980

北韓IT人士埋伏全球企業，協助駭客進行網路攻擊
https://home.treasury.gov/system/files/126/20220516_dprk_it_worker_advisory.pdf

北韓駭客Lazarus鎖定南韓組織的VMware遠距工作平臺Log4Shell漏洞下手
https://asec.ahnlab.com/en/34461/

4中國特工1美公民涉情蒐鎖定中國異議與民運人士
https://www.cna.com.tw/news/aopl/202205190055.aspx

中國數位絲路若建成...商業、情報，連印度發電廠都可能受控制
https://www.businessweekly.com.tw/international/blog/3009795

報告稱中國駭客試圖竊取俄羅斯國防數據
https://cn.nytimes.com/china/20220520/china-hackers-russia/zh-hant/

中國駭客間諜全球入侵下手對象包括盟友俄羅斯
https://www.cna.com.tw/news/acn/202205200200.aspx

中共靠攏侵烏俄國中東歐對中關係重新省思
https://reurl.cc/o1RWG3

美司法部正式承諾不控告從事安全研究的白帽駭客
https://www.ithome.com.tw/news/151026

美國將把白帽駭客行為除罪化確保資安技術成長
https://www.cool3c.com/article/177504

瑞典和芬蘭提高網絡攻擊警戒級別，擔心因申請加入北約遭到報復
https://reurl.cc/d2n6q8

義大利國家網路安全局：將運用AI及新型軟體抵制網路犯罪
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=dc398ba0-0e3e-42a6-bd0a-3c68060ff0b4

台商刺探法輪功情資二審無罪最高法院發回更審
https://reurl.cc/x9anRN

歐洲推出第二版網路暨資訊系統安全指令，將擴大適用範圍
https://digital-strategy.ec.europa.eu/en/library/proposal-directive-measures-high-common-level-cybersecurity-across-union

Researchers Expose Inner Workings of Billion-Dollar Wizard Spider Cybercrime Gang
https://thehackernews.com/2022/05/researchers-expose-inner-working-of.html

U.S. Warns Against North Korean Hackers Posing as IT Freelancers
https://thehackernews.com/2022/05/us-warns-against-north-korean-hackers.html

Europe Agrees to Adopt New NIS2 Directive Aimed at Hardening Cybersecurity
https://thehackernews.com/2022/05/europe-agrees-to-adopt-new-nis2.html

Ukrainian Hacker Jailed for 4-Years in U.S. for Selling Access to Hacked Servers
https://thehackernews.com/2022/05/ukrainian-hacker-jailed-for-4-years-in.html

Researchers Uncover Rust Supply-Chain Attack Targeting Cloud CI Pipelines
https://thehackernews.com/2022/05/researchers-uncover-rust-supply-chain.html

軟體開發工程師
https://www.104.com.tw/job/7muzf

國網中心/網路與資安組/學研總中心規劃推動計畫/專案管理計畫人員/1人(111_06_2)
https://www.104.com.tw/job/7n1q8

【視訊面試】資安工程師 --接受無經驗,但想往資安發展,有完整培訓
https://www.104.com.tw/job/7mw8c?jobsource=jolist_c_date

資訊部-資安工程師
https://job.taiwanjobs.gov.tw/internet/jobwanted/JobDetail.aspx?R2=15&EMPLOYER_ID=446216&HIRE_ID=11174009

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Interactive Phishing: Using Chatbot-like Web Applications to Harvest Information
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-using-chatbot-like-web-applications-to-harvest-information/

金融大老籲與司法界多交流　刑事局建議做好風險評估避免被駭被騙
https://www.ctwant.com/article/184048

怕出門染疫...民眾網路交易遭騙損荷包！「這些手法」要當心
https://news.housefun.com.tw/news/article/111660335556.html

疫情期間聯卡中心提醒留意網路詐欺或手機簡訊釣魚
https://www.chinatimes.com/realtimenews/20220518005239-260410?chdtv

網購刷卡詐騙多聯卡中心提醒遇可疑主動向銀行查證
https://money.udn.com/money/story/5613/6323474

釣魚網站騙信用卡資料　盜刷星巴克點數洗錢1年賺近千萬元
https://news.sina.com.tw/article/20220518/41861670.html

駭客利用客服機器人進行網路釣魚，竊取信用卡資料
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-using-chatbot-like-web-applications-to-harvest-information/

主播簡立喆超崩潰臉書遭駭信用卡又被盜刷
https://ent.ltn.com.tw/news/breakingnews/3932719

全球網絡詐騙行業今年首季有增長趨勢
https://unwire.pro/2022/05/20/arkose-labs/security/

手機報稅小心個資外洩陷阱！趨勢科技教你 3 招防止駭客攻擊
https://www.techbang.com/posts/96118-mobile-phone-tax-filing-beware-of-personal-leakage-traps-trend

【錯誤】網傳網站「填寫相關問題抽10,000超市禮券..」
https://tfc-taiwan.org.tw/articles/7509

假冒加密貨幣交易所　HKCERT 提醒市民小心短訊釣魚攻擊
https://www.pcmarket.com.hk/phishing-attack-on-fake-cryptocurrency-exchange-sms/

馬來西亞超過2千萬國民個資外洩，賣家大膽公開內政部長身分證
https://www.thenewslens.com/article/167095

稱台灣原創卻放中國盜錄片 TV Pay被起訴
https://www.epochtimes.com/b5/22/5/17/n13739289.htm

買清冠遇詐騙！　誆贈兩劑快篩　新手媽遭騙1萬
https://www.ftvnews.com.tw/news/detail/2022517N06M1

E.研究報告/工具
TeamT5 發布模組化後門程式 Pangolin8RAT 與關聯駭客團體研究
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9857

零信任資安模型與 DevOps 整合的 5 大元素
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9862

第3屆ICANN APAC-TWNIC合作交流論壇引領探索網路本質，實現全球公共利益
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9856

ICANN 開發用於監控及打擊惡意網路行為的工具
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9860

網站追蹤器元件可能會在用戶送出前截取輸入表單的資料
https://homes.esat.kuleuven.be/~asenol/leaky-forms/

巴哈駭客教你如何不因為違反兒少保護被水桶
https://forum.gamer.com.tw/C.php?bsn=60076&snA=7097054

駭客使用sqlps公用程式鎖定攻擊SQL Server
https://www.ithome.com.tw/news/150991

如果猴子拿到打字機：從柏拉圖談到《駭客任務》的小說創作心法
https://reurl.cc/ErjEmR

你的按鍵被監控了嗎?什麼是鍵盤側錄器（keylogger）? 鍵盤側錄器進入電腦的四個管道
https://blog.trendmicro.com.tw/?p=71541

CVE-2022-26923：Active Directory網域權限提升漏洞修補分析
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9870

Excel 刪除重覆值或取得唯一值
https://amingosec.blog/excel-remove-duplicates/

介接專攻中日韓語系引擎　行欄位面向高效資料庫索引 MySQL外掛Mroonga　全文檢索搜尋中文更有力
https://www.netadmin.com.tw/netadmin/zh-tw/technology/A383340B3A934B92938826D76380D9AE

【反面教材】解構勒索集團LAPSUS$入侵事件科技巨企網絡安全超脆弱
https://www.wepro180.com/lapsus220523/

無線滲透–wifiphisher之wifi釣魚獲取wifi密碼
https://reurl.cc/9Gv2Mj

Mirantis OpenStack 9.0 在 VirtualBox上的部署安装
https://reurl.cc/RrqA6e

Can analyzing javascript files lead to remote code execution
https://melotover.medium.com/can-analyzing-javascript-files-lead-to-remote-code-execution-f24112f1aa1f

What’s new in Flutter 3.0, let’s discuss the top 10 new things
https://shirsh94.medium.com/whats-new-in-flutter-3-0-let-s-discuss-the-top-10-new-things-839aba69929b

Build Your first CI/CD Pipeline in Azure DevOps
https://qatechtalks.medium.com/build-your-first-ci-cd-pipeline-in-azure-devops-5bd3408f36ff

2022 Custom VSCode Setup
https://medium.com/@crstnmac/2022-custom-vscode-setup-b72b10ef1e0a

Reset the Password for Vulnerability
https://medium.com/@sathvika03/reset-the-password-for-vulnerability-b0805f7adf9c

An overview of Threat Intelligence in Cybersecurity
https://4noobies.medium.com/an-overview-of-threat-intelligence-in-cybersecurity-f48ecf37c323

Why the Raspberry Pi should be your next home server
https://medium.com/the-pi-project/why-the-raspberry-pi-should-be-your-next-home-server-e901e796e7a6

12 Awesome Linux Commands && Utilities
https://medium.com/codex/12-awesome-linux-commands-utilities-49ab56588a84

How to make real money with Python and YouTube
https://medium.com/geekculture/how-to-make-real-money-with-python-and-youtube-494bb34ca9ac

How I managed to take over any account visits my profile with Stored XSS
https://0xmahmoudjo0.medium.com/how-i-managed-to-take-over-any-account-visits-my-profile-with-stored-xss-6b378d33e90f

7 Best GitHub Repositories to Learn Any Programming Language
https://javascript.plainenglish.io/7-best-github-repositories-to-learn-any-programming-language-5843e5a3c8d8

My Mac OS essential tools list at work
https://medium.com/@spawnrider/my-mac-os-essential-tools-list-at-work-391792dfcd1d

90 % of Javascript Developer fail to answer these code snippets (Asked in Interview) Part-1
https://vineetmishrahbk.medium.com/90-of-javascript-developer-fail-to-answer-these-code-snippets-asked-in-interview-436e00ec1287

How I became a Web3 dev in just 7 days and got my first 8000$ Web3 contract
https://blog.cryptostars.is/how-i-became-a-web3-dev-in-just-7-days-and-got-my-first-8000-web3-contract-8f554bcb5352

Hacking Smart Contracts: Beginners Guide
https://learn.block6.tech/hacking-smart-contracts-beginners-guide-9c84e9de7194

7 Key Findings from the 2022 SaaS Security Survey Report
https://thehackernews.com/2022/05/7-key-findings-from-2022-saas-security.html

Web Trackers Caught Intercepting Online Forms Even Before Users Hit Submit
https://thehackernews.com/2022/05/web-trackers-caught-intercepting-online.html

Hackers Gain Fileless Persistence on Targeted SQL Servers Using a Built-in Utility
https://thehackernews.com/2022/05/hackers-gain-fileless-persistence-on.html

Are You Investing in Securing Your Data in the Cloud
https://thehackernews.com/2022/05/are-you-investing-in-securing-your-data.html

Fake Clickjacking Bug Bounty Reports: The Key Facts
https://thehackernews.com/2022/05/fake-clickjacking-bug-bounty-reports.html

Google Created 'Open Source Maintenance Crew' to Help Secure Critical Projects
https://thehackernews.com/2022/05/google-created-open-source-maintenance.html

2022 Cybersecurity Skills Gap
https://www.fortinet.com/content/dam/fortinet/assets/reports/report-2022-skills-gap-survey.pdf

F.商業
Noname Security成立台灣辦事處擴展亞太市場
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9859

Google推出經過安全驗證的開源軟體套件
https://cloud.google.com/blog/products/identity-security/introducing-assured-open-source-software-service

駭客猖獗網安股夯 Palo Alto盤後噴10% 同業跟漲
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=789c444f-77d8-4a85-b480-29f6c039595f

芬-安全企業版發佈全新品牌WithSecure™ 並以「唯思安全」為品牌中文命名 WithSecure™象徵
「Co-security協同安全」的理念，共創可信賴的數位安全社會
https://times.hinet.net/topic/23925044

Fortinet 資安能力報告：八成企業因資安知識不足導致安全威脅
http://n.yam.com/Article/20220518741552

資安鬧人才荒、公司技術不足！Fortinet：8成企業遭受資安威脅
https://www.bnext.com.tw/article/69257/cybersecurity-fortinet-report

華邦電推進45奈米Nor flash製程開發資安產品需求看好
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=c5c74867-8480-4226-9fac-10c95ad688bb

微軟加碼在台投資透過首座微軟雲端資料中心加速培育數位轉型人才
https://www.managertoday.com.tw/articles/view/65106

微軟與財團法人電信技術中心雙管齊下推動5G專網資安
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=41&id=0000635152_Z6628WXK4EO1583WIFEJB

精誠(6214)旗下恆逸成台灣首家Aruba國際認證授權教育訓練中心
https://fnc.ebc.net.tw/fncnews/content/150641

恆逸成為首家台灣Aruba國際認證授權教育訓練中心
https://www.storm.mg/stylish/4341920

中華電信500M以上客戶淨增3成 WiFi全屋通淨增台數55％
https://turnnewsapp.com/livenews/finance/A79860002022051816345041

逸盈科技成為 Noname Security 臺灣授權代理商
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/906C2FDE919A47FCA15D60F741822220

AI、HPC、資安將成COMPUTEX數位轉型解決方案熱門項目
https://wantrich.chinatimes.com/news/20220519900420-420501

全面升級！MailGates 6.0 高效抵禦社交工程、BEC、APT 攻擊守護企業資安
https://www.openfind.com.tw/taiwan/news_detail.php?news_id=10317

Palo Alto Networks呼籲網安產業採用零信任、零例外ZTNA 2.0
https://news.sina.com.tw/article/20220519/41866934.html

中華電信連續兩年取得Azure Expert MSP最高階專業認證
https://times.hinet.net/news/23923260

Sophos 2022年勒索軟體現況報告揭露勒索軟體攻擊
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=60&id=0000635343_4J44YW4V39A5GP4LJP2KT

Sophos 揭密流動性挖礦 CryptoCrime 的手法
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9869

中華資安國際：結合滲透測試、紅隊演練服務，提高資安防線的強韌度
https://www.owlting.com/news/articles/97832

最先進的防護與效能，以滿足5G、邊緣運算與持續增加頻寬的規定。Radware 推出 Terabit 等級 DDoS 緩解平台
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/3E323235C03C4949B03651321676B887

Superhub x VMware助各類企業打造Work Smarter雲端方案
https://www.wepro180.com/superhub_vmware_220505/

G.政府
「單一性別做決策會產生盲點」國防院學者杜貞儀：國安領域也需男女平等參與
https://watchout.tw/reports/5EhBdt76F2Ko2LW6JHb9

資策會大改組織架構，宣示轉型為第三方協力機構
https://technews.tw/2022/05/19/organizational-adjustment-of-the-iii/

資策會設2大研究院拚薪資看齊國際
https://wantrich.chinatimes.com/news/20220520900048-420501

資安螺絲鬆了？　「台灣好玩卡」官網驚見五星旗
https://www.ftvnews.com.tw/news/detail/2022519P12M1

台波舉行經貿諮商會議　簽署三份合作備忘錄達成共識
https://beanfun.com/articles/detail/1526507736206938112?country=tw&site=1

台波蘭簽訂三大合作備忘錄　聚焦半導體、電動車盼台商投資
https://finance.ettoday.net/news/2253224

我布建低軌衛星專家示警與國際接軌問題
https://www.rti.org.tw/news/view/id/2133114

低軌通訊衛星技術、人才與資安不可缺
https://reurl.cc/GxjWzv

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability
https://thehackernews.com/2022/05/zyxel-releases-patch-for-critical.html

駭客可遠端解鎖特斯拉還開走！研究員推估：至少 200 萬輛受威脅
https://auto.ltn.com.tw/news/20340/3

手機鑰匙很方便，駭客偷車更easy ! 來看如何在10 秒內開走一輛Tesla Model Y
https://reurl.cc/55vYOy

藍牙 LE 被發現有資安問題，恐衝擊包括家用與車用的智慧門鎖
https://www.cool3c.com/article/177395

SEMI E187 訂下半導體資安標準，為何這可能是台灣半導體設備商競爭力突破點
https://buzzorange.com/techorange/2022/05/18/semi-e187/

電動車轉型腳步跟不上歐洲車廠！英國智庫：倒數三名全是日本品牌
https://auto.ltn.com.tw/news/20324/3

網絡安全專家發現特斯拉無鑰匙系統可被攻破部分功能可被強制控制
https://reurl.cc/q5VQGE

憂台海危機造成半導體斷鏈，傳美日將深化先進半導體合作研發與製造、防止中國竊密
https://www.thenewslens.com/article/166929

防半導體供應斷鏈美歐將設早期預警系統
https://www.worldjournal.com/wj/story/121209/6317647

I.教育訓練
物聯網時代的15堂資安基礎必修課 (Practical Iot Hacking: The Definitive Guide to Attacking the Internet of Things)
https://www.tenlong.com.tw/products/9786263241756?list_name=p-r-zh_tw

中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

沙崙資安基地線上免費資安課程多的是你不知道的事-揭秘OSINT 2022/5/24
https://bit.ly/3vDkjYO

釣魚釣魚釣到你_白帽駭客教你如何利用人性弱點突破防禦 2022/5/25
http://www.cs.thu.edu.tw/web/news/detail.php?id=4129

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

「零信任資安時代下的機會與挑戰」論壇 (線上) 2022/5/26
https://seminars.tca.org.tw/D15t00933.aspx

從 ISO 合規看企業設備資安管理 - 線上研討會 2022/5/26
https://jamf.kktix.cc/events/jamfnation-compliance-webinar

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=course_index

【公益資訊安全講座】－【非營利組織的個資與資安防護觀念建立】 2022/06/01
https://taiwanngo.tw/Post/81845

HITCON FreeTalk 2022 - 烏俄網路戰 & CTF 經驗分享 2022/6/6
https://hitcon.kktix.cc/events/hitcon-freetalk-2022

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

醫療資安女力論壇 2022/6/11
https://isipevent.kktix.cc/events/e58d0573-copy-1

資訊安全管理(週日班) 2022/7/3 ~ 2022/8/28
https://mymcu.mcu.edu.tw/zh-hant/product/e022205151

創科資訊②⓪②②軟體開發實戰訓練營➠線上實習說明會 2022/7/6
https://trunk-studio.kktix.cc/events/monosparta-code-camp-2022-9

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/5/9 ~ 2022/5/13

noreply@blogger.com (Unknown) — Fri, 13 May 2022 14:28:00 +0000

資安事件新聞週報 2022/5/9 ~ 2022/5/13

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布 NFV 基礎軟體的安全性更新
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9

駭客透過F5的BIG-IP重大漏洞進行破壞性攻擊，意圖清除該系統上的所有檔案
https://www.bleepingcomputer.com/news/security/critical-f5-big-ip-vulnerability-targeted-by-destructive-attacks/

F5 Networks之BIG-IP產品存在高風險安全漏洞(CVE-2022-1388)
https://www.klcg.gov.tw/tw/education/3522-254843.html

F5 修補重大的BIG-IP遠端執行漏洞，概念性驗證攻擊程式即將現身
https://www.ithome.com.tw/news/150831

F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
https://www.exploit-db.com/exploits/50932

兩家資安業者發現BIG-IP系統重大漏洞極為容易利用，呼籲用戶儘速修補
https://www.bleepingcomputer.com/news/security/exploits-created-for-critical-f5-big-ip-flaw-install-patch-immediately/

HP修補逾200款HP電腦與筆電的韌體漏洞，若不修補，恐被攻擊者取得作業系統核心權限執行程式碼
https://www.bleepingcomputer.com/news/security/hp-fixes-bug-letting-attackers-overwrite-firmware-in-over-200-models/

HP修補波及逾200款裝置的BIOS漏洞
https://www.ithome.com.tw/news/150889

研究人員揭露Zyxel防火牆遠端命令注入漏洞，並指控廠商未經公告就上架修補程式恐讓用戶曝險
https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/

Zyxel資安公告：針對防火牆系統命令注入漏洞 (Command Injection)
https://www.zyxel.com/tw/zh/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml

微軟發布5月例行修補，修補75個漏洞，其中3個為零時差漏洞
https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2022-patch-tuesday-fixes-3-zero-days-75-flaws/

搶修已被開採零日漏洞！微軟釋出Windows 系統最新安全更新
https://3c.ltn.com.tw/news/49044

Microsoft Mitigates RCE Vulnerability Affecting Azure Synapse and Data Factory
https://thehackernews.com/2022/05/microsoft-mitigates-rce-vulnerability.html

駭客利用IceApple漏洞利用工具包攻擊Exchange伺服器
https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf

Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting (XSS) (CVE-2022-22345)
https://www.ibm.com/support/pages/node/6584451?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

ESET發現百款Lenovo（聯想）筆記型電腦內含UEFI漏洞
https://reurl.cc/Kb0RYq

Intel修補UEFI韌體高風險漏洞
https://www.securityweek.com/intel-patches-high-severity-vulnerabilities-bios-boot-guard

套件管理平臺RubyGems出現可用來竄改套件的漏洞
https://www.bleepingcomputer.com/news/security/check-your-gems-rubygems-fixes-unauthorized-package-takeover-bug/

威聯通視訊監控錄影系統存在漏洞，恐被用於RCE攻擊
https://www.qnap.com/en/security-advisory/qsa-22-07

Google Chrome 78.0.3904.70 - Remote Code Execution
https://www.exploit-db.com/exploits/50917

Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
https://www.exploit-db.com/exploits/50914

ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
https://www.exploit-db.com/exploits/50904

SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
https://www.exploit-db.com/exploits/50900

GitLab 14.9 - Stored Cross-Site Scripting (XSS)
https://www.exploit-db.com/exploits/50889

Gitlab 14.9 - Authentication Bypass
https://www.exploit-db.com/exploits/50888

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
法規鬆綁金融商機更寬廣　案例說明雲端成創新關鍵主要挑戰決定轉型方向　雲服務貼近金融需求
https://www.netadmin.com.tw/netadmin/zh-tw/trend/392FF20CBA514EDEB61332CF4B8A3310

Android and Chrome Users Can Soon Generate Virtual Credit Cards to Protect Real Ones
https://thehackernews.com/2022/05/blog-post.html

防信用卡個資被竊，Google推出虛擬信用卡功能
https://times.hinet.net/topic/23910266

臺灣銀行招考新進人員　正備取合計312名
https://www.1111.com.tw/news/jobns/145556

金管會副主委邱淑貞：我國電商平台保單銷售已逾5億美元
https://reurl.cc/M08gdK

全球人壽啟動ESG教育訓練逾千名員工線上完成
https://ec.ltn.com.tw/article/breakingnews/3924179

使用手機報稅先等等，留意「前、中、後」三大注意事項
https://orange.udn.com/orange/story/121415/6297911

金控祭高薪獵人頭高階資安警官爆出走潮
https://times.hinet.net/news/23905626

嘆「辦案有份升官沒缺」紛轉職　他推掉千萬邀約只為3個字
https://www.mirrormedia.mg/story/20220509soc004/

3.電子支付/行動支付/pay/資安
「全盈+PAY」行動支付上線！全家 App 變身微型銀行亮點一次看
https://applealmond.com/posts/142744

已經有 FamiPay，全家為何再推出「全盈+PAY」？拆解超商二哥的電支布局
https://www.managertoday.com.tw/articles/view/65102

支付工具太多？俏媽咪一招縮短結帳時間
https://ctee.com.tw/industrynews/technology/641428.html

歐盟認為蘋果在 iOS 裝置限制 PayPal 等第三方電子錢包競爭能力讓 Apple Pay 取得電子支付競爭優勢
https://www.cool3c.com/article/176717

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
As NFT Sales Continue to Plummet, Is the Bubble About To Burst
https://stephenmoore.medium.com/as-nft-sales-continue-to-plummet-is-the-bubble-about-to-burst-19b78fac4403

Stop Creating Those 10,000 NFT Collections
https://medium.com/@h.ansel/stop-creating-those-10-000-nft-collections-8f28c5b020f

幾秒內超隱私資料被看光光！解析在踏入元宇宙前，一定要知道的資安危機
https://buzzorange.com/techorange/2022/05/11/web3-information-security/

解讀拜登行政命令：影響全球加密貨幣監管的歷史性里程碑
https://www.cw.com.tw/article/5121119

可以「炫耀」NFT的冷錢包！當NFT泡沫湧現之際，SecuX為何勇敢推出新產品
https://meet.bnext.com.tw/articles/view/49067

比特幣交易額1日可達10億！台最大虛擬交易所籲政府成立目的事業主管機關
https://www.storm.mg/article/4327798?page=1

OpenSea推出NFT檢測與帳戶驗證功能！提高數位市場真實性
https://times.hinet.net/news/23910590

比特幣大騙局：竊盜、駭客、投機者，加密貨幣交易所Mt. Gox的腐敗運作與破產真相
https://www.books.com.tw/products/0010924768

三箭資本CEO談「LUNA崩盤」：相信LUNA社區，將盡我所能提供幫助
https://news.cnyes.com/news/id/4873086

法拉利官網子域被駭客劫持發布欺詐NFT騙局
https://amp-news.cnyes.com/news/id/4866387

Otherdeed系列NFT 24小時交易額增幅達49.44%
https://news.cnyes.com/news/id/4866521

數據：一匿名地址將2萬枚ETH轉移至幣安
https://news.cnyes.com/news/id/4866689

安全團隊：SeaHorseArmyNFT的discord遭駭客入侵
https://news.cnyes.com/news/id/4866863

美國制裁加密貨幣混幣平臺Blender
https://www.ithome.com.tw/news/150828

安全團隊：GraBoys NFT的管理員discord賬號遭駭客盜取
https://amp-news.cnyes.com/news/id/4866929

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
日本服飾品牌思夢樂遭網攻勒索　旗下2200家店受波及
https://www.appledaily.com.tw/international/20220511/3ZNQJIYLNRDJZF6ZJDL7E6IMTM/

日本服飾業者思夢樂傳出遭勒索軟體LockBit 2.0攻擊
https://www3.nhk.or.jp/news/html/20220510/k10013620031000.html

伊朗駭客鎖定德國汽車產業散布竊密程式
https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/

美國林肯學院因勒索軟體攻擊被迫閉校
https://www.bleepingcomputer.com/news/security/lincoln-college-to-close-after-157-years-due-ransomware-attack/

安卓木馬FluBot透過多媒體簡訊向芬蘭散布
https://www.kyberturvallisuuskeskus.fi/fi/varoitus_1/2022

駭客組織Bitter鎖定孟加拉散布木馬程式
https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html

木馬程式Nerbian RAT鎖定義大利、西班牙、英國而來
https://www.proofpoint.com/us/blog/threat-insight/nerbian-rat-using-covid-19-themes-features-sophisticated-evasion-techniques

後門程式BPFDoor鎖定Linux與Solaris主機而來
https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malware-bypasses-firewalls-for-remote-access/

伊朗駭客利用Windows內建的磁碟加密工具，對美國組織發動勒索軟體攻擊
https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us

有人提供駭客打造惡意軟體KurayStealer的框架工具，使得衍生的變種接連出現
https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks

惡意軟體工具包Eternity供駭客購買竊密程式、蠕蟲、勒索軟體
https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/

哥斯大黎加遭 Conti 勒贖攻擊，全國進入緊急狀態
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9855

跡象顯示勒索軟體REvil駭客組織復活
https://www.ithome.com.tw/news/150907

新報告發現 REvil 勒索軟件可能正捲土重來
https://unwire.pro/2022/05/13/fresh-ransomware-samples-indicate-revil-is-back/security/

美國農業設備製造商AGCO遭勒索軟體攻擊
https://news.agcocorp.com/news/agco-announces-ransomware-attack

Government Sector Cyber Threat Intel - Key Insights (April 2022)
https://otx.alienvault.com/pulse/62793cb07a4f302772f424ba

Operation (Dragon) EviLoong: The Electronic Party of "Borderless" Hackers
https://mp-weixin-qq-com.translate.goog/s/K1uBLGqD8kgsIp1yTyYBfw?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

Massive spread of the JesterStealer malware using chemical attack themes
https://cert.gov.ua/article/40135

SEO Poisoning - A Gootloader Story
https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/

Quantum Locker Ransomware
https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware

Emotet: New Delivery Mechanism to Bypass VBA Protection
https://www.netskope.com/blog/emotet-new-delivery-mechanism-to-bypass-vba-protection
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Emotet/IOCs/2022-05-06

BPFDoor: Chinese tool almost undetected for FIVE years is second BPF-based attack this year
https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896
https://github.com/Neo23x0/signature-base/blob/master/yara/mal_lnx_implant_may22.yar
https://github.com/GossiTheDog/ThreatHunting/blob/master/YARA/BPFDoor-Unknown.yar

REvil Development Adds Confidence About GOLD SOUTHFIELD Reemergence
https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence

Dirty Deeds Done Dirt Cheap: Russian RAT Offers Backdoor Bargains
https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains

From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
https://www.sentinelone.com/blog/from-the-front-lines-unsigned-macos-orat-malware-gambles-for-the-win/

Examining the Black Basta Ransomware’s Infection Routine
https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html

Critical F5 BIG-IP Vulnerability
https://isc.sans.edu/diary/rss/28624
https://blog.talosintelligence.com/2022/05/threat-advisory-critical-f5-big-ip-vuln.html
https://unit42.paloaltonetworks.com/cve-2022-1388/

Operation RestyLink: Targeted attack campaign targeting Japanese companies
https://insight--jp-nttsecurity-com.translate.goog/post/102ho8o/operation-restylink?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en

A closer look at Eternity Malware
https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/?utm_source=Social&utm_medium=Twitter&utm_campaign=Eternity+Malware&utm_id=Malware+

APT34 targets Jordan Government using new Saitama backdoor
https://blog.malwarebytes.com/threat-intelligence/2022/05/apt34-targets-jordan-government-using-new-saitama-backdoor/
https://www.fortinet.com/blog/threat-research/please-confirm-you-received-our-apt

Bitter APT adds Bangladesh to their targets
https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html

Iceapple: A novel Internet Information Services (IIS) post-exploitation framework
https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf

Nerbian RAT Using COVID-19 Themes Features Sophisticated Evasion Techniques
https://www.proofpoint.com/us/blog/threat-insight/nerbian-rat-using-covid-19-themes-features-sophisticated-evasion-techniques

Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding
https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encoding-decoding/

InfoSec Handlers Diary Blog - SANS Internet Storm Center
https://isc.sans.edu/diary/rss/28636

Public Cloud Cybersecurity Threat Intelligence (202204)
https://otx.alienvault.com/pulse/627bc2acc45f0ce91ba52a06

The Trojan subscribers Joker, MobOk, Vesub and GriftHorse
https://securelist.com/mobile-subscription-trojans-and-their-tricks/106412/

Iranian Hackers Leveraging BitLocker and DiskCryptor in Ransomware Attacks
https://thehackernews.com/2022/05/iranian-hackers-leveraging-bitlocker.html

Researchers Warn of Nerbian RAT Targeting Entities in Italy, Spain, and the U.K
https://thehackernews.com/2022/05/researchers-warn-of-nerbian-rat.html

Malicious NPM Packages Target German Companies in Supply Chain Attack
https://thehackernews.com/2022/05/malicious-npm-packages-target-german.html

New REvil Samples Indicate Ransomware Gang is Back After Months of Inactivity
https://thehackernews.com/2022/05/new-revil-samples-indicate-ransomware.html

Experts Detail Saintstealer and Prynt Stealer Info-Stealing Malware Families
https://thehackernews.com/2022/05/experts-detail-saintstealer-and-prynt.html

Another Set of Joker Trojan-Laced Android Apps Resurfaces on Google Play Store
https://thehackernews.com/2022/05/another-set-of-joker-trojan-laced.html

Ukrainian CERT Warns Citizens of a New Wave of Attacks Distributing Jester Malware
https://thehackernews.com/2022/05/ukrainian-cert-warns-citizens-of-new.html

U.S. Offering $10 Million Reward for Information on Conti Ransomware Hackers
https://thehackernews.com/2022/05/us-offering-10-million-reward-for.html

Phishing Campaign Delivering Three Fileless Malware
https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware

Malicious Compiled HTML Help File Delivering Agent Tesla
https://unit42.paloaltonetworks.com/malicious-compiled-html-help-file-agent-tesla/

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
發表會最大驚奇！Google 提前自爆下一代旗艦手機 Pixel 7 細節
https://3c.ltn.com.tw/news/49064

【Google I/O 2022】追求更美、更隱私、更安全，Android 13 新 Beta 版開放下載
https://www.inside.com.tw/article/27651-google-io-2022-5-android-13-beta

6款APP快刪！駭客入侵「這款藏30追蹤器」下載破9億
https://reurl.cc/d2DgDy

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
臺灣百貨業者資安曝險，電子郵件安全、帳密外洩待改善
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9844

2021年網路犯罪造成全球損失逾6兆美元
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=dd887391-ecb5-4f3d-b098-2f081d952a83

尋找資安長/金控祭高薪挖角資安好手，為什麼波麗士大人這麼吃香
https://money.udn.com/money/story/5613/6305410

尋找資安長/不是誰來都行，資安長的條件有這三個
https://money.udn.com/money/story/5613/6305419

有人假冒德國企業的名義發布惡意NPM套件，經追查竟是紅隊演練公司所為，引起爭議
https://jfrog.com/blog/npm-supply-chain-attack-targets-german-based-companies/

華裔美籍工程師竊可口可樂機密意圖使中國企業獲利遭判14年徒刑
https://www.cna.com.tw/news/acn/202205100046.aspx

伊朗駭客組織APT34使用後門程式Saitama向約旦外交單位發動攻擊
https://blog.malwarebytes.com/threat-intelligence/2022/05/apt34-targets-jordan-government-using-new-saitama-backdoor/

美國、英國、歐盟提出證據並指控俄羅斯是衛星網路Ka-Sat攻擊事件的幕後黑手
https://www.bleepingcomputer.com/news/security/us-eu-blame-russia-for-cyberattack-on-satellite-modems-in-ukraine/

戰火延燒到太空！美軍證實：俄羅斯攻擊GPS系統
https://news.ltn.com.tw/news/world/breakingnews/3924810

俄侵烏前夕對歐發動網攻
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1502164&type=universal

俄國最大影音平台被駭 90％備份資料被毀匿名者：會讓網站永久消失
https://news.ltn.com.tw/news/world/breakingnews/3925755

駭客入侵俄羅斯的智慧電視系統，在節目表中顯示反戰標語
https://reurl.cc/VDLg76

韓國加入CCDCOE給我們的省思
https://talk.ltn.com.tw/article/paper/1516828

匿名者告誡中國勿犯台小心中國航母遼寧號沉沒
https://reurl.cc/vd72vN

黑客組織警告：北京不要愚蠢侵台
https://www.soundofhope.org/post/618931?lang=b5

美國中情局局長：北京正仔細研究並汲取俄烏戰爭教訓以便應用在攻台戰計畫上
https://www.cmmedia.com.tw/home/articles/33727

中國官方發布網路直播強化未成年人保護規範將禁止未成年人參與直播贊助
https://gnn.gamer.com.tw/detail.php?sn=231558

E.U. Proposes New Rules for Tech Companies to Combat Online Child Sexual Abuse
https://thehackernews.com/2022/05/eu-proposes-new-rules-for-tech.html

E.U. Blames Russia for Cyberattack on KA-SAT Satellite Network Operated by Viasat
https://thehackernews.com/2022/05/eu-blames-russia-for-cyberattack-on-ka.html

Thousands of WordPress Sites Hacked to Redirect Visitors to Scam Sites
https://thehackernews.com/2022/05/thousands-of-wordpress-sites-hacked-to.html

Everything We Learned From the LAPSUS$ Attacks
https://thehackernews.com/2022/05/everything-we-learned-from-lapsus.html

Bitter APT Hackers Add Bangladesh to Their List of Targets in South Asia
https://thehackernews.com/2022/05/bitter-apt-hackers-add-bangladesh-to.html

U.S. Proposes $1 Million Fine on Colonial Pipeline for Safety Violations After Cyberattack
https://thehackernews.com/2022/05/us-proposes-1-million-fine-on-colonial.html

Experts Sound Alarm on DCRat Backdoor Being Sold on Russian Hacking Forums
https://thehackernews.com/2022/05/experts-sound-alarm-on-dcrat-backdoor.html

資安駐點工程師-ACSI
https://www.linkedin.com/jobs/view/%E8%B3%87%E5%AE%89%E9%A7%90%E9%BB%9E%E5%B7%A5%E7%A8%8B%E5%B8%AB-acsi-at-acer-3070417652/?originalSubdomain=tw

資安系統工程師
https://www.cakeresume.com/companies/yhisec/jobs?locale=id

資安系統工程師
https://www.cakeresume.com/companies/yhisec/jobs/information-security-system-engineer

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
新一波釣魚攻擊，鎖定官方認證 Twitter 帳號
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9853

網傳圖卡：「PCR測試故意損害或破壞Amygdala（杏仁核）...如果受損，恐懼就不能被感知。永遠不要讓孩子挖鼻孔接受測試」
https://tfc-taiwan.org.tw/articles/7328

快篩劑贈友邦遭曲解外交部籲防中共認知戰
https://reurl.cc/VDLg6A

防中收集個資美擬推新規嚴堵
https://ctee.com.tw/news/china/642404.html

拜登政府起草新行政命令阻中國取得美民眾個資
https://www.cna.com.tw/news/aopl/202205120067.aspx

蘋果、亞馬遜遭調查！英國會議員：秘密收集數據恐危害隱私
https://reurl.cc/1Z1Eem

Apple ID 爆出大規模帳密外流危機！開啟『雙重認證』來帳號提升安全性
https://agirls.aotter.net/post/60730

蘋果爆大量個資外洩「Apple ID遭駭」 3步驟提升帳號安全
https://www.ettoday.net/news/20220508/2246313.htm

蘋果爆Apple ID集體遭駭！大量網友出現登入位置在中國「3招搶救」
https://3c.ltn.com.tw/news/48996

我的帳號密碼有外洩嗎？這 4 個工具幫你檢測帳號密碼安全性
https://applealmond.com/posts/143717

國台辦稱願協助取快篩陸委會酸：藉快篩分化台灣仍可慶祝母親節
https://cnews.com.tw/215220508a01/

洩漏判決書草稿大法官遭政治操作
https://www.worldjournal.com/wj/story/121201/6297218

FBI 全新 IDLE 專案透過“虛假資料”幫助公司欺騙駭客 | 每日安全資訊
https://sa123.cc/wcii6dx22h0wmgl7orpi.html

駭客釣魚郵件新工具，利用 Google SMTP服務漏洞發送欺詐郵件
https://www.techbang.com/posts/96001-google-smtp-services-are-exploited-to-send-fraudulent-emails

駭客假借馬斯克的名義來行加密貨幣詐騙
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/crypto-scammers-exploit-talk-on-cryptocurrency/

FBI：去年網絡詐騙導致全球損失 69 億美元
https://unwire.pro/2022/05/10/fbi-cyber-scams-cost-victims-6-9b-plus-worldwide-in-2021/security/

E.研究報告/工具
企業進軍元宇宙！勤業眾信公布 2022 六大數位媒體趨勢
https://finance.technews.tw/2022/05/11/six-digital-media-trends/

烏克蘭網路攻擊事件影響分析
https://ieknet.iek.org.tw/iekrpt/rpt_more.aspx?actiontype=rpt&indu_idno=3&domain=66&rpt_idno=320942940

讓我們來告訴你什麼是弱點掃描
https://www.pumo.com.tw/security/whatIsWebScan.jsp

Introducing Flutter 3
https://medium.com/flutter/introducing-flutter-3-5eb69151622f

10 Python Automation Scripts for Your Daily Problems
https://python.plainenglish.io/10-python-automation-scripts-for-your-daily-problems-aefb502969e2

BITB (browser in the browser)Attack
https://infosecwriteups.com/bitb-browser-in-the-browser-attack-e2008c405701

THE 15 BEST Chrome Extensions for 2022
https://bdarfler.medium.com/the-16-bestchrome-extensions-for-2022-b14e3bd08001

A Super-Fast Way to Loop in Python
https://towardsdatascience.com/a-super-fast-way-to-loop-in-python-6e58ba377a00

Python: Scrape Any Website in Seconds with One Line of Code
https://medium.com/@alains/python-scrape-any-website-in-seconds-with-one-line-of-code-574e4bd57005

Introduction to GIT
https://medium.com/ntust-aivc/introduction-to-git-66473777b9b3

What is an API
https://medium.com/codex/lets-learn-build-and-sell-an-api-a12b0d7b4c2

REST API
https://medium.com/@ugur.suicmez/rest-api-a25d6b638723

How to learn anything fast, no matter what your brain condition is
https://medium.com/illumination/how-to-learn-anything-fast-no-matter-what-your-brain-condition-is-e3ffd9bf7e12

Stop using Alpine Docker images
https://medium.com/inside-sumup/stop-using-alpine-docker-images-fbf122c63010

Why the Raspberry Pi should be your next home server
https://medium.com/the-pi-project/why-the-raspberry-pi-should-be-your-next-home-server-e901e796e7a6

Developing a Money-Making Telegram Bot on Python. Part 1
https://medium.com/codex/developing-a-money-making-telegram-bot-on-python-pt-1-a19fae54d3f

90 % of Javascript Developer fail to answer these code snippets (Asked in Interview) Part-1
https://vineetmishrahbk.medium.com/90-of-javascript-developer-fail-to-answer-these-code-snippets-asked-in-interview-436e00ec1287

Automate 4 Boring Tasks in Python with 5 Lines of Code
https://medium.com/geekculture/automate-4-boring-tasks-in-python-with-5-lines-of-code-55901b3cd5dc

Top 15 IT Certifications in 2022
https://arctutorials.medium.com/top-15-it-certifications-in-2022-97a1538f7c81

How Your Metamask Got Hacked (Probably)
https://medium.com/coinmonks/how-your-metamask-got-hacked-probably-795abca4534a

Bypassing Login Page in 2 Mins
https://aravind07.medium.com/bypassing-login-page-in-2-mins-5b773d46f4d

Automate Alert Triage and Response Tasks with Intezer EDR Connect
https://www.intezer.com/blog/incident-response/alert-triage-edr-integrations/?utm_medium=email

How to Write YARA Rules That Minimize False Positives
https://www.intezer.com/blog/threat-hunting/yara-rules-minimize-false-positives/?utm_medium=email&utm_source=hs_email

How to Analyze Malicious PDF Files
https://www.intezer.com/blog/incident-response/analyze-malicious-pdf-files/?utm_medium=email&utm_source=hs_email

Top Cyber Threats to the Telecom Industry
https://www.intezer.com/blog/incident-response/cyber-threats-telecom-industry/?utm_medium=email&utm_source=hs_email

Modern SOC Analyst Workflows
https://www.youtube.com/watch?v=JZm0WwDAFM0

Threat Hunting Tutorial- Day3, Hunt for LoLbas in Splunk, Intezer
https://www.youtube.com/watch?v=P6Ozw93cHYA

Discord Infostealers: How hackers steal your password
https://www.youtube.com/watch?v=3GW1QqPNLig

5 Benefits of Detection-as-Code
https://thehackernews.com/2022/05/5-benefits-of-detection-as-code.html

SHIELDS UP in bite sized chunks
https://thehackernews.com/2022/05/shields-up-in-bite-sized-chunks.html

F.商業
網路即安全 Aruba ClearPass強化網路存取的安全性和合規性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9851

Citrix 推出以意圖為基礎的新世代應用與安全交付解決方案
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9849

安克諾斯Acronis Cyber Protect Cloud為MSP服務供應商提供整合資安平台
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9850

精誠總代理Nozomi networks成為CISA首家資安合作夥伴
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000634717_LK362NT42VVJ8164QVILT

設備不只要硬規格更須看軟實力　智能儲存解救變局生存危機中小企業靠資料逆風求勝　以PowerStore力拚未來
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/338D6780EE2E49D890EE5E6EE98EE0A4

偉康科技打造雲端身分認證SaaS服務
https://wantrich.chinatimes.com/news/20220512900063-420101

全新 Synology RT6600ax Wi-Fi 6 三頻無線路由器：超凡效能、安全連網、方便管理三位一體，以軟體多樣性實現全能化的網路控管中心
https://www.techbang.com/posts/96147-synology-rt6600ax-wi-fi-6-wireless-router-review

原IBM全球資訊科技服務部門　Kyndryl結盟夥伴拓展新業務金融受兩大重點監管　適地適性上雲應全面考量
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/2D5314B763174C3A926240BC40265CF4

A10 Networks公布網路威脅研究調查 2021全球DDoS攻擊暴增100％
https://reurl.cc/d2Dgq2

微軟推出網絡安全服務協助客戶對抗勒索軟體和其他攻擊
https://news.cnyes.com/news/id/4868213

G.政府
李明哲曝中國曾暗示「認間諜罪」　國台辦：不實之詞不值一評
https://www.mirrormedia.mg/story/20220511edi014/

劉櫂豪督促NCC委辦計畫　應審慎辦理受委辦機構不得再委外
https://www.ettoday.net/news/20220512/2249703.htm

公務員初考、升官等考試　112年起刪除公文格式用語
https://www.1111.com.tw/news/jobns/145575

苗栗縣府活動官網變色情網站　簡體字宣傳「嫩模浪叫」
https://www.setn.com/News.aspx?NewsID=1110335

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
醫療轉型臨床5大資安危機，兼顧資安防護與醫療效能是關鍵
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9845

趨勢科技成立新公司VicOne，著眼車聯網資安
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9848

智慧機械、5G及資安產品投資抵減辦法出爐資誠解析重點
https://times.hinet.net/news/23908494

車用資安產學對接企業應以「精準資安」為目標
https://www.digitimes.com.tw/iot/article.asp?cat=158&id=0000635246_Q9Y3KER53WNF5E7Y8T3VQ

是時候制定物聯網安全標準
https://www.eettaiwan.com/20220512nt31-it-s-about-time-for-iot-security-standards/

UWB、BLE、NFC，使用哪種技術的數位車鑰更安全一點
https://www.techbang.com/posts/96295-talk-about-the-potential-safety-risks-of-digital-car-keys

車聯網啟動更安全、高效率的智慧交通新時代
https://www.eettaiwan.com/20220512nt1x-techtaipei-iov-and-smartcar/

車聯網：「邊緣運算」上路奔馳
https://www.eettaiwan.com/20220513nt31-iov-become-edge-computing-equipment/

DLINK DAP-1620 A1 v1.01 - Directory Traversal
https://www.exploit-db.com/exploits/50919

DLINK DIR850 - Open Redirect
https://www.exploit-db.com/exploits/50907

DLINK DIR850 - Insecure Access Control
https://www.exploit-db.com/exploits/50906

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

工控系統資安安全線上論壇 2022/5/16
https://www.ctsp.gov.tw/chinese/01-News/01-online_view.aspx?v=1&fr=1000&no=1001&sn=15005

網路自由小聚 [5月] 大家來開講：數位發展部行不行 2022/5/19
https://ocftw.kktix.cc/events/internetfreedom-may2022

沙崙資安基地線上免費資安課程多的是你不知道的事-揭秘OSINT 2022/5/24
https://bit.ly/3vDkjYO

釣魚釣魚釣到你_白帽駭客教你如何利用人性弱點突破防禦 2022/5/25
http://www.cs.thu.edu.tw/web/news/detail.php?id=4129

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

從 ISO 合規看企業設備資安管理 - 線上研討會 2022/5/26
https://jamf.kktix.cc/events/jamfnation-compliance-webinar

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=course_index

HITCON FreeTalk 2022 - 烏俄網路戰 & CTF 經驗分享 2022/6/6
https://hitcon.kktix.cc/events/hitcon-freetalk-2022

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

醫療資安女力論壇 2022/6/11
https://isipevent.kktix.cc/events/e58d0573-copy-1

創科資訊②⓪②②軟體開發實戰訓練營➠線上實習說明會 2022/7/6
https://trunk-studio.kktix.cc/events/monosparta-code-camp-2022-9

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/5/2 ~ 2022/5/6

noreply@blogger.com (Unknown) — Fri, 06 May 2022 15:49:00 +0000

資安事件新聞週報 2022/5/2 ~ 2022/5/6

1.重大弱點漏洞/後門/Exploit/Zero Day
F5 BIG-IP 多版本存在安全性弱點
https://support.f5.com/csp/article/K23605346

Cisco 近日發布更新以解決多個產品的安全性弱點
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-security-bypass-JhOd29Gg

Linux 系統拉警報！全新 Nimbuspwn 漏洞讓駭客成功獲取系統最高權限
https://technews.tw/2022/05/03/new-nimbuspwn-linux-vulnerability-gives-hackers-root-privileges/

Google修補Chrome逾30個漏洞，當中7個存在重大風險
https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html

Google Releases Android Update to Patch Actively Exploited Vulnerability
https://thehackernews.com/2022/05/google-releases-android-update-to-patch.html

微軟修補Azure PostgreSQL租戶隔離漏洞
https://www.wiz.io/blog/wiz-research-discovers-extrareplica-cross-account-database-vulnerability-in-azure-postgresql/

TLStorm 2.0漏洞波及Aruba、Avaya交換器
https://www.armis.com/blog/tlstorm-2-nanossl-tls-library-misuse-leads-to-vulnerabilities-in-common-switches/

北韓駭客DarkSeoul利用Log4Shell漏洞入侵VMware遠距工作平臺
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/stonefly-north-korea-espionage

Critical RCE Bug Reported in dotCMS Content Management Software
https://thehackernews.com/2022/05/critical-rce-bug-reported-in-dotcms.html

Critical TLStorm 2.0 Bugs Affect Widely-Used Aruba and Avaya Network Switches
https://thehackernews.com/2022/05/critical-tlstorm-20-bugs-affect-widely.html

Unpatched DNS Related Vulnerability Affects a Wide Range of IoT Devices
https://thehackernews.com/2022/05/unpatched-dns-related-vulnerability.html

Which Hole to Plug First? Solving Chronic Vulnerability Patching Overload
https://thehackernews.com/2022/05/which-hole-to-plug-first-solving.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
報稅季線上申報留意自我資安防護檢測
https://turnnewsapp.com/livenews/finance/A07659002022050312300874

百年行庫從ATM案重生，一銀跨域挖角救火力挽狂瀾
https://times.hinet.net/news/23895014

矽谷搶華爾街午餐！　陳冲：十年來「純網銀」命運最坎坷
https://finance.ettoday.net/news/2242858?redirect=1

網攻逐年增加，「零信任安全」概念打造金融資安聯防網，徹底防駭
https://www.bnext.com.tw/article/68959/finance-security-twb

將來銀行爆帳務異常狂發「扣款未成功」簡訊硬拗系統優化
https://www.wealth.com.tw/articles/d5521c6c-5c1e-4fe8-a569-5bbbffa04e02

強化上市櫃資安措施政策大公開，提供資通安全管控指引，推動加入情資分享平臺
https://www.ithome.com.tw/news/150803

手機報稅全攻略 3認證5步驟完成
https://reurl.cc/GxEabZ

為何我的無框行動門號無法進行手機報稅? 手機報稅須知
https://www.kocpc.com.tw/archives/439491

3.電子支付/行動支付/pay/資安
歐盟認為蘋果在 iOS 裝置限制 PayPal 等第三方電子錢包競爭能力讓 Apple Pay 取得電子支付競爭優勢
https://www.cool3c.com/article/176717

iPhone悠遊卡NFC功能有望實現？歐盟控蘋果NFC 行動支付壟斷
https://mrmad.com.tw/eu-controls-apples-nfc-payment-monopoly

方保僑：香港電子支付市場洗牌
https://reurl.cc/loep5Y

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Blockchain layers (L0, L1, L2, L3) in a Diagram
https://medium.com/@nick.5montana/blockchain-layers-l0-l1-l2-l3-in-a-diagram-569162398db

Why blockchain and Web3 user interfaces will suck for a while
https://uxdesign.cc/why-blockchain-and-web-3-user-interfaces-will-suck-for-a-while-7575b7515757

驚悚趣聞？「北韓駭客」來面試區塊鏈工程師是一種怎樣的體驗
https://www.blocktempo.com/i-think-i-just-interviewed-a-north-korean-hacker/

駭客竊取的 3 億美元等值比特幣遭沒收，暗網「絲路」創辦人的賠償金不用還了
https://www.inside.com.tw/article/27543-silk-road-ross-ulbricht-debt-bitcoin-siezure

NEAR 彩虹橋攻擊始末：駭客未得逞反損失 2.5 枚以太幣
https://blockcast.it/2022/05/03/hacker-lost-2-5-eth-due-to-a-failed-attack-on-the-near-protocol-rainbow-bridge/

一夜歸零！穩定幣項目Cashio遭駭客攻擊
https://reurl.cc/QLbVEp

虛擬貨幣玩家必備？軍規安全等級「大螢幕」電子硬體錢包，讓你的數位資產更安全
https://www.gq.com.tw/gadget/article/secux

「無聊猿」BAYC交易總額突破20億美元
https://news.cnyes.com/news/id/4862526

Yuga Labs元宇宙Otherside虛擬地塊Otherdeed NFT交易量突破20萬枚ETH
https://news.cnyes.com/news/id/4863127

買NFT沒有買到JPG嗎？談BAYC無聊猿藏家的模糊高度權利開放，到Koda的版權規則明朗化
https://news.cnyes.com/news/id/4864458

Cronos 上 DeFi 協議 MM.Finance 遭到前端攻擊，損失超 200 萬美元
https://news.cnyes.com/news/id/4864978?exp=a

什麼是加密貨幣挖礦（Crypto Mining）？新手挖礦掏金前需要知道的幾件事
https://blog.trendmicro.com.tw/?p=71744

電子支付最後一哩路央行數位貨幣見雛形
https://vip.udn.com/vip/story/121938/6262361

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
微軟關閉VBA使Emotet改用新手法感染用戶
https://www.ithome.com.tw/news/150714

殭屍網路Emotet改用Excel外掛發動攻擊
https://www.proofpoint.com/au/blog/threat-insight/emotet-tests-new-delivery-techniques

安全團隊：駭客團伙利用惡意的 npm 包盜取助記詞和數字資產
https://news.cnyes.com/news/id/4862406

中國駭客Moshen Dragon操弄防毒軟體元件，利用DLL側載的方式執行後門程式
https://reurl.cc/q5NKVg

勒索軟體Magniber以Windows 10更新名義散布
https://reurl.cc/vdWKaL

OpenSSF推出能檢測惡意NPM與PyPI套件的工具
https://github.com/ossf/package-analysis/blob/main/docs/case_studies.md

勒索軟體REvil重出江湖，研究人員發現新的惡意軟體檔案
https://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-back/

Avast防蠕蟲元件遭到勒索軟體AvosLocker濫用，用於停用防毒軟體，並掃描Log4Shell漏洞
https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html

勒索軟體Black Basta竄改傳真服務並在安全模式執行
https://blog.minerva-labs.com/new-black-basta-ransomware-hijacks-windows-fax-service

駭客以AWS的名義上傳2個惡意NPM套件
https://www.whitesourcesoftware.com/resources/blog/aws-targeted-by-a-package-backfill-attack/

中Windows更新勒索病毒大崩潰！別想救回網勸1退路
https://3c.ltn.com.tw/news/48972

Windows用戶小心被騙！勒索病毒利用更新入侵要贖金
https://reurl.cc/OA4R97

北韓駭客Lazarus利用多種勒索軟體發動攻擊
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-hermit-kingdoms-ransomware-play.html

網路圖書館應用程式Onleihe供應商遭到勒索軟體LockBit攻擊
https://www.bleepingcomputer.com/news/security/online-library-app-onleihe-faces-issues-after-cyberattack-on-provider/

駭客以無聊猿的名義向圖像創作者散布惡意軟體
https://blog.malwarebytes.com/scams/2022/05/fake-cyberpunk-ape-executives-target-artists-with-malware-laden-job-offer/

研究人員發起Malvuln專案，找尋勒索軟體的漏洞來阻止攻擊行動
https://www.malvuln.com/

Mustang Panda deploys a new wave of malware targeting Europe
https://blog.talosintelligence.com/2022/05/mustang-panda-targets-europe.html

NetDooka Framework Distributed via PrivateLoader Malware as Part of Pay-Per-Install Service
https://www.trendmicro.com/en_us/research/22/e/netdooka-framework-distributed-via-privateloader-ppi.html

Raspberry Robin gets the worm early
https://redcanary.com/blog/raspberry-robin/

Old Services, New Tricks: Cloud Metadata Abuse by UNC2903
https://www.mandiant.com/resources/cloud-metadata-abuse-unc2903

The strange link between a destructive malware and a ransomware-gang linked
custom loader: IsaacWiper vs Vatet
https://reurl.cc/RrXk36

A new secret stash for “fileless” malware
https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/

Password protected Excel spreadsheet pushes Remcos RAT
https://isc.sans.edu/diary/rss/28616

A new BluStealer Loader Uses Direct Syscalls to Evade EDRs
https://blog.minerva-labs.com/a-new-blustealer-loader-uses-direct-syscalls-to-evade-edrs

Analyzing BlackByte Ransomware Go-Based Variants
https://www.zscaler.com/blogs/security-research/analysis-blackbyte-ransomwares-go-based-variants

Backdoor disguised as a document editing and messenger program (*.chm)
https://asec.ahnlab.com/ko/33948/

Update on cyber activity in Eastern Europe
https://otx.alienvault.com/pulse/6272996039678903e0b73dd5

UAC-0056 cyberattack using GraphSteel and GrimPlant malware and COVID-19
https://cert.gov.ua/article/39882

AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell
https://reurl.cc/0pXWrA

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware
https://documents.trendmicro.com/assets/txt/earth-berberoka-domains-2.txt
https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad
https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/

UNC3524: Eye Spy on Your Email
https://www.mandiant.com/resources/unc3524-eye-spy-email

Researchers Disclose Years-Old Vulnerabilities in Avast and AVG Antivirus
https://thehackernews.com/2022/05/researchers-disclose-10-year-old.html

Researchers Warn of 'Raspberry Robin' Malware Spreading via External Drives
https://thehackernews.com/2022/05/researchers-warn-of-raspberry-robin.html

Experts Analyze Conti and Hive Ransomware Gangs' Chats With Their Victims
https://thehackernews.com/2022/05/experts-analyze-conti-and-hive.html

AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection
https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html

Here's a New Tool That Scans Open-Source Repositories for Malicious Packages
https://thehackernews.com/2022/05/heres-new-tool-that-scans-for-malicious.html

Hackers Using PrivateLoader PPI Service to Distribute New NetDooka Malware
https://thehackernews.com/2022/05/hackers-using-privateloader-ppi-service.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Google to Add Passwordless Authentication Support to Android and Chrome
https://thehackernews.com/2022/05/google-to-add-passwordless.html

Google Releases First Developer Preview of Privacy Sandbox on Android 13
https://thehackernews.com/2022/05/google-releases-first-developer-preview.html

西班牙首相和防長手機發現間諜軟體
https://reurl.cc/7Dpb7y

不再隱藏！微軟網頁版App商店終於有「最後更新日期」
https://3c.ltn.com.tw/news/48923

「使用手機等於同意接受跟監」——美國發明這 APP，讓你取回自身隱私的控制權
https://buzzorange.com/citiorange/2022/05/05/phone-privacy-information-security/

中國京東方擅改iPhone OLED設計，遭蘋果抓包導致暫停生產
https://www.bnext.com.tw/article/69002/boe-changed-iphone-oled-design

日線上醫療「 LINE Doctor 」診療件數再創新高！3 亮點：免群聚、輕症分流、幼兒安心
https://www.inside.com.tw/article/27559-line-doctor-20times-onlinemed-omicron

蘋果Apple Silicon處理器存在Augury漏洞，恐洩露準備要執行的命令
https://www.prefetchers.info/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
台灣第一隊！如梭世代團隊入選國際資安機構弱點研究成員
https://www.ettoday.net/news/20220504/2244175.htm

台灣資安新秀成軍3年　被國際漏洞揭露計畫招為No.1管理者
https://www.ctwant.com/article/181687

前高中生黑帽駭客今變CNA資安專家漏洞通報全球資料庫
https://udn.com/news/story/7315/6291363

當雲端環境出現挖礦活動,對企業是一種警訊
https://blog.trendmicro.com.tw/?p=72183

資安長該擔心的不只資料外洩或勒索病毒, 別忽略「礦坑的金絲雀」－加密貨幣挖礦
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9843

新興地下商業模式:專賣企業網路存取權限的 AaaS ,五個資安長 (CISO) 該知道的防禦策略
https://blog.trendmicro.com.tw/?p=71956

鴻海研究院執行長李維斌：AI塑造的環境就像是廚房，駭客蟑螂找到價值就會攻擊
https://www.thenewslens.com/article/166369

評鑑台灣百貨業者資安防護力，網站、電郵安全性最弱
https://technews.tw/2022/05/03/department-store-security/

駭客有多神祕？可以確定跟電影演的不一樣
https://www.gvm.com.tw/article/89500

駭客到底有多賺錢？抓1個漏洞最高拿260萬元
https://www.gvm.com.tw/article/89501

曝露於網際網路的資料庫於自2021年開始不斷增加
https://www.group-ib.com/media/public-facing-db/

Atlassian斷線事件影響775家客戶
https://www.ithome.com.tw/news/150708

SolarWinds 駭客這次進攻iOS 設備，竊取果粉網站登入資訊
https://techtagtw.com/results/086674a4a51f325b63d5

OpenSea官方Discord遭遇駭客攻擊，放出與YouTube合作相關釣魚鏈接
https://news.cnyes.com/news/id/4865772

美軍方社群網站帳號遭駭客入侵
https://reurl.cc/2ZmlGa

傳真社新聞通訊系統網站及內部系統受駭客入侵逾3700電郵被存取
https://reurl.cc/ErRbY0

網路間諜藉由Exchange伺服器竊密，並攻擊網路視訊設備
https://www.mandiant.com/resources/unc3524-eye-spy-email

俄羅斯駭客APT29濫用工作行程安排平臺Trello發動攻擊
https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns

駭客空前攻擊俄國疲於應付
https://news.ltn.com.tw/news/world/paper/1515054

「匿名者」挺烏克蘭讓俄羅斯成「紙老虎」？慘遭3股境外駭客勢力圍剿
https://www.ftvnews.com.tw/news/detail/2022503W0046

烏情報主管：普廷死後戰爭才能結束
https://ec.ltn.com.tw/article/breakingnews/3913914

俄遇空前駭客攻擊浪潮普京或勝利日正式宣戰摩爾多瓦恐遭入侵北京開緊急會議
https://www.soundofhope.org/post/617707?lang=b5

香港無線新聞連發「詭異推播」疑遭駭客警介入調查
https://reurl.cc/j1Gm3m

無綫新聞App連發異常推送訊息 TVB：網罪科今午已到辦公室蒐證
https://reurl.cc/yrMKvD

準備隨時接管洗腦？香港TVB連發詭異推播
https://www.ntdtv.com/b5/2022/05/03/a103416896.html

TVBS難道也有駭客入侵的問題嗎
https://www.readgov.com/8560/

中國駭客Naikon攻擊南亞軍事單位，植入滲透測試工具Viper
https://cluster25.io/2022/04/29/lotus-panda-awake-last-strike/

韓國執法部門逮捕2名朝鮮駭客資助的間諜
https://news.cnyes.com/news/id/4863410

北韓駭客利用VMware Log4j漏洞，駭入美國防、能源業的工程合作廠商
https://www.ithome.com.tw/news/150749

俄羅斯駭客針對羅馬尼亞政府發動DDoS攻擊
https://www.sri.ro/articole/atacuri-cibernetice-asupra-site-urilor-unor-institutii-publice-si-financiar-bancare.html

CrowdStrike的Docker蜜罐發現兩個可能引發阻斷服務的映像檔，疑似鎖定俄羅斯、白俄羅斯政府機關
https://www.crowdstrike.com/blog/compromised-docker-honeypots-used-for-pro-ukrainian-dos-attack/

美報告再揭中國政府駭客竊密涉及國防產業逾30家企業受害
https://news.ltn.com.tw/news/world/breakingnews/3915448

所有單位統一用國產電腦網民爆料中共實施安可計畫
https://www.soundofhope.org/post/618220?lang=b5

北京擬令各機關和國企全面汰除外國電腦消除資安疑慮
https://www.worldjournal.com/wj/story/121347/6293807

美媒提前披露布林肯演講內容仍定位中共是美最大威脅
https://www.soundofhope.org/post/618280?lang=b5

南韓加入北約網路防禦中心　強化網路防衛力
https://www.upmedia.mg/news_info.php?Type=3&SerialNo=144033

NIST Releases Updated Cybersecurity Guidance for Managing Supply Chain Risks
https://thehackernews.com/2022/05/nist-releases-updated-guidance-for.html

Chinese Hackers Caught Stealing Intellectual Property from Multinational Companies
https://thehackernews.com/2022/05/chinese-hackers-caught-stealing.html

Ukraine War Themed Files Become the Lure of Choice for a Wide Range of Hackers
https://thehackernews.com/2022/05/ukraine-war-themed-files-become-lure-of.html

Chinese Hackers Caught Exploiting Popular Antivirus Products to Target Telecom Sector
https://thehackernews.com/2022/05/chinese-hackers-caught-exploiting.html

Chinese "Override Panda" Hackers Resurface With New Espionage Attacks
https://thehackernews.com/2022/05/chinese-override-panda-hackers.html

Russian Hackers Targeting Diplomatic Entities in Europe, Americas, and Asia
https://thehackernews.com/2022/05/russian-hackers-targeting-diplomatic.html

Experts Uncover New Espionage Attacks by Chinese 'Mustang Panda' Hackers
https://thehackernews.com/2022/05/experts-uncover-new-espionage-attacks.html

NIST Releases Updated Cybersecurity Guidance for Managing Supply Chain Risks
https://thehackernews.com/2022/05/nist-releases-updated-guidance-for.html

資訊系統工程師(山鶯)-IIS(OA資安)_某知名公司 (3005767)
https://headhunt.com.tw/Pages/job-description.aspx?id=3005767

【知名外商網路資安軟體公司】軟體測試工讀生
https://www.104.com.tw/job/7mek1

台中大軟體公司資安主管
https://www.104.com.tw/job/7mg0i

MIS 程式設計師
https://www.104.com.tw/job/7meew

【資安所】資安生態推動人員
https://www.104.com.tw/job/7mfx3

資安軟體-業務工程師
https://www.104.com.tw/job/7mg22

新手網路資安工程師
https://www.1111.com.tw/job/98768986/

資安威脅與調查分析工程師
https://www.104.com.tw/job/7mj3y

資訊安全主管人員_某知名公司 (3004391)
https://headhunt.com.tw/pages/job-description.aspx?id=3004391

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
SEC Plans to Hire More Staff in Crypto Enforcement Unit to Fight Frauds
https://thehackernews.com/2022/05/sec-plans-to-hire-more-staff-in-crypto.html

網購詐騙再現！5大高風險電商曝　來電出現「+」就要當心
https://www.setn.com/News.aspx?NewsID=1109208

「你被加入高級會員」迪卡儂消費者遭詐50萬
https://reurl.cc/2Zmlm9

網路報稅成趨勢　會計師提醒：小心6跡象、駭客竊個資
https://finance.ettoday.net/news/2242689

手機報稅夯，KPMG：留意三大安全要點，防駭客竊個資
https://www.bnext.com.tw/article/68935/tax-return-0503

好萊塢名媛大量私密裸照外流囂張駭客再盜她數百萬元
https://reurl.cc/e3OVyj

小白機蒐1.7億筆個資 17房仲灌錄程式獲緩起訴
https://www.chinatimes.com/realtimenews/20220503004876-260402?chdtv

駭客濫用Google的SMTP中繼服務發送釣魚郵件
https://www.avanan.com/blog/the-gmail-smtp-relay-service-exploit

五大高風險電商 Q1發生1127詐騙
https://udn.com/news/story/7320/6281303?from=udn_ch2_menu_v2_main_cate

英國健保局有上百名員工的帳號遭駭，被用來發送網釣郵件
https://www.ithome.com.tw/news/150772

別當詐騙集團提款機，趨勢科技教你網路報稅如何顧資安
https://technews.tw/2022/05/05/scam-tax/

網傳購物網站「緊急通知！輝瑞新冠口服特效藥正式上線治療率達89%可降低重症感染以及死亡率」
https://tfc-taiwan.org.tw/articles/7301

網傳殯儀館燒不停調查局：疑境外勢力造假
https://www.rti.org.tw/news/view/id/2131952

多個 NFT 平台上的創作者遭釣魚惡意軟體攻擊
https://www.twcert.org.tw/tw/cp-104-6093-de801-1.html

新一波釣魚攻擊，鎖定官方認證 Twitter 帳號
https://www.twcert.org.tw/tw/cp-104-6092-c7c57-1.html

Yahoo交易安全中心提醒：注意釣魚網站與詐騙手法
https://reurl.cc/vdWEny

第一季詐騙高風險賣場出爐　假冒客服人員3月騙529件
https://beanfun.com/articles/detail/1520762648084353024?country=tw&site=446

E.研究報告/工具
研究報告:駭客集團入侵大量雲端機器挖礦圖利,對企業造成那些影響
https://blog.trendmicro.com.tw/?p=72196

微軟 Edge 新增免費 VPN 服務，臨時安全上網的方便選擇
https://technews.tw/2022/05/05/for-security-microsoft-edge-provides-free-vpn/

GitHub 將在 2023 年前強制所有貢獻者啟用雙重驗證
https://unwire.pro/2022/05/05/github-2/security/

資安學習路上-怎麼開始的
https://ithelp.ithome.com.tw/articles/10284928?sc=rss.qu

TikTok事件，是資安保護？還是政治打劫
https://vocus.cc/article/626f9d2cfd89780001bfb8bc

資安學習路上-Linux基礎與Web基礎
https://www.potatomedia.co/post/164f7462-23df-4e82-a8c5-3ffa49105aa2
https://www.potatomedia.co/post/2b271fb6-1d12-40ab-9bba-36bf6db32f5a

如何啟用Windows的動態鎖定功能
https://www.techbang.com/posts/95157-how-to-enable-the-dynamic-lock-feature-of-windows

擔心系統「遭小偷」，怎麼靠備份還原防止駭客入侵
https://www.bnext.com.tw/article/68991/hacker-proof-dep-backup-nick

軍備藍圖失竊？報告揭中駭客竊密壯大經濟，美歐亞企業受害
https://open.firstory.me/story/cl2srswz5006i01yo0s8t9n85

疫情驅動雲端化應用成顯學　企業重新奪回資安風險控制點 SASE融合網路安全　雲端服務保護混合辦公
https://www.netadmin.com.tw/netadmin/zh-tw/trend/0553A593737F49ACAD8714E603ECE06E

收購手段補強微分段技術　持續擴展SASE框架機制邊緣至地端東西向防護　落實零信任網路存取
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/D0048821033D4D9EBD121A191CA68897

10 Books Every Senior Engineer Should Read
https://semaphoreci.medium.com/10-books-every-senior-engineer-should-read-a61c1917e2a7

I Switched Password Managers and It Changed Everything
https://medium.com/macoclock/i-switched-password-managers-and-it-changed-everything-9b0417fe64a

Python Alpha 5 is HERE! 5 Promising Features that will blow your mind
https://medium.com/@Sabrina-Carpenter/python-alpha-5-is-here-5-promising-features-that-will-blow-your-mind-a4abd406d0ad

Renegotiate the web “bargain” by blocking all ads
https://doctorow.medium.com/renegotiate-the-web-bargain-by-blocking-all-ads-93844287566f

LinkedIn Is No Longer a Professional Networking Site
https://medium.com/artistic-mystic-soul/linkedin-is-no-longer-a-professional-networking-site-3ed273b05872

top 10 Android libraries
https://medium.com/localazy/top-10-android-libraries-to-boost-your-development-in-2022-3ec37fce8c22

A Bug Bounty Hunter’s Guide to IDOR Vulnerabilities
https://medium.com/@daniel.j.hunt/an-bug-bounty-hunters-guide-to-idor-vulnerabilities-27012bbccd7

Published in CodeX
https://medium.com/codex/lets-learn-build-and-sell-an-api-a12b0d7b4c2

Build Your first CI/CD Pipeline in Azure DevOps
https://qatechtalks.medium.com/build-your-first-ci-cd-pipeline-in-azure-devops-5bd3408f36ff

THE 15 BEST Chrome Extensions for 2022
https://bdarfler.medium.com/the-16-bestchrome-extensions-for-2022-b14e3bd08001

Spotify: UX Research case study
https://medium.com/@jainanumeha74/spotify-ux-research-case-study-68997acf20f1

How to learn anything fast, no matter what your brain condition is
https://medium.com/illumination/how-to-learn-anything-fast-no-matter-what-your-brain-condition-is-e3ffd9bf7e12

8 amazing Open Source projects
https://medium.com/codex/part-2-8-best-open-source-projects-you-should-try-out-6de58feba631

Train your computer vision models atleast 2X faster by making these small changes
https://akhilprasannan.medium.com/train-your-computer-vision-model-least-2x-by-making-these-small-changes-db801e7b22ad

10 Automation Scripts for Your Daily Python Projects
https://python.plainenglish.io/10-automation-scripts-for-your-daily-python-projects-892a82be3f75

Everything That You Didn’t Know About The Dark Web But Should
https://medium.com/illumination/everything-that-you-didnt-know-about-the-dark-web-but-should-24ecb4c501a

The Importance of Defining Secure Code
https://thehackernews.com/2022/05/the-importance-of-defining-secure-code.html

Heroku Forces User Password Resets Following GitHub OAuth Token Theft
https://thehackernews.com/2022/05/heroku-forces-user-password-resets.html

How to make Excel look less like… Excel
https://datastudio.medium.com/how-to-make-excel-look-less-like-excel-8eb91b75ab8f

Top 5 FREE Cyber Security Certifications
https://medium.com/@sam5epi0l/top-5-free-cyber-security-certifications-ac06fe46309c

F.商業
雲世代的資安治理需與企業商業決策並行
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9836

Check Point Research：全球三分之二 Android 使用者恐面臨隱私洩露風險
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9839

東捷資訊一站式供應鏈整合管理平台為製造業打造合規安全的供應鏈生態系
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9842

SailPoint推出雲端身分安全治理組合方案全新模組
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9841

漢領國際總代理Perception Point 防禦即服務 Prevention as a Service
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9837

訊連加入FIDO聯盟，致力打造安全簡易的數位身份驗證
https://www.techbang.com/posts/95940-cyberlink-joins-fido-alliance

研發擴展雲端資安服務能量　統一政策監控防破口遭滲透端到端整合安全連線存取　實踐零信任邊緣架構
https://www.netadmin.com.tw/netadmin/zh-tw/trend/B7A9171CF1774A9DB4763B41B31DC649

快速還原機制不難打造！企業如何從勒索攻擊中全身而退
https://buzzorange.com/techorange/2022/05/05/commvault-it/

Microsoft 365、Azure即將允許不同帳號間一鍵切換
https://www.ithome.com.tw/news/150709

義美高志明站台！完成近 6,000 萬元募資，池安科技瞄準「後量子密碼技術」
https://technews.tw/2022/05/03/chelpis-post-quantum-cryptography-aorta/

免費G-Suite企業版6月1日自動改成付費Workspace，新增免費使用方案
https://www.ithome.com.tw/news/150722

Nozomi Networks成為CISA首家資安合作夥伴
https://tw.systex.com/nozomi-networks-cisa/

中華電組織轉型最後一塊拼圖成立資訊技術分公司
https://news.cnyes.com/news/id/4863678

Citrix 全新以意圖為基礎的新世代應用與安全交付解決方案
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/4EC424B8D273420D8C017FC3EA223A83

Noname Security 主動偵測找出 API 資安威脅，打造專屬的 API 資安平台
https://www.netfos.com.tw/Projects/netfos/pages/product/Noname.html

IBM 宣布推出新一代快閃儲存產品，因應當前資安挑戰
https://technews.tw/2022/05/05/ibm-flashsystem-cyber-vault/

網路即安全 Aruba ClearPass強化網路存取的安全性和合規性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9851

G.政府
副總統：臺灣發展新安全產業是天時、地利、人和
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9840

資安威脅政府單位首當其衝事前監控才能有效防堵
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000634250_F673SSGK47YQNK1ILPR3H

《李忠憲專欄》1922 資料庫
https://taronews.tw/2022/05/02/829215/

民調駭客頻干擾惹民怨民進黨屏東縣黨部譴責此風不可長
https://reurl.cc/n1Oldn

調查局公布科、組長等34人職務調動
https://news.ltn.com.tw/news/society/breakingnews/3913699

PCR結果收不到？指揮中心：手機號碼填寫一定要正確
https://news.ltn.com.tw/news/life/breakingnews/3917549

台北市補助低收入戶買華為基進批把市民當韭菜
https://www.epochtimes.com/b5/22/5/6/n13728804.htm

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
趨勢科技攻車用資安 VicOne要做「電動車界莫德納」
https://www.chinatimes.com/realtimenews/20220504004925-260410?chdtv

用於嵌入式系統的程式庫存在DNS漏洞，恐波及數百萬物聯網設備
https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/

小心新DNS漏洞！數百萬路由器、IoT恐遭駭客攻擊
https://3c.ltn.com.tw/news/48955

大葉大學蔡渙良開發物聯網系統監測電力減少電器虛功
https://times.hinet.net/news/23891713

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
【資安系列講座】去中心化神話也暗藏危機? 區塊鏈安全線上講座 2022/5/7
https://hackersir.kktix.cc/events/20220507blockchain

Scala Taiwan Mokumoku #15 2022/5/7
https://www.meetup.com/Scala-Taiwan-Meetup/events/285310131/

Just a chat - with no Expectations 2022/5/7
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/285326731/

Empowering Yourself, Empowering Others | 一場蛻變的旅程 | Part 1 2022/5/8
https://www.meetup.com/Women-Who-Code-Taipei/events/285321784/

K12的科技教育-除了程式還可以教什麼 2022/5/9
https://www.meetup.com/rladies-taipei/events/284421238/

資安社 - 大學之道: 數位時代的資安素養入門-認識資安搶旗賽、參賽經驗分享 2022/5/11
https://nsysuisc.kktix.cc/events/20220511ctf

沙崙資安基地線上免費資安課程個人資料盤點暨風險評鑑實務 2022/5/12
https://bit.ly/3kcdoRg

Taipei Creative Coders Meetup #17 2022/5/13
https://www.meetup.com/tpecreativecoders/events/285540074/

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

工控系統資安安全線上論壇 2022/5/16
https://www.ctsp.gov.tw/chinese/01-News/01-online_view.aspx?v=1&fr=1000&no=1001&sn=15005

沙崙資安基地線上免費資安課程多的是你不知道的事-揭秘OSINT 2022/5/24
https://bit.ly/3vDkjYO

釣魚釣魚釣到你_白帽駭客教你如何利用人性弱點突破防禦 2022/5/25
http://www.cs.thu.edu.tw/web/news/detail.php?id=4129

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=course_index

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/4/25 ~ 2022/4/29

noreply@blogger.com (Unknown) — Sat, 30 Apr 2022 10:06:00 +0000

資安事件新聞週報 2022/4/25 ~ 2022/4/29

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://tools.cisco.com/security/center/publicationListing.x

惡意軟體檢測平臺VirusTotal出現RCE漏洞
https://www.cysrc.com/blog/virus-total-blog/

仍有大量用戶使用存在Log4Shell漏洞的Log4j
https://www.rezilion.com/log4shell-4-months-later/

又有駭客鎖定4月初VMware公布身分驗證系統的漏洞，發動惡意軟體攻擊
https://blog.morphisec.com/vmware-identity-manager-attack-backdoor

Iranian Hackers Exploiting VMware RCE Bug to Deploy 'Core Impact' Backdoor
https://thehackernews.com/2022/04/iranian-hackers-exploiting-vmware-rce.html

Microsoft Azure Vulnerability Exposes PostgreSQL Databases to Other Customers
https://thehackernews.com/2022/04/microsoft-azure-vulnerability-exposes.html

威聯通呼籲用戶停用AFP通訊協定，避免NAS遭到Netatalk元件的漏洞波及
https://www.qnap.com/zh-tw/security-advisory/qsa-22-12

Linux弱點Nimbuspwn可被攻擊者用於提升權限
https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with Known Vulnerabilities
https://www.ibm.com/support/pages/node/6574787?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
(CVE-2022-22345, CVE-2020-8022, CVE-2021-33813, CVE-2020-9488)
https://www.ibm.com/support/pages/node/6574453?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security Bulletin: Multiple vulnerabilities in Linux Kernel affect
IBM QRadar SIEM (CVE-2021-22543, CVE-2021-3653, CVE-2021-3656, CVE-2021-37576)
https://www.ibm.com/support/pages/node/6576215?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Everything you need to know to create a Vulnerability Assessment Report
https://thehackernews.com/2022/04/everything-you-need-to-know-to-create.html

NPM弱點可讓駭客為套件任意新增維護者，嫁禍他人
https://blog.aquasec.com/npm-package-planting

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages
https://thehackernews.com/2022/04/npm-bug-allowed-attackers-to-distribute.html

Atlassian Drops Patches for Critical Jira Authentication Bypass Vulnerability
https://thehackernews.com/2022/04/atlassian-drops-patches-for-critical.html

7-Zip 被爆零日漏洞，攻擊者可提權並執行程式碼
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9819

Drupal 近日發布更新以解決產品的安全性弱點
https://www.drupal.org/sa-core-2022-009

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
台灣的銀行業務效率超低？BBC專文探討：彷彿回到1980年代
https://times.hinet.net/news/23882201

不是專業證照｜金融業徵才　這張最重要
https://www.appledaily.com.tw/gadget/20220429/Z5LDRNGTZVFA3FBYDQUTVZWQ5M/

金融業求才若渴會外語、懂資安最吃香
https://www.epochtimes.com/b5/22/4/29/n13723513.htm

手機報稅2.0，掃臉、按指紋就能直接報稅！金融業都導入的FIDO是什麼
https://www.bnext.com.tw/article/68897/cathay-holdings-fido

金管會開放證券期貨業資料共享首案採核准制
https://www.cna.com.tw/news/afe/202204280388.aspx

架設10G高速光纖網路彰銀建置自動化攻擊防護系統
https://reurl.cc/k1L25x

3.電子支付/行動支付/pay/資安
手機報稅刷哪張卡，哪種Pay最划算？電支、銀行優惠懶人包來了
https://www.bnext.com.tw/article/68839/file-taxes-discount

有圖！13個App、3行動支付可手機繳稅　郵局要繞道台灣Pay
https://finance.ettoday.net/news/2232729

全盈支付一上線就有1萬家店！全家如何說服玉山、網家、全聯結盟
https://www.cw.com.tw/article/5120942?template=transformers

非現金交易行動支付占45％最高
https://ec.ltn.com.tw/article/paper/1510830

蘋果涉壟斷歐盟再提訴訟
https://reurl.cc/6ZDML5

電子支付、禁入醫院外送國家隊將成軍
https://reurl.cc/Xjlg5a

防疫減少現金交易議員：推電子支付
https://reurl.cc/M0kgXm

3家第三方支付快被金管會納管！　去年代收付款日均額超過10億
https://finance.ettoday.net/news/2233406

日本Uber Eats攜手樂天將可使用樂天Pay電子支付服務
https://news.cnyes.com/news/id/4854994

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Critical Bug in Everscale Wallet Could've Let Attackers Steal Cryptocurrencies
https://thehackernews.com/2022/04/critical-bug-in-everscale-wallet.html

幣託交易所追求永續用戶資產與個資安全為先
https://news.cnyes.com/news/id/4860601

跨國元宇宙智庫成立期盼就科技治理規範凝聚國際共識
https://times.hinet.net/news/23888166

資安廠商發現漏洞後，Everscale 區塊鏈關閉其 web 版加密貨幣錢包
https://reurl.cc/A7RYxY

無聊猿猴IG帳號遭駭，駭客盜走粉絲近3百萬美元的NFT
https://www.ithome.com.tw/news/150623

Coinbase印度擴展受阻盧比電子支付被國家機器終止
https://reurl.cc/k1L2qG

電子支付最後一哩路央行數位貨幣見雛形
https://vip.udn.com/vip/story/121938/6262361

如何替加密貨幣訂出價值
https://www.ithome.com.tw/article/150702

DEUS Finance 遭攻擊、駭客竊走 1340 萬美元，代幣暴跌13%
https://www.blocktempo.com/derivatives-platform-deus-finance-exploited-for-13m/

加密貨幣背後的故事系列
https://vocus.cc/article/626a9cc6fd89780001835e49

帶動NFT熱潮再起，STEPN跑步賺幣，跑1天賺千元
https://www.gvm.com.tw/article/89419

以太坊共識層存款合約地址ETH餘額突破1200萬枚，已超當前ETH總量的 10%
https://news.cnyes.com/news/id/4861341

NFT遊戲183億加密貨幣失竊　FBI控北韓駭客犯案
https://news.tvbs.com.tw/world/1774272

史上最大加密幣竊盜案之一：北韓駭客盜走6億美元，投資人學到什麼教訓
https://www.storm.mg/lifestyle/4307830?page=1

Parity多簽錢包部分2017年被盜資金被轉入Tornado Cash
https://news.cnyes.com/news/id/4861947

派盾：DEUS Finance遭到攻擊，駭客獲利約1340萬美元
https://news.cnyes.com/news/id/4860497

Sky Mavis：長期目標是將網路驗證節點數量增加至超過 100 個
https://news.cnyes.com/news/id/4860349

「神鬼駭客」史諾登親自證實！他曾協助創建隱私幣 Zcash
https://blockcast.it/2022/04/28/edward-snowden-played-a-secret-role-in-the-creation-of-zcash/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
駭客利用IE漏洞投放竊密軟體RedLine
https://www.bitdefender.com/blog/labs/redline-stealer-resurfaces-in-fresh-rig-exploit-kit-campaign/

俄羅斯駭客鎖定電信業者散布惡意軟體DarkWatchman
https://securityintelligence.com/posts/hive00117-fileless-malware-delivery-eastern-europe/

勒索軟體Onyx鎖定大型檔案進行破壞
https://www.bleepingcomputer.com/news/security/psa-onyx-ransomware-destroys-large-files-instead-of-encrypting-them/

勒索軟體Black Basta很有可能是Conti另起爐灶
https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/

研究人員揭露Conti新的惡意軟體Bumblebee
https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming

美國牙醫協會遭到勒索軟體Black Basta攻擊
https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/

北韓駭客利用惡意軟體Goldbackdoor攻擊記者
https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/

AWS雲端服務的Log4Shell漏洞曾出現修補不全的狀況、勒索軟體REvil疑死灰復燃
https://reurl.cc/413723

擴散速度超快的「量子」勒索軟體不用4小時就感染全網域
https://reurl.cc/NAZd19

An Overview of the Increasing Wiper Malware Threat
https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat

LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility
https://reurl.cc/RrbmLe

Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/stonefly-north-korea-espionage

This isn't Optimus Prime's Bumblebee but it's Still Transforming
https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming

Destructive Malware Targeting Organizations in Ukraine
https://www.cisa.gov/uscert/ncas/alerts/aa22-057a

Qakbot Observed IOC - 2022-04-27
https://otx.alienvault.com/pulse/6269a15092a9c062b1c1f3f2

APT attack on a telecommunications company in Kazakhstan
https://st.drweb.com/static/new-www/news/2022/march/telecom_research_en.pdf

The ink-stained trail of GOLDBACKDOOR
https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf

Quantum Ransomware
https://thedfirreport.com/2022/04/25/quantum-ransomware/

Comprehensive Threat Intelligence: TeamTNT targeting AWS, Alibaba
https://blog.talosintelligence.com/2022/04/teamtnt-targeting-aws-alibaba.html

Cybercriminals Using New Malware Loader 'Bumblebee' in the Wild
https://thehackernews.com/2022/04/cybercriminals-using-new-malware-loader.html

New RIG Exploit Kit Campaign Infecting Victims' PCs with RedLine Stealer
https://thehackernews.com/2022/04/new-rig-exploit-kit-campaign-infecting.html

Chinese Hackers Targeting Russian Military Personnel with Updated PlugX Malware
https://thehackernews.com/2022/04/chinese-hackers-targeting-russian.html

Emotet Testing New Delivery Ideas After Microsoft Disables VBA Macros by Default
https://thehackernews.com/2022/04/emotet-testing-new-delivery-ideas-after.html

Gold Ulrick Hackers Still in Action Despite Massive Conti Ransomware Leak
https://thehackernews.com/2022/04/gold-ulrick-hackers-still-in-action.html

North Korean Hackers Target Journalists with GOLDBACKDOOR Malware
https://thehackernews.com/2022/04/north-korean-hackers-target-journalists.html

New BotenaGo Malware Variant Targeting Lilin Security Camera DVR Devices
https://thehackernews.com/2022/04/new-botenago-malware-variant-targeting.html

FBI Warns of BlackCat Ransomware That Breached Over 60 Organisations Worldwide
https://thehackernews.com/2022/04/fbi-warns-of-blackcat-ransomware-that.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Twitter's New Owner Elon Musk Wants DMs to be End-to-End Encrypted like Signal
https://thehackernews.com/2022/04/twitters-new-owner-elon-musk-wants-dms.html

Google's New Safety Section Shows What Data Android Apps Collect About Users
https://thehackernews.com/2022/04/googles-new-safety-section-shows-what.html

蘋果被App開發商爆料！強迫30天內更新App否則永久下架
https://times.hinet.net/news/23881507

IG用戶注意！出現這2情況恐有重大危機
https://reurl.cc/DyZE7d

夏威夷航空宣布成為第一家採用Starlink衛星連網服務的航空業者
https://mashdigi.com/hawaiian-airlines-to-offer-free-high-speed-starlink-internet-connectivity-on-transpacific-fleet/

高通、聯發科音訊解碼器有漏洞！　Android手機沒更新恐被駭
https://www.ettoday.net/news/20220428/2240064.htm

Check Point Research：全球三分之二 Android 使用者恐面臨隱私洩露風險
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9839

Apple 自助維修計劃正式在美國上線
https://hypebeast.com/zh/2022/4/apple-launches-diy-device-repair-service

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
日神社推「IT界專屬護身符」保佑電腦遠離中毒hang機惡運
https://reurl.cc/e3mAKm

駭客戳破謊言，大疆承認旗下產品資料傳輸沒加密
https://technews.tw/2022/04/29/dji-admitted-its-drones-are-not-encrypted/

上市櫃公司年報揭露資安作為，已有台積電、京城銀十多家企業公布
https://www.ithome.com.tw/news/150630

北市線上教學平臺酷課雲遭DDoS攻擊而停擺
https://tw.appledaily.com/life/20220426/KVUUKSFXO5AN5G7OQNCJAMVHQA/

駭客發動大規模的HTTPS加密流量DDoS攻擊
https://blog.cloudflare.com/15m-rps-ddos-attack/

全球約六分之一組織成為SpringShell攻擊目標
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9834

台灣資安主管聯盟正式成軍產官學研界齊讚聲
https://udn.com/news/amp/story/7239/6276321

台灣資安主管聯盟成軍盼縮小4萬人才缺口
https://reurl.cc/Lm7qEX

台灣資安主管聯盟成立 3年強化企業防護架構
https://ec.ltn.com.tw/article/breakingnews/3908938

因應資安成公司治理重要指標，14家上市櫃公司共同發起「臺灣資安主管聯盟」
https://www.youtube.com/watch?v=1Kyr-wyPyuU

糗了！台灣資安主管聯盟成立大會視訊斷線唐鳳笑回這也算資安
https://ec.ltn.com.tw/article/breakingnews/3908781

中共滲透東南亞和在美間諜活動同期被示警
https://www.epochtimes.com/b5/22/4/27/n13721723.htm

90後女生自述: 傳播翻牆了解的真相遭中共威脅恐嚇
https://www.soundofhope.org/post/616246?lang=b5

戰爭未必有煙硝味…你手中的貨幣可能是他國的武器　若中國人行這樣做，恐成台灣威脅
https://www.businesstoday.com.tw/article/category/183025/post/202204280033/

德國多家風力發電廠遭到網路攻擊，疑與俄羅斯駭客有關
https://www.ithome.com.tw/news/150625

情報單位、谷歌發警告：美遭惡劣網攻中國威脅最大
https://www.worldjournal.com/wj/story/121186/6276511

美國懸賞千萬美元追捕Sandworm駭客
https://www.ithome.com.tw/news/150654

美國務院懸賞千萬美金抓捕六名俄羅斯駭客
https://www.soundofhope.org/post/615892?lang=b5

中國駭客Mustang Panda鎖定俄羅斯政府官員發動網釣攻擊
https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx

駭客近半年來針對印度石油公司攻擊逾36萬次
https://www.livemint.com/technology/cyberattacks-rise-at-oil-firms-as-hackers-step-up-their-game-11650649127129.html

普丁把烏克蘭當成網攻的遊樂場？地緣政治資訊實戰
https://gvlf.gvm.com.tw/article/89393

俄大量網攻擾亂烏政軍經體系
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1500107

自俄烏開戰以來，至少有6個俄羅斯駭客集團針對烏克蘭發動逾200次攻擊
https://www.ithome.com.tw/news/150664

從烏克蘭戰爭開戰至今，俄羅斯駭客已攻擊烏克蘭237次
https://blogs.microsoft.com/on-the-issues/2022/04/27/hybrid-war-ukraine-russia-cyberattacks/

微軟報告：俄羅斯武攻、網攻齊下烏克蘭防禦力超預期
https://udn.com/news/story/122663/6276513?from=udn-catelistnews_ch2

WordPress網站再度成為駭客攻擊烏克蘭的工具，被用於感染用戶電腦發動DDoS攻擊
https://www.bleepingcomputer.com/news/security/ukraine-targeted-by-ddos-attacks-from-compromised-wordpress-sites/

涉為北韓竊情報南韓1名現役軍人與1名商人落網
https://www.cna.com.tw/news/aopl/202204290200.aspx

兩名韓國公民因幫助間諜獲取軍事機密而被指控
https://news.cnyes.com/news/id/4861619

南韓斬首部隊向北韓駭客洩密！收受巨額虛擬貨幣　駭取軍事情報
https://www.ettoday.net/news/20220430/2241056.htm

T-Mobile Admits Lapsus$ Hackers Gained Access to its Internal Tools and Source Code
https://thehackernews.com/2022/04/t-mobile-admits-lapsus-hackers-gained.html

Microsoft Discovers New Privilege Escalation Flaws in Linux Operating System
https://thehackernews.com/2022/04/microsoft-discovers-new-privilege.html

Microsoft Documents Over 200 Cyberattacks by Russia Against Ukraine
https://thehackernews.com/2022/04/microsoft-documents-over-200.html

Experts Detail 3 Hacking Teams Working Under the Umbrella of TA410 Group
https://thehackernews.com/2022/04/experts-detail-3-hacking-teams-working.html

Indian Govt Orders Organizations to Report Security Breaches Within 6 Hours to CERT-In
https://thehackernews.com/2022/04/indian-govt-orders-organisations-to.html

U.S. Offers $10 Million Bounty for Information on 6 Russian Military Hackers
https://thehackernews.com/2022/04/us-offers-10-million-bounty-for.html

資安工程師
https://www.104.com.tw/job/7m7x7

【Architect】Linux資安研發工程師
https://www.cakeresume.com/companies/teamt5-org-tw/jobs/dcf3c5?locale=zh-TW

資安工程師
https://hunter.104.com.tw/zh-cn/job/FG00005249

資安經理/副理 (跨國金控)
https://www.linkedin.com/jobs/view/%E8%B3%87%E5%AE%89%E7%B6%93%E7%90%86-%E5%89%AF%E7%90%86-%E8%B7%A8%E5%9C%8B%E9%87%91%E6%8E%A7-at-michael-page-3035616932/?originalSubdomain=tw

資安實習工程師
https://www.104.com.tw/job/7m9wu

資安工程師(駐點基隆)
https://www.104.com.tw/job/7mcik

資安開發工程師-ACSI
https://www.linkedin.com/jobs/view/%E8%B3%87%E5%AE%89%E9%96%8B%E7%99%BC%E5%B7%A5%E7%A8%8B%E5%B8%AB-acsi-at-acer-3050940666/?originalSubdomain=tw

資安服務工程師_某知名公司 (3005192)
https://headhunt.com.tw/Pages/job-description.aspx?id=3005192

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
駭客冒充執法官員竊取數據誘騙勒索！眾多科技巨頭受害
https://times.hinet.net/news/23884072

網傳網址「蔡英文的最新投資讓專家們感到敬畏，也讓大銀行產生恐慌」、「儘管不知道麥克風已經打開，但她的言論震驚了世界」
https://tfc-taiwan.org.tw/articles/7271

想刪除網路「隱私資訊」怎辦？Google：2條件優先
https://news.ebc.net.tw/news/living/314792

維護用戶隱私！Google宣布：允許刪除個人敏感資訊
https://times.hinet.net/news/23886314

駭侵團體宣稱駭入可口可樂，竊得大量機敏資訊
https://www.twcert.org.tw/tw/cp-104-6078-825c8-1.html

駭客組織聲稱入侵可口可樂，竊得161 GB資料
https://www.bleepingcomputer.com/news/security/coca-cola-investigates-hackers-claims-of-breach-and-data-theft/

北投麗禧酒店疑客戶個資外洩　買溫泉券竟被詐騙歹徒盯上成肥羊
https://beanfun.com/articles/detail/1518936108895834112?country=tw&site=446

在咖啡廳工作也會被竊取資料？公共 Wi-Fi 釀資安風險，用關鍵步驟加值個資保護層
https://buzzorange.com/techorange/2022/04/27/wife-infor/

美國法官下令，Uber提交2016年數據洩露事件相關記錄
https://news.knowing.asia/news/4600ba2f-15e1-4267-b4f3-b37491b5a71e

網路釣魚假冒 Facebook 攻擊手法翻新！防範臉書帳密遭盜用3招破解
https://3c.ltn.com.tw/news/48835

復仇者聯盟臥底阻詐騙香港仙股投資群組藏陷阱
https://times.hinet.net/news/23889203

E.研究報告/工具
所有人的零信任：實用指南
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9835

既有法遵面臨挑戰雲世代資安長如何應對
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=80&id=0000634213_DSW3A9HZ0TK4SM4Q3M2OK

傳統網路顯露疲態 SDN開啟下世代網路新革命
https://reurl.cc/A7RYmp

資安學習路上-怎麼開始的
https://www.potatomedia.co/post/68fa09d2-6a9f-411a-88ad-3b2a33771b33

資安長 (CISO) 該擔心的不只資料外洩或勒索病毒, 別忽略「礦坑的金絲雀」-加密貨幣挖礦
https://blog.trendmicro.com.tw/?p=71910

為何資安與 DevOps 的協作如此重要
http://www.omniwaresoft.com.tw/product-news/elastic-news/how-to-build-collaboration-across-security-and-devops/

Shiro550反序列化漏洞分析
https://mp.weixin.qq.com/s?__biz=Mzg2NjU0MjA0Ng==&mid=2247485888&idx=1&sn=71385d297e97bf118f50334664be9f31

滲透測試｜記一次bypass拿下主機過程
https://mp.weixin.qq.com/s?__biz=MzkwMDMxMzIzNA==&mid=2247488932&idx=1&sn=281c267970f5c0bceaefc111827827ed

Surfshark 提供 12 個方法加強資安防止智慧型電視不被駭客入侵，或者被監視
https://iqmore.tw/surfshark-smart-tv-vpn-news

The 6 Cybersecurity Certifications You Must know About
https://blog.magda-on-cyber.com/the-5-cybersecurity-certifications-you-must-know-about-ebd4c37b02b7

Top 15 IT Certifications in 2022
https://arctutorials.medium.com/top-15-it-certifications-in-2022-97a1538f7c81

20 Linux commands that every Computer Science Engineer must know
https://medium.com/@SingaramPalaniappan/20-linux-commands-that-every-computer-science-engineer-must-know-dc022674e0ee

10 Hardest Python Questions
https://medium.com/@saint_sdmn/10-hardest-python-questions-98986c8cd309

Bypassing Login Page in 2 Mins
https://aravind07.medium.com/bypassing-login-page-in-2-mins-5b773d46f4d

Remove the if-else hell
https://medium.com/javarevisited/remove-the-if-else-hell-java-7927194bd2e

Say goodbye to Let’s Encrypt, welcome Google-managed SSL certificates
https://xbery.medium.com/say-goodbye-to-lets-encrypt-welcome-google-managed-ssl-certificates-4d92831750e1

Comments: How Google Developers write their comments
https://paigeshin1991.medium.com/comments-how-google-developers-write-their-comments-5443657ecc4b

From File Upload to Command Injection to AWS compromise
https://systemweakness.com/from-file-upload-to-command-injection-to-aws-compromise-e937271bff2e

BITB (browser in the browser)Attack
https://infosecwriteups.com/bitb-browser-in-the-browser-attack-e2008c405701

8 Visual Studio Code extensions: I’m in Love with
https://medium.com/codex/8-visual-studio-code-extensions-im-in-love-with-4d07786801cc

Dependency Inversion Principle: How Google Developers write code
https://paigeshin1991.medium.com/dependency-inversion-principle-how-google-developers-write-code-f6cbd3b530a6

How I Got an Interview with Microsoft
https://medium.com/@gertrude.kaneah.abagale/how-i-got-an-interview-with-microsoft-ccd6d37a3d87

My Raspberry Pi + ESP32 drone (or my first steps into robotics)
https://medium.com/@tohntobshi/my-raspberry-pi-esp32-drone-or-my-first-steps-into-robotics-64c7e35b4777

Microservices Design Patterns
https://learncsdesign.medium.com/microservices-design-patterns-91fe56a33a47

7 (Extreme) Performance Tips in JavaScript
https://towardsdev.com/7-extreme-performance-tips-in-javascript-1544b3a9d03d

How to Create One-Page Reports With Python
https://python.plainenglish.io/one-page-reports-with-python-adf58432ae46

Becoming a “real” data analyst
https://towardsdatascience.com/becoming-a-real-data-analyst-dcaf5f48bc34

3 Web Observers Every Web Developer Should Know
https://levelup.gitconnected.com/3-web-observers-every-web-developer-should-know-c2f65302b5df

I Switched Password Managers and It Changed Everything
https://medium.com/macoclock/i-switched-password-managers-and-it-changed-everything-9b0417fe64a

Git commands nobody has told you
https://bootcamp.uxdesign.cc/git-commands-nobody-has-told-you-cd7025bea8db

Valuable GitHub Repositories for Beginner Developer’s
https://vatsalchauhan.medium.com/valuable-github-repositories-for-beginner-developers-f59d2a453902

Automate WhatsApp Messages with Python in 3 Steps
https://towardsdatascience.com/automate-whatsapp-messages-with-python-in-3-steps-d64cf0de4539

F.商業
Palo Alto Networks 深度剖析2022 年勒索軟體威脅趨勢
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9829

F5：台灣對IT/OT、零信任和威脅情報技術整合最感興趣
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9826

Menlo雲端安全防護平台確保行動辦公安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9832

偉康科技擴張數位身份SaaS市場版圖，助NPO整合平台建構資安防禦網
https://www.techbang.com/posts/95796-webcomm-successfully-expands-the-digital-identity-saas-market

中華電信前進Secutech 2022 打造跨域智慧安全平台
https://udn.com/news/story/7240/6268740

東捷提供整合管理平台為製造業打造靈活供應鏈生態系
https://udn.com/news/story/7240/6268643

應用程式更易招入侵 Synopsys三招「源頭保護」免程式被黑客控制
https://www.wepro180.com/synopsys220331/

SailPoint：做好身分帳號管理才能做好企業資安
https://today.line.me/tw/v2/article/eLaXgPO

逾9成資安破口來自身分！SailPoint用AI提高身分安全管理，瞄準金融、供應鏈需求
https://www.bnext.com.tw/article/68854/sailpoint-iam

領先全球！Fortinet 連續 9 年居全球資安設備出貨量之冠
https://www.thehubnews.net/archives/96856

安碁資訊獨董提名李紀珠
https://www.sinotrade.com.tw/richclub/news/62697d995e4b846361c7ae19

趨勢科技整合產業技術推出Trend Micro One網路資安平台
https://www.techbang.com/posts/95865-trend-micro-launches-trend-micro-one-platform

CyberArk調查報告指出暴漲的數位身分導致「資安債」持續擴大
http://www.compotechasia.com/a/press/2022/0428/51060.html

Nozomi Networks成為CISA首家資安合作夥伴
https://ctee.com.tw/industrynews/technology/635734.html

漏洞管理解決方案業者Tenable買下外部攻擊面管理廠商Bit Discovery
https://www.tenable.com/press-releases/Tenable-Agrees-To-Acquire-Bit-Discovery

Radware 推出Terabit 等級 DDoS 緩解平台: DefensePro 800
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9838

中華電信佳績頻傳再度蟬聯臺灣證券交易所公司治理評鑑Top 5%
https://times.hinet.net/news/23887634

耀睿引進中華電信核心網路率台灣O-RAN生態系邁大步
https://www.moneyweekly.com.tw/ArticleData/Info/Article/80590

訊連加入FIDO聯盟強化生物辨識技術
https://wantrich.chinatimes.com/news/20220428900778-420101

微軟測試將 VPN 安全網路深度導入 Edge 瀏覽器
https://www.kocpc.com.tw/archives/438184

G.政府
華視「共軍開戰」出包案　調查局「災防法」報北檢指揮偵辦
https://www.setn.com/News.aspx?NewsID=1106410

掰了實聯制！防疫邁入下一階段　蔡英文：展現台灣堅強韌性
https://www.setn.com/News.aspx?NewsID=1107457

簡訊實聯制取消台中副市長、經發局長竟未用社交距離APP
https://newtalk.tw/news/view/2022-04-28/746514

社交距離APP 議場備詢官員僅1/3下載
https://news.ltn.com.tw/news/life/paper/1514428

劉櫂豪要求NCC嚴懲華視重大疏失重視假訊息防範加強無人機連網資安
https://www.ly.gov.tw/Pages/Detail.aspx?nodeid=38917&pid=219145

資通安全網路月報(111年3月)
https://nicst.ey.gov.tw/Page/8770AD7511CB8DC9/86891dc5-377f-4aad-ac4c-20a5eaa101ee

府遭駭變偽文件照劇本走　但時間序難辨真假分不清
https://rwnews.tw/Article/Detail/3481

終結總統府駭客電郵風暴　北檢「查無入侵來源」低調簽結
https://rwnews.tw/Article/Detail/3479

蔡英文連任就職前夕驚魂　連三封電郵挑動綠營內鬥敏感神經
https://rwnews.tw/Article/Detail/3480

新北線上疫調驚見正妹照？　衛生局：惡意轉傳重罰
https://www.ftvnews.com.tw/news/detail/2022429S08M1

快篩實名系統異常！單號今賣出3092份　陳時中：不會要求退貨
https://www.upmedia.mg/news_info.php?Type=24&SerialNo=143636

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
奧義智慧聯手菱鏡，共建車聯網資安生態系
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9831

Arm全方位物聯網解方亮相　加速產品開發流程
https://www.mem.com.tw/arti.php?sn=2204270007

Arm發表Cortex-M85微處理器，強化物聯網全面解決方案提升產品研發效率
https://www.techbang.com/posts/95883-arm-cortex-m85

車聯網興起但消費者付費意願低
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=220&id=0000634238_3TH3FAG02KYM5C97B17CX

Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices
https://www.cisa.gov/uscert/ncas/alerts/aa22-103a

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
從Python到TensorFlow線上讀書會-Python基礎導讀(7) -第七章 tuple與串列 2022/5/3
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/284265348/

資安社 - 大學之道: 新興資安威脅下的主動出擊-淺談 Honeynet 誘捕技術 2022/5/4
https://nsysuisc.kktix.cc/events/20220504

Android Code Club(Taipei) 2022/5/4
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/285269125/

SyntaxError 2022/5/4
https://www.meetup.com/pythonhug/events/285269148/

HackingThursday 黑客星期四 - Week meetup Tamsui 固定聚會淡水 2022/5/5
https://www.meetup.com/hackingthursday/events/285290707/

【資安系列講座】去中心化神話也暗藏危機? 區塊鏈安全線上講座 2022/5/7
https://hackersir.kktix.cc/events/20220507blockchain

Scala Taiwan Mokumoku #15 2022/5/7
https://www.meetup.com/Scala-Taiwan-Meetup/events/285310131/

Just a chat - with no Expectations 2022/5/7
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/285326731/

Empowering Yourself, Empowering Others | 一場蛻變的旅程 | Part 1 2022/5/8
https://www.meetup.com/Women-Who-Code-Taipei/events/285321784/

K12的科技教育-除了程式還可以教什麼 2022/5/9
https://www.meetup.com/rladies-taipei/events/284421238/

資安社 - 大學之道: 數位時代的資安素養入門-認識資安搶旗賽、參賽經驗分享 2022/5/11
https://nsysuisc.kktix.cc/events/20220511ctf

沙崙資安基地線上免費資安課程個人資料盤點暨風險評鑑實務 2022/5/12
https://bit.ly/3kcdoRg

Taipei Creative Coders Meetup #17 2022/5/13
https://www.meetup.com/tpecreativecoders/events/285540074/

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

沙崙資安基地線上免費資安課程多的是你不知道的事-揭秘OSINT 2022/5/24
https://bit.ly/3vDkjYO

釣魚釣魚釣到你_白帽駭客教你如何利用人性弱點突破防禦 2022/5/25
http://www.cs.thu.edu.tw/web/news/detail.php?id=4129

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=course_index

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

資安事件新聞週報 2022/4/18 ~ 2022/4/22

noreply@blogger.com (Unknown) — Fri, 22 Apr 2022 15:56:00 +0000

資安事件新聞週報 2022/4/18 ~ 2022/4/22

1.重大弱點漏洞/後門/Exploit/Zero Day
Oracle Critical Patch Update for April 2022
https://www.oracle.com/corporate/security-practices/assurance/vulnerability/security-fixing.html

Juniper 近日發布更新以解決多個產品的安全性弱點
https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sort=date%20descending&f:ctype=[Security%20Advisories]
https://supportportal.juniper.net/s/article/2022-04-Security-Bulletin-Contrail-Networking-Multiple-Vulnerabilities-have-been-resolved-in-Contrail-Networking-release-2011-L4?language=en_US

思科修補可繞過身分認證的無線網路控制器韌體漏洞
https://www.ithome.com.tw/news/150464

思科資安解決方案的管理遠端存取機制存在漏洞，恐被攻擊者竊取管理員帳密
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uva-static-key-6RQTRs4c

Cisco Releases Security Patches for TelePresence, RoomOS and Umbrella VA
https://thehackernews.com/2022/04/cisco-releases-security-patches-for.html

駭客著手開採微軟今年2月修補的Windows Print Spooler漏洞
https://www.ithome.com.tw/news/150512

美國要求聯邦機構限期修補已遭利用的Print Spooler漏洞
https://www.bleepingcomputer.com/news/security/cisa-warns-of-attackers-now-exploiting-windows-print-spooler-bug/

聯想筆電韌體存在漏洞，攻擊者恐用於植入UEFI惡意軟體
https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/

威聯通公告部分NAS機種可能存在Apache HTTP伺服器漏洞，並提出緩解措施
https://www.qnap.com/zh-tw/security-advisory/qsa-22-11

QNAP Advises Users to Update NAS Firmware to Patch Apache HTTP Vulnerabilities
https://thehackernews.com/2022/04/qnap-advises-users-to-update-nas.html

解壓縮軟體7-Zip出現漏洞，恐讓攻擊者獲得管理員權限
https://github.com/kagancapar/CVE-2022-29072#readme=

Google資安報告驚見58個零日漏洞、全球駭客攻擊創歷史新高
https://3c.ltn.com.tw/news/48696

Amazon's Hotpatch for Log4j Flaw Found Vulnerable to Privilege Escalation Bug
https://thehackernews.com/2022/04/amazons-hotpatch-for-log4j-flaw-found.html

Unpatched Bug in RainLoop Webmail Could Give Hackers Access to all Emails
https://thehackernews.com/2022/04/unpatched-bug-in-rainloop-webmail-could.html

Critical Chipset Bugs Open Millions of Android Devices to Remote Spying
https://thehackernews.com/2022/04/critical-chipset-bug-opens-millions-of.html

New Incident Report Reveals How Hive Ransomware Targets Organizations
https://thehackernews.com/2022/04/new-incident-report-reveals-how-hive.html

Google Project Zero Detects a Record Number of Zero-Day Exploits in 2021
https://thehackernews.com/2022/04/google-project-zero-detects-record.html

Hackers Exploiting Recently Reported Windows Print Spooler Vulnerability in the Wild
https://thehackernews.com/2022/04/hackers-exploiting-recently-reported.html

New Lenovo UEFI Firmware Vulnerabilities Affect Millions of Laptops
https://thehackernews.com/2022/04/new-lenovo-uefi-firmware.html

Critical RCE Flaw Reported in WordPress Elementor Website Builder Plugin
https://thehackernews.com/2022/04/critical-rce-flaw-reported-in-wordpress.html

Researchers Detail Bug That Could Paralyze Snort Intrusion Detection System
https://thehackernews.com/2022/04/researchers-detail-bug-that-could.html

Microsoft 已發布公告以解決關鍵的遠端程式碼執行弱點
https://docs.microsoft.com/zh-tw/windows-server/storage/file-server/smb-secure-traffic
https://www.cisa.gov/uscert/ncas/current-activity/2022/04/13/microsoft-releases-advisory-address-critical-remote-code-execution

Researcher Releases PoC for Recent Java Cryptographic Vulnerability
https://thehackernews.com/2022/04/researcher-releases-poc-for-recent-java.html

Watch Out! Cryptocurrency Miners Targeting Dockers, AWS and Alibaba Cloud
https://thehackernews.com/2022/04/watch-out-cryptocurrency-miners.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
臺企銀行動銀行App 首推Wi-Fi安全偵測
https://wantrich.chinatimes.com/news/20220418900142-420101

駭客風暴帶來的教訓：北富銀善用瀑布式管理與敏捷導入，高效開發智能資安系統
https://www.managertoday.com.tw/articles/view/64972

擔心出門忘記帶錢包？英國新創在手上植入微晶片，讓你成為「人體信用卡」
https://meet.bnext.com.tw/articles/view/48970

手機報稅2.0升級新增3大功能
https://ec.ltn.com.tw/article/breakingnews/3901954

統一超整合虛實通路推繳稅服務平台
https://www.cna.com.tw/news/ahel/202204210092.aspx

3.電子支付/行動支付/pay/資安
街口電支的成長經驗：IT 團隊如何活用專案管理技術、撐過業務爆量期的陣痛
https://www.managertoday.com.tw/articles/view/64973

行動支付結帳時皮夾放一旁 3秒內就遭竊
https://reurl.cc/WrLy4D

悠遊卡公司總經理邱昱凱：「一卡一付」生態圈逐漸成形，望能實現無現金生活
https://reurl.cc/q58oDn

印度最大行動支付Paytm 誇口明年Q3前打平
https://reurl.cc/x90oDe

Meta Platforms在印度移動支付市場是如何落於人後的
https://reurl.cc/vd1onj

中華郵政i郵箱首家電子支付上線
https://reurl.cc/o1dpLD

日本Uber Eats攜手樂天將可使用樂天Pay電子支付服務
https://news.cnyes.com/news/id/4854994

為蝦皮放寬電子支付門檻？黃天牧怒回應
https://ctee.com.tw/news/policy/626317.html

金管會盯第三方支付　3家業者列電支預備生
https://www.cardu.com.tw/news/detail.php?45927

不只蝦皮交易超過10億元兩家第三方支付亦逼近納管門檻
https://news.cnyes.com/news/id/4855817

Coinbase印度擴展受阻盧比電子支付被國家機器終止
https://reurl.cc/mo97n7

電子消費券｜街市不足三成檔販裝電子支付　檔販拆解一原因致卻步
https://reurl.cc/7DonXN

電子支付APP 掃碼繳稅最便利
https://reurl.cc/ZA7EO3

台灣超商揪甘心！中國人妻離開電子支付　直呼：交易不再是冰冷機器－民視新聞
https://www.ftvnews.com.tw/video/detail/EBYlzLzcTR0

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Beanstalk 遭閃電貸攻擊損失 1.8 億美元，穩定幣 $BEAN 脫鉤瞬崩跌 90%
https://www.blocktempo.com/attacker-drains-182m-from-beanstalk/

安全團隊：UglyPeopleNFT的Discord被駭客入侵
https://amp-news.cnyes.com/news/id/4854786

NFT項目Metaconz遭受攻擊，駭客利用惡意函數剝奪錢包權限
https://news.cnyes.com/news/id/4855024

比特幣與以太幣週一連袂下挫，比特幣盤中下滑3.57%，跌破4月低點
https://reurl.cc/QL3NLo

要價 2.5 ETH 矚目 NFT 項目《Moonbirds》發售 2 日內地板價飆升將近 8 倍
https://hypebeast.com/zh/2022/4/moonbirds-nft-proof-collective-opensea-volume-ranking

DeFi一個月竟然被偷兩次！穩定幣協議Beanstalk損失1.82億美元，創辦人回應：不該要我們負責
https://www.bnext.com.tw/article/68622/defi-attack-hacker

穩定幣協議 Beanstalk 遭閃電貸攻擊，BEAN 暴跌近 90%
https://smartrichs.com/stablecoin-protocol-beanstalk-was-attacked-by-flash-loan-bean-plummeted-by-nearly-90/

Robinhood推出加密錢包，加密資產離主流更進一步
https://hk.investing.com/analysis/article-100435

駭客鎖定加密錢包MetaMask用戶下手，竊取存放在iCloud的通關密語來掏空加密貨幣
https://www.bleepingcomputer.com/news/security/hackers-steal-655k-after-picking-metamask-seed-from-icloud-backup/

近一周Ronin駭客錢包地址累計轉出2.24萬枚ETH
https://news.cnyes.com/news/id/4855904?exp=a

Beanstalk Farms將商討項目重啟方案，並呼籲駭客返還90%被盜資金
https://news.cnyes.com/news/id/4855640

加密幣焦慮/夯到用來賄選？法務部長的憂慮有沒有道理
https://money.udn.com/money/story/5648/6253348

NFT市集Rarible存在漏洞，恐被攻擊者用於竊取NFT與Token
https://research.checkpoint.com/2022/check-point-research-detects-vulnerability-in-the-rarible-nft-marketplace-preventing-risk-of-account-take-over-and-cryptocurrency-theft/

CipherTrace報告｜門羅幣正走向勒索軟體首選，駭客將比特幣贖金支付增10-20%溢價
https://www.blocktempo.com/monero-crypto-of-choice-as-ransomware/

北朝鮮電玩高手竊走NFT遊戲加密貨幣6.2億美金，驚動FBI出面調查
https://www.5richer.com/arts/42846.html

Web3時代！中國有條件開放NFT交易活動專家:建議新手這麼做!
https://www.thehubnews.net/archives/95135

NFT、虛擬加密貨幣賺很大? 謹防騙子拿走這兩個東西,血本無歸
https://blog.trendmicro.com.tw/?p=71904

安全公司：illogicsNFT Discord兩名團隊成員的Discord帳戶被盜
https://news.cnyes.com/news/id/4857181?exp=a

盤點 13 起史上規模最大 DeFi 竊盜案，今年 Beanstalk 、Wormhole、Ronin 入列前五
https://www.blocktempo.com/13-biggest-defi-hacks-and-heists/

DeFi借貸協議YEED遭受攻擊，駭客獲利百萬卻被永久鎖定
https://news.cnyes.com/news/id/4857413

門羅幣成駭客勒索首選，比特幣同等溢價提升 20%
https://reurl.cc/VDXnd6

全方位保障交易安全　 BingX交易所創下錢包零盜失歷史
https://www.thehubnews.net/archives/95642

駭客偏好從DeFi平臺盜取加密貨幣
https://blog.chainalysis.com/reports/2022-defi-hacks/

LINE開發NFT平台首度在台招募區塊鏈技術團隊
https://www.rti.org.tw/news/view/id/2130815

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
風力發電大廠 Nordex 遭 Conti 勒贖攻擊，IT 系統與風機管理系統停擺
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9818

什麼是 RagnarLocker？FBI 發布舊勒索軟體家族的新警報
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9814

Mars Stealer惡意軟體潛藏於Google上之OpenOffice廣告
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9816

木馬程式RemcosRAT鎖定非洲銀行下手
https://threatresearch.ext.hp.com/malware-campaigns-targeting-african-banking-sector/

駭客組織Karakurt與勒索軟體Conti狼狽為奸，協助該組織後續索討贖金
https://reurl.cc/j15VR2

方便的 Google Play Store 安裝工具被發現惡意程式碼，幫忙竄改瀏覽器好讓 Windows 11 用戶連上詐騙網頁
https://www.kocpc.com.tw/archives/436715

駭客藉由提供Windows 11升級的名義來散布竊密軟體
https://www.bleepingcomputer.com/news/security/unofficial-windows-11-upgrade-installs-info-stealing-malware/

駭客建立Windows 11 下載偽官網，助你免費安裝客製「病毒化」Windows 11系統
https://www.techbang.com/posts/95710-security-personnel-discovered-a-new-fake-microsoft-win11

只要下載就會被盜！這款惡意軟體「偽裝成銀行APP」，連客服電話都是假的！
https://ebcbuzz.com/category/fun/new/244719

間諜軟體Pegasus又有新的受害者！英國政府遭到鎖定
https://citizenlab.ca/2022/04/uk-government-officials-targeted-pegasus/

惡意軟體Emotet攻擊行動再度急劇增加
https://www.bleepingcomputer.com/news/security/emotet-botnet-switches-to-64-bit-modules-increases-activity

殭屍網路BotenaGo變種病毒鎖定利凌視訊監視器下手
https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs/

資安業者提供勒索軟體「閰羅王」解密工具
http://support.kaspersky.com/8547

微軟成功接管 ZLoader 殭屍網路超過 400 個網域
https://technews.tw/2022/04/22/microsoft-successfully-takes-over-zloader-botnet/

勒索軟體鎖定農業合作社下手
https://www.ic3.gov/Media/News/2022/220420-2.pdf

勒索軟體Black Cat半年內已入侵逾60個組織
https://www.ic3.gov/Media/News/2022/220420.pdf

蠕蟲程式TeamTNT針對AWS、阿里雲發動攻擊
https://blog.talosintelligence.com/2022/04/teamtnt-targeting-aws-alibaba.html

駭客向其他網路罪犯免費提供竊密軟體Ginzo Stealer，疑似為了培養客群
https://www.gdatasoftware.com/blog/2022/03/ginzo-free-malware

兩勒索軟件組織發動今年首季逾半攻擊
https://www.wepro180.com/ransomware220422/

Kaspersky report on Emotet modules and recent attacks
https://securelist.com/emotet-modules-and-recent-attacks/106290/

Tough Times for Ukrainian Honeypot
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tough-times-for-ukrainian-honeypot/

Lazarus Targets Chemical Sector
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical

Zloader 2: The Silent Night
https://decoded.avast.io/vladimirmartyanov/zloader-the-silent-night/
https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/
https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/

"Haskers Gang" Introduces New ZingoStealer
https://blog.talosintelligence.com/2022/04/haskers-gang-zingostealer.html

Cyberattack on state organizations of Ukraine using the malicious program IcedID
https://cert.gov.ua/article/39609

Eagle Monitor RAT
https://blog.cyble.com/2022/04/18/under-the-lens-eagle-monitor-rat/

Peering into A PYSA Ransomware Attack
https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies
https://www.cisa.gov/uscert/ncas/alerts/aa22-108a

A new type of malware from the Lazarus attack group that exploits the INITECH process
https://asec.ahnlab.com/ko/33706/

Malware Campaigns Targeting African Banking Sector
https://threatresearch.ext.hp.com/malware-campaigns-targeting-african-banking-sector/

Nobelium - Israeli Embassy Maldoc
https://inquest.net/blog/2022/04/18/nobelium-israeli-embassy-maldoc

Public Cloud Cybersecurity Threat Intelligence (202203)
https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/

An Investigation of the BlackCat Ransomware
https://reurl.cc/rD80yk
https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html

"aa" distribution Qakbot (Qbot) infection with DarkVNC traffic
https://isc.sans.edu/diary/rss/28568

New BotenaGo Variant Discovered
https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs/

Information Stealer Targets Crypto Wallets Via Fake Windows 11 Update
https://cloudsek.com/whitepapers_reports/information-stealer-targets-crypto-wallets-via-fake-windows-11-update/

Cyberattack on state organizations of Ukraine using the topic "Azovstal" and the malicious program Cobalt Strike Beacon
https://www.circl.lu/doc/misp/feed-osint/1b2b6e15-3655-4648-afcb-c93214187736.json

Prynt Stealer Spotted In the Wild
https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/

Warez users fell for Certishell
https://decoded.avast.io/danielbenes/warez-users-fell-for-certishell/
https://github.com/avast/ioc/blob/master/Certishell/samples.sha256
https://github.com/avast/ioc/blob/master/Certishell/samples.sha1
https://github.com/avast/ioc/blob/master/Certishell/network.txt

Nokoyawa Ransomware | New Karma/Nemty Variant Wears Thin Disguise
https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/

The ink-stained trail of GOLDBACKDOOR
https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report_-The-ink-stained-trail-of-GOLDBACKDOOR.pdf

Hive Ransomware Analysis
https://www.varonis.com/blog/hive-ransomware-analysis

Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine
https://github.com/Symantec/threathunters/blob/main/Shuckworm/host
https://github.com/Symantec/threathunters/blob/main/Shuckworm/network

Hackers Sneak 'More_Eggs' Malware Into Resumes Sent to Corporate Hiring Managers
https://thehackernews.com/2022/04/hackers-sneak-moreeggs-malware-into.html

Researchers Share In-Depth Analysis of PYSA Ransomware Group
https://thehackernews.com/2022/04/researchers-share-in-depth-analysis-of.html

New SolarMarker Malware Variant Using Updated Techniques to Stay Under the Radar
https://thehackernews.com/2022/04/new-solarmarker-malware-variant-using.html

New Hacking Campaign Targeting Ukrainian Government with IcedID Malware
https://thehackernews.com/2022/04/new-hacking-campaign-targeting.html

Hackers Sneak 'More_Eggs' Malware Into Resumes Sent to Corporate Hiring Managers
https://thehackernews.com/2022/04/hackers-sneak-moreeggs-malware-into.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
iPhone 網路不穩怎麼辦？10招解決網路變慢和上網不穩問題
https://mrmad.com.tw/iphone-network-instability-how-to-solve

Mac電腦的App Store市集出現騙錢軟體，不訂閱就無法關閉應用程式
https://reurl.cc/NA6OG5

「零點擊攻擊」讓手機躺著也中槍？還能成為全球各國大生意
https://www.bnext.com.tw/article/68371/dos-zero-click-attack

不受限制的信息平台：俄烏戰爭中的Telegram
https://cn.nytimes.com/world/20220419/russian-propaganda-telegram-ukraine/zh-hant/

蘋果開發新款HomePod！將與Apple TV和FaceTime相機結合
https://times.hinet.net/news/23868322

高通、聯發科晶片爆最新漏洞！主流 Android 手機幾乎全中標
https://3c.ltn.com.tw/news/48723

蘋果老舊 ALAC 格式有漏洞，卻危及高通、聯發科晶片手機
https://technews.tw/2022/04/22/apple-alac-qualcomm-mediatek/

高通與聯發科手機處理器晶片使用存在漏洞的聲音解碼器，恐波及三分之二安卓用戶
https://blog.checkpoint.com/2022/04/21/largest-mobile-chipset-manufacturers-used-vulnerable-audio-decoder-2-3-of-android-users-privacy-around-the-world-were-at-risk/

手機密碼「全面消失」！安卓1功能爆入侵危機　專家給答案
https://news.tvbs.com.tw/life/1773192

歐盟進一步推動以USB-C作為統一充電規格，預計2026年以前確定無線充電技術通用性
https://mashdigi.com/common-charger-meps-agree-on-proposal-to-reduce-electronic-waste/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
黑帽公布2022年黑帽亞洲混合大會的主題演講貴賓名單
http://www.businesswirechina.com/hk/news/50257.html

「攻擊就是最好的防守！」拿下資安界奧斯卡獎的戴夫寇爾，如何解密網路戰爭背後的資安挑戰
https://buzzorange.com/techorange/2022/04/19/ppodcast-devcore-cyber-warfare/

76%台灣企業認為：未來12月內會被駭客攻擊得逞
https://udn.com/news/story/7240/6251055?from=udn-catelistnews_ch2

Trend Micro趨勢科技公布網路資安風險指標：台灣超過3/4企業機構認為自己在2022年有可能遭駭客入侵
https://zeekmagazine.com/archives/170223

呼籲企業應採用公開標準進行第三方網路資安風險量化評估
https://news.ebc.net.tw/news/living/313587

鼎峰亞太集團呼籲公開標準進行第三方網路資安風險量化評估
https://money.udn.com/money/story/5635/6258432

遙距工作依賴雲端應用資安風險靠SASE把關
https://www.18hall.com/sase/

疫情蔓延企業數位化轉型 DDoS資安威脅引起重視
https://www.storm.mg/localarticle/4295663

當心！駭客攻擊手法再創新　音訊檔「WAV」成犯罪工具
http://n.yam.com/Article/20220419863490

Okta公布Lapsus$駭客事件調查結果：只被駭了25分鐘
https://www.ithome.com.tw/news/150561

FBI警告：北韓駭客以拉撒路（Lazarus）為首，恐大量針對加密公司攻擊
https://www.horizonnextsumari.com/article/3815

慢霧：注意防範APT組織Lazarus Group駭客攻擊
https://news.cnyes.com/news/id/4855524?exp=a

美國揭露北韓駭客Lazarus攻擊區塊鏈業者手法
https://www.ithome.com.tw/news/150497

公民實驗室示警英政府內部網路疑遭飛馬入侵
https://www.cna.com.tw/news/aopl/202204190278.aspx

駭客用盜來的OAuth權杖存取GitHub的私有儲存庫
https://www.ithome.com.tw/news/150462

攻擊者利用遭竊的OAuth憑證入侵NPM等數十個組織的GitHub
https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/

親俄羅斯駭客集團 Conti 遭報復！烏籍研究員洩出大量內部對話、原始碼、營運資料
https://www.blocktempo.com/russian-ransomware-group-conti-hurt-by-leaks/

羞辱普丁匿名者公佈俄國特務名單並攻擊石油相關產業
https://newtalk.tw/news/view/2022-04-19/741858

烏克蘭組網軍施壓跨國企業撤出俄國
https://ec.ltn.com.tw/article/breakingnews/3899680

聲援烏克蘭的神秘駭客組織將推 GameFi？一款離線也獲取收益的區塊鏈資安概念遊戲
https://www.blocktempo.com/anonverse-gamefi-crypto-war-v/

俄烏苦戰敲響警鐘！日媒指陸被迫改攻台劇本　擴大核武力
https://news.tvbs.com.tw/politics/1770960

對抗飛彈最佳武器就是科技！31歲烏克蘭部長率百人躲地窖打「第一次世界網路大戰」
https://udn.com/news/story/122663/6256349

俄媒意外曝光！俄國防部公布俄軍死傷網驚和烏克蘭戰報相符
https://news.ltn.com.tw/news/world/breakingnews/3902495

微軟Windows 再次受到中國Hafnium組織攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9808

美國政府表示朝鮮支持的駭客組織以加密和區塊鏈公司為攻擊目標
https://news.cnyes.com/news/id/4855435

英相官邸遭「間諜軟體」入侵、外交部也被駭阿聯疑策畫
https://www.worldjournal.com/wj/story/121257/6252905

北約在俄烏戰爭背景下舉行「鎖盾」網絡安全演習
https://reurl.cc/yrgWW2

Experts Uncover Spyware Attacks Against Catalan Politicians and Activists
https://thehackernews.com/2022/04/experts-uncover-spyware-attacks-against.html

FBI, U.S. Treasury and CISA Warn of North Korean Hackers Targeting Blockchain Companies
https://thehackernews.com/2022/04/fbi-us-treasury-and-cisa-warns-of-north.html

資安管理師
https://www.cakeresume.com/companies/presco-ws/jobs/information-security-manager?locale=fr

資安鑑識分析師
https://www.104.com.tw/job/5xtj0?jobsource=cs_custlist

網路資安解決方案工程師
https://www.104.com.tw/job/6hygw?jobsource=cs_custlist

資深網路資安解決方案工程師
https://www.104.com.tw/job/6hyog?jobsource=cs_custlist

資安檢測工程師
https://www.104.com.tw/job/64myq?jobsource=cs_custlist

ICS工控資安工程師 (工業控制系統)
https://www.104.com.tw/job/6j369?jobsource=cs_custlist

資安事件調查員
https://www.104.com.tw/job/6j3cl?jobsource=cs_custlist

資深網路安全工程師
https://www.104.com.tw/job/5xo6u?jobsource=cs_custlist

ICS工控資安工程師(資訊/資安)
https://www.104.com.tw/job/6ne28?jobsource=cs_custlist

資安系統工程師
https://www.104.com.tw/job/7m18m

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Okta Says Security Breach by Lapsus$ Hackers Impacted Only Two of Its Customers
https://thehackernews.com/2022/04/okta-says-security-breach-by-lapsus.html

蘆竹傳「假警察、真碰瓷」團伙犯案警關切原Po竟刪文
https://udn.com/news/amp/story/7320/6246848

公衛資安遭駭入？超過百萬個資被詐騙集團所接收
https://reurl.cc/QL3Nb0

美國警告鎖定T-Mobile用戶來的簡訊網釣攻擊
https://www.cyber.nj.gov/alerts-advisories/new-smishing-campaign-targets-t-mobile-customers

美國警告鎖定行動支付的網釣簡訊攻擊
https://www.ic3.gov/Media/Y2022/PSA220414

肉票變綁匪!不肖兒詐48萬贖金露餡母崩潰
https://news.cts.com.tw/cts/society/202204/202204182077649.html

華人失業金遭盜刷紐約布魯克林再爆多案
https://www.worldjournal.com/wj/story/121381/6249485

大馬才子來台收入歸零 4月初帳號還被盜
https://www.epochtimes.com/b5/22/4/19/n13715265.htm

強制全民參與研究，個資法默許－健保資料庫釋憲在即
https://www.civilmedia.tw/archives/110271

他回撥「蘋果來電」慘了！才2秒鐘　1900萬加密貨幣全被偷光
https://www.ettoday.net/news/20220421/2234959.htm

蘋果用戶提供驗證碼竟損失1900萬？資安專家揭網路詐騙新招
https://news.ltn.com.tw/news/world/breakingnews/3901639

嚴防認知作戰威脅強化全民媒體識讀
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1498675&type=forum

Whoscall警告假冒虛擬貨幣交易所釣魚簡訊連日來達上百封，成最新詐騙手法
https://www.techbang.com/posts/95784-attention-investors-phishing-newsletters-on-virtual-currency

多名網友PTT帳號被盜，疑似採用與其他網站服務相同的密碼，或使用不安全連線所致
https://www.facebook.com/PttTW/posts/10158226494581364

E.研究報告/工具
防駭客的基本認知 : 備份與還原
https://tech-blog.cymetrics.io/posts/nick/backup/

VPN在安全領域的使用優勢
https://qooah.com/2022/04/19/advantages-of-vpn-in-the-field-of-security/

免費的最貴？！VPN的安全危機
https://player.soundon.fm/p/8fdc3e51-8bfb-4bfa-9c65-8ea2ce5a6eb7/episodes/0912e433-7c6f-4414-9797-d19270e3c790

Automate Alert Triage and Response Tasks with Intezer EDR Connect
https://www.intezer.com/blog/incident-response/alert-triage-edr-integrations/?utm_medium=email&utm_source=hs_email

Why WAF and Firewall Solutions Will Not Help Against Third-Party Website Attacks
https://www.reflectiz.com/blog/why-your-web-application-firewall-waf-will-not-help-against-third-party-website-attacks/?utm_medium=paved

GitHub Notifies Victims Whose Private Data Was Accessed Using OAuth Tokens
https://thehackernews.com/2022/04/github-notifies-victims-whose-private.html

Benchmarking Linux Security – Latest Research Findings
https://thehackernews.com/2022/04/benchmarking-linux-security-latest.html

Gatekeepers in Machine Learning
https://themeansquare.medium.com/gatekeepers-in-machine-learning-98375d1d6e90

How I’m using Machine Learning to Trade in the Stock Market
https://medium.com/analytics-vidhya/how-im-using-machine-learning-to-trade-in-the-stock-market-3ba981a2ffc2

Advanced exploratory data analysis (EDA) with Python
https://medium.com/epfl-extension-school/advanced-exploratory-data-analysis-eda-with-python-536fa83c578a

How to convert TensorFlow model and run it with OpenVINO™ Toolkit
https://medium.com/openvino-toolkit/how-to-convert-tensorflow-model-and-run-it-with-openvino-toolkit-519e4277ccdb

Blockchain layers (L0, L1, L2, L3) in a Diagram
https://medium.com/@nick.5montana/blockchain-layers-l0-l1-l2-l3-in-a-diagram-569162398db

Say goodbye to Let’s Encrypt, welcome Google-managed SSL certificates
https://xbery.medium.com/say-goodbye-to-lets-encrypt-welcome-google-managed-ssl-certificates-4d92831750e1

F.商業
FortiOS 7.2 新增超過 300 項功能，保護分散式基礎架構
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9811

Westcon-Comstor和 Broadcom 宣佈簽屬專屬 Symantec 銷售代理協議
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9810

思科：台灣企業平均花費200萬美元在隱私保護
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9815

台灣微軟藉 Azure HPC 助攻，加速鴻海人工智慧研究成果
https://technews.tw/2022/04/19/cooperation-between-microsoft-taiwan-and-hon-hai-in-artificial-intelligence/

新職缺顯示亞馬遜也計畫投入結合擴增實境、混合實境的元宇宙佈局
https://mashdigi.com/amazon-is-working-on-a-mysterious-ar-smart-home-product-according-to-job-listings/

資安威脅政府單位首當其衝，Openfind 提供縱深防禦方案
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9822

Palo Alto Networks 深度剖析2022 年勒索軟體威脅趨勢
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9829

偉康科技推雲端身分認證服務以高規架構堅實資安防護網
http://n.yam.com/Article/20220422518121

偉康科技數位身份SaaS 助NPO建構主動資安防禦網
https://money.udn.com/money/story/11799/6258236

G.政府
華視新聞誤播台海戰爭快訊緊急道歉召開自律委員會懲處
https://www.cna.com.tw/news/ahel/202204200044.aspx

誤報共軍襲台　鄭麗文：蔡政府先錄好，打算選前大賣芒果乾
https://www.storm.mg/article/4296731

調查局追華視誤植「導彈攻台」假訊息！2導播招：單純失誤
https://www.setn.com/News.aspx?NewsID=1103451

華視誤報「兩岸開戰」！調查局約談2導播　失誤原因曝光
https://tw.appledaily.com/life/20220421/D6RI26V6BRFOBGJQJSUZ6COV34/

華視誤播「新北市遭共軍導彈擊中」調查局通知導播、字幕人員說明
https://newtalk.tw/news/view/2022-04-21/742683

華視導彈烏龍內幕曝光調查局資安站第一時間趕抵查境外勢力
https://wantrich.chinatimes.com/news/20220421900356-420501

華視「導彈攻台」烏龍法務部說話了！涉國安偵辦中
https://www.chinatimes.com/realtimenews/20220421002721-260407?chdtv

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
五眼聯盟警告俄羅斯駭客集團針對全球重大基礎設施展開報復性攻擊
https://www.ithome.com.tw/news/150539

美國CISA發布AA22-103A警報：關鍵基礎設施及製造業提防PLC被 Pipedream攻陷
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9813

疑報復經濟制裁，俄羅斯駭客鎖定全球關鍵基礎設施展開網路攻擊
https://www.cisa.gov/uscert/ncas/alerts/aa22-110a

保障IoT節點安全性的「硬」方法
https://www.eettaiwan.com/20220419nt31-securing-the-iot-technical-approaches-to-defend-and-protect-iot-nodes/

居家安裝室內監控鏡頭小心家人影像駭客看光光
https://www.worldjournal.com/wj/story/121473/6252077

這款居家監控鏡頭有漏洞駭客全看光專家：軟體須定期更新
https://reurl.cc/WrLzzy

車用資安防衛戰開打！法遵尚且不足台廠仍需努力
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=220&id=0000633036_7W61SE4K2S6TIX7WB9EPJ

奧義智慧攜手菱鏡共建車聯網資安生態系
https://ctee.com.tw/industrynews/technology/631175.html

ASUS RT-AX88U - Format String
https://www.twcert.org.tw/tw/cp-132-6043-0f72c-1.html

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Python 數據分析一日工作坊 - 電商、Airbnb分析實戰 2022/4/23
https://www.meetup.com/PyLadiesTW/events/284972118/

區塊鏈與智慧資安女力論壇 2022/4/24
https://isipevent.kktix.cc/events/e58d0573

沙崙資安基地線上免費課程：【資產盤點暨風險評鑑實務】 2022/04/26
https://bit.ly/3KmFTqW

資通安全電腦稽核-防火牆管理查核實例演練~稽核最佳實務演練 2022/04/28
https://www.acl.com.tw/news/news_display.php?id=1802

SEMI E187設備資安標準導入與實務研討會 2022/4/29
https://www.semi.org/zh/cybersecurity-standards-seminar

「資安鑑識課程-系列Ⅰ初級課程：資安科技基礎養成：滑鼠鍵盤敲起來【從密碼到資安】」線上研習 2022/4/29
https://docs.google.com/forms/d/1yS8JontNqGinMYUOaYj9aQ-Ov92yda7eFldgjotOAUs

K12的科技教育-除了程式還可以教什麼 2022/5/9
https://www.meetup.com/rladies-taipei/events/284421238/

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/4/11 ~ 2022/4/15

noreply@blogger.com (Unknown) — Fri, 15 Apr 2022 16:19:00 +0000

資安事件新聞週報 2022/4/11 ~ 2022/4/15

1.重大弱點漏洞/後門/Exploit/Zero Day
Apple 緊急發布2個零日漏洞補丁
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9796

Critical Auth Bypass Bug Reported in Cisco Wireless LAN Controller Software
https://thehackernews.com/2022/04/critical-auth-bypass-bug-reported-in.html

Microsoft Issues Patches for 2 Windows Zero-Days and 126 Other Vulnerabilities
https://thehackernews.com/2022/04/microsoft-issues-patches-for-2-windows.html

Critical LFI Vulnerability Reported in Hashnode Blogging Platform
https://thehackernews.com/2022/04/critical-lfi-vulnerability-reported-in.html

網頁伺服器Nginx傳出與LDAP有關的零時差漏洞
https://securityonline.info/nginx-zero-day-rce-vulnerability-alert/

NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation
https://thehackernews.com/2022/04/nginx-shares-mitigations-for-zero-day.html

微軟CVE-2022-26809漏洞出現攻擊程式只是早晚的問題？專家警告快修補
https://www.ithome.com.tw/news/150440

Microsoft's New Autopatch Feature to Help Businesses Keep Their Systems Up-to-Date
https://thehackernews.com/2022/04/microsofts-new-autopatch-feature-to.html

微軟新推Autopatch服務，Windows Enterprise E3以上企業用戶將於7月可免費使用
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/get-current-and-stay-current-with-windows-autopatch/ba-p/3271839#_note2

研究人員針對微軟甫修補的RPC漏洞提出警告，呼籲Windows用戶儘速安裝相關更新軟體
https://reurl.cc/b24Nly

微軟4月例行修補修復119個漏洞，其中有2個零時差漏洞
https://reurl.cc/o1zYvg

快更新 Windows 電腦！微軟點名有 10 個嚴重、115 個重要資安漏洞
https://3c.ltn.com.tw/news/48571

VMware於4月初公布身分管理平臺重大漏洞，本週已出現漏洞利用攻擊
https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-vmware-cve-2022-22954-bug-patch-now/

Critical VMware Cloud Director Bug Could Let Hackers Takeover Entire Cloud Infrastructure
https://thehackernews.com/2022/04/critical-vmware-cloud-director-bug.html

美國CISA再要求聯邦政府優先修補8項漏洞，包含WatchGuard與微軟已遭成功利用的漏洞
https://reurl.cc/A7n3yQ

開源內容管理平臺Directus修補可允許文件任意執行JS的重大漏洞
https://www.zdnet.com/article/xss-vulnerability-patched-in-directus-data-engine-platform

俄羅斯NPM開發者竄改event-source-polyfill套件，希望俄羅斯政府能結束烏克蘭戰爭
https://www.bleepingcomputer.com/news/security/third-npm-protestware-event-source-polyfill-calls-russia-out/

圖像式WordPress網站建置外掛程式Elementor出現RCE漏洞，恐波及逾百萬網站
https://www.pluginvulnerabilities.com/2022/04/12/5-million-install-wordpress-plugin-elementor-contains-authenticated-remote-code-execution-rce-vulnerability/

HP旗下的遠端桌面解決方案Teradici存在漏洞，恐波及1,500萬臺電腦
https://www.bleepingcomputer.com/news/security/critical-hp-teradici-pcoip-flaws-impact-15-million-endpoints/

Intel更新ControlFlag，用AI可發現PHP程式碼中潛在漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9807

快更新 Chrome！Google 緊急釋出重要安全更新
https://3c.ltn.com.tw/news/48611

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
Anonymous Just Hacked Russia’s Central Bank
https://alan-12169.medium.com/anonymous-just-hacked-russias-central-bank-be2d7f91a3f4

資安頻出包被罰國泰世華銀回應了
https://wantrich.chinatimes.com/news/20220412900763-420101

系統出包國泰世華銀遭重罰增資停設ATM
https://ctee.com.tw/news/finance/625814.html

量子運算如雙刃刀金融業關注資安
https://reurl.cc/g2knzp

土銀今年聚焦ESG 拚五大營運重點
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=d1e764ae-1258-40a4-ab1f-a10ee02dc230

金融世界的新戰爭型態不容小覷專家籲強化台灣金融韌性
https://times.hinet.net/topic/23858724

金融戰爭得失台灣應借鏡
https://wantrich.chinatimes.com/news/20220414900416-420501

3.電子支付/行動支付/pay/資安
想當人體信用卡？英國公司幫你植入微晶片從此嗶手不嗶卡
https://dq.yam.com/post/14857

華為支付來了行動支付大戰開打
https://www.chinatimes.com/newspapers/20220407000690-260301?chdtv

華為殺入行動支付微信、支付寶迎新勁敵
https://ctee.com.tw/news/china/621355.html

財政部推出「手機報稅2.0」資料可修改且新增行動支付及電子支付帳戶繳稅
https://reurl.cc/o1zKRM

樂購蝦皮疑規避監理　金管會查支付交易金流
https://www.cardu.com.tw/news/detail.php?45880

電子支付APP 掃碼繳稅最便利
https://reurl.cc/e3vVzj

提高太平洋地區數碼支付的安全性：南太平洋銀行與Netcetera 合作
https://money.udn.com/money/story/12987/6242010

擴大 FinTech 版圖，PChome 子公司併購喬睿科技
https://finance.technews.tw/2022/04/13/pchome-makes-strategic-investment-in-cherri-tech-inc/

悠遊卡越來越少人用？致命關鍵曝光
https://reurl.cc/Wra8ND

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
NFT 101
https://medium.com/madworld-nft/nft-101-bc5c9bdf15

Ethereum Developer Jailed 63 Months for Helping North Korea Evade Sanctions
https://thehackernews.com/2022/04/ethereum-developer-jailed-63-months-for.html

Rarible NFT Marketplace Flaw Could've Let Attackers Hijack Crypto Wallets
https://thehackernews.com/2022/04/rarible-nft-marketplace-flaw-couldve.html

駭客盯上NFT.加密幣風潮周杰倫.余文樂損失上千萬
https://globalnewstv.com.tw/202204/183658/

虛擬貨幣平台「派網」帳戶遭駭　綠委憂中資背景恐引發國安問題
https://tw.appledaily.com/local/20220412/RJSAFLTUA5ECTLWLQGCUSZ2KCM/

加密貨幣專家因向朝鮮提供規避制裁的建議而入獄
https://news.cnyes.com/news/id/4853073

Ronin 駭客事件後：Axie Infinity 正在經歷至暗時刻
https://reurl.cc/0pgWrA

Coinbase 市占率遭瓜分、交易額縮水，今年股價摔 40%
https://finance.technews.tw/2022/04/13/coinbase-shares-fell-40-percent-this-year/

安全公司：TheArmorsNFT項目的discord遭受駭客入侵
https://news.cnyes.com/news/id/4853299

攻擊Ronin的駭客向中間地址轉入3302.6枚以太坊，並將1400枚以太坊轉入Tornado Cash
https://news.cnyes.com/news/id/4853353?exp=a

Tornado Cash：駭客最愛的混幣器與平民的隱私工具
https://reurl.cc/yr1AzM

Pi Netwrok應用已經被駭客植入了木馬程式
https://www.pi0314.com/2022/04/pi-netwrok-pipi.html

打造安全資產護城河幣託台幣信託 5 月正式上線
https://money.udn.com/money/story/11799/6239859

元宇宙帶動區塊鏈金融投資，詐騙手法需注意
https://news.pts.org.tw/article/576127

美國財政部將Ronin跨鏈橋攻擊者地址與朝鮮駭客組織相關聯並納入制裁
https://news.cnyes.com/news/id/4853855

FBI：北韓駭客盜取6.2億加密貨幣
https://www.rti.org.tw/news/view/id/2130086

美國執法部門將北韓犯罪集團與5.4億美元加密貨幣失竊案關聯起來
https://reurl.cc/zZg5m6

Ronin Chain被駭超6億美元，美財政部確認由北韓駭客組織Lazarus所為
https://news.cnyes.com/news/id/4853964

美國證實是北韓駭客盜走《Axie Infinity》6.25億美元的虛擬貨幣
https://www.4gamers.com.tw/news/detail/52716/north-korean-hackers-linked-to-620-million-axie-infinity-crypto-heist

NFT遊戲被駭180億元　FBI查出：北韓駭客幹的
https://www.appledaily.com.tw/international/20220415/VOF3E2H6ARAKHMRPDJ75OXGCIY/

FBI抓包金正恩派駭客偷走價值179億加密貨幣
https://ec.ltn.com.tw/article/breakingnews/3894698

Robinhood上架SOL、SHIB、COMP、MATIC，芝商所正考慮推出 SOL、ADA 期貨
https://news.cnyes.com/news/id/4852640

Fireblocks與支付巨頭FIS合作為機構級用戶提供加密入口
https://news.cnyes.com/news/id/4853015

建金融防線！北京推數位人民幣欲破美元霸權
https://reurl.cc/NA1Nl6

印度加密交易所Coin Switch Kuber在其行動應用中臨時禁用盧比存款
https://news.cnyes.com/news/id/4852192

華爾街加速擁抱加密貨幣，金融精英為何引頸期盼比特幣ETF登場
https://www.bnext.com.tw/article/68558/bitcoin-spot-etf-wall-street

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
美國汽車工具製造商Snap-on遭Conti勒索軟體攻擊
https://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/

出現可攔截通話並偽冒銀行電話語音的金融木馬
https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/?web_view=true

Sophos：攻擊者入侵伺服器長達5個月部署Lockbit勒索軟體
https://www.ctimes.com.tw/DispNews/tw/Sophos/2204141418LO.shtml

一台美國政府伺服器遭潛入5 個月並被部署勒索軟體
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9809

勒索軟體LockBit在美國地方政府的網路埋伏半年才發動攻擊
https://news.sophos.com/en-us/2022/04/12/attackers-linger-on-government-agency-computers-before-deploying-lockbit-ransomware/

微軟、ESET等多家資安業者聯手破壞殭屍網路ZLoader
https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/

直接攻擊發電廠的惡意軟體 Industroyer 試圖切斷烏克蘭電網，ESET和微軟成功阻止網路攻擊
https://www.techbang.com/posts/95574-with-the-help-of-eset-and-microsoft-ukraine-successfully

多支惡意 Android 應用程式使用資料竊取 SDK，下載多達 4,500 萬次
https://blog.twnic.tw/2022/04/13/22781/

挖礦程式專攻AWS Lambda 用戶外洩帳戶資料損失自負
https://www.wepro180.com/lambda220414/

殭屍網路病毒Enemybot感染多種處理器架構的設備，以發動DDoS攻擊
https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet

殭屍網路Fodcha利用裝置漏洞與暴力破解工具發動攻擊
https://blog.netlab.360.com/fodcha-a-new-ddos-botnet/

竊密軟體ZingoStealer兼具讓駭客投放其他惡意軟體的功能
https://blog.talosintelligence.com/2022/04/haskers-gang-zingostealer.html

駭客以提供Windows 11用戶Android子系統功能為幌子，散布惡意軟體
https://www.bleepingcomputer.com/news/security/windows-11-tool-to-add-google-play-secretly-installed-malware/

駭客組織OldGremlin以金融卡停用為由入侵俄羅斯組織，發動勒索軟體攻擊
https://blog.group-ib.com/oldgremlin_comeback

駭客鎖定烏克蘭政府機關散布惡意軟體IcedID，並針對協作平臺Zimbra漏洞下手
https://www.bleepingcomputer.com/news/security/hackers-target-ukrainian-govt-with-icedid-malware-zimbra-exploits/

Pysa Ransomware IOC
https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis

Kaspersky report on Emotet modules and recent attacks
https://securelist.com/emotet-modules-and-recent-attacks/106290/

Enemybot: A Look into Keksec's Latest DDoS Botnet
https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet

Tarrask malware uses scheduled tasks for defense evasion
https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/

The Fodcha botnet that made a fortune
https://blog.netlab.360.com/men-sheng-fa-da-cai-fodchajiang-shi-wang-luo/

Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload
https://www.trendmicro.com/en_no/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt

Recent attacks by Bahamut group revealed
https://mp.weixin.qq.com/s/YAAybJBAvxqrQWYDg31BBw?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=zh-CN

CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/spring4shell/IOCs-Spring4Shell.txt
https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html

Bruteforce attack against RDP - Honeypot
https://otx.alienvault.com/pulse/6255385287c2737fd13b0250

Cyberattack by Sandworm Group (UAC-0082) on energy facilities of Ukraine using malicious programs INDUSTROYER2 and CADDYWIPER
https://cert.gov.ua/article/39518

SystemBC Being Used by Various Attackers
https://asec.ahnlab.com/en/33600/

MoqHao Part 2: Continued European Expansion
https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/

Look out for Octo's tentacles! A new on-device fraud Android Banking Trojan with a rich legacy
https://www.threatfabric.com/blogs/octo-new-odf-banking-trojan.html

Snow abuse and gluttony: Analysis of suspected Lazarus attack activities against Korean companies
https://mp.weixin.qq.com/s/kcIaoB8Yta1zI6Py-uxupA

New SolarMarker (Jupyter) Campaign Demonstrates the Malware’s Changing Attack Patterns
https://unit42.paloaltonetworks.com/solarmarker-malware/

New EnemyBot DDoS Botnet Borrows Exploit Code from Mirai and Gafgyt
https://thehackernews.com/2022/04/new-enemybot-ddos-botnet-borrows.html

Microsoft Disrupts ZLoader Cybercrime Botnet in Global Operation
https://thehackernews.com/2022/04/microsoft-disrupts-zloader-cybercrime.html

Microsoft Exposes Evasive Chinese Tarrask Malware Attacking Windows Computers
https://thehackernews.com/2022/04/microsoft-exposes-evasive-chinese.html

Russian Hackers Tried Attacking Ukraine's Power Grid with Industroyer2 Malware
https://thehackernews.com/2022/04/russian-hackers-tried-attacking.html

E.U. Officials Reportedly Targeted with Israeli Pegasus Spyware
https://thehackernews.com/2022/04/eu-officials-reportedly-targeted-with.html

Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware
https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html

Researchers Connect BlackCat Ransomware with Past BlackMatter Malware Activity
https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html

Haskers Gang Gives Away ZingoStealer Malware to Other Cybercriminals for Free
https://thehackernews.com/2022/04/haskers-gang-gives-away-zingostealer.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
How to prevent hackers from reverse engineering your Android apps
https://proandroiddev.com/how-to-prevent-hackers-from-reverse-engineering-your-android-apps-2981661ab1c2

Android — 1 Minute guide to Useful Tips and Libraries in 2022
https://blog.canopas.com/android-development-best-practices-2022-203682a440f5

烏克蘭國安部門警告新一波網路攻擊鎖定Telegram用戶，目的是騙取帳號權限
https://thehackernews.com/2022/04/ukraine-warns-of-cyber-attack-aiming-to.html

Android用戶警惕黑客用假黑屏登銀行帳戶
https://www.ntdtv.com/b5/2022/04/12/a103398389.html

美國國防部鼓勵企業建立開源互通 5G 系統
https://unwire.pro/2022/04/12/5g-2/news/

安全團隊：Discord用戶需警惕不明來歷的私信圖片
https://news.cnyes.com/news/id/4852200

Uber加密電話背後功臣是它，雲端通訊平台Twilio助應用程式融入電話、簡訊功能
https://www.bnext.com.tw/article/68511/twilio-us-co

網曝「某款手機」安全漏洞多惡意代碼橫行帳密權限恐遭竊取
https://www.chinatimes.com/realtimenews/20220412004737-260405?chdtv

臺灣企銀行動銀行App 推出Wi-Fi安全偵測
https://money.udn.com/money/story/5636/6236578

無線網路進化　智慧管理抗干擾易維運 6E蓄勢待發　Wi-Fi新設備卡位
https://www.netadmin.com.tw/netadmin/zh-tw/market/35A5847BEBC84A56BA754E49720CB15F

港人常用社交媒體收集多達19種用戶資料 FB、IG及WhatsApp均上榜
https://reurl.cc/415b3V

免用實聯制社交距離APP進化：秒通知接觸記錄
https://www.businessweekly.com.tw/focus/blog/3009537

安裝「台灣社交距離」App未來免掃實聯制：手機耗電量微乎其微，去識別化標籤保隱私
https://www.thenewslens.com/article/165475

小心！資安公司示警這2款APP 暗藏木馬病毒
https://www.chinatimes.com/realtimenews/20220415002957-260412?chdtv

TikTok 封鎖俄羅斯計畫失敗　反成烏俄戰爭宣傳利器
http://n.yam.com/Article/20220415827046

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
會將用戶導向惡意網站的重導服務，影響超過 16,500 個網站
https://www.twcert.org.tw/tw/cp-104-6003-99a7e-1.html

Panasonic證實加拿大分公司2月底遭到網路攻擊
https://techcrunch.com/2022/04/11/panasonic-canada-ransomware/

在DevOps界知名的Atlassian雲端服務斷線7天，至今仍未完全恢復
https://jira-service-management.status.atlassian.com/

「嘸蝦米輸入法」官方公告網站屢遭攻擊，暫時關閉會員服務
https://boshiamy.com/index.php

會將用戶導向惡意網站的重導服務，影響超過 16,500 個網站
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9805

北韓駭客經由惡意部落格內容攻擊南韓智庫
https://intlfocus.ncc.gov.tw/xcdoc/cont?xsmsid=0J210565885111070723&sid=0M020411383877603476&sq=

印度多個政府官方推特賬號被入侵，駭客發布NFT相關詐騙網站
https://amp-news.cnyes.com/news/id/4851974

烏克蘭遭俄羅斯駭客攻擊！微軟與網路安全公司協助脫險
https://newtalk.tw/news/view/2022-04-13/738522

烏克蘭阻止俄羅斯駭客集團Sandworm針對該國電廠的攻擊
https://www.ithome.com.tw/news/150392

黑客干擾美國發電站設備　或導致化學洩漏、爆炸
https://reurl.cc/mo6kZj

一場「全方位的網絡大戰」正籠罩烏克蘭
https://reurl.cc/VDpWWR

(Daily Issue)烏俄衝突大打資訊戰　AI技術派上用場
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=1&id=0000631951_CQX8QT5R6GFC740JNHYB0

「現在只看到二、三流的俄羅斯駭客！」普京豢養的頂級網路殺手「沙蟲」，即將絕地大反攻
https://www.storm.mg/article/4289484

第四輪ATT&CK評估計畫結果出爐，以兩大俄羅斯駭客為攻擊發動者
https://www.ithome.com.tw/news/150394

駭客組織NB65攻擊俄羅斯航太機構的事故，疑似已經利用Conti原始碼作案
https://www.telegraph.co.uk/business/2022/04/11/russias-space-programme-hit-western-cyber-attack/

中國駭客Hafnium利用作業系統工作排程機制漏洞來規避偵測
https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/

中國當局加強遊戲直播管理禁止違規遊戲直播、失德主播並強化成年人保護機制
https://gnn.gamer.com.tw/detail.php?sn=230601

FBI, Europol Seize RaidForums Hacker Forum and Arrest Admin
https://thehackernews.com/2022/04/fbi-europol-seize-raidforums-hacker.html

Finding Attack Paths in Cloud Environments
https://thehackernews.com/2022/04/finding-attack-paths-in-cloud.html

Chinese Hacker Groups Continue to Target Indian Power Grid Assets
https://thehackernews.com/2022/04/chinese-hacker-groups-continue-to.html

JekyllBot:5 Flaws Let Attackers Take Control of Aethon TUG Hospital Robots
https://thehackernews.com/2022/04/new-jekyllbot5-flaws-let-attackers-take.html

成長駭客_M01
https://www.104.com.tw/job/6frwd?jobsource=jlisthotkeywords

[2022 資安大會] 5/17~5/19 展場工讀生
https://www.104.com.tw/job/7lm17

資安技術工程師
https://www.1111.com.tw/job/98737389/

資安副理 (資安服務部)
https://www.104.com.tw/job/7lqjo

(科政中心)資安或科技政策研究人員(碩士、博士)111020
https://www.104.com.tw/job/7lpvl

資安工程師-台北/新竹(37Z)
https://www.104.com.tw/job/7lqch

醫療資訊室(資訊組)院聘資訊工程師(資安)
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=48309&HIRE_ID=11116757

TS-資安人員
https://www.104.com.tw/job/7lree?jobsource=cj2008

精誠配發5元股利　今年擴大招募逾千人
https://today.line.me/tw/v2/article/1Dp0xnp

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Fake News about our Fake News Study Spread Faster than its Truth… Just as We Predicted
https://sinanaral.medium.com/fake-news-about-our-fake-news-study-spread-faster-than-its-truth-just-as-we-predicted-77db6d9ca8c8

資料外洩警示! 剖析2022Q1的 3個 SaaS App攻擊事件
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9803

Google Sues Scammer for Running 'Puppy Fraud Scheme' Website
https://thehackernews.com/2022/04/google-sues-scammer-for-running-puppy.html

美國福斯新聞因配置錯誤，導致1300萬條敏感記錄無保護的讓外部都可存取
https://www.hackread.com/fox-news-exposed-13-million-sensitive-records-online/

駭客裸照恐嚇要錢受害者：拒妥協不願被威脅
https://reurl.cc/XjDQEe

最新網購詐騙手法　你銀行存款會「一次被領光光」
https://vocus.cc/article/6256405cfd89780001dff6c2

庫克全球私隱高峰會上批反壟斷法規稱開放側載危害用戶資安
https://news.cnyes.com/news/id/4852414

庫克批反壟斷監管，稱一些政策會傷害iPhone用戶隱私
https://news.knowing.asia/news/7b8979b2-0a99-400c-9ec6-5058e082815d

駭客組織匿名者攻陷俄羅斯3個大型企業，竊得逾400 GB資料
https://www.hackread.com/anonymous-hits-russian-entities-leaks-400-gb-emails/

詐騙老梗頻現龜山警同行員合力阻詐保48萬元
https://times.hinet.net/news/23859968

假檢警騙健保卡遭冒用 8旬老婦險匯「擔保款」36萬元
https://udn.com/news/story/7320/6238253

越來越多的商業郵件詐騙手法更為詭詐，難以透過行為和意圖識破
https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports/roundup/navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report

俄烏戰爭下，假消息成蔓延全球的新戰場！如何在社群上避免以訛傳訛
https://www.bnext.com.tw/article/68466/fake-news-ylib-sa

5電商名列資安高風險個資易遭盜
https://www.cyberangel.org.tw/tw/cap-news/cap-news/item/5-2

因應5/1勞動節和疫情影響，勞動部體恤勞工發放補助金5000元？惡作劇連結
https://www.mygopen.com/2022/04/515000.html

連比爾蓋茲都上當！一個華爾街騙子，如何靠「行善又能致富」騙全球菁英
https://www.businessweekly.com.tw/business/blog/3009555

網傳影片稱「德國在聯合國的發言，烏克蘭人為西方虛假的承諾付出了代價」
https://tfc-taiwan.org.tw/articles/7201

1999錄音分析恐違個資法！議員疑把關失靈　資訊局長提２解方
https://tw.appledaily.com/life/20220414/GEYEEN25KVBNJEV5FXZADWTIW4/

E.研究報告/工具
OpenSSH 9.0開始採用後量子密碼，因應日後量子破密威脅
https://www.phoronix.com/scan.php?page=news_item&px=OpenSSH-9.0-Released

協助資安長 (CISO) 評估市場主流資安解決方案的Mitre Engenuity ATT&CK Evaluations 為何重要
https://blog.trendmicro.com.tw/?p=71898

How to make Excel look less like… Excel
https://datastudio.medium.com/how-to-make-excel-look-less-like-excel-8eb91b75ab8f

How to Start Bug Bounties 101 & How to Make a Million in 4 Years
https://ozguralp.medium.com/how-to-start-bug-bounties-101-how-to-make-a-million-in-4-years-e15ee62d6f4

The Dark Truth about VPN
https://medium.com/geekculture/the-dark-truth-about-vpn-cb2d8d9735ad

DevOps Roadmap 2022
https://faun.pub/devops-roadmap-2022-340934d360f9

How I bypassed 403 forbidden domain using a simple trick
https://janmuhammadzaidi.medium.com/how-i-bypassed-403-forbidden-domain-using-a-simple-trick-c2d538de04b8

Give me a browser, I’ll give you a Shell
https://systemweakness.com/give-me-a-browser-ill-give-you-a-shell-de19811defa0

How I was able to find 50+ Cross-site scripting (XSS) Security Vulnerabilities on Bugcrowd Public Program
https://infosecwriteups.com/how-i-was-able-to-find-50-cross-site-scripting-xss-security-vulnerabilities-on-bugcrowd-public-ba33db2b0ab1

What the Apps Ukrainians Are Downloading Tell Us About Their Situation
https://debugger.medium.com/what-the-apps-ukrainians-are-downloading-tell-us-about-their-situation-2dd8d8404a1b

Advanced exploratory data analysis (EDA) with Python
https://medium.com/epfl-extension-school/advanced-exploratory-data-analysis-eda-with-python-536fa83c578a

3 Design Patterns Every Developer Should Learn
https://blog.bitsrc.io/3-design-patterns-every-developer-should-learn-71a51568ac9d

Are You a Python Developer? Check If You Have These 12 Skills
https://medium.com/illumination/are-you-a-python-developer-check-if-you-have-these-12-skills-96765cdbb78f

Spotify Data Analysis and Visualisation with Python
https://blog.devgenius.io/spotify-data-analysis-with-python-a727542beaa7

Python: Scrape Any Website in Seconds with One Line of Code
https://medium.com/@alains/python-scrape-any-website-in-seconds-with-one-line-of-code-574e4bd57005

PHP Is Dying Fast
https://levelup.gitconnected.com/php-is-dying-a3805e23a3b8

DevOps & DecSecOps Roadmap [From beginner to an expert]
https://faun.pub/devops-decsecops-roadmap-from-beginner-to-an-expert-c3e4fca2b347

UI/UX Roadmap for Beginners
https://medium.com/@sahubablu22/ui-ux-roadmap-for-beginners-6601d15027ca

Code like there is no if-statement
https://medium.com/@shirkavand/code-like-there-is-no-if-statement-36ca170c2b92

Could Spain Finally Be About to Join the 21st Century
https://marker.medium.com/could-spain-finally-be-about-to-join-the-21st-century-2aea9547e3e3

10 SQL Queries You Should Know as a Data Scientist
https://selectfrom.dev/10-sql-queriesyou-should-know-as-a-data-scientist-8bf616204765

Stop Using JSON Web Tokens For Authentication (The wrong way)
https://betterprogramming.pub/stop-using-json-web-tokens-for-authentication-use-stateful-sessions-instead-c0a803931a5d

Goodbye HTML. Hello Canvas
https://javascript.plainenglish.io/goodbye-html-hello-canvas-part-1-92f750961666

Cross-Regional Disaster Recovery with Elasticsearch
https://thehackernews.com/2022/04/cross-regional-disaster-recovery-with.html

Researchers warn of FFDroider and Lightning info-stealers targeting users in the wild
https://thehackernews.com/2022/04/researchers-warn-of-ffdroider-and.html

As State-Backed Cyber Threats Grow, Here's How the World Is Reacting
https://thehackernews.com/2022/04/as-state-backed-cyber-threats-grow.html

F.商業
鼎新電腦助企業輕鬆啟用MDR、快速有效瞬間提升資安防禦力
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9779

Dropbox 推出 HelloSign 電子簽名模板、Dropbox Backup 新備份工具
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9798

OPSWAT 為關鍵基礎設施推出資安行動實驗室 - CyberTrailer
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9801

Westcon成為 Efficient iP台灣區代理商
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9802

私募基金Thoma Bravo以69億美元收購身分安全管理業者SailPoint
https://investors.sailpoint.com/news/2022/04-11-2022-114519925

HelpSystems併購資安培訓平臺業者Terranova Security
https://www.helpnetsecurity.com/2022/04/09/helpsystems-terranova-security/

Cymetrics 結盟是方電訊　提供雲端資安服務
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/E391E0155EEB414C80D03ECB95E4BA46

NordVPN 免費加入全方位威脅防護功能　提供進一步安全保障
https://unwire.hk/2022/04/13/nordvpn-threat-protection/life-tech/

KKR擬收購資安企業Barracuda 交易價值估40億美元
https://turnnewsapp.com/livenews/global/A06626002022041303090922

全球最大半導體設備商AMAT入股京鼎
https://www.1111.com.tw/news/jobns/145117

Citrix 發佈全新 Citrix Virtual Apps and Desktops 2203 LTSR 長期服務版本
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/23DDA792593F46B0A1A2B7E16E3904A0

Fortinet 最新升級！FortiOS 7.2 新增超過 300 項功能，為企業打造資安基礎架構
https://news.sina.com.tw/article/20220414/41603136.html

Westcon宣布成為Efficient iP台灣區代理商
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000633182_W100740K9JB0XI1HF5S6V

和碩聯合科技攜手微軟以 RPA 化繁為簡全面加速數位轉型
https://www.businessweekly.com.tw/business/indep/1002298

G.政府
第3屆ICANN APAC-TWNIC 邀請全球網路意見領袖共同探討網路治理議題
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9800

綠委拋成立數位指揮中心防資訊戰蘇貞昌：已有防錯假訊息防制平台
https://www.rti.org.tw/news/view/id/2129813

經民連批金管會為中資蝦皮開後門：「中國武力犯臺前，臺灣恐先經濟亡國！」
https://musou.watchout.tw/read/SIeng5lR0KgO8WzqJOXf

31億蝦皮金流當機沒人管？民團批金管會放水要求立院速審法規
https://newtalk.tw/news/view/2022-04-13/738836

NCC：低軌衛星涉頻譜開放未來由數發部掌管
https://www.cna.com.tw/news/afe/202204140245.aspx

立法委員高虹安：資安成國家重要課題，望台灣能打造出自助、助人的資安國家隊
https://news.knowing.asia/news/c4073007-db73-495c-983c-7383b6466c52

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
美國警告國家級駭客鎖定ICS、SCADA系統發動攻擊
https://www.bleepingcomputer.com/news/security/us-warns-of-govt-hackers-targeting-industrial-control-systems/

美示警：駭客已能攻擊關鍵基礎設施
https://reurl.cc/LmjnYL

美國CISA發布AA22-103A警報：關鍵基礎設施及製造業提防PLC被Pipedream攻陷
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9813

101 DATA SCIENCE with Cheat Sheets (ML, DL, Scraping, Python, R, SQL, Maths & Statistics)
https://medium.com/@anushka.datascoop/101-data-science-cheat-sheets-ml-dl-scraping-python-r-sql-maths-statistics-ef30b4d786eb

工業網絡公司組建遊說團體，以應對美國政府加強監管
https://reurl.cc/x9x37V

俄羅斯駭客Sandworm鎖定烏克蘭能源供應商的ICS系統下手
https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/

醫療機器人存在零時差漏洞JekyllBot:5，恐被攻擊者用於遠端控制
https://reurl.cc/OA7m6r

D-Link 無線路由器「這5款」舊機存重大漏洞！美國土部示警盡快停用
https://today.line.me/tw/v2/article/0MpY2X3

75% 資安事件曾造成生產線停擺！TXOne：打造智慧工廠必備「這 5 大資安思維」
https://buzzorange.com/techorange/2022/04/13/smart-manufacturing-security/

搶攻智慧醫療商機！趨勢科技執行長陳怡樺創立智趨動，加速仿生科技落地
https://www.bnext.com.tw/article/68548/smart-healthcare-trendmicro

以實現智慧城市為目標三菱電機Diamond Controls 發揮關鍵作用
https://www.businessweekly.com.tw/careers/indep/1002303

博歐如何用區塊鏈技術使汽車身份認證更安全
https://www.digitimes.com.tw/iot/article.asp?cat=158&id=0000633212_MCN1OH9L21747V1T5WT1F

無人機發展涉及資安專家：應建立資通訊安全標準
https://reurl.cc/OA7RV3

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
AIAA講座【台北場】：資安思維 X 政府應用AI案例 X 數位轉型 2022/4/16
https://www.accupass.com/event/2203031213512786993470

SP-ISAC【資安專題講座】網站安全面面觀 2022/04/19
https://reurl.cc/6EWjRM

網站應用程式安全 2022/04/19
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19881

SDN x Cloud Native Meetup #47 2022/4/19
https://www.meetup.com/CloudNative-Taiwan/events/284821277/

Quarterly Professional Networking Event 2022/4/21
https://www.meetup.com/taiwan-digital-drinks/events/284733775/

2022 美台金融資安論壇數位轉型下的資安再造 2022/04/21 ~ 2022/04/22
https://event.netmag.tw/202204ait/

南部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名） 2022/4/21
https://www.cisanet.org.tw/Course/Detail/2784

Python 數據分析一日工作坊 - 電商、Airbnb分析實戰 2022/4/23
https://www.meetup.com/PyLadiesTW/events/284972118/

區塊鏈與智慧資安女力論壇 2022/4/24
https://isipevent.kktix.cc/events/e58d0573

沙崙資安基地線上免費課程：【資產盤點暨風險評鑑實務】 2022/04/26
https://bit.ly/3KmFTqW

資通安全電腦稽核-防火牆管理查核實例演練~稽核最佳實務演練 2022/04/28
https://www.acl.com.tw/news/news_display.php?id=1802

SEMI E187設備資安標準導入與實務研討會 2022/4/29
https://www.semi.org/zh/cybersecurity-standards-seminar

「資安鑑識課程-系列Ⅰ初級課程：資安科技基礎養成：滑鼠鍵盤敲起來【從密碼到資安】」線上研習 2022/4/29
https://docs.google.com/forms/d/1yS8JontNqGinMYUOaYj9aQ-Ov92yda7eFldgjotOAUs

K12的科技教育-除了程式還可以教什麼 2022/5/9
https://www.meetup.com/rladies-taipei/events/284421238/

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

資訊安全系列課程系列九：機器學習與資安異常診斷實務(第1期) 2022/6/7
https://www.tabf.org.tw/CourseDetail.aspx?PID=487302

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/4/4 ~ 2022/4/8

noreply@blogger.com (Unknown) — Fri, 08 Apr 2022 15:29:00 +0000

資安事件新聞週報 2022/4/4 ~ 2022/4/8

1.重大弱點漏洞/後門/Exploit/Zero Day
Beastmode DDoS Botnet Exploiting New TOTOLINK Bugs to Enslave More Routers
https://thehackernews.com/2022/04/beastmode-ddos-botnet-exploiting-new.html

CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability
https://thehackernews.com/2022/04/cisa-warns-of-active-exploitation-of.html

Spring Core出現零時差遠端程式攻擊弱點
https://tanzu.vmware.com/security/cve-2022-22950
https://tanzu.vmware.com/security/cve-2022-22963
https://thehackernews.com/2022/03/unpatched-java-spring-framework-0-day.html?fbclid=IwAR2Fg7nYqASDEY1QJXVDn1OqzqqQvVeI_wxCTGlQ6m9mtH2XiDGGy4Vsdew&m=1

Java開發框架再傳Spring4Shell漏洞是否會引發更大的資安風暴
https://reurl.cc/jkxQ62

駭客企圖開採微軟雲端服務上的SpringShell漏洞
https://www.ithome.com.tw/news/150275

有16%的企業組織面臨針對SpringShell漏洞的嘗試性攻擊
https://blog.checkpoint.com/2022/04/05/16-of-organizations-worldwide-impacted-by-spring4shell-zero-day-vulnerability-exploitation-attempts-since-outbreak/

Sophos Firewall v18.5 MR3 (含)之前版本存在驗證弱點。該弱點允許遠端攻擊者藉由用戶名稱和 Webadmin 中繞過身份驗證。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-1040

Sonicwall 產品 SonicOS 存在阻斷服務弱點。該弱點允許攻擊者藉由 HTTP 請求的基於堆棧的緩衝區溢出，導致服務阻斷情況或執行任意程式碼。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22274

程式碼代管平臺GitLab出現重大漏洞，攻擊者可用於接管帳號
https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/

趨勢科技修補資安防護主控臺Apex Central的RCE漏洞
https://success.trendmicro.com/dcx/s/solution/000290678

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
FIN7 Hackers Leveraging Password Reuse and Software Supply Chain Attacks
https://thehackernews.com/2022/04/fin7-hackers-leveraging-password-reuse.html

Ukrainian FIN7 Hacker Gets 5-Year Sentence in the United States
https://thehackernews.com/2022/04/ukrainian-fin7-hacker-gets-5-year.html

三無印度銀行中門大開損失百萬盧比
https://www.wepro180.com/bank220408/

安聯集團將進軍純網路產險　鎖定電信、電商結盟合作
https://www.ftvnews.com.tw/news/detail/2022408W0138

3.電子支付/行動支付/pay/資安
美國行動支付Cash資料外洩，820萬用戶受到影響
https://techcrunch.com/2022/04/05/block-cash-app-data-breach/

英國連鎖零售商The Works遭到網路攻擊，支付系統受到波及
https://otp.tools.investis.com/clients/uk/the_works_stores_ltd/rns/regulatory-story.aspx?cid=2405&newsid=1570877

印度台商推出電子支付鑰匙圈
https://reurl.cc/qOyG8D

歐付寶成首家電子支付繳稅系統
https://reurl.cc/Go7nrd

涉嫌非法使用電子支付APP的2名中國人在日被捕
https://zh.cn.nikkei.com/politicsaeconomy/politicsasociety/48125-2022-03-31-16-18-17.html

印度最大行動支付Paytm 誇口明年Q3前打平
https://reurl.cc/OpdYqA

華為殺入行動支付微信、支付寶迎新勁敵
https://ctee.com.tw/news/china/621355.html

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
This Coin Will Recover All Your Losses
https://medium.com/@jessicadoosan09/this-coin-will-recover-all-your-losses-4a328bdd2580

臉書幣復活？Meta 傳要發全新虛擬貨幣，內部稱 Zuck Bucks – INSIDE
https://reurl.cc/Opd5Nv

近700萬美元被黑的Ronin資金被發送到Tornado Cash
https://news.cnyes.com/news/id/4846694?exp=a

Change the Code, Not the Climate！環團要求變更比特幣挖礦方式
https://www.inside.com.tw/article/27244-bitcoin-changethecode-greenpeaceusa

最近NFT詐騙及駭客事件頻傳，新手該注意甚麼
https://www.potatomedia.co/post/9b5c84c6-150d-4ad5-85c1-e94e8d892d5f

攻擊Ronin的駭客向新地址轉入超過2000枚以太坊，並向Tornado Cash轉入1000枚以太坊
https://news.cnyes.com/news/id/4848122?exp=a

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
忽必烈控館長「派人鬧場逼退費」！電腦疑遭植木馬閉館3天
https://www.setn.com/News.aspx?NewsID=1094736

來自俄羅斯的新型惡意間諜程式現蹤！偷聽Android用戶手機、竊個資
https://3c.ltn.com.tw/news/48408

勒索軟體事件激增最新調查：企業高層對網路安全仍缺乏認識
https://cnews.com.tw/124220406a01/

中國駭客APT10透過影音播放軟體VLC Player側載惡意程式
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-china-ngo-government-attacks

挖礦軟體罪犯目標轉向雲端
https://www.ithome.com.tw/news/150332

美國迅速移除惡意軟體！防止俄羅斯網路攻擊
https://times.hinet.net/news/23849982

美俄網戰先交火！美司法部爆秘密刪除俄羅斯惡意軟體擋下網攻
https://www.rti.org.tw/news/view/id/2129373

美先發制人瓦解俄軍駭客殭屍網路
https://news.ltn.com.tw/news/world/breakingnews/3886007

惡意軟體Denonia鎖定無伺服器運算服務AWS Lambda下手，植入XMRig變種挖礦軟體
https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/

駭客利用惡意網頁導向服務Parrot TDS感染逾1.6萬個網站，目的是散布惡意軟體
https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/

木馬程式Borat具備竊密、DDoS攻擊能力，並讓駭客能用於部署勒索軟體
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/

全球2千萬工程師的救星！美國資安獨角獸Snyk找出安全漏洞，靠的是「惡意病毒」
https://meet.bnext.com.tw/articles/view/48920?

Conti攻擊多點開花，Panasonic、Konica Minolta、福特等公司遭駭洩露資料
https://www.ithome.com.tw/news/150302

Detecting EnemyBot – Securonix Initial Coverage Advisory
https://www.securonix.com/blog/detecting-the-enemybot-botnet-advisory

Exposing the Iranian EvilNominatus Ransomware
https://www.clearskysec.com/wp-content/uploads/2022/04/EvilNominatus_Ransomware_7.4.22.pdf

Google is on guard: sharks shall not pass
https://research.checkpoint.com/2022/google-is-on-guard-sharks-shall-not-pass/

Parrot TDS takes over web servers and threatens millions
https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/

Cyber attack of UAC-0010 group (Armageddon) on state organizations of Ukraine
https://cert.gov.ua/article/39386

Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group
https://otx.alienvault.com/pulse/624ff0af271429d152b5a27e

Adversarial Threat Report - April 2022
https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf

Cado Discovers Denonia: The First Malware Specifically Targeting Lambda - Cado Security | Cloud Investigation
https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/

Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/

FFDroider Stealer Targeting Social Media platform Zscaler
https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users

Fake E-shops on the prowl for banking credentials using Android malware
https://www.welivesecurity.com/2022/04/06/fake-eshops-prowl-banking-credentials-android-malware/

Operation Bearded Barbie: APT-C-23 Campaign Targeting Israeli Officials
https://www.cybereason.com/blog/operation-bearded-barbie-apt-c-23-campaign-targeting-israeli-officials

The Latest Remcos RAT Driven By Phishing Campaign
https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing

Windows MetaStealer Malware Report
https://isc.sans.edu/diary/rss/28522

Peace through Pegasus: Jordanian Human Rights Defenders and Journalists Hacked with Pegasus Spyware
https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/

Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-china-ngo-government-attacks

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7
https://www.mandiant.com/resources/evolution-of-fin7

CaddyWiper Analysis: New Malware Attacking Ukraine
https://blog.morphisec.com/caddywiper-analysis-new-malware-attacking-ukraine

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage
https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/

Complete dissection of an APK with a suspicious C2 Server
https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/

Scammers are Exploiting Ukraine Donations
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/scammers-are-exploiting-ukraine-donations/

Cyber attack by UAC-0010 (Armageddon) on state institutions of the European Union
https://otx.alienvault.com/pulse/624c210d91980fdfba0319a7

Malicious Word Documents Using MS Media Player (Impersonating AhnLab)
https://asec.ahnlab.com/en/33477/

Elephant Framework Delivered in Phishing Attacks Against Ukrainian Orgs
https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/

Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign
https://www.fortinet.com/blog/threat-research/totolink-vulnerabilities-beastmode-mirai-campaign

SharkBot Banking Trojan Resurfaces On Google Play Store Hidden Behind 7 New Apps
https://thehackernews.com/2022/04/sharkbot-banking-trojan-resurfaces-on.html

Researchers Uncover How Colibri Malware Stays Persistent on Hacked Systems
https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html

FBI Shut Down Russia-linked "Cyclops Blink" Botnet That Infected Thousands of Devices
https://thehackernews.com/2022/04/fbi-shut-down-russia-linked-cyclops.html

U.S. Treasury Department Sanctions Russia-based Hydra Darknet Marketplace
https://thehackernews.com/2022/04/us-treasury-department-sanctions-russia.html

Germany Shuts Down Russian Hydra Darknet Market; Seizes $25 Million in Bitcoin
https://thehackernews.com/2022/04/germany-shuts-down-russian-hydra.html

Researchers Uncover New Android Spyware With C2 Server Linked to Turla Hackers
https://thehackernews.com/2022/04/researchers-uncover-new-android-spyware.html

Multiple Hacker Groups Capitalizing on Ukraine Conflict for Distributing Malware
https://thehackernews.com/2022/04/multiple-hacker-groups-capitalizing-on.html

Experts Shed Light on BlackGuard Infostealer Malware Sold on Russian Hacking Forums
https://thehackernews.com/2022/04/experts-shed-light-on-blackguard.html

Stolen Images Campaign Ends in Conti Ransomware
https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/

New Octo Banking Trojan Spreading via Fake Apps on Google Play Store
https://thehackernews.com/2022/04/new-octo-banking-trojan-spreading-via.html

First Malware Targeting AWS Lambda Serverless Platform Discovered
https://thehackernews.com/2022/04/first-malware-targeting-aws-lambda.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Hackers Distributing Fake Shopping Apps to Steal Banking Data of Malaysian Users
https://thehackernews.com/2022/04/hackers-distributing-fake-shopping-apps.html

Ukraine Warns of Cyber attack Aiming to Hack Users' Telegram Messenger Accounts
https://thehackernews.com/2022/04/ukraine-warns-of-cyber-attack-aiming-to.html

Block Admits Data Breach Involving Cash App Data Accessed by Former Employee
https://thehackernews.com/2022/04/block-admits-data-breach-involving-cash.html

微軟成立新的Android部門，打算讓Windows與Android之間的流暢度比擬macOS與iOS
https://times.hinet.net/news/23842662

小心病毒搬光你的錢？快檢視手機中毒的「7大」症狀
https://3c.ltn.com.tw/news/48410

趕快更新軟體！三星 Android 手機爆資安漏洞「可能被駭客接管」
https://3c.ltn.com.tw/news/48431

致命漏洞快更新！安卓「這4種」手機遭入侵銀行APP危險
https://reurl.cc/EpkgDn

Android手機爆資安漏洞！4系統藏「不明代號」　網銀戶頭恐被盜光
https://www.ettoday.net/news/20220406/2224005.htm

Google 將多款內藏收集個人資料 SDK Android 軟件下架
https://www.pcmarket.com.hk/google-takes-down-several-android-apps-embedded-personal-data-collection-sdk/

11款APP快刪！官方證實「恐盜銀行帳密」 6000萬用戶崩潰
https://fnc.ebc.net.tw/fncnews/tech/148913

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
電子郵件行銷公司MailChimp遭駭，牽連加密貨幣業者
https://times.hinet.net/news/23843823

最新資料刪除軟體導致Viasat歐洲通訊衛星斷線
https://www.ithome.com.tw/news/150255

Google Analytics遭網釣駭客用來改善攻擊成效，但同樣也可用來追蹤網釣活動
https://reurl.cc/pW7aDr

美國CISA成立「Shields Up」網站列出可行的重點資安指引
https://www.ithome.com.tw/news/150239

美國國務院宣布設立「網路空間暨數位政策局」，將數位安全列入外交政策
https://www.inside.com.tw/article/27287-cdp-cyberattack-blinken

日本通訊行業龍頭將結束與卡巴斯基的合作關係
https://news.cnyes.com/news/id/4848754

擔憂安保風險日本NTT集團將停用俄卡巴斯基軟體
https://udn.com/news/story/122699/6224792?from=udn-catebreaknews_ch2

網路間諜行動Bearded Barbie鎖定以色列官員而來
https://www.cybereason.com/blog/operation-bearded-barbie-apt-c-23-campaign-targeting-israeli-officials

微軟接管俄羅斯駭客Fancy Bear用於攻擊烏克蘭的網域名稱
https://blogs.microsoft.com/on-the-issues/2022/04/07/cyberattacks-ukraine-strontium-russia/

烏克蘭危機：最新的網路攻擊「雨刷」
https://blog.twnic.tw/2022/04/07/22645/

歐盟擬透過數位服務法向大型網路平台徵收「保護費」
https://ec.ltn.com.tw/article/breakingnews/3884068

中資收購英國晶片廠懸而未決就業國安短中期考慮成焦點
https://www.voacantonese.com/a/6518240.html

英媒指中國開戰前網攻烏克蘭中方：一派胡言
https://money.udn.com/money/amp/story/5599/6214981

被控烏俄開戰前網攻烏克蘭軍事及核子設施中國：一派胡言不足為信
https://newtalk.tw/news/view/2022-04-04/734297

中方支持駭客襲擊印度電力設施？陸外交部：潑中方髒水
https://www.chinatimes.com/realtimenews/20220407004253-260409?chdtv

紐時點出「普丁開戰」真正原因　無法忍受烏克蘭1件事
https://www.ettoday.net/news/20220404/2222614.htm

戰情早被看光？匿名者：成功駭取12萬名俄軍個資
https://news.ltn.com.tw/news/world/breakingnews/3882627

俄政府最大喉舌被「匿名者」洩露近百萬封電郵
https://www.secretchina.com/news/b5/2022/04/08/1002883.html

美、德攜手破獲俄超大暗網 Hydra Market，沒收 543 枚比特幣
https://technews.tw/2022/04/06/worlds-biggest-darknet-marketplace-russia-linked-hydra-market-seized-and-shut-down/

Meta制止俄駭客美司法部制裁俄寡頭及網絡犯罪
https://www.soundofhope.org/post/610190?lang=b5

俄羅斯盜烏軍臉書發投降文！Meta公布駭客入侵手段
https://reurl.cc/qOyGdD

加拿大冀提升數位防禦，推出免費中小企業網路安全認證服務
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=0c747a5e-6fd5-4ed1-9fee-2be212d2b0c7

Hamas-linked Hackers Targeting High-Ranking Israelis Using 'Catfish' Lures
https://thehackernews.com/2022/04/hamas-linked-hackers-targeting-high.html

Researchers Trace Widespread Espionage Attacks Back to Chinese 'Cicada' Hackers
https://thehackernews.com/2022/04/researchers-trace-widespread-espionage.html

Brokenwire Hack Could Let Remote Attackers Disrupt Charging for Electric Vehicles
https://thehackernews.com/2022/04/brokenwire-hack-could-let-remote.html

Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine
https://thehackernews.com/2022/04/microsoft-obtains-court-order-to-take.html

Hamas-linked Hackers Targeting High-Ranking Israelis Using 'Catfish' Lures
https://thehackernews.com/2022/04/hamas-linked-hackers-targeting-high.html

短期駐點資訊安全人員
https://www.104.com.tw/job/7kdk6

網管工程師
https://www.104.com.tw/job/7lbf5

【集團】資安網管工程師
https://www.104.com.tw/job/7kwc1?jobsource=jolist_d_relevance

網路管理資安工程師
https://www.518.com.tw/job-yMAjvv.html

中華資安國際行政助理
https://worknowapp.com/jobs/a9717268-4db0-4090-9263-6b7b5ef8de4e

資安工程師
https://www.518.com.tw/job-G7o0p6.html

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Hackers Breach Mailchimp Email Marketing Firm to Launch Crypto Phishing Scams
https://thehackernews.com/2022/04/hackers-breach-mailchimp-email.html

防個資被盜律師：社安、信用卡號勿同時給他人
https://www.worldjournal.com/wj/story/121360/6212357

你儲值出錯！摩斯個資洩「消費隔日詐騙集團就有資料」　女慘遭騙30萬
https://news.tvbs.com.tw/life/1757656

誠品網路書店再爆個資外洩　民眾接一通電話後慘噴10多萬
https://www.appledaily.com.tw/property/20220404/HMU4XIER3FCZTBJABCPUQTVVCA/

Discord上包括無聊猿猴在內的多個NFT專案遭駭客入侵並廣播詐騙訊息
https://www.ithome.com.tw/news/150257

黃明志60億點擊YouTube帳號遭駭玻璃心等MV全消失
https://www.rti.org.tw/news/view/id/2129144

一頁式詐騙又來！謊稱蔡宏圖投資加密貨幣致富
https://www.ftvnews.com.tw/news/detail/2022405F04M1

資安專家6招防魚叉式釣魚攻擊
https://reurl.cc/yQ2Dol

驚！最新網購詐騙手法　你銀行存款會「一次被領光光」
https://www.setn.com/News.aspx?NewsID=1096539

遭投資群組拐走150萬她怒控165專線沒用害賣屋還債
https://reurl.cc/e6qG07

雀巢公司數據泄露凸顯與戰爭相關的駭客活動風險
https://reurl.cc/8WQ6rd

E.研究報告/工具
Golang — 1 Minute guide to Useful Tips and Libraries in 2022
https://blog.canopas.com/1-min-guide-to-golang-development-best-practices-in-2022-b50d846fd6c

Into the Breach: Breaking Down 3 SaaS App Cyber Attacks in 2022
https://thehackernews.com/2022/04/into-breach-breaking-down-3-saas-app.html

Is API Security on Your Radar
https://thehackernews.com/2022/04/is-api-security-on-your-radar.html

MITRE ATT&CK第四輪評估計畫結果出爐
https://attackevals.mitre-engenuity.org/enterprise/participants/?adversaries=wizard-spider-sandworm

電磁紀錄怎麼刑事扣押
https://www.ettoday.net/news/20220407/2223595.htm

資料外洩警示! 剖析2022Q1的 3個 SaaS App攻擊事件
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9803

F.商業
微軟推資安規格Office 365 Government Secret 政府處理數位文件更安全
https://m.333dushi.com/post/96935.html

傳歐盟反托拉斯主管機關盯上微軟雲端業務
https://www.ithome.com.tw/news/150265

OPSWAT 為關鍵基礎設施推出資安行動實驗室
https://www.docutek.com.tw/newsDetail.php?id=443

IBM 推出 z16 新一代大型主機系統，具備量子加密技術防止資安風險
https://technews.tw/2022/04/07/ibm-unveils-z16-next-generation-mainframe-system/

G.政府
數發部將掛牌朝野立委盼成為數位科技領頭羊
https://www.cna.com.tw/news/aipl/202204030170.aspx

中共侵台手段盡出！蔡英文示警：加強防範「裡應外合」
https://www.setn.com/News.aspx?NewsID=1096117

羅智強發起徵「百萬TikTok粉絲」活動！劉仕傑示警：輕忽中共資訊戰
https://www.ftvnews.com.tw/news/detail/2022407W0190

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
程式語言Go以5招式防禦軟體供應鏈攻擊
https://www.ithome.com.tw/news/150235

椰棗、友嘉聯手強化工控資安防護
https://readers.ctee.com.tw/cm/20220407/a25ab1/1178126/share

DLink DAP-1360 F1硬體版本<=v6.10中的“webupg”二進製文件裡，
攻擊者在“name=deleteFile”參數為“name=deleteFile”的情況下，經過授權後，
攻擊者可以使用“file”參數執行任意系統命令。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44127

D-Link 產品 DIR-820L 1.05B03 版本存在 RCE 弱點。該弱點藉由 /lan.asp 的名稱參數可能導致遠端執行任意程式碼。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-26258

NETGEAR 產品設備 R8500 1.0.2.158 版本組件 (.cgi) 的 sysNewPasswd
和 sysConfirmPasswd 參數存在遠端執行程式碼弱點。該弱點允許攻擊者由 shell 元字符執行任意命令。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-27945
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-27946
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-27947

Totolink 產品 T10 V2 韌體版本 V4.1.8cu.5207_B20210320 存在
緩衝區溢出弱點。該弱點可能在 HTTP 請求過程中處理 http_request_parse 函數的主機資訊造成 Buffer Overflow 情況。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-43636

ASUS RT-AC86U - Heap-based buffer overflow
https://www.twcert.org.tw/tw/cp-132-5793-4f9d3-1.html

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Just a chat - with no Expectations 2022/4/9
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/284734457/

Coffee & Code 2022/4/10
https://www.meetup.com/Innovate-Taiwan/events/284921441/

2022 數位轉型論壇(二) 無懼威脅的天堂--後疫情時代的資訊安全 2022/4/12
https://www.cisanet.org.tw/Services/MemberActivityServiceDetail/685

從Python到TensorFlow線上讀書會-Python基礎導讀(4) -第四章用 if 來選擇 2022/4/12
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/284265342/

SyntaxError 2022/4/13
https://www.meetup.com/pythonhug/events/284820898/

中部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名）2022/4/13
https://www.cisanet.org.tw/Course/Detail/2783

只要有心，人人都能成為雲端人才！AWSome Day線上雲端培訓日 2022/4/14
https://lihi1.com/FE09M

AIAA講座【台北場】：資安思維 X 政府應用AI案例 X 數位轉型 2022/4/16
https://www.accupass.com/event/2203031213512786993470

SP-ISAC【資安專題講座】網站安全面面觀 2022/04/19
https://reurl.cc/6EWjRM

網站應用程式安全 2022/04/19
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19881

SDN x Cloud Native Meetup #47 2022/4/19
https://www.meetup.com/CloudNative-Taiwan/events/284821277/

Quarterly Professional Networking Event 2022/4/21
https://www.meetup.com/taiwan-digital-drinks/events/284733775/

2022 美台金融資安論壇數位轉型下的資安再造 2022/04/21 ~ 2022/04/22
https://event.netmag.tw/202204ait/

南部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名） 2022/4/21
https://www.cisanet.org.tw/Course/Detail/2784

Python 數據分析一日工作坊 - 電商、Airbnb分析實戰 2022/4/23
https://www.meetup.com/PyLadiesTW/events/284972118/

區塊鏈與智慧資安女力論壇 2022/4/24
https://isipevent.kktix.cc/events/e58d0573

SEMI E187設備資安標準導入與實務研討會 2022/4/29
https://www.semi.org/zh/cybersecurity-standards-seminar

「資安鑑識課程-系列Ⅰ初級課程：資安科技基礎養成：滑鼠鍵盤敲起來【從密碼到資安】」線上研習 2022/4/29
https://docs.google.com/forms/d/1yS8JontNqGinMYUOaYj9aQ-Ov92yda7eFldgjotOAUs

K12的科技教育-除了程式還可以教什麼 2022/5/9
https://www.meetup.com/rladies-taipei/events/284421238/

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/3/28 ~ 2022/4/1

noreply@blogger.com (Unknown) — Sat, 02 Apr 2022 03:32:00 +0000

資安事件新聞週報 2022/3/28 ~ 2022/4/1

1.重大弱點漏洞/後門/Exploit/Zero Day
Unpatched Java Spring Framework 0-Day RCE Bug Threatens Enterprise Web Apps Security
https://thehackernews.com/2022/03/unpatched-java-spring-framework-0-day.html

Spring Core出現零時差遠端程式攻擊漏洞
https://www.ithome.com.tw/news/150201

Spring修補SpringShell漏洞
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Spring4shell 來襲！繼 Log4Shell 後又一 Java 生態系嚴重漏洞出現
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9792

QNAP Warns of OpenSSL Infinite Loop Vulnerability Affecting NAS Devices
https://thehackernews.com/2022/03/qnap-warns-of-openssl-infinite-loop.html

Palo Alto Networks用戶技術支援報修服務網站傳出漏洞，使用者竟能看到近2千筆他人報修的工單
https://www.bleepingcomputer.com/news/security/palo-alto-networks-error-exposed-customer-support-cases-attachments/

Sophos Firewall作業系統存在安全漏洞(CVE-2022-1040)，允許攻擊者遠端執行任意程式碼
https://www.klcg.gov.tw/tw/education/3522-253263.html

Sophos 近日發布更新以解決 Firewall 的安全性弱點
https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce

Sophos防火牆設備存在身分驗證繞過漏洞，恐被攻擊者用於執行任意程式碼
https://www.bleepingcomputer.com/news/security/critical-sophos-firewall-vulnerability-allows-remote-code-execution/

Critical Sophos Firewall RCE Vulnerability Under Active Exploitation
https://thehackernews.com/2022/03/critical-sophos-firewall-rce.html

Google緊急修復2022年第二個Chrome零日漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9785

Chrome零時差漏洞疑遭濫用，Google緊急修補
https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html

Google Chrome、Microsoft Edge、Brave及Vivaldi瀏覽器存在高風險安全漏洞，允許攻擊者遠端執行任意程式碼
https://www.klcg.gov.tw/tw/education/3522-253290.html

快更新！！ Chrome存在高風險漏洞狐狸錢包恐有被駭風險
https://reurl.cc/9OegE8

VMware Carbon Black App Control的安全更新
https://www.cisa.gov/uscert/ncas/current-activity/2022/03/24/vmware-releases-security-updates

SonicWall防火牆的網頁管理介面存在記憶體溢位漏洞
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003

Wyze視訊鏡頭存在漏洞，攻擊者可存取錄下的畫面
https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-wyze-cam-iot-device/

PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated)
https://www.exploit-db.com/exploits/50847

ProtonVPN 1.26.0 - Unquoted Service Path
https://www.exploit-db.com/exploits/50837

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
強化資安公股銀網羅資訊人員
https://reurl.cc/8WEQKy

將來銀行正式開業！中華電信將以資安、大數據與 AI 技術加持
https://axiang.cc/archives/72973

中華電信攜手將來銀行開業布局放眼數位金融新商機
https://www.taiwannews.com.tw/ch/news/4491006

LINK Bank、樂天銀行與將來銀行累計虧損達44億元，「純網銀」的未來何去何從
https://www.thenewslens.com/article/164837

清明連假將到金管會通令各保險公司服務不中斷
https://ec.ltn.com.tw/article/breakingnews/3878231

重量級股東站台　將來銀行後發先至佈局戰略大公開
https://www.mirrormedia.mg/story/20220401ind002/

將來銀行「國產鯰魚」正式開業！一文看懂創新亮點優惠
https://www.gvm.com.tw/article/88439

台灣 3 間網銀皆虧損上億！將來銀行要打出什麼名號扭轉將來
https://buzzorange.com/techorange/2022/03/30/online-banking/

將來銀行一波三折今營運　落後一年商機挑戰多
https://finance.ettoday.net/news/2217909

將來銀行開業中華電力挺謝繼茂：放眼數位金融新商機
https://udn.com/news/story/7239/6199900

疑銀行賬戶遭駭客入侵泰國女子8萬銖存款不翼而飛
https://www.sgnews.co/19836.html

3.電子支付/行動支付/pay/資安
近九成消費者傾向非現金支付 1.5成民眾不信任金融資安
https://www.chinatimes.com/realtimenews/20220324003575-260410?chdtv

歐付寶成首家電子支付繳稅系統
https://reurl.cc/02AYjM

涉嫌非法使用電子支付APP的2名中國人在日被捕
https://zh.cn.nikkei.com/politicsaeconomy/politicsasociety/48125-2022-03-31-16-18-17.html

看好數位化支付高盛給予Square、PayPal買入評級
https://ec.ltn.com.tw/article/breakingnews/3878314

為何 LINE、樂天、軟銀都搶推行動支付？看上亞馬遜想補足的「缺口」
https://www.managertoday.com.tw/books/view/64864?

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
虛擬貨幣設陷阱釣魚簡訊駭密碼投資詐術升級一年被騙走20億元
https://reurl.cc/Qjryqo

震驚！周杰倫爆NFT被偷了「恐損失千萬」　無奈：以為愚人節開玩笑
https://star.ettoday.net/news/2220889

ETH Global公布利用Lens Protocol構建項目的駭客松LF Grow獲勝項目
https://news.cnyes.com/news/id/4845254?exp=a

哥被盜了！周杰倫無聊猿 (BAYC) 遭竊；駭客釣魚成功轉手獲利 130 ETH
https://www.blocktempo.com/jaychou-bayc3738-hacked/

駭竊偽冒成挑戰元宇宙興起催化資安商機
https://itritech.itri.org.tw/blog/metaverse_security_business/

最大加密貨幣竊案區塊鏈遊戲遭駭盜175億
https://news.ustv.com.tw/newsdetail/20220330A054

準備好！幣安計劃3年內美國IPO上市第四季利潤超越UBER 新推出學幣賺幣平臺掀浪潮
https://hk.investing.com/news/stock-market-news/article-223591

休眠近 8 年！一錢包突轉出 11,325 枚比特幣，疑與 Cryptsy 交易所竊盜案有關
https://technews.tw/2022/03/31/cryptsy-vernon/

未連結錢包仍遭駭！駭客透過已認證推特帳戶發布 APE 空投釣魚網站，上週至少 35 個 NFT 失竊
https://zombit.info/verified-twitter-accounts-hack-via-phishing-attack/

黑客盜46.8億元虛擬貨幣　料屬歷來最大劫案之一
https://hk.on.cc/hk/bkn/cnt/finance/20220330/bkn-20220330101644316-0330_00842_001.html

比特幣怎麼玩？虛擬貨幣入門新手教學
https://www.cool3c.com/article/174988

Cashio：此次攻擊事件無法補償用戶損失，如駭客退還資金願提供 100 萬美元賞金
https://amp-news.cnyes.com/news/id/4842290

Cashio攻擊駭客留言： 6大條件願向資金「低於10萬美元」受害者退款
https://www.blocktempo.com/hacker-of-cashio-will-return-part-of-stolen-funds/

DeFi史上最嚴重駭客事件！熱門NFT遊戲Axie Infinity開發商被盜6億美元加密貨幣
https://today.line.me/tw/v2/article/l21O7P3

去中心化金融史上最大盜竊案區塊鏈公司Ronin被盜6.25億美元加密貨幣
https://reurl.cc/nEakQX

PeckShield：DeFi協議Revest Finance遭到駭客攻擊
https://news.cnyes.com/news/id/4842162

玩虛擬貨幣被盜舞陽痛失7百萬
https://reurl.cc/nEaWnn

盤點加密貨幣常見風險專家提供防範建議
https://udn.com/news/story/12674/6186620

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
數百個 GoDaddy 代管網站已被部署後門
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9777

Fortinet：Log4j漏洞仍受攻擊、變種惡意軟體全球猖獗
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9783

資安機構曝這些 APP 藏木馬詐騙、竊個資還會遠端幫下載惡意程式
https://www.owlting.com/news/articles/75304

中國駭客組織利用VMware遠距工作平臺Log4Shell漏洞，植入蠕蟲軟體
https://www.fortinet.com/blog/threat-research/deep-panda-log4shell-fire-chili-rootkits

駭客利用Log4Shell漏洞，鎖定VMware遠距工作平臺植入後門、挖礦軟體
https://news.sophos.com/en-us/2022/03/29/horde-of-miner-bots-and-backdoors-leveraged-log4j-to-attack-vmware-horizon-servers/

勒索軟體Hive利用新的混淆手法IPfuscation，以規避偵測
https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/

惡意NPM套件鎖定Azure、Uber、Airbnb的開發者竊密
https://checkmarx.com/blog/a-beautiful-factory-for-malicious-packages/

中國駭客組織Muhstik利用Redis漏洞，投放惡意軟體組成殭屍網路
https://blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers

勒索軟體Hive改以Rust程式語言開發Linux版本，意圖規避資安系統檢測
https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/

以程式語言Python開發的勒索軟體鎖定Jupyter Notebooks而來
https://blog.aquasec.com/python-ransomware-jupyter-notebook

說好的不攻擊醫療院所破功了！美國俄克拉荷馬州診所遭到Suncrypt勒索軟體攻擊
https://www.databreaches.net/oklahoma-city-indian-clinic-impacted-by-suncrypts-ransomware-attack/

竊密軟體Mars Stealer透過Google搜尋廣告散布
https://blog.morphisec.com/threat-research-mars-stealer

使用惡意軟體Purple Fox的駭客正在散布木馬程式FatalRAT
https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html

惡意軟體載入器Verblecon被用於投放挖礦軟體
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/verblecon-sophisticated-malware-cryptocurrency-mining-discord

Palo Alto：2021年暗網解密頻繁贖金支付再創新高
https://reurl.cc/02AL7b

盜版Windows啟動器藏有惡意程式一用即中木馬被偷個人資料
https://reurl.cc/k7xm4b

New Malware Loader 'Verblecon' Infects Hacked PCs with Cryptocurrency Miners
https://thehackernews.com/2022/03/new-malware-loader-verblecon-infects.html

Experts Detail Virtual Machine Used by Wslink Malware Loader for Obfuscation
https://thehackernews.com/2022/03/experts-detail-virtual-machine-used-by.html

FCC Adds Kaspersky and Chinese Telecom Firms to National Security Threat List
https://thehackernews.com/2022/03/fcc-adds-kaspersky-and-chinese-telecom.html

'Purple Fox' Hackers Spotted Using New Variant of FatalRAT in Recent Malware Attacks
https://thehackernews.com/2022/03/purple-fox-hackers-spotted-using-new.html

Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability
https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html

Hackers Hijack Email Reply Chains on Unpatched Exchange Servers to Spread Malware
https://thehackernews.com/2022/03/hackers-hijack-email-reply-chains-on.html

Researchers Expose Mars Stealer Malware Campaign Using Google Ads to Spread
https://thehackernews.com/2022/03/researchers-expose-mars-stealer-malware.html

New Python-based Ransomware Targeting JupyterLab Web Notebooks
https://thehackernews.com/2022/03/new-python-based-ransomware-targeting.html

Blackguard Info Stealer - Sophisticated Variant Spotted In The Wild
https://blog.cyble.com/2022/04/01/dissecting-blackguard-info-stealer/
https://www.zscaler.com/blogs/security-research/analysis-blackguard-new-info-stealer-malware-being-sold-russian-hacking

Lazarus Trojanized DeFi app for delivering malware
https://securelist.com/lazarus-trojanized-defi-app/106195/

Spring Vulnerability - Exploitation Attempts CVE-2022-22965
https://isc.sans.edu/diary/rss/28504

AcidRain: A Modem Wiper Rains Down on Europe
https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/

VajraEleph from South Asia - Cyber espionage against Pakistani military personnel revealed
https://mp.weixin.qq.com/s/B0ElRhbqLzs-wGQh79fTww

New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits
https://www.fortinet.com/blog/threat-research/deep-panda-log4shell-fire-chili-rootkits

New Wave Of Remcos RAT Phishing Campaign
https://blog.morphisec.com/remcos-trojan-analyzing-attack-chain

Malicious Word File Targeting Corporate Users Being Distributed
https://asec.ahnlab.com/en/33186/

UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malware
https://cert.gov.ua/article/38374

Muhstik Gang targets Redis Servers
https://blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers

New spear phishing campaign targets Russian dissidents
https://blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/

Forged in Fire: A Survey of MobileIron Log4Shell Exploitation
https://www.mandiant.com/resources/mobileiron-log4shell-exploitation

APT attack disguised as North Korean defector resume
https://asec.ahnlab.com/ko/33141/

Mars Stealer: Exclusive New Threat Research
https://blog.morphisec.com/threat-research-mars-stealer

Spoofed Invoice Used to Drop IcedID
https://www.fortinet.com/blog/threat-research/spoofed-invoice-drops-iced-id

APT attack disguised as North Korean defector resume
https://asec.ahnlab.com/ko/33141/

Crypto malware in patched wallets targeting Android and iOS devices
https://www.welivesecurity.com/2022/03/24/crypto-malware-patched-wallets-targeting-android-ios-devices/

Verblecon: Sophisticated New Loader Used in Low-level Attacks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/verblecon-sophisticated-malware-cryptocurrency-mining-discord

Transparent Tribe campaign uses new bespoke malware to target Indian government officials
https://blog.talosintelligence.com/2022/03/transparent-tribe-new-campaign.html

New Conversation Hijacking Campaign Delivering IcedID
https://www.intezer.com/blog/research/conversation-hijacking-campaign-delivering-icedid/

Russian Wiper Malware Likely Behind Recent Cyberattack on Viasat KA-SAT Modems
https://thehackernews.com/2022/04/russian-wiper-malware-responsible-for.html

Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit
https://thehackernews.com/2022/04/chinese-hackers-target-vmware-horizon.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
iOS與macOS裝置存在2個零時差漏洞，蘋果緊急修補
https://www.bleepingcomputer.com/news/security/apple-emergency-update-fixes-zero-days-used-to-hack-iphones-macs/

蘋果釋iOS 15.4.1更新　修正iPhone耗電變快問題
https://www.ftvnews.com.tw/news/detail/2022401W0061

多款手機即時通訊軟體存在控制字元RTLO漏洞，恐遭駭客用於網釣攻擊
https://www.bleepingcomputer.com/news/security/url-rendering-trick-enabled-whatsapp-signal-imessage-phishing/

簡訊 OTP 值得信賴嗎？手機簡訊認證帳號服務與可能的犯罪
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9795

資安風波再起，手機迎來改革
https://reurl.cc/jkzxNp

別用來路不明的APP！央視驚曝部份中國瀏覽器會洩銀行帳密、監視用戶
https://cnews.com.tw/%E5%88%A5%E7%94%A8%E4%BE%86%E8%B7%AF%E4%B8%8D%E6%98%8E%E7%9A%84app%EF%BC%81%E5%A4%AE%E8%A6%96%E9%A9%9A%E6%9B%9D%E9%83%A8%E4%BB%BD%E4%B8%AD%E5%9C%8B%E7%80%8F%E8%A6%BD%E5%99%A8%E6%9C%83%E6%B4%A9/

資安機構曝這些APP藏木馬詐騙、竊個資還會遠端幫下載惡意程式
https://cnews.com.tw/%E8%B3%87%E5%AE%89%E6%A9%9F%E6%A7%8B%E6%9B%9D%E9%80%99%E4%BA%9Bapp%E8%97%8F%E6%9C%A8%E9%A6%AC-%E8%A9%90%E9%A8%99%E3%80%81%E7%AB%8A%E5%80%8B%E8%B3%87%E9%82%84%E6%9C%83%E9%81%A0%E7%AB%AF%E5%B9%AB/

暴力、色情、資安疑慮！　美國、印度禁用抖音
https://www.ftvnews.com.tw/news/detail/2022329P12M1

用戶快刪！8個App藏木馬程式「竊取個資」　帳密、卡號全都偷
https://www.ftvnews.com.tw/news/detail/2022328W0070

安卓用戶快刪掉！Google Play導航、投資App藏木馬「偷錢、竊個資」，破50萬用戶中招
https://www.storm.mg/lifestyle/4261173

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
借鏡日本：數位轉型，資安長也要轉型
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9788

對付資電戰，日本成立駭客調查隊＝預計4月上路
https://www.jp-home.com/article_show.asp?aid=87928

未來10年新興科技將帶來更深的資安風險，台灣準備好面對資訊戰的威脅嗎
https://www.thenewslens.com/article/164380

量販店疑系統遭駭顧客淪人頭戶還挨告
https://news.cts.com.tw/cts/local/202204/202204012076085.html

遭 DDoS 攻擊，《Among Us》伺服器暫時關閉
https://technews.tw/2022/03/28/among-us-servers-are-down-due-to-ddos-attacks/

聯網 UPS 設備成為駭客攻擊對象
https://iknow.stpi.narl.org.tw/Post/Read.aspx?PostID=18980

才剛關閉IG帳號！普丁私生女豪宅位置曝光　全因外送資料庫遭駭
https://www.ftvnews.com.tw/news/detail/2022328W0309

駭客首領曝！16歲自閉兒入侵微軟英特爾
https://ctee.com.tw/news/global/619029.html

Lapsus$持續作案，駭入IT廠商Globant並公布70GB客戶專案程式碼
https://times.hinet.net/topic/23836053

針對遭到駭客組織Lapsus$攻擊，Okta坦承延遲揭露逾2個月，影響處理時效
https://www.bleepingcomputer.com/news/security/okta-we-made-a-mistake-delaying-the-lapsus-hack-disclosure/

駭客組織Lapsus$入侵IT業者軟體開發承包商Globant，並得到證實
https://www.bleepingcomputer.com/news/security/globant-confirms-hack-after-lapsus-leaks-70gb-of-stolen-data/

駭客以提供進階身分驗證工具的名義，鎖定印度政府員工發動攻擊
https://blog.talosintelligence.com/2022/03/transparent-tribe-new-campaign.html

「核武」級任務啟動！小心「活力熊」、「蜻蜓」這些名字，都是俄駭客組織Center16的化身
https://www.storm.mg/article/4266713

俄羅斯聯邦航空運輸局聲稱遭駭而回歸紙本作業，匿名者否認與他們有關
https://www.aviation24.be/miscellaneous/russo-ukrainian-war/powerful-cyber-attack-on-russias-civil-aviation-authority-servers-no-more-data-nor-back-up/

俄羅斯航空主管機關遭刪光所有資料，被疑為自導自演
https://www.ithome.com.tw/news/150221

俄羅斯的網路策略促使 FCC解決網路路由安全問題
https://blog.twnic.tw/2022/04/01/22629/

Viasat衛星網路用戶的數據機遭到資料破壞軟體AcidRain攻擊
https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/

烏克蘭戰爭開打即遭駭，美國衛星通訊服務業者Viasat公布調查結果
https://www.ithome.com.tw/news/150233

援烏星鏈被俄國駭客攻擊！馬斯克沒在怕：至今沒被突破
https://reurl.cc/2D15ga

美司法部宣布給予認證俄羅斯黑客的人1000萬美元獎勵
https://gnews.org/zh-hant/2234597/

烏抗俄戰無人機立功台專家：民間資源可轉軍用
https://www.epochtimes.com/b5/22/3/30/n13683589.htm

駭客利用WordPress網站散布攻擊工具，利用瀏覽網站的用戶電腦向烏克蘭發動DDoS攻擊
https://www.bleepingcomputer.com/news/security/hacked-wordpress-sites-force-visitors-to-ddos-ukrainian-targets/

谷歌：俄羅斯駭客正在攻擊北約和東歐軍事單位
https://reurl.cc/Go8WZW

最近烏俄戰爭下駭客入侵家裡無線分享器及監控系統當成跳板對外攻擊的情形愈加嚴重
https://es.nnkieh.tn.edu.tw/modules/tadnews/index.php?nsn=990

烏克蘭最大網絡供應商遭網絡攻擊　連線服務較戰前下降13%
https://reurl.cc/nEakWX

烏克蘭電信公司遭網攻網路服務一度中斷
https://money.udn.com/money/story/5599/6200351

烏克蘭數位戰全靠他！31歲科技部長花費2年強化網路韌性，俄國網軍難以癱瘓
https://www.storm.mg/article/4258342

誓言「讓俄羅斯回到石器時代」，揭秘烏克蘭的IT大軍：由程式員兼職、工作之餘加入網路戰
https://www.techbang.com/posts/95092-bringing-russia-back-to-the-stone-age-reveals-ukraines-it-army

他用鍵盤戰鬥！烏克蘭IT專家破壞臭名昭著的俄羅斯網路勒索集團
https://times.hinet.net/news/23834782

烏克蘭政府：對俄情報工作已佔據上風
https://www.soundofhope.org/post/606740?lang=b5

俄侵烏克蘭日學者：讓中國知武力犯台代價非常大
https://www.rti.org.tw/news/view/id/2128383

俄羅斯指責美國協助烏克蘭對其進行網絡侵略
https://unwire.pro/2022/03/30/russia-cyberattacks/security/

FBI：俄駭客掃描美能源系統對國安構成現行威脅
https://wacowla.com/blog/2022/03/30/cna-fbi-russia-hack-scan-energy-system/

美國將卡巴斯基列入可能造成國安威脅的名單
https://www.bleepingcomputer.com/news/security/us-says-kaspersky-poses-unacceptable-risk-to-national-security/

路透：美警告企業卡巴斯基軟體可能遭俄國利用
https://udn.com/news/story/6811/6207322

歐盟與美國達成跨大西洋資料隱私框架初步協議
https://www.ithome.com.tw/news/150123

美國CISA官員為機構制定採納零信任安全政策的指引
https://blog.twnic.tw/2022/03/31/22419/

北約和歐盟機密資料被看光！匈媒曝：匈牙利政府任由俄駭客滲透
https://newtalk.tw/news/view/2022-04-01/732866

加拿大每天遭數千次網攻中共是主要威脅
https://reurl.cc/Rj5AK9

「大翻譯運動」令中共裸奔中共惱怒打壓
「大翻譯運動」將中文網內容譯外文告訴世界中共的真實立場
https://www.epochtimes.com/b5/22/3/26/n13674838.htm

Hackers Increasingly Using 'Browser-in-the-Browser' Technique in Ukraine Related Attacks
https://thehackernews.com/2022/03/hackers-increasingly-using-browser-in.html

CISA Warns of Ongoing Cyber Attacks Targeting Internet-Connected UPS Devices
https://thehackernews.com/2022/03/cisa-warns-of-ongoing-cyber-attacks.html

New Hacking Campaign by Transparent Tribe Hackers Targeting Indian Officials
https://thehackernews.com/2022/03/new-hacking-campaign-by-transparent.html

North Korean Hackers Distributing Trojanized DeFi Wallet Apps to Steal Victims' Crypto
https://thehackernews.com/2022/04/north-korean-hackers-distributing.html

資安管理人員 (2名)
https://www.1111.com.tw/job/98702128/

資安管理工程師
https://www.518.com.tw/job-yvM6jj.html

網路工程師(大夜班)/ NOC Engineer_某知名公司 (3005013)
https://headhunt.com.tw/Pages/job-description.aspx?id=3005013

高級資安研究員
https://www.104.com.tw/job/7l2og

期交所擴大招募報名至4/18
https://www.1111.com.tw/news/jobns/144881

【資安所】AI資安研發工程師
https://www.104.com.tw/job/7l9e6

【資安所】資安檢測工讀生
https://www.104.com.tw/job/7l9e7

【2022年暑期實習】AW0130-資安管理&技術研究研發實習生
https://www.104.com.tw/job/7l3h6

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
產官學界研究發表「在地化攻擊狙殺鏈」防治假訊息
https://reurl.cc/Npv3Vp

IT Firm Globant Confirms Breach after LAPSUS$ Leaks 70GB of Data
https://thehackernews.com/2022/03/lapsus-claims-to-have-breached-it-firm.html

駭客鎖定俄羅斯政府機關與民眾發動釣魚郵件攻擊，疑似監控反戰人士
https://blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/

蘋果、Meta傳出不慎將用戶資料交給假的執法單位
https://www.bloomberg.com/news/articles/2022-03-30/apple-meta-gave-user-data-to-hackers-who-forged-legal-requests

駭客假冒執法人員以「緊急數據請求」詐取用戶個資，Meta、蘋果都受騙
https://www.thenewslens.com/article/164934

烏克蘭拆除散播戰爭假訊息的機器人農場機房，並沒收1萬張SIM卡
https://www.bleepingcomputer.com/news/security/ukraine-dismantles-5-disinformation-bot-farms-seizes-10-000-sim-cards/

以收集戰爭犯罪證據為幌子，中國駭客Scarab鎖定烏克蘭發動網釣攻擊
https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine/

新網路「愚」人三大騙術　趨勢科技提醒民眾投資、捐款、交友要小心
https://www.appledaily.com.tw/property/20220401/ICEUKSTJUNFN5PIDJ45NCFVBQ4/

2022首季最常見網路詐騙調查出爐投資、捐款、交友位列前三甲
https://reurl.cc/zM3vvk

小心臉書變Spy？　五動作設定保護隱私
https://isafe.moe.edu.tw/article/2550?user_type=4&topic=8

今年第1季投資詐騙簡訊超過60萬筆 NFT詐騙是新手法
https://udn.com/news/story/7240/6206843

年輕人想要被動收入　投資詐騙年財損達20.8億元
https://www.ctwant.com/article/175460

Anonymous大量傾倒數家俄國企業資料，號稱規模歷來之最
https://www.ithome.com.tw/news/150157

駭客組織 Hive 聲稱已盜取加州健康保險患者數據
https://unwire.pro/2022/03/31/hive/security/

英國國防部招募網站被入侵令資料外洩
https://unwire.pro/2022/03/27/capita/security/

OpenSea網路釣魚郵件
https://blog.trendmicro.com.tw/?p=71715

在烏經營音響店？導致音箱無法售出？詐騙購物貼文！辨識技巧與防詐觀念學起來
https://www.mygopen.com/2022/03/speaker-fb.html

匿名者宣布：駭入俄羅斯央行！將公布3.5萬份機密文件
https://reurl.cc/mG8e9G

Anonymous宣稱報復雀巢不撤離俄羅斯而竊走資料　雀巢：那是我們自己洩露的
https://netmag.tw/2022/03/26/anonymus-has-claimed-revenge-for-nestles-withdrawal-from-russia-and-that-it-was-our-own-leak

你今天被騙了嗎？「國際事實查核日」Google 推假訊息查核新功能
https://www.inside.com.tw/article/27231-google-ifcn-fakenews-newfunction

E.研究報告/工具
資安犯罪心理軌跡
https://www.cakeresume.com/portfolios/4b8ff5?locale=zh-TW

企業資安裁罰案件分析:深度解析27個實際案件, 靈活運用資安策略
https://tphcc.ebook.hyread.com.tw/bookDetail.jsp?id=273648

第一次選購 NAS 就上手 - 5 分鐘成選購達人
https://reurl.cc/8WEQdX

別登出資安！4 個新法重點，跳出駭客狙擊圈
https://www.openfind.com.tw/taiwan/markettrend_detail.php?news_id=24781

Synk靠惡意病毒找出開源軟體漏洞！資安獨角獸如何解決最頭痛的駭客問題
https://today.line.me/tw/v2/article/EX313en

資訊安全黑客(駭客) 技術簡介
https://reurl.cc/bkQMMM

為什麼要用 VPN？4 個關於 VPN 常見的問題
https://technews.tw/2022/03/30/4-questions-about-vpn/

【防制資料勒索的新思路】走向資安應用的資料唯讀技術
https://www.ithome.com.tw/tech/150106

USB資料救援軟體哪款最好用？實測4DDiG 救援工具三步驟秒救回
https://mrmad.com.tw/tenorshare-4ddig-datarescue

電腦拔了網線還能被竊密和控制嗎？頂級駭客給出了答案
https://www.jasve.com/zh-tw/kx/32115cd05aeccdf6f5648610831d51f5.html

NFT 101
https://medium.com/madworld-nft/nft-101-bc5c9bdf15

Run python code hundreds of times faster
https://medium.com/easyread/run-python-code-hundreds-of-times-faster-716f4da20669

The Only 3 Exercises You Need To Build Powerful Arms
https://betterhumans.pub/the-only-3-exercises-you-need-to-build-powerful-arms-1476fd2f804d

101 DATA SCIENCE with Cheat Sheets (ML, DL, Scraping, Python, R, SQL, Maths & Statistics)
https://medium.com/@anushka.datascoop/101-data-science-cheat-sheets-ml-dl-scraping-python-r-sql-maths-statistics-ef30b4d786eb

Spoofing File Extensions — Ethical Hacking
https://levelup.gitconnected.com/spoofing-file-extensions-ethical-hacking-bd128189738b

Of Cybercriminals and IP Addresses
https://thehackernews.com/2022/03/of-cybercriminals-and-ip-addresses.html

Privid: A Privacy-Preserving Surveillance Video Analytics System
https://thehackernews.com/2022/03/privid-privacy-preserving-surveillance.html

Results Overview: 2022 MITRE ATT&CK Evaluation – Wizard Spider and Sandworm Edition
https://thehackernews.com/2022/04/results-overview-2022-mitre-att.html

K24912123: Mitigate the Spring Framework (Spring4Shell) and Spring Cloud vulnerabilities with the BIG-IP system
https://support.f5.com/csp/article/K24912123

K11510688: Spring Framework (Spring4Shell) and Spring Cloud vulnerabilities CVE-2022-22965, CVE-2022-22950, and CVE-2022-22963
https://support.f5.com/csp/article/K11510688

Understanding and Addressing Spring4Shell and Related Vulnerabilities (CVE-2022-22965, CVE-2022-22950, CVE-2022-22963)
https://www.f5.com/company/blog/understanding-addressing-spring4shell-vulnerabilities

Does Spring4Shell impacts on F5 AWS WAF
https://community.f5.com/t5/technical-forum/does-spring4shell-impacts-on-f5-aws-waf/td-p/294080

April/2022 – CVE-2022-22965: Spring4Shell Remote Code Execution Mitigation
https://www.haproxy.com/de/blog/april-2022-cve-2022-22965-spring4shell-remote-code-execution-mitigation/

The Log4j Vulnerability Remediation with WAF and IPS
https://www.picussecurity.com/resource/blog/log4j-vulnerability-remediation-with-waf-and-ips-cve-2021-44228

Guidance for reducing Spring4Shell security vulnerability risk with Citrix WAF (CVE-2022-22963 / CVE-2022-22965)
https://www.citrix.com/blogs/2022/04/01/guidance-for-reducing-spring4shell-security-vulnerability-risk-with-citrix-waf/

Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965)
https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/

Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring
https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/

【TeamT5 資安即時快訊】Spring Core RCE 零日漏洞
https://teamt5.org/tw/posts/spring-rce-zeroday-vulnerability/

Spring4Shell-POC (CVE-2022-22965)
https://github.com/BobTheShoplifter/Spring4Shell-POC

“VMWare Spring Cloud” Java bug gives instant remote code execution – update now!
https://www.securecybersolution.com/vmware-spring-cloud-java-bug-gives-instant-remote-code-execution-update-now/

Decrypting your own HTTPS traffic with Wireshark
https://www.trickster.dev/post/decrypting-your-own-https-traffic-with-wireshark/

GitGuardian Shield: protect your secrets with GitGuardian
https://github.com/GitGuardian/ggshield

Lazarus Trojanized DeFi app for delivering malware
https://securelist.com/lazarus-trojanized-defi-app/106195/

Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations
https://www.mandiant.com/resources/mapping-dprk-groups-to-government

Tracking cyber activity in Eastern Europe
https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/

ウクライナの政府機関、非営利団体、IT 組織の機能停止を目的とするワイパー型マルウェア WhisperGate
https://blogs.blackberry.com/ja/jp/2022/03/threat-thursday-whispergate-wiper

F.商業
鼎新電腦助企業輕鬆啟用MDR、快速有效瞬間提升資安防禦力
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9779

Progress發表強化IT基礎設施監控與安全性的最新版WhatsUp Gold 2022
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9780

資安新戰略：微軟資安長與資安佈局分享會
https://reurl.cc/5Gje6v

本土研發端點保護涵蓋DLP　隨處工作皆可強制套用控管代理程式解析敏感資料　依場景風險動態加嚴
https://www.netadmin.com.tw/netadmin/zh-tw/trend/565636A303DF485C8E2CCF9DC88AF3CA

Lenovo與SentinelOne策略結盟，為ThinkShield增添AI驅動型端點防護能力
https://www.techbang.com/posts/95115-lenovo-announces-strategic-partnership-with-sentinelone

精誠軟體服務攜手台灣微軟揭示企業創新與永續致勝方程式
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&id=0000632274_3ZA3W60L62VOOQ53H47LI

數據分析轉「流量」為「留量」　資訊技術亦須理解行銷 MarTech成網路商務關鍵　保護個資才有信任基礎
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/76942B0DEC1B443A9B3DFBA99D12B05D

中華電信5G加速器「賦能新創數位轉型新未來」　第四屆活動開始線上徵件
https://www.taiwannews.com.tw/ch/news/4488510

Google 向 FDA 提交審批 Fitbit 的簡化版的心率不正偵測技術
https://chinese.engadget.com/fitbit-launches-its-first-largescale-study-to-detect-irregular-heartbeats-110009613.html

G.政府
TWNIC與 DotAsia簽署雙邊合作，啟動域外效力快速處理機制
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9782

成大Ｘ逢甲Ｘ台灣資安鑄造開啟新世代行動金融服務與資安檢測
https://money.udn.com/money/story/5635/6209139?from=edn_newestlist_cate_side

清大開發「AI鷹眼」線上防弊全球適用
https://www.rti.org.tw/news/view/id/2128507

美捷聯合聲明提及台灣外交部：與台灣關係密切的證明
https://www.taiwannews.com.tw/ch/news/4492597

國訓中心選手檢測疑資安漏洞？賴品妤：一個月內改善
https://cnews.com.tw/%E5%9C%8B%E8%A8%93%E4%B8%AD%E5%BF%83%E9%81%B8%E6%89%8B%E6%AA%A2%E6%B8%AC%E7%96%91%E8%B3%87%E5%AE%89%E6%BC%8F%E6%B4%9E%EF%BC%9F%E8%B3%B4%E5%93%81%E5%A6%A4%EF%BC%9A%E4%B8%80%E5%80%8B%E6%9C%88%E5%85%A7/

【公視片庫全刪光】公視片庫遭刪「董事會怒了」　命出包經理走人、工程師記過調職
https://www.mirrormedia.mg/story/20220331inv002/

不只無人機　蔡英文欽點扶植11項「軍民兩用」產業首度曝光
https://www.storm.mg/article/4265882?page=1

林楚茵指抖音、小紅書滲透台灣陳明通「密切關注中」
https://news.cts.com.tw/cts/politics/202203/202203282075706.html

反斬首「復安專案」預警情資暴增　陳明通低調
https://www.youtube.com/watch?v=Sa8VpAG7Y1E

俄製防毒軟體遭美列黑名單國安局考量跟進
https://www.epochtimes.com/b5/22/3/28/n13678412.htm

上網就遭滲透？國安局已關注2平台
https://news.sina.com.tw/article/20220328/41488412.html

國土防衛進化！抵制威權擴張　蔡英文揪威爾森：強化民主
https://www.setn.com/News.aspx?NewsID=1092228

關鍵基礎設施政院徹查「周遭潛在弱點」
https://news.ltn.com.tw/news/politics/paper/1509279

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
奧義參與MIH 打造車用安全開放平台，以AI 助力車聯網資安
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9784

SEMI攜英國考文垂大學發布半導體調查報告　助提升供應鏈資安
https://finance.ettoday.net/news/2219382

研究人員揭露可干擾電動汽車充電站運作的Brokenwire攻擊手法
https://www.brokenwire.fail/

滿足最新RED網路安全法規搶攻歐盟物聯網供應鏈市場
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000632680_WFQ7PSIH7DYGH71FLPWFH

Zyxel修補影響VPN、防火牆產品的韌體重大漏洞
https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml

微軟物聯網端點防護系統存在漏洞，攻擊者恐用於執行SQL注入攻擊
https://www.sentinelone.com/labs/pwning-microsoft-azure-defender-for-iot-multiple-flaws-allow-remote-code-execution-for-all/

Honda汽車遙控鎖存在漏洞，駭客恐利用重放攻擊啟動引擎
https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/

Bugs in Wyze Cams Could Let Attackers Takeover Devices and Access Video Feeds
https://thehackernews.com/2022/03/bugs-in-wyze-cams-could-let-attackers.html?_m=3n%2e009a%2e2707%2ekl0ao0dcsu%2e1q6g

Honda's Keyless Access Bug Could Let Thieves Remotely Unlock and Start Vehicles
https://thehackernews.com/2022/03/hondas-keyless-access-bug-could-let.html

Tenda AC6 v15.03.05.09_multi存在安全弱點，該弱點源於SetSysTimeCfg函數中的ntpserver參數被發現包含堆疊溢位。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25457
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25453
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25454
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25455
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25456
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25460
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25452
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25461
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25459
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25451
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25449
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25448
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25446
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25458
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25450
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25445
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25433
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25427
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25428
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25429
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25431
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25439
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25434
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25439
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25434
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25435
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25437
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25440
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25441
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25438

Critical Bugs in Rockwell PLC Could Allow Hackers to Implant Malicious Code
https://thehackernews.com/2022/04/critical-bugs-in-rockwell-plc-could.html

捷而思參與OT工控資安年會提供資安防禦教戰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9794

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Android Code Club(Taipei) 2022/4/6
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/284673237/

HackingThursday 黑客星期四 - Week meetup Taipei 固定聚會台北 2022/4/7
https://www.meetup.com/hackingthursday/events/284696809/

資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：
資網料敵機先-資安情資偵蒐解析與資料保護、鑑定實務」線上研習課程 2022/4/7
https://docs.google.com/forms/d/1hPoNDnqz2jt1kn2W5x0ZGp3e-1ee_Tar5nIwmRRDtLA/viewform?edit_requested=true

『資訊安全系列課程：藍隊實戰養成證照課程講座』線上研討會 2022/4/7
https://zoom.us/j/91883778252?pwd=ZytSYmx5dkZIZUpxNXhkYWs1T21nQT09

『資訊安全系列課程：紅隊實戰養成證照課程講座』線上研討會 2022/4/8
https://zoom.us/j/94606398800?pwd=Y29XY0gwNThZUDVuTzZicnJucUZWQT09

Taipei Creative Coders Meetup #16 2022/4/8
https://www.meetup.com/tpecreativecoders/events/284848490/

Just a chat - with no Expectations 2022/4/9
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/284734457/

Coffee & Code 2022/4/10
https://www.meetup.com/Innovate-Taiwan/events/284921441/

2022 數位轉型論壇(二) 無懼威脅的天堂--後疫情時代的資訊安全 2022/4/12
https://www.cisanet.org.tw/Services/MemberActivityServiceDetail/685

從Python到TensorFlow線上讀書會-Python基礎導讀(4) -第四章用 if 來選擇 2022/4/12
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/284265342/

SyntaxError 2022/4/13
https://www.meetup.com/pythonhug/events/284820898/

中部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名）2022/4/13
https://www.cisanet.org.tw/Course/Detail/2783

只要有心，人人都能成為雲端人才！AWSome Day線上雲端培訓日 2022/4/14
https://lihi1.com/FE09M

AIAA講座【台北場】：資安思維 X 政府應用AI案例 X 數位轉型 2022/4/16
https://www.accupass.com/event/2203031213512786993470

網站應用程式安全 2022/04/19
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19881

SDN x Cloud Native Meetup #47 2022/4/19
https://www.meetup.com/CloudNative-Taiwan/events/284821277/

Quarterly Professional Networking Event 2022/4/21
https://www.meetup.com/taiwan-digital-drinks/events/284733775/

2022 美台金融資安論壇數位轉型下的資安再造 2022/04/21 ~ 2022/04/22
https://event.netmag.tw/202204ait/

南部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名） 2022/4/21
https://www.cisanet.org.tw/Course/Detail/2784

Python 數據分析一日工作坊 - 電商、Airbnb分析實戰 2022/4/23
https://www.meetup.com/PyLadiesTW/events/284972118/

區塊鏈與智慧資安女力論壇 2022/4/24
https://isipevent.kktix.cc/events/e58d0573

SEMI E187設備資安標準導入與實務研討會 2022/4/29
https://www.semi.org/zh/cybersecurity-standards-seminar

「資安鑑識課程-系列Ⅰ初級課程：資安科技基礎養成：滑鼠鍵盤敲起來【從密碼到資安】」線上研習 2022/4/29
https://docs.google.com/forms/d/1yS8JontNqGinMYUOaYj9aQ-Ov92yda7eFldgjotOAUs

K12的科技教育-除了程式還可以教什麼 2022/5/9
https://www.meetup.com/rladies-taipei/events/284421238/

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/3/21 ~ 2022/3/25

noreply@blogger.com (Unknown) — Fri, 25 Mar 2022 02:13:00 +0000

資安事件新聞週報 2022/3/21 ~ 2022/3/25

1.重大弱點漏洞/後門/Exploit/Zero Day
OpenSSL修補高嚴重性的憑證解析漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9770

Over 200 Malicious NPM Packages Caught Targeting Azure Developers
https://thehackernews.com/2022/03/over-200-malicious-npm-packages-caught.html

New Dell BIOS Bugs Affect Millions of Inspiron, Vostro, XPS, Alienware Systems
https://thehackernews.com/2022/03/new-dell-bios-bugs-affect-millions-of.html

Dell BIOS 包含不正確的輸入驗證弱點。本地經過身份驗證的惡意用戶可能會通過使用 SMI 在 SMM 期間執行任意程式碼。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24420
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24419
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24416
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24415
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24421

Apache HTTP Server 的 mod_sed 中的越界寫入弱點允許攻擊者使用可能攻擊者提供的資料覆蓋堆記憶體。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-23943
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22720

Sophos UTM 高風險安全性漏洞
https://www.klcg.gov.tw/tw/education/3522-253026.html

NPM套件node-ipc作者加入額外的相依套件抗議俄羅斯發動戰爭，有資安業者認為是資安漏洞並指派CVE編號
https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

IE終成時代眼淚！微軟再度公告「最終死期」
https://n.yam.com/Article/20220322529350

微軟更新自有Linux發行版
https://times.hinet.net/news/23816428

WD電腦版應用程式EdgeRover存在目錄穿越漏洞，攻擊者恐用於外洩資料
https://www.bleepingcomputer.com/news/security/western-digital-app-bug-gives-elevated-privileges-in-windows-macos/

Linux網路流量過濾元件Netfilter存在權限提升漏洞，攻擊者恐用來對系統為所欲為
https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/

ProtonVPN 1.26.0 - Unquoted Service Path
https://www.exploit-db.com/exploits/50837

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
Hackers Target Bank Networks with new Rootkit to Steal Money from ATM Machines
https://thehackernews.com/2022/03/hackers-target-bank-networks-with-new.html

駭客組織UNC2891鎖定ATM系統下手，並疑似從多家銀行盜領現金
https://www.mandiant.com/resources/unc2891-overview

匿名者宣布攻陷俄羅斯央行，將公布 3 萬 5 千份祕密檔案
https://finance.technews.tw/2022/03/25/anonymous-hack-russia-central-bank/

俄央行恢復股市部分交易駭客曝入侵竊取機密
https://reurl.cc/nEgQLX

俄羅斯銀行Sber應用程式遭駭，起因疑似駭客竄改開源程式庫
https://www.theverge.com/2022/3/21/22989339/protestware-attacks-russia-sberbank-open-source

保險業估資安險費率續飆升
https://ctee.com.tw/news/insurance/615440.html

公股銀育才鎖定數位、資安
https://readers.ctee.com.tw/cm/20220321/a10aa10/1175381/share

巴西駭客聲稱透過弱密碼，入侵消費者信用業者環聯南非分公司
https://www.bleepingcomputer.com/news/security/hackers-claim-to-breach-transunion-south-africa-with-password-password/

「線上申辦」金融服務上傳證件守護資安成難題
https://reurl.cc/9O8dYY

5月手機報稅2.0來了！　可編修扶養親屬、免用讀卡機
https://finance.ettoday.net/news/2212307

中華郵政推出「郵政數位存款帳戶」帳戶能連結街口支付及一卡通MONEY等電子支付
https://www.kocpc.com.tw/archives/432022

3.電子支付/行動支付/pay/資安
零接觸交易夯電支電票結合
https://ctee.com.tw/industrynews/financesmanage/601852.html

哥倫比亞去年電子錢包支付交易金額年增195%，優於預期
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=ca1fcaa8-80ab-4a0f-9455-3808a469df47

手機報稅2.0 行動支付也OK
https://ctee.com.tw/news/tax-law/610587.html

高雄市首創全國之先　市公車全面裝設四合一電子支付設備　並應用推出公車擁擠度查詢、MeNGo交通服務QR套票
https://news.sina.com.tw/article/20220325/41474618.html

非現金支付成常態！　高達9成國人持續使用
https://finance.ettoday.net/news/2214828

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
DeFiance Capital 遭竊後續》Lido 治理論壇發起「凍結資產」提案，燒毀地址所有代幣防竊
https://reurl.cc/6EzpLO

質押協議 Lido 已銷毀「1,320萬鎂LDO」，防 Defiance Capital 資產遭駭客銷贓
https://www.blocktempo.com/lido-burned-13million-token-to-prevent-attack-of-hacker/

一夜歸零！穩定幣協議Cashio遭無限鑄造攻擊，駭客增發20億枚CASH崩盤
https://www.blocktempo.com/solana-backed-stablecoin-cashio-loses/

DeFiance創辦人被駭事件｜點擊文檔駭客即可訪問錢包、指控北韓駭客組織「Lazarus」
https://news.cnyes.com/news/id/4839491

盜取DeFiance Capital創始人資產的駭客將500 ETH轉入Tornado Cash
https://news.cnyes.com/news/id/4839896

Defiance Capital創始人在熱錢包駭客攻擊中損失160萬美元
https://news.cnyes.com/news/id/4838092?exp=a

<虛擬貨幣值得信賴嗎？由「分散式共識」談起>
https://reurl.cc/e6Y0LL

HubSpot遇駭波及，NYDIG、BlockFi、Circle…成受害客戶 :「用戶加密資產安全無虞」
https://www.blocktempo.com/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/

黑客是如何通過Tornado.Cash洗白贓款的
https://news.cnyes.com/news/id/4837551

OneRing確認遭到閃電貸攻擊，駭客竊取逾145萬美元
https://news.cnyes.com/news/id/4837863

OneRing Finance遇閃電貸攻擊、損失200萬美元；RING代幣急挫超20%
https://www.blocktempo.com/onering-finance-is-exploited/

亞太金融科技加密資產、區塊鏈吸金
https://ctee.com.tw/news/finance/613272.html

加密錢包資安｜NFT 投資者分享三層錢包結構，6529 示範鑄造、快照標準操作
https://www.owlting.com/news/articles/72082

DEX聚合協議Li.Finance遭駭客攻擊，已停用所有交易功能
https://news.cnyes.com/news/id/4837077

優秀交易員是怎麼用加密貨幣賺被動收入的
https://www.inside.com.tw/article/27089-how-people-actually-make-money-from-cryptocurrencies

加密貨幣金融機構BlockFi供應商Hubspot發生數據泄露
https://news.cnyes.com/news/id/4836792

幣安搶頭香取得巴林加密資產牌照，將在杜拜建區塊鏈技術中心
https://www.bnext.com.tw/article/68177/biance-dubai

加納央行：希望確保數位貨幣eCedi能夠在行動支付平台上協同運行
https://news.cnyes.com/news/id/4833639

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
研究人員發現勒索軟體DeadBolt攻擊威聯通NAS的情況再度升溫
https://censys.io/deadbolt-ransomware-is-back/

駭客透過Excel附加元件散布木馬程式JSSLoader
https://blog.morphisec.com/new-jssloader-trojan-delivered-through-xll-files

駭客以提供攻擊工具的名義散布竊密程式
https://reurl.cc/Go0zAZ

蘇格蘭心理諮商機構SAMH傳出遭勒索軟體RansomEXX攻擊
https://www.bbc.com/news/uk-scotland-60826263

希臘國營郵局遭勒贖攻擊，郵件遞送服務停擺
https://www.twcert.org.tw/tw/cp-104-5937-32691-1.html

希臘郵政公司ETLA遭勒索軟體攻擊導致業務中斷
https://www.bleepingcomputer.com/news/security/greeces-public-postal-service-offline-due-to-ransomware-attack/

駭客攻擊俄羅斯肉品業者Miratorg，並使用BitLocker加密檔案
https://reurl.cc/5Gn716

中國駭客使用惡意軟體Gimmick攻擊macOS用戶
https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/

木馬程式BitRAT透過韓國檔案共享服務散布
https://asec.ahnlab.com/en/32781/

價廉物美木馬軟件BitRAT 偽裝Windows 10啟動版權器誘下載
https://www.wepro180.com/bitrat220323/

惡意軟體Serpent透過軟體管理系統Chocolatey散布，攻擊法國多個公家機關與公司行號
https://reurl.cc/bkpZYd

美國警告勒索軟體AvosLocker鎖定關鍵基礎設施下手，臺灣也有受害者
https://www.ic3.gov/Media/News/2022/220318.pdf

勒索軟體駭客BlackMatter亦曾使用另一款勒索軟體BlackCat
https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html

殭屍網路TrickBot鎖定MikroTik路由器設備而來
https://www.microsoft.com/security/blog/2022/03/16/uncovering-trickbots-use-of-iot-devices-in-command-and-control-infrastructure/

烏克蘭人士再度公布勒索軟體Conti的原始碼
https://www.bleepingcomputer.com/news/security/newer-conti-ransomware-source-code-leaked-out-of-revenge/

勒索軟體Conti新版本再遭公開
https://www.ithome.com.tw/news/150030

中國駭客組織TA416利用烏克蘭戰爭等歐洲時事為誘餌，散布Hodur後門程式
https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/

Chinese Threat Actor Scarab Targeting Ukraine
https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine/

Cyberattack on Ukrainian enterprises using the DoubleZero
https://bamboo.aveng.me/browse/TI

Bad Actors Trying to Capitalize on Current Events via Shameless Email Scams
https://www.fortinet.com/blog/threat-research/bad-actors-capitalize-current-events-email-scams

New JSSLoader Trojan Delivered Through XLL Files
https://blog.morphisec.com/new-jssloader-trojan-delivered-through-xll-files

Arkei Variants: From Vidar to Mars Stealer
https://isc.sans.edu/diary/rss/28468

Vidar Malware Launcher Concealed in Help File
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/

APT35 Automates Initial Access Using ProxyShell
https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/

Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS
https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/
https://github.com/volexity/threat-intel/blob/main/2022/2022-03-22%20GIMMICK/indicators/yara.yar

Clipper Malware disguised as AvD Crypto Stealer
https://blog.cyble.com/2022/03/22/hunters-become-the-hunted/

Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain
https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain

New Variant of Chinese Gimmick Malware Targeting macOS Users
https://thehackernews.com/2022/03/new-variant-of-chinese-gimmick-malware.html

Botnet of Thousands of MikroTik Routers Abused in Glupteba, TrickBot Campaigns
https://thehackernews.com/2022/03/over-200000-microtik-routers-worldwide.html

New Backdoor Targets French Entities via Open-Source Package Installer
https://thehackernews.com/2022/03/new-backdoor-targets-french-entities.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
3 Easy Ways Your Phone’s SIM Card Can Be Hacked
https://medium.com/@WrittenMastery/3-easy-ways-your-phones-sim-card-can-be-hacked-ebd92d05b616

Experts Uncover Campaign Stealing Cryptocurrency from Android and iPhone Users
https://thehackernews.com/2022/03/experts-uncover-campaign-stealing.html

CryptoRom比特幣詐騙行動鎖定iPhone與Android用戶而來
https://reurl.cc/6EzpQV

'CryptoRom' Crypto Scam Abusing iPhone Features to Target Mobile Users
https://thehackernews.com/2022/03/cryptorom-crypto-scam-abusing-iphone.html

手機間諜軟體Facestealer上架Google Play市集，逾10萬用戶受害
https://blog.pradeo.com/spyware-facestealer-google-play

蘋果服務連2天當機 App Stores、Apple Music等受影響
https://news.cnyes.com/news/id/4838743

中華電5G智慧應用成功輸出泰國
https://www.cna.com.tw/news/afe/202203220262.aspx

為開發者大會做準備？Google總部Android雕像全撤離
https://reurl.cc/X4nO93

iPhone用戶注意！這款App恐引駭客「全面入侵」
https://reurl.cc/veNy2j

當心！APP藏木馬「竊個資、偷錢」　恐逾50萬人受害
https://news.tvbs.com.tw/life/1750145

App Store和內購系統允許第三方！歐盟將強迫蘋果執行
https://mrmad.com.tw/eu-law-changes-to-force-apple-to-open-up-to-third-parties

歐盟新法要App Store開放第三方下載　蘋果違規將罰370億美元
https://www.ettoday.net/news/20220320/2212008.htm

繞過蘋果審查機制　黑客藉TestFlight散播惡意應用
https://reurl.cc/AKZEmK

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
上市櫃公司資通安全管控指引發布，產業該如何因應
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9775

資通安全發展趨勢下的風險與作為
https://reurl.cc/QjQ1AO

電商資安知多少？系統平台如何選
https://today.line.me/tw/v2/article/BEoyeOj

隨著台灣資安產業轉向雲端應用防禦惡意攻擊應多管齊下
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000631602_8WR5ZKYL1N879K1YTEMP5

設定不當責任遭駭須企業自負　自動化機制有助防範雲端組態設錯成資安破口　最常見失誤排行大公開
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/A3523336B1964DA697AD3D579DAA45CB

資安長修練GRC基本功牢牢守護企業關鍵資產
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000631884_XHD924TU7GUFYJ5IWI9HW

元宇宙興起催化資安商機
https://ec.ltn.com.tw/article/breakingnews/3867903

俄烏戰爭燒出資安危機企業急需六種人才
https://www.sinotrade.com.tw/richclub/news/623bdeb5e08ee5dd5677f58c

微軟將把資安培訓計畫擴大到其它23個國家
https://www.ithome.com.tw/news/150095

入侵管道掮客Exotic Lily假冒受害公司的員工，竊取存取內部網路環境的方法
https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/

微軟遭駭！入侵4家科技公司主謀竟是16歲青少年
https://reurl.cc/dXZdeg

勒索軟體駭客Lapsus$首腦可能是名16歲英國少年
https://reurl.cc/OpW2vX

微軟搜尋引擎遭入侵！囂張駭客Telegram上公布內容
https://reurl.cc/Wk9evx

微軟稱攻擊Okta的駭客組織曾入侵微軟賬戶
https://reurl.cc/qOe90p

勒索軟體駭客Lapsus$聲稱竊得微軟Bing、Cortana的原始碼
https://reurl.cc/rQWzv1

勒索軟體駭客Lapsus$駭入身分驗證管理業者Okta，竊得超級使用者帳號
https://www.cyberkendra.com/2022/03/okta-service-hacked-by-lapsus-gained.html

微軟研究人員揭露勒索軟體駭客Lapsus$的攻擊手法
https://reurl.cc/qOe9Lp

Okta證實勒索軟體駭客Lapsus$曾於1月入侵技術支援工程師的筆電
https://reurl.cc/VjVGLn

資料刪除很容易？為何沒異地備份？──公視「片庫被全刪」意外，教會我們的 3 件事
https://crossing.cw.com.tw/article/16002

豐田也中招！2度遭駭客入侵　台廠怎麼防
https://www.cw.com.tw/article/5120538

臺港菲等國的彩券行遭到攻擊，駭客竟是透過WPS Office漏洞下手
https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/

韓國駭客DarkHotel鎖定澳門飯店下手，以處理活動相關的事宜發動網釣攻擊
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/suspected-darkhotel-apt-activity-update.html

駭客「匿名者」槓上國際企業竊10G機密威脅：退出俄市場
https://m.match.net.tw/pc/news/technology/20220324/6457548

美國指控俄羅斯政府駭客對全球能源行業進行網絡攻擊
https://reurl.cc/RjMKvr

涉侵駭美核電廠和沙烏地煉油廠俄4官員遭起訴
https://www.cna.com.tw/news/aopl/202203250120.aspx

俄羅斯駭客組織InvisiMole鎖定烏克蘭下手
https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/

31萬烏國工程師組「IT大軍」　嗆讓俄回到「石器時代」
https://www.ftvnews.com.tw/news/detail/2022325F03M1

俄羅斯打烏克蘭，除了砲彈還有資訊戰：駭客與假消息，如何改變這場戰爭
https://www.storm.mg/article/4253701?page=1

俄羅斯承認遭「空前」駭客攻擊政府官網被改鼓勵軍隊叛逃
https://news.ltn.com.tw/news/world/breakingnews/3864494

馬斯克助攻、區塊鏈募款　烏克蘭的數位援軍，如何全球協作
https://www.cw.com.tw/article/5120486

烏克蘭斷網恐斷國防系統星鏈將成無人攻擊機最後信號連結管道俄國怒尋反擊
https://www.inside.com.tw/article/27083-ukraine-starlink-russia-aerorozvidka

「老舊帳號」劫持＋「PrintNightmare」漏洞入侵！俄羅斯國家級駭客讓雙因素認證破功
https://technews.tw/2022/03/21/cisa-issues-warning-that-russian-hackers-are-bypassing-two-factor-authentication/

美企當心！白宮：俄羅斯正設法發動網路攻擊
https://www.sinotrade.com.tw/richclub/news/62391fa8e08ee5dd560e8753

美國、歐盟警告衛星通訊的網路攻擊風險
https://www.ithome.com.tw/news/150009

美國預計通過新法案:關鍵基礎設施之網路攻擊應於時限內通報
https://www.isda.org.tw/2022/03/19/2baf5f884c2a8ee6fe6b47aff039bd3f/

FBI：2021 年全美因網路犯罪造成的損失，高達 69 億美元以上
https://www.twcert.org.tw/tw/cp-104-5939-f514e-1.html

中國大陸360安全專家：美國網路攻擊將超越虛擬世界造成巨大威脅
https://www.chinatimes.com/realtimenews/20220323002489-260409?chdtv

烏俄戰火下憂中共武攻大學生籲檢討國防兵役政策
https://news.ltn.com.tw/news/politics/breakingnews/3866024

義大利以國安為由，要求政府部門棄用卡巴斯基防毒軟體
https://www.reuters.com/technology/italy-set-curb-use-russian-anti-virus-software-public-sector-2022-03-17/

香港國安舉報熱線接逾21萬訊息港警務處長：對反恐很有用
https://www.chinatimes.com/realtimenews/20220319001559-260409?chdtv

中共二十大前「清網」 7200餘主播遭封禁
https://reurl.cc/LpGvx3

Chinese APT Hackers Targeting Betting Companies in Southeast Asia
https://thehackernews.com/2022/03/chinese-apt-hackers-targeting-betting.html

U.S. Charges 4 Russian Govt. Employees Over Hacking Critical Infrastructure Worldwide
https://thehackernews.com/2022/03/us-charges-4-russian-govt-employees.html

23-Year-Old Russian Hacker Wanted by FBI for Running Marketplace of Stolen Logins
https://thehackernews.com/2022/03/23-year-old-russian-hacker-wanted-by.html

Researchers Trace LAPSUS$ Cyber Attacks to 16-Year-Old Hacker from England
https://thehackernews.com/2022/03/researchers-trace-lapsus-cyber-attacks.html

7 Suspected Members of LAPSUS$ Hacker Gang, Aged 16 to 21, Arrested in U.K.
https://thehackernews.com/2022/03/7-suspected-members-of-lapsus-hacker.html

North Korean Hackers Exploited Chrome Zero-Day to Target Fintech, IT, and Media Firms
https://thehackernews.com/2022/03/north-korean-hackers-exploited-chrome.html

Microsoft and Okta Confirm Breach by LAPSUS$ Extortion Group
https://thehackernews.com/2022/03/microsoft-and-okta-confirm-breach-by.html

U.S. Government Warns Companies of Potential Russian Cyber Attacks
https://thehackernews.com/2022/03/us-government-warns-companies-of.html

South Korean DarkHotel Hackers Targeted Luxury Hotels in Macau
https://thehackernews.com/2022/03/south-korean-darkhotel-hackers-targeted.html

精誠營收連續6年創新高擴大徵才逾千人
https://www.1111.com.tw/news/jobns/144797

資安工程師/資深工程師（WEB安全方向）
https://www.yourator.co/companies/huasheng/jobs/23176

資安工程師/資深工程師（APP安全方向）
https://www.yourator.co/companies/huasheng/jobs/23185

資安人員
https://www.yes123.com.tw/wk_index/job.asp?p_id=20100513171945_22748868&job_id=20201211085129_51720703

資安檢測鑑識分析師(竹南/台南)
https://www.104.com.tw/job/7kqj3

行政管理處_副工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=5&EMPLOYER_ID=2456585&HIRE_ID=10955283

資深網管與資安技術經理-A502
https://www.104.com.tw/job/7kqcb

資安法規稽核師(竹南/台南)
https://www.104.com.tw/job/7kqjb

【資安所】資安產業推動人員
https://www.104.com.tw/job/7kolt

資安規劃工程師_竹科
https://www.104.com.tw/job/7ky9l

資安工程師
https://www.104.com.tw/job/7kmaz

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
德國公司因使用Google字體服務違反GDPR而被罰款
https://blog.twnic.tw/2022/03/25/22391/

居家辦公夯！駭客勒索釣魚郵件增4成
https://reurl.cc/Wk9eDL

全新「BitB」攻擊手法的網路釣魚技術現身！精明網友也無法看出「有鬼」
https://technews.tw/2022/03/25/new-browser-in-the-browser-bitb-attack-makes-phishing-nearly-undetectable/

日本醫療諮詢平臺Doctors Me的AWS S3儲存桶配置不當，用戶個資曝光
https://www.safetydetectives.com/news/doctorsme-leak-report/

資安廠商指出，8 個字元長度的複雜密碼，最新繪圖卡僅需一小時即可破解
https://www.twcert.org.tw/tw/cp-104-5932-6dff6-1.html

俄羅斯大型石油管道公司Transneft驚傳資料外洩
https://www.theverge.com/2022/3/17/22983085/russia-transneft-omega-data-leak-hillary-clinton

雲端CRM業者HubSpot驚傳資料外洩，波及近30家加密貨幣業者
https://decrypt.co/95586/hacker-steals-customer-data-circle-blockfi-big-crypto-firms

接來電通知被無端轉帳德州婦急處理戶頭瞬間歸零
https://www.worldjournal.com/wj/story/121473/6184611

網路釣魚詐騙最愛冒用的十大品牌揭曉！駭客攻擊偏好挑在這個時間點
https://3c.ltn.com.tw/news/48253

台灣受假訊息侵擾連9年奪冠學者籲提高警覺
https://reurl.cc/rQWznZ

Sophos 發現加密交易詐騙向受害者索求數千美元的假「利潤稅」以解鎖帳戶
https://www.docutek.com.tw/newsDetail.php?id=435

密碼長度與強度怎樣設最不易被駭客破解
https://pttweb.tw/s/4P3vy1

烏俄戰爭：駭客散佈Deepfake影片假冒烏克蘭總統要人民投降
https://netmag.tw/2022/03/18/urussia-war-hackers-scatter-deepfake-video-counterfeit-ukrainian-president-to-surrender-the-people

金石堂網路書店出現山寨網頁！詐騙信用卡個資　資安公司提醒6招防範
https://finance.ettoday.net/news/2211463?redirect=1

陸央廣網評：羊被牽走做核酸？輿論解開村官扮警察變強盜案疑點
https://www.chinatimes.com/realtimenews/20220319002196-260409?chdtv

「女兒」電郵索錢買房港婦被詐騙痛失120萬美元
https://udn.com/news/story/7332/6177684?from=udn-catebreaknews_ch2

E.研究報告/工具
Git 實戰 - 將檔案從歷史 Commit 中移除
https://blog.darkthread.net/blog/rm-files-from-git-history/

2022 年最佳 SQL 注入(INJECTION) 駭客/黑客攻擊檢測工具
https://reurl.cc/pWEqL8

掃描彙整各協定IoT設備　強悍工具端看用途為善為惡網路空間搜尋引擎發威　連網裝置資訊全都露
https://www.netadmin.com.tw/netadmin/zh-tw/technology/CEB367CCB75F4551B6029C6F496E4CDA

有錢能使鬼推磨，公司內部資安危機重重
https://player.soundon.fm/p/8fdc3e51-8bfb-4bfa-9c65-8ea2ce5a6eb7/episodes/a3226e4a-fbf4-40a5-979a-901ef634a138

Do you really know React? #InterviewQuestions
https://hashlucifer.medium.com/do-you-really-know-react-interviewquestions-3bd2e109183a

How to Build a Custom Malware Analysis Sandbox
https://thehackernews.com/2022/03/how-to-build-custom-malware-analysis.html

Use This Definitive RFP Template to Effectively Evaluate XDR solutions
https://thehackernews.com/2020/07/extended-detection-response.html

Wazuh Offers XDR Functionality at a Price Enterprises Will Love
https://thehackernews.com/2022/03/wazuh-offers-xdr-functionality-at-price.html

New Browser-in-the Browser (BITB) Attack Makes Phishing Nearly Undetectable
https://thehackernews.com/2022/03/new-browser-in-browser-bitb-attack.html

Scale Incident Response With Detection Engineering: Detect & Hunt with Intezer
https://www.intezer.com/blog/threat-hunting/scale-incident-response-detection-engineering/

My First Bug Bounty Reward
https://infosecwriteups.com/my-first-bug-bounty-reward-50bea0749c5c

Using Node.js for Backend Web Development in 2022
https://medium.com/geekculture/using-node-js-for-backend-web-development-in-2022-f2917c6c0a87

F.商業
Oracle Cloud Infrastructure 推出11 個運算、網路、儲存服務和功能
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9774

Acronis True Image 更名為 Acronis Cyber Protect Home Office
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9765

VMware發佈容器運行保護功能，強化雲原生工作負載的端到端安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9764

中租迪和實現安全數位轉型之旅資安防護網扮演幕後功臣
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000632137_8NO019PE4KXEF96OO5U45

趨勢科技：資安威脅創新高示警未來企業資安工作千鈞重負
http://www.hope.com.tw/DispNews-tw.asp?O=HK63O8T9UIGSAA00NK

趨勢科技：資安威脅偵測量增長42％創新高
https://www.chinatimes.com/realtimenews/20220325001663-260410?chdtv

奧義智慧科技與 Emplos、TAKTIK 成為合作夥伴
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9781

McAfee的SASE業務獨立為Skyhigh Security上市
https://reurl.cc/Epdq11

Lenovo、SentinelOne策略結盟　替「AI驅動型端點」增添防護
https://finance.ettoday.net/news/2214835

Google Cloud與VMware擴大合作助企業加速雲端轉型
https://reurl.cc/OpW2QR

勤業眾信資安科技暨鑑識分析中心再進化
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=140&id=0000630959_1LNLUPSQ4P1AZZLMOOGJY

G.政府
資安即國安！郭台銘支持成立資通安全與科技發展策進會
https://udn.com/news/story/7240/6189439

郭台銘：烏俄衝突前網路戰早開打台灣資安不可忽視
https://reurl.cc/mG1W39

資安即國安！從俄烏戰學習郭台銘籲官民合作制訂共同網路防禦計劃
https://newtalk.tw/news/view/2022-03-24/728909

「雲端資料中心成果展」資訊資源共享創造智慧雲端高雄
https://market.ltn.com.tw/article/12154

火箭軍電腦遺失邱國正道歉
https://reurl.cc/9O8dDX

雷霆2000機密恐洩？六軍團火箭營搞丟電腦主機 2週尚未找回
https://newtalk.tw/news/view/2022-03-21/726868

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
8大關鍵層面讓產線安全亮紅燈製造業資安韌性提升迫在眉睫
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000631667_K0R7CBKX5CUOSK82EMBAP

智慧製造下台灣製造業資安3大挑戰
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9772

三大工控網路市場成長動能催生IT/OT互融互通網路架構，滿足工業維運安全強固不中斷
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9767

totolink a3100r_firmware 通過 hosTime 參數在 adm/ntm.asp 中的
TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 中存在命令注入弱點。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44620

LG webos 公共 API 錯誤導致攻擊者能夠繞過 API 訪問控制。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-23730

橫河電機產品編碼 CAMS 服務器應用程式的密碼：
CENTUM VP 版本從 R5.01.00 到 R5.04.20 和版本從 R6.01.00 到 R6.08.00，Exaopc 版本從 R3.72.00 到 R3.79.00
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-23402

Cyclops Blink Sets Sights on Asus Routers
https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html

繼WatchGuard防火牆遭到鎖定，殭屍網路Cyclops Blink將攻擊範圍擴及數款華碩家用路由器產品
https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html

用戶注意！華碩17款路由器遭俄駭客攻擊官方曝自救法
https://www.chinatimes.com/realtimenews/20220324004986-260412?chdtv

領軍沙盒實驗！勤崴推動自駕車有成
https://www.inside.com.tw/article/27115-kingwaytek

IoT技術發展實現元宇宙世代，群創董座稱「面板為人、機界面橋樑」
https://news.sina.com.tw/article/20220318/41431002.html

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
雲端資安防禦實作研討會 2022/3/29
https://www.ecloudvalley.com/zh-hant/event/ms_security/

資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：
資網料敵機先-資安情資偵蒐解析與資料保護、鑑定實務」線上研習課程 2022/4/7
https://docs.google.com/forms/d/1hPoNDnqz2jt1kn2W5x0ZGp3e-1ee_Tar5nIwmRRDtLA/viewform?edit_requested=true

中部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名）2022/4/13
https://www.cisanet.org.tw/Course/Detail/2783

只要有心，人人都能成為雲端人才！AWSome Day線上雲端培訓日 2022/4/14
https://lihi1.com/FE09M

AIAA講座【台北場】：資安思維 X 政府應用AI案例 X 數位轉型 2022/4/16
https://www.accupass.com/event/2203031213512786993470

網站應用程式安全 2022/04/19
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19881

2022 美台金融資安論壇數位轉型下的資安再造 2022/04/21 ~ 2022/04/22
https://event.netmag.tw/202204ait/

南部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名） 2022/4/21
https://www.cisanet.org.tw/Course/Detail/2784

區塊鏈與智慧資安女力論壇 2022/4/24
https://isipevent.kktix.cc/events/e58d0573

SEMI E187設備資安標準導入與實務研討會 2022/4/29
https://www.semi.org/zh/cybersecurity-standards-seminar

元智資工高中生短期資訊課程-微插電資安體驗工作坊 2022/5/14
https://cse-yzu.kktix.cc/events/yzcs7

資安政策法規標準 2022/5/25 ~ 2022/5/26
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19873

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/3/14 ~ 2022/3/18

noreply@blogger.com (Unknown) — Fri, 18 Mar 2022 02:12:00 +0000

資安事件新聞週報 2022/3/14 ~ 2022/3/18

1.重大弱點漏洞/後門/Exploit/Zero Day
Linux近日發布更新以解決Dirty Pipe的安全性弱點
https://www.cisa.gov/uscert/ncas/current-activity/2022/03/10/dirty-pipe-privilege-escalation-vulnerability-linux

Symantec Management Agent 容易受到權限提升弱點的影響。可以通過註冊表操作將低權限的本地帳戶提升到 SYSTEM 級別。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25623

FBI公布俄羅斯駭客開採PrintNightmare漏洞並繞過MFA的手法
https://www.ithome.com.tw/news/149947

Popular NPM Package Updated to Wipe Russia, Belarus Systems to Protest Ukraine Invasion
https://thehackernews.com/2022/03/popular-npm-package-updated-to-wipe.html

Unpatched RCE Bug in dompdf Project Affects HTML to PDF Converters
https://thehackernews.com/2022/03/unpatched-rce-bug-in-dompdf-project.html

威聯通公告部分NAS設備存在Linux寫入權限漏洞Dirty Pipe
https://www.qnap.com/zh-tw/security-advisory/qsa-22-05

'Dirty Pipe' Linux Flaw Affects a Wide Range of QNAP NAS Devices
https://thehackernews.com/2022/03/dirty-pipe-linux-flaw-affects-wide.html

New Linux Bug in Netfilter Firewall Module Lets Attackers Gain Root Access
https://thehackernews.com/2022/03/new-linux-bug-in-netfilter-firewall.html

OpenSSL修補高嚴重性的憑證解析漏洞，建議用戶立即進行更新
https://www.twcert.org.tw/tw/cp-104-5894-83b76-1.html

加密通訊程式庫OpenSSL存在憑證解析漏洞，一旦遭到攻擊者利用，恐導致服務中斷
https://www.bleepingcomputer.com/news/security/openssl-cert-parsing-bug-causes-infinite-denial-of-service-loop/

VOIP 產品的開源多媒體程式庫 PJSIP，內含 5 個嚴重資安漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9763

AMD 處理器也未逃過 Spectre V2 漏洞威脅，當前處理方式將使性能下降 54%
https://www.cool3c.com/article/174252

Google更新reCAPTCHA Enterprise加入帳戶防護工具
https://times.hinet.net/news/23802423

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
中國駭客早已虎視眈眈！奧義智慧挖掘金融機構攻擊事件內幕，呼籲即刻清查供應鏈避免情勢惡化
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/44C177B5BCF34264822AAFED2A011C11

合庫金資安長由周俊隆擔任
https://m.esunsec.com.tw/news/instant-detail.aspx?id=%7BC110E56C-070C-400E-865A-AC04D409B192%7D

美國證交所打算要求重大資安事故要在4天內通報
https://www.ithome.com.tw/news/149847

郵政數位存款帳戶3/21上線與實體只能2擇1
https://money.udn.com/money/story/5618/6174854?from=edn_subcatelist_cate

郵政數位存款帳戶及行動郵局APP 體驗郵政美好新生活
https://reurl.cc/mGOqjG

俄羅斯改用人民幣支付債券票息，沙烏地考慮部分石油改採人民幣計價，挑戰美元主導地位
https://www.thenewslens.com/article/164273

將來銀行讓用戶自選帳號！串連全聯、中華電打造生態圈，還有哪些搶客法寶
https://money.udn.com/money/story/5612/6158782

陸傳要求騰訊將微信支付納入金融控股公司
https://www.chinatimes.com/realtimenews/20220318003518-260410?chdtv

3.電子支付/行動支付/pay/資安
中國再次拉緊監管力道，微信支付面臨破紀錄數億罰款，騰訊、阿里巴巴傳出裁員風暴
https://www.thenewslens.com/article/164074

多方位支付佈局綠界掛牌
https://reurl.cc/X48erM

「手機報稅2.0」5月上路增加電子支付及行動支付功能
https://www.chinatimes.com/realtimenews/20220315005384-260410?chdtv

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
以太坊元宇宙駭客松BuildQuest閉幕，共有10個項目獲獎
https://news.cnyes.com/news/id/4834718

Adobe內容憑證再擴展，加入Polygon NFT驗證與展示功能
https://news.cnyes.com/news/id/4835882

超級巨鯨？前黑帽駭客自稱：我個人持有超 70 億美元的比特幣
https://www.agoscan.com/post/53.html

你買的NFT是假貨？台灣「這團隊」靠一協議讓盜圖無所遁形
https://www.gvm.com.tw/article/87957

派盾：攻擊Deus Finance駭客已將約1,100枚ETH和20萬枚DAI轉入Tornado Cash
https://news.cnyes.com/news/id/4833257

NFT的世界「沒有跌停板」　腦哥提醒：一不小心粉身碎骨
https://finance.ettoday.net/news/2208757

派盾：Parity 2017年被盜資金髮生異動，990枚ETH被轉移到Tornado Cash
https://news.cnyes.com/news/id/4832429

派盾：元宇宙項目Paraluni遭駭客利用漏洞交易，損失約170萬美元
https://news.cnyes.com/news/id/4831218

2017 年 Parity 15萬枚以太坊贓款｜派盾：駭客已轉移 990枚 ETH 至 Tornado Cash
https://www.blocktempo.com/2017-parity-wallet-hacker-begins-moving-eth/

台灣首場元宇宙資安論壇高虹安出席：推企業資安投資抵稅
https://www.ettoday.net/news/20220313/2207390.htm

區塊鏈遊戲孵化器Seedify與DeFi駭客攻擊緩解工具Lossless達成合作
https://news.cnyes.com/news/id/4831168

駭客利用重入漏洞攻擊Paraluni，獲利逾170萬美元，約1/3已流入Tornado
https://news.cnyes.com/news/id/4831255

TreasureDAO：NFT市場將在24小時內重新開放
https://news.cnyes.com/news/id/4830462

第一時間捐贈烏克蘭10萬美金的神秘駭客組織，他們究竟是誰？為什麼要發幣
https://reurl.cc/dX3Vo2

幣安再佈局巴西市場，趙長鵬會見聖保羅州長、考慮收購當地銀行、支付商並設立總部
https://news.cnyes.com/news/id/4834667

加納央行：希望確保數位貨幣eCedi能夠在行動支付平台上協同運行
https://news.cnyes.com/news/id/4833639

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
金融惡意軟體 SharkBot 在 Google Play Store 中假扮為防毒工具，誘騙 Android 用戶安裝
https://www.twcert.org.tw/tw/cp-104-5892-6dc76-1.html

惡意軟體Emotet鎖定美國報稅季，以國稅局的名義散布
https://cofense.com/blog/emotet-spoofs-irs-in-tax-season/

木馬程式Gh0stCringe鎖定兩大關聯式資料庫下手
https://asec.ahnlab.com/en/32572/

勒索軟體LokiLocker攻擊東歐和亞洲，鎖定英文使用者而來
https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware

經營殭屍網路TrickBot的駭客利用逾500個網域發動網釣攻擊，意圖竊取Naver用戶帳密
https://www.prevailion.com/what-wicked-webs-we-unweave/

GoDaddy代管的WordPress網站疑遭惡意軟體攻擊，1天內近300個網站受害
https://www.wordfence.com/blog/2022/03/increase-in-malware-sightings-on-godaddy-managed-hosting/

微軟企業版防毒軟體驚傳誤報，這次是將Office更新當作勒索軟體
https://www.bleepingcomputer.com/news/security/microsoft-defender-tags-office-updates-as-ransomware-activity/

俄軍開戰植木馬程式想癱瘓烏！葉元之：微軟早進場破局
https://www.setn.com/News.aspx?NewsID=1087175

新的殭屍網路利用Log4Shell漏洞入侵受害電腦，並透過DNS隧道埋藏攻擊流量
https://www.bleepingcomputer.com/news/security/new-linux-botnet-exploits-log4j-uses-dns-tunneling-for-comms/

新的勒索軟體Nokoyawa疑似與Hive有關，鎖定南美洲而來
https://www.trendmicro.com/en_us/research/22/c/nokoyawa-ransomware-possibly-related-to-hive-.html

新的殭屍網路利用Log4Shell漏洞入侵受害電腦，並透過DNS隧道埋藏攻擊流量
https://www.bleepingcomputer.com/news/security/new-linux-botnet-exploits-log4j-uses-dns-tunneling-for-comms/

新的勒索軟體Nokoyawa疑似與Hive有關，鎖定南美洲而來
https://www.trendmicro.com/en_us/research/22/c/nokoyawa-ransomware-possibly-related-to-hive-.html

公視新聞資料庫驚傳42萬筆資料遺失，去年遭勒索軟體攻擊事故曝光
https://www.mirrormedia.mg/story/20220314inv001/

汽車電氣零件供應商Denso遭勒索軟體攻擊，洩露Toyota約1.4 TB資料
https://www3.nhk.or.jp/nhkworld/en/news/20220313_23/

鎖定烏克蘭的資料破壞軟體CaddyWiper，將會摧毀受害電腦磁碟分割區
https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/

駭客假借提供安全更新，鎖定烏克蘭散布Cobalt Strike
https://www.facebook.com/UACERT/posts/321475313345067

日本汽車零件大廠電裝遭Pandora勒索軟體攻擊
https://www.ithome.com.tw/news/149904

俄羅斯公布涉及針對境內單位進行 DDoS 攻擊的 17,576 個 IP 名單
https://www.twcert.org.tw/tw/cp-104-5879-7a4fe-1.html

美國FBI發布RagnarLocker勒索軟體威脅指標，請各領域會員加強偵測與防護
https://www.klcg.gov.tw/tw/education/3522-252730.html

勒索軟體LockBit聲稱攻擊輪胎業者普利司通
https://www.bleepingcomputer.com/news/security/bridgestone-americas-confirms-ransomware-attack-lockbit-leaks-data/

電玩廠商Ubisoft遭網路攻擊，全公司重設密碼，疑成勒索軟體Lapsus$受害者
https://www.theverge.com/2022/3/11/22972768/ubisoft-cyber-security-incident-hack

安卓木馬Escobar偽裝成防毒軟體散布，疑似具備能繞過雙因素驗證的能力
https://blog.cyble.com/2022/03/10/aberebot-returns-as-escobar/

DDoS 僵屍網路、加密貨幣挖擴惡意軟體，仍大量使用 Log4Shell 漏洞
https://blog.twnic.tw/2022/03/15/22377/

陸公布美國安局木馬病毒分析報告　植入即「潛伏」等待喚醒竊數據
https://www.ettoday.net/news/20220314/2207941.htm

微軟測試Windows 11家用版安全管理軟體Defender
https://www.ithome.com.tw/news/149876

如何在Mac上解決 Safari 延伸功能無法開啟警告可能的病毒問題
https://blog.trendmicro.com.tw/?p=70839

Cisco Talos警告駭客正在利用俄烏衝突散布惡意程式
https://www.ithome.com.tw/news/149855

Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting
Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability | CISA
https://www.cisa.gov/uscert/sites/default/files/publications/AA22-074A.stix.xml

Kimsuky Group's APT Attacks
https://download.ahnlab.com/global/brochure/Analysis%20Report%20of%20Kimsuky%20Group.pdf

Have Your Cake and Eat it Too? An Overview of UNC2891
https://www.mandiant.com/resources/unc2891-overview

How the Malleable C2 Profile Makes Cobalt Strike Difficult to Detect
https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/

Pandora Ransomware - The Box has been open for a while
https://dissectingmalwa.re/blog/pandora/

Suspected Conti Ransomware Activity in the Auto Manufacturing Secto
https://www.dragos.com/blog/industry-news/suspected-conti-ransomware-activity-in-the-auto-manufacturing-sector/

Cyclops Blink Sets Sights on Asus Routers
https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyclops-blink-sets-sights-on-asus-routers/Appendix_Cyclops%20Blink%20Sets%20Sights%20on%20ASUS%20Routers.pdf

LAPSUS$ Hacking Group
https://otx.alienvault.com/pulse/62324535fc8686a6577c135a

Qakbot infection with Cobalt Strike and VNC activity
https://isc.sans.edu/diary/rss/28448

Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/

Linux Backdoor B1txor20 Using DNS Tunnel Technology Is Spreading Via Log4j Vulnerability
https://blog.netlab.360.com/b1txor20-use-of-dns-tunneling_cn/

Webinar on cyberattacks in Ukraine
https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/

Brazilian trojan impacting Portuguese users and using the same capabilities seen in other Latin American threats
https://otx.alienvault.com/pulse/622f4f68476d6fb93502ddb8

New Wiper Malware Attacking Russia: Deep-dive into RURansom Malware
https://blog.cyble.com/2022/03/11/new-wiper-malware-attacking-russia-deep-dive-into-ruransom-malware/

Analysis of Attack Activities of Suspected APT Organization UNC1151 Against Ukraine and Other Countries
https://ti.qianxin.com/blog/articles/Analysis-of-attack-activities-of-suspected-aptorganization-unc1151-against-ukraine-and-other-countries/

DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly
https://thehackernews.com/2022/03/dirtymoe-botnet-gains-new-exploits-in.html

TrickBot Malware Abusing MikroTik Routers as Proxies for Command-and-Control
https://thehackernews.com/2022/03/trickbot-malware-abusing-hacked-iot.html

New "B1txor20" Linux Botnet Uses DNS Tunnel and Exploits Log4J Flaw
https://thehackernews.com/2022/03/new-b1txor20-linux-botnet-uses-dns.html

Nearly 34 Ransomware Variants Observed in Hundreds of Cyberattacks in Q4 2021
https://thehackernews.com/2022/03/nearly-34-ransomware-variants-observed.html

CaddyWiper: Yet Another Data Wiping Malware Targeting Ukrainian Networks
https://thehackernews.com/2022/03/caddywiper-yet-another-data-wiping.html

Russian Ransomware Gang Retool Custom Hacking Tools of Other APT Groups
https://thehackernews.com/2022/03/russian-ransomware-gang-retool-custom.html

Researchers Find New Evidence Linking Kwampirs Malware to Shamoon APT Hackers
https://thehackernews.com/2022/03/researchers-find-new-evidence-linking.html

Experts Find Some Affiliates of BlackMatter Now Spreading BlackCat Ransomware
https://thehackernews.com/2022/03/experts-find-some-affiliates-of.html

Google Uncovers 'Initial Access Broker' Working with Conti Ransomware Gang
https://thehackernews.com/2022/03/google-uncovers-initial-access-broker.html

DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly
https://thehackernews.com/2022/03/dirtymoe-botnet-gains-new-exploits-in.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
果粉小心千萬別裝這軟體！駭客躲過蘋果審查傳送惡意應用程式
https://3c.ltn.com.tw/news/48181

果粉小心千萬別裝這軟體！駭客躲過蘋果審查傳送惡意應用程式
https://web.bc3ts.net/post/5248967

這下蘋果也難防，駭客利用 TestFlight 傳送惡意 iOS 應用程式
https://technews.tw/2022/03/17/testflight-ios/

如何知道iPhone被監控？教你透過6招反手機監控技巧
https://mrmad.com.tw/how-to-know-if-iphone-is-being-monitored

資安即國安！電信推「網路計畫」　AI惹議：出錯誰負責
https://news.tvbs.com.tw/world/1738064

俄烏開戰後，眾多網路犯罪分子透過 Telegram 進行各式不法資安活動
https://www.twcert.org.tw/tw/cp-104-5855-22508-1.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
上市櫃公司依規須設資安主管產險資安險浮現新商機
https://wantrich.chinatimes.com/news/20220317900327-420101

全台2,630家派遣業者 6月1日起要訂個資安維計畫
https://ctee.com.tw/livenews/jj/ctee/b03004002022031122084884

隨著台灣資安產業轉向雲端應用，防禦惡意攻擊應多管齊下
https://news.sina.com.tw/article/20220317/41423268.html

什麼是CIA Triad？從常見的五大資安威脅，檢視企業資訊安全防護力
https://www.thenewslens.com/article/164125

炮火下的烏克蘭外包軟體工程師，聽著防空警報還是得寫程式碼
https://www.techbang.com/posts/94614-ukrainian-software-industry-under-gunfire-listening-to-anti

解密國際駭客三等級資安專家提五招應對
https://news.cnyes.com/news/id/4834257

豐田汽車零件大廠遭駭疑遭勒索贖金
https://udn.com/news/story/6811/6162007

Google揭露駭客前鋒Exotic Lily
https://www.ithome.com.tw/news/149979

臺灣PCB大廠健鼎遭網路攻擊，部分資訊系統受影響
https://www.ithome.com.tw/news/149950

健鼎遭駭客攻擊第一時間啟動防禦對營運無重大影響
https://money.udn.com/money/story/11162/6168895?from=edn_subcatelist_cate

國內又有PCB廠遇網路攻擊事件，健鼎公告部份資訊系統受影響
https://www.ithome.com.tw/news/149950

東映動畫遭網路攻擊，動畫播出被迫延後
https://corp.toei-anim.co.jp/ja/press/press3317734943536499055.html

俄羅斯國防供應商Rostec證實遭DDoS攻擊，指控是烏克蘭IT軍隊所為
https://www.bleepingcomputer.com/news/security/russian-defense-firm-rostec-shuts-down-website-after-ddos-attack/

俄羅斯企業網站3月遭DDoS攻擊的次數大幅增加，10天攻擊次數已超過2月總和
https://rt-solar.ru/events/news/2583/

波蘭工程師打造一平臺讓使用者可傳送訊息至俄羅斯手機
https://www.ithome.com.tw/news/149880

以色列政府網站疑似遭受駭客組織DDoS攻擊
https://www.twcert.org.tw/tw/cp-104-5889-47518-1.html

疑似伊朗駭客組織攻擊！以色列政府網站被迫關閉
https://times.hinet.net/news/23808083

共諜目標劉美賢赴北京奧運！美派員嚴密保護
https://www.ntdtv.com.tw/b5/20220318/video/322365.html

美國立法要求關鍵企業遭網絡攻擊時向政府報告
https://reurl.cc/Vjx36n

拜登簽新令保衛國安！　禁美國情報員退休後「成為外國傭兵」
https://www.ettoday.net/news/20220317/2210285.htm

關係緊繃美遭俄網攻風險升
https://wantrich.chinatimes.com/news/20220314900211-420201

波蘭火車系統6成停擺疑遭駭客蓄意攻擊
https://reurl.cc/jkEq7q

俄烏戰爭資訊戰！　駭客組織聯手網攻俄羅斯
https://www.ftvnews.com.tw/news/detail/2022317I09M1

烏克蘭擴大數位資訊戰，號召 200 多間科技公司一同抗俄
https://technews.tw/2022/03/18/ukraine-russia-tech-companies/

烏克蘭電信業者合作維護境內通訊並阻止駭客
https://www.ithome.com.tw/news/149956

科技戰！烏克蘭正導入臉部識別 Clearview AI 擬辨認間諜、敵軍死者
https://www.inside.com.tw/article/27004-ukraine-has-started-using-clearview-ais-facial-recognition-during-war

中共啟動非對稱作戰　瞄準台灣重要基礎設施
https://www.upmedia.mg/news_info.php?Type=2&SerialNo=140160

駭客入侵俄國網路攝影機、國有油管業者
https://www.ithome.com.tw/news/149982

抓到賣國賊！烏克蘭逮「60內奸＋20特工」　駭客潛入架Wi-Fi…1000通電話助俄勸降
https://m.news.sina.com.tw/article/20220316/41405842.html

烏克蘭國家安全局自稱，逮捕一名俄國駭客，暗中協助俄軍提供Wi-fi網路連線。
https://www.laitimes.com/article/3gnj9_3xckh.html

烏克蘭遭入侵時衛星網路被破壞西方進行調查
https://wantrich.chinatimes.com/news/20220312900477-420201

恐有駭客攻擊風險，德政府警告別用卡巴斯基防毒軟體
https://technews.tw/2022/03/16/germany-issues-hacking-warning-for-users-of-kaspersky/

俄羅斯駭客利用組織對於使用者帳號的管理不當，繞過雙因素身分驗證機制並控制使用者帳號
https://www.cisa.gov/uscert/ncas/alerts/aa22-074a

解密俄羅斯網軍專家5提醒台企檢視資安曝險
https://www.cna.com.tw/news/afe/202203160287.aspx

俄駭客宣布攻破匿名者官網匿名者邊笑邊釋出36萬份政府機密文件
https://reurl.cc/7e8yq9

利用電話協助俄軍通訊！烏克蘭安全局逮捕網路駭客
https://newtalk.tw/news/view/2022-03-16/724764

政府網站被駭客打爆俄羅斯：遭受史無前例的駭客攻擊
https://www.chinatimes.com/realtimenews/20220318001465-260408?chdtv

微軟、Netflix、Adobe抵制俄羅斯不給用，俄國真的放大招解鎖最大盜版網站Rutracker
https://www.techbang.com/posts/94686-russian-hackers-loosen-the-copyright-era-faces-the-biggest

國家互聯網應急中心稱中國互聯網遭境外網絡攻擊　主要攻擊地址來自美國
https://www.pcmarket.com.hk/cncert-said-china-network-being-attacked-from-america-since-february/

New Infinite Loop Bug in OpenSSL Could Let Attackers Crash Remote Servers
https://thehackernews.com/2022/03/new-infinite-loop-bug-in-openssl-could.html

FBI, CISA Warn of Russian Hackers Exploiting MFA and PrintNightmare Bug
https://thehackernews.com/2022/03/fbi-cisa-warn-of-russian-hackers.html

German Government Warns Against Using Russia's Kaspersky Antivirus Software
https://thehackernews.com/2022/03/german-government-warns-against-using.html

Massive DDoS Attack Knocked Israeli Government Websites Offline
https://thehackernews.com/2022/03/massive-ddos-attack-knocked-israeli.html

Gaming Company Ubisoft Confirms It was Hacked, Resets Staff Passwords
https://thehackernews.com/2022/03/gaming-company-ubisoft-confirms-it-was.html

New Variant of Russian Cyclops Blink Botnet Targeting ASUS Routers
https://thehackernews.com/2022/03/new-variant-of-russian-cyclops-blink.html

資安業務
https://www.104.com.tw/job/7k1bs?jobsource=cj2008

滲透測試工程師
https://www.104.com.tw/job/7jlrs?jobsource=jolist_d_date

MIS工程師
https://www.104.com.tw/job/7jlrr?jobsource=jolist_d_date

工控資安技術工程師
https://www.104.com.tw/job/7jlrq?jobsource=jolist_d_date

資安獵捕監控工程師
https://www.104.com.tw/job/7jlrp?jobsource=jolist_d_date

情資研析工程師
https://www.104.com.tw/job/7jlro?jobsource=jolist_d_date

監控工程師
https://www.104.com.tw/job/7jlrl?jobsource=jolist_d_date

資安產品與服務顧問
https://www.104.com.tw/job/7jlrj?jobsource=jolist_d_date

行動App威脅獵捕分析師
https://www.104.com.tw/job/7jlri?jobsource=jolist_d_date

前端網頁工程師
https://www.104.com.tw/job/7jlrh?jobsource=jolist_d_dateAI/

人工智慧應用工程師
https://www.104.com.tw/job/7jsd5?jobsource=jolist_d_date

維運工程師
https://www.104.com.tw/job/7jlrk?jobsource=jolist_d_date

短期駐點資訊安全人員
https://www.104.com.tw/job/7kdk6

5S元富證券-資安管理師
https://www.skfh.com.tw/hr/job_detail.aspx?id=4681

5L新光人壽-資訊安全管理師(有相關經驗、證照者從優核敘)
https://www.skfh.com.tw/hr/job_detail.aspx?id=4665

5H新光金控_資安治理專案襄理/經理
https://www.skfh.com.tw/hr/job_detail.aspx?id=4650

5H新光金控_資安營運專案襄理/經理
https://www.skfh.com.tw/hr/job_detail.aspx?id=4651

IT資訊安全工程師_竹科
https://www.1111.com.tw/job/98695499/

資安工程師
https://www.yes123.com.tw/wk_index/job.asp?p_id=25530_68919301&job_id=20220314032003_54181380

資訊安全工程師
https://www.104.com.tw/job/7jvuw

資安管理師【總公司】
https://www.1111.com.tw/job/98691229/

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
遠傳Friday購物傳出客戶個資外洩，近期連3周被165列為高風險賣場
https://165.npa.gov.tw/#/articles/risk

微軟示警駭客竊取帳號事件頻傳，企業強化身份識別安全刻不容緩
https://www.techbang.com/posts/94869-microsoft-advises-businesses-to-strengthen-identity-security

【烏俄戰爭】深偽影片首在烏俄資訊戰現身冒充澤倫斯基要求烏軍投降
https://tfc-taiwan.org.tw/articles/7099

2018年Meta資料外洩事件判罰1,700萬歐元
https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-meta-facebook-inquiry

駭客組織匿名者聲稱對俄羅斯石油龍頭的德國分公司出手，竊得20 TB資料
https://anonleaks.net/en/2022/anonymous-germany/20-terabytes-anonymous-germany-hijacks-data-from-rosneft-germany/

英國渡輪業者Wightlink遭網路攻擊，疑似部分客戶與員工個資外洩
https://portswigger.net/daily-swig/uk-ferry-operator-wightlink-flags-potential-data-breach-after-highly-sophisticated-cyber-attack

詐騙集團先竊取公益團體捐款資料，再向捐款人行騙，3月上旬得手逾5百萬元
https://www.cna.com.tw/news/asoc/202203130112.aspx

假冒「公益團體」詐騙多　接獲不明電話指示操作ATM要小心
https://www.mirrormedia.mg/story/20220313soc013/

假冒公益團體詐騙警受理24件財損
http://www.ksnews.com.tw/index.php/news/contents_page/0001581910

有愛心也要有警覺心！捐款操作錯誤詐騙本月已24件逾500萬
https://news.ltn.com.tw/news/society/breakingnews/3858129

派遣公司不小心洩漏個資須通報　違者依個資法開罰最高50萬
https://finance.ettoday.net/news/2206168

反擊制裁！俄羅斯擬盜版合法化　資安公司：91%俄國人喜歡用盜版
https://www.ctwant.com/article/172423

李奧納多捐款1000萬美元給烏克蘭的假新聞，如何傳遍全球
https://www.cw.com.tw/article/5120387

人頭戶網路買虛寶耍詐主嫌到案
https://reurl.cc/6Emy4k

E.研究報告/工具
The Golden Hour of Incident Response
https://thehackernews.com/2022/03/the-golden-hour-of-incident-response.html

Why Enterprise Threat Mitigation Requires Automated, Single-Purpose Tools
https://thehackernews.com/2022/03/why-enterprise-threat-mitigation.html

供應鏈風險、零日漏洞利用和勒索軟體仍將是 2022 年金融機構迫在眉睫的資安威脅
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9756

PSA Certified 2022 安全性報告：裝置安全性將直接影響企業盈虧
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9754

透過 API 進行的資安攻擊，2021 年大增 681%
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9757

從勒索軟體談關鍵資訊基礎設施防護
https://www.pngh.mohw.gov.tw/public/news/1f3f1f96a35aa69ab0c70d2e689521c0.pdf

Google推出社群安全分析專案，可用於定義常見雲端威脅偵測規則
https://www.ithome.com.tw/news/149854

F.商業
Aruba 預測五大網路技術趨勢，提零信任網路架構
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9751

Check Point Software 強化三大產品線功能
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9753

聯達資訊成為中華資安國際「SecuTex」台灣代理商
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9752

資安成為競爭力新指標，迎棧科技結合Tigera幫助企業掌握效率與安全的平衡之道
https://reurl.cc/bkrRbl

SentinelOne併購Attivo Networks，強化身分驗證防護能力
https://www.sentinelone.com/press/sentinelone-to-acquire-attivo-networks-bringing-identity-to-xdr/

英國暫緩NortonLifeLock與Avast併購案，要求業者提出說明
https://www.gov.uk/government/news/cma-finds-nortonlifelock-purchase-of-avast-could-reduce-competition

文化轉型需長期投資佈局　中小企業或可借鏡衛星辦公室混合辦公非一蹴可幾　循序漸進完備資安協作
https://www.netadmin.com.tw/netadmin/zh-tw/trend/CFBB29DF852C4502A29755E7874DBF51

精誠資訊啟動5A、雲服務、資安擴大徵才計畫
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000631291_ZCM1N8TMLHBUWS04MD8LZ

偉康推OETH雲端身份認證SaaS服務遠距辦公更安全
https://ec.ltn.com.tw/article/breakingnews/3863549

偉康攻遠距辦公推雲端身分認證SaaS服務
https://udn.com/news/story/7240/6174811

Check Point Software全面強化三大產品線功能
https://turnnewsapp.com/livenews/tech/A07657002022031711175685

NetApp與思科深化夥伴關係將融合式基礎架構延伸至混合雲
http://www.ctimes.com.tw/DispNews-tw.asp?O=HK63H83WQA6SAA00N7

Google以6項趨勢說明Google Cloud如何確保網路架構安全
https://mashdigi.com/google-highlights-google-cloud-security-and-flexibility/

資安有價有市　Mandiant指與Google有共同願景
https://reurl.cc/KpWxen

Check Point強化三大產品線功能落實資安在地化願景
https://reurl.cc/3jnNX0

MongoDB與亞馬遜雲科技擴大全球合作
https://news.sina.com.tw/article/20220316/41400482.html

F5 Distributed Cloud Services強化數位世界保護
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=60&id=0000630777_NO48M9VP6O10458LJ3SDI

推動永續創新流程轉型達梭系統於 3DEXPERIENCE 平台推出生命週期評估解決方案
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/6C7008E128934742AC9FDF5F0D3FE4BD

Openfind 提供 Emotet 加密病毒信完整攔阻方式，助客戶抵禦強烈攻勢
http://n.yam.com/Article/20220315211537

華碩轉型三部曲：從智慧製造經驗，孵出轉型小金雞
https://buzzorange.com/techorange/2022/03/14/asus-digital-cloud-service/

提供多層次網站應用程式與API防護，F5新一代資安雲成軍
https://www.ithome.com.tw/review/149592

G.政府
馬斯克的星鏈衛星助烏克蘭不斷網！吳政忠：台灣也會有落地機制
https://www.bnext.com.tw/article/68157/starlink-ukraine-relate-tw

抗衡中共北斗台科技部：戰時將與國際衛星合作
https://www.epochtimes.com/b5/22/3/17/n13653430.htm

防資訊滲透政院：關鍵是強化數位公民意識
https://reurl.cc/pWNyea

公視資安與影視職安成災難朝野立委籲請文化與勞動兩部速訂防範亡羊補牢
https://today.line.me/tw/v2/article/gzEDq6z

公視新聞片庫遭誤刪監委質疑資安漏洞申請調查
https://money.udn.com/money/story/7307/6174416

工研院2022 VLSI國際研討會下月登場　聚焦AI、量子運算及智慧物聯網資安
https://www.appledaily.com.tw/property/20220318/CO7YY7YRKBH37IYRUR53AWSP7Q/

台南公共費用行動支付成長119％黃偉哲要求加強資安
https://news.ltn.com.tw/news/life/breakingnews/3860843

張文村談數位信任透過科技來維護組織聲譽
https://reurl.cc/WkmEOy

東吳攜手以色列新加坡培育一級資安人才
https://web-ch.scu.edu.tw/epaper/news/6916/18680

台防長：烏克蘭經驗被納入台海不對稱作戰規劃
https://www.epochtimes.com/b5/22/3/11/n13637960.htm

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
dlink dir-859_firmware 通過函數 genacgi_main 發現 D-Link DIR-859 v1.05 包含基於堆疊的緩衝區溢出。此弱點允許攻擊者通過精心設計的有效負載引發阻斷服務 (DoS)
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25106

小米路由器AX3600存在命令注入弱點。該弱點是由於缺乏對傳入數據檢測的檢查造成的。攻擊者可以利用此弱點執行程式碼。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-14111
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-14115

siemens 在第三方組件中，分配分區大小的過程無法檢查記憶體邊界。因此，如果攻擊者請求大量，由於整數環繞，可能會導致分配較小的大小。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-42019
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24408

tenda ax1806_firmware 發現騰達AX1806 v1.0.0.1函數formSetProvince中存在堆疊溢出。此弱點允許攻擊者通過 ProvinceCode 參數導致阻斷服務 (DoS)。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25558
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25566
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25557
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25548
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25554
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25553
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25552
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25551
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25546
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25547
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25550
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-25549
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-46393
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-46394

TP-LINK 產品(版本 WR-886N 20190826 2.3.8) 的函數 (/cloud_config/router_post/check_reg_verify_code) 存在緩衝區溢出弱點。該弱點允許已被刪除的惡意用戶藉由 post 請求導致執行任意程式碼。
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44622
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44623
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44625
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44626
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44629
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44627
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44628
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44630
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44631
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44632

工控資安：IT/OT疆界模糊，勒索攻擊鑽漏洞
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9759

MOXA：工業4.0趨勢發展重點符合多網融合、遠端作業、安全監控等特性
https://udn.com/news/story/7086/6170307

三大工控網路市場成長動能催生IT/OT互融互通網路架構，滿足工業維運安全強固不中斷
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9767

俄羅斯的關鍵基礎設施的SCADA系統，屢遭網路攻擊而癱瘓
https://blog.cyble.com/2022/03/09/russia-ukraine-crisis-places-critical-infrastructure-at-high-risk/

歐姆龍PLC程式開發軟體存在高風險漏洞
https://www.securityweek.com/high-severity-vulnerabilities-patched-omron-plc-programming-software

挖掘AI時代的台灣優勢
https://news.cnyes.com/news/id/4830653

國泰智能電動車伺機進場
https://money.udn.com/money/story/5618/6160291

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：LINE 社交平台資安機制：雲端 LINE Chatting 機器人系統」2022/3/25
https://docs.google.com/forms/d/1pjgu56Qqxuo9-eQTndqLzK2oZuzAWnv3v78VvuipDwA/viewform?edit_requested=true

雲端資安防禦實作研討會 2022/3/29
https://www.ecloudvalley.com/zh-hant/event/ms_security/

中部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名）2022/4/13
https://www.cisanet.org.tw/Course/Detail/2783

AIAA講座【台北場】：資安思維 X 政府應用AI案例 X 數位轉型 2022/4/16
https://www.accupass.com/event/2203031213512786993470

網站應用程式安全 2022/04/19
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19881

2022 美台金融資安論壇數位轉型下的資安再造 2022/04/21 ~ 2022/04/22
https://event.netmag.tw/202204ait/

南部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名） 2022/4/21
https://www.cisanet.org.tw/Course/Detail/2784

駭客奪旗攻防演練：金融資安人才養成專班(第1期) 2022/04/28~2022/06/09
https://www.tabf.org.tw/CourseDetail.aspx?PID=487750

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/3/7 ~ 2022/3/11

noreply@blogger.com (Unknown) — Fri, 11 Mar 2022 15:53:00 +0000

資安事件新聞週報 2022/3/7 ~ 2022/3/11

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-dos-JLh9TxBp

Critical Patches Issued for Cisco Expressway Series, TelePresence VCS Products
https://thehackernews.com/2022/03/critical-patches-issued-for-cisco.html

Critical Bugs Could Let Attackers Remotely Hack, Damage APC Smart-UPS Devices
https://thehackernews.com/2022/03/critical-bugs-could-let-attackers.html

TP-Link無線路由器RCE漏洞的攻擊程式已遭公開，建議用戶立即進行更新
https://www.twcert.org.tw/tw/cp-104-5815-b7721-1.html

駭客透過VoIP系統漏洞放大流量發動DDoS攻擊，新手法可將流量放大近43億倍
https://www.akamai.com/blog/security/phone-home-ddos-attack-vector

Amazon Echo 驚現「自駭」漏洞！駭客讓智慧音箱對自己下惡意指令
https://technews.tw/2022/03/10/novel-attack-turns-amazon-devices-against-themselves/

Critical "Access:7" Supply Chain Vulnerabilities Impact ATMs, Medical and IoT Devices
https://thehackernews.com/2022/03/critical-access7-supply-chain.html

Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses
https://thehackernews.com/2022/03/critical-rce-bugs-found-in-pascom-cloud.html

The Continuing Threat of Unpatched Security Vulnerabilities
https://thehackernews.com/2022/03/the-continuing-threat-of-unpatched.html

New Security Vulnerability Affects Thousands of Self-Managed GitLab Instances
https://thehackernews.com/2022/03/new-security-vulnerability-affects.html

微軟發佈3月份安全性公告
https://www.cisa.gov/uscert/ncas/current-activity/2022/03/08/microsoft-releases-march-2022-security-updates

IBM QRadar SIEM and Apache log4j version 1 usage
https://www.ibm.com/support/pages/node/6561889?myns=swgother&mynp=OCSSBQAC&mynp=OCSSKMKU&mync=E&cm_sp=swgother-_-OCSSBQAC-OCSSKMKU-_-E

QRadar: After an upgrade the Admin tab repeatedly displays, "A new version of the event collection service is available for upgrade."
https://www.ibm.com/support/pages/node/6555146?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

2 New Mozilla Firefox 0-Day Bugs Under Active Attack — Patch Your Browser ASAP
https://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html

New Linux Kernel cgroups Vulnerability Could Let Attackers Escape Container
https://thehackernews.com/2022/03/new-linux-kernel-cgroups-vulnerability.html

三大廠牌處理器出現新的推測執行漏洞
https://www.bleepingcomputer.com/news/security/intel-amd-arm-warn-of-new-speculative-execution-cpu-bugs/

近3成WordPress外掛程式存在重大漏洞，卻沒有相關修補程式可用
https://patchstack.com/whitepaper/the-state-of-wordpress-security-in-2021

McAfee(R) Safe Connect VPN - Unquoted Service Path Elevation Of Privilege
https://www.exploit-db.com/exploits/50814

Webmin 1.984 - Remote Code Execution (Authenticated)
https://www.exploit-db.com/exploits/50809

Malwarebytes 4.5 - Unquoted Service Path
https://www.exploit-db.com/exploits/50806

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
https://www.exploit-db.com/exploits/50797

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
財長：公股行庫全力支援受俄烏戰爭影響企業
https://turnnewsapp.com/livenews/finance/A95620002022031020155649

銀行業提防兩大新風險
https://udn.com/news/story/7338/6156147

台數位金融蓬勃發展資安人才搶手
https://www.epochtimes.com/b5/22/3/8/n13630992.htm

將來銀行備戰329開業　帳號自由選搶先預訂
https://www.cardu.com.tw/news/detail.php?45579

玉山金多元領域招募菁英
https://reurl.cc/nEb5rd

玉山金今年將徵才600人
https://money.udn.com/money/story/5613/6145078?from=edn_subcatelist_cate

元大金徵才！首招投資研究MA 接軌國際金融市場
https://udn.com/news/story/7239/6142255

迎數位金融浪潮金融業招攬多元領域人才
https://ctee.com.tw/news/finance/604989.html

中信金首創多語系人才交流！　泰國、印尼國籍諮詢踴躍
https://finance.ettoday.net/news/2202123

總經理集體出動！9大金控徵才條件一次看　百萬年薪不是夢
https://www.setn.com/News.aspx?NewsID=1080564

3.電子支付/行動支付/pay/資安
行動支付盛行 LINE Pay愛心捐款逾4億元
https://www.chinatimes.com/realtimenews/20220310001962-260410?chdtv

一卡通Money、街口、悠遊付…8家電子支付！儲值、轉帳、提領手續費多少
https://www.cardu.com.tw/mpay/detail.php?38340

新版LINE Pay App怎麼用？和一卡通Money怎麼區分
https://reurl.cc/OpakQg

一卡通與LINE Bank聯手合作啟動國內首次純網銀與電支帳戶連結
https://www.chinatimes.com/realtimenews/20220311004800-260410?chdtv

全支付電支執照准了！9月1日前須開業
https://ctee.com.tw/wealth/fintech/602407.html

全家拿下電子支付執照！成全台第一間零售通路結合金融產業的電子支付
https://www.inside.com.tw/article/26820-familymart-epay

支付戰純網銀參一腳
https://udn.com/news/story/7239/6133108

一卡通Money捐款助烏克蘭轉帳免手續費
https://reurl.cc/Qjl6O0

「全支付」取得電子支付營業執照全聯PX Pay升級「全支付」電支登場
https://news.sina.com.tw/article/20220303/41309548.html

Steam 俄羅斯無法使用電子支付用戶無法購買任何遊戲
https://unwire.hk/2022/03/08/russiasteam/game-channel/

PayPal擴大制裁停止在俄羅斯提供服務
https://ec.ltn.com.tw/article/breakingnews/3849713

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
破獲史上最高額比特幣洗錢案美國追回逾36億美元
https://www.chinatimes.com/realtimenews/20220311000013-260408?chdtv

地緣衝突和通脹高漲之下，加密貨幣的又一個牛市在醞釀
https://hk.investing.com/analysis/article-100084

BNB Chain宣布舉辦駭客馬拉松提供1000萬美元獎金和種子資金
https://news.cnyes.com/news/id/4827275

派盾：攻擊Fantasm Finance駭客使用Tornado.cash混幣1,007 ETH
https://news.cnyes.com/news/id/4828605

美加速草擬加密貨幣法規、發行數位美元阻止俄國逃避經濟制裁
https://times.hinet.net/news/23795861

俄羅斯提議禁止使用和開採加密貨幣
https://blog.twnic.tw/2022/03/07/21829/

BaconProtocol遭受駭客攻擊損失100萬美元
https://news.cnyes.com/news/id/4824695

虛擬貨幣洗錢列非常高風險
https://reurl.cc/EpNZQK

全球首台NFT自動販賣機設立紐約華爾街！用信用卡即可進行交易
https://newtalk.tw/news/view/2022-03-07/719781

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
資料破壞軟體RURansom鎖定俄羅斯實體下手
https://www.trendmicro.com/en_us/research/22/c/new-ruransom-wiper-targets-russia.html

勒索軟體Ragnar Locker鎖定52個美國關鍵基礎設施實體下手
https://www.documentcloud.org/documents/21397387-ragnarlocker-ransomware-indicators-of-compromise

NVIDIA外流「程式碼簽章」遭駭客利用將惡意軟體偽裝成官方驅動程式
https://www.cool3c.com/article/174071

KPMG：企業遭網攻勒索軟體最常見
https://readers.ctee.com.tw/cm/20220310/a11aa11/1173584/share

Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups
https://blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html

Conti Ransomware | CISA
https://www.cisa.gov/uscert/ncas/alerts/aa21-265a

Lazyscripter’s scripts: double compromise in a single obfuscation
https://lab52.io/blog/very-very-lazy-lazyscripters-scripts-double-compromise-in-a-single-obfuscation/

Nvidia leak - abused certificate for signing malicious code and tools such as mimikatz
https://twitter.com/cyb3rops/status/1499514240008437762

PROPHET SPIDER Exploits Citrix ShareFile
https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/

中國駭客APT41利用網頁應用系統的零時差漏洞，攻擊美國州政府
https://www.mandiant.com/resources/apt41-us-state-governments

Chinese APT41 Hackers Broke into at Least 6 U.S. State Governments: Mandiant
https://thehackernews.com/2022/03/chinese-apt41-hackers-broke-into-at.html

A Summary of APT41 Targeting U.S. State Governments
https://www.mandiant.com/resources/apt41-us-state-governments

The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates
https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european

MS Office Files Involved Again in Recent Emotet Trojan Campaign
https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one

Fake Purchase Order Used to Deliver Agent Tesla
https://www.fortinet.com/blog/threat-research/fake-purchase-order-used-to-deliver-agent-tesla

SharkBot Banking Malware Spreading via Fake Android Antivirus App on Google Play Store
https://thehackernews.com/2022/03/sharkbot-banking-malware-spreading-via.html

Cyberattack on the state authorities of Ukraine using the malicious program Cobalt Strike Beacon
https://cert.gov.ua/article/37704

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Both Sides in Russia-Ukraine War Heavily Using Telegram for Disinformation and Hacktivism
https://thehackernews.com/2022/03/both-sides-in-russia-ukraine-war.html

路透：TikTok與甲骨文接近就美國用戶資料儲存達成協議
https://news.cnyes.com/news/id/4830218

三星證實Galaxy原始碼遭竊籲用戶啟用雙重認證
https://www.mypeoplevol.com/Article/18135

Google Play驚見4款「入侵網銀」App　有下載的快移除
https://www.ctwant.com/article/171569

SIGNAL創辦人警告用TELEGRAM存資安風險
https://www.isda.org.tw/2022/03/05/dad0487bad728eea166aab47e5e187c6/

Apple公司寫信向國會議員解釋"側載"是一種惡意軟件的危險
https://reurl.cc/GoqbGZ

掃實聯制竟有木馬病毒　資安公司警告：這款萬人下載APP有狀況
https://www.ctwant.com/article/171052

SIM卡漏洞遭SimJacker入侵！駭客發送簡訊即可監控掌握手機　10億用戶面臨威脅
https://www.bg3.co/a/simqia-lou-dong-zao-simjackerru-qin-hai-ke-fa-song-jian-xun-ji-ke-jian-kong-zhang-wo-shou-ji-10yi-yong-hu-mian-lin-wei-xie.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
隱私計算網路Oasis開啟為期8周的駭客松活動
https://news.cnyes.com/news/id/4829919?exp=a

資料中心四大關鍵技術報告節能效率／混和架構／資訊安全／人工智慧
https://wantrich.chinatimes.com/news/20220306900027-420301

科技經濟戰台灣別輸了
https://udn.com/news/story/7315/6143600

照片型社群軟體很可怕？家長免驚，安全4步驟引導孩子上網
https://isafe.moe.edu.tw/article/2524?user_type=3&topic=9

報告指近一成 IT 資安事件原因為外接儲存裝置
https://technews.tw/2022/03/10/top-attack-vectors-january-2022/

Nvidia、電子五哥遭駭客下毒手，問題不在預算不足！專家：資安不能疊床架屋
https://www.bnext.com.tw/article/68053/check-point--security-trend

駭入三星、Nvidia的駭客要利誘微軟、蘋果等公司員工協助內應
https://www.ithome.com.tw/news/149841

沒有牆的廠房資安如何保平安
https://udn.com/news/story/11726/6152404

東映動畫遭駭客惡意入侵　《數碼寶貝：幽靈遊戲》《ONE PIECE》等多部動畫皆受影響
https://www.toy-people.com/?p=69830

俄羅斯政府網站遭駭，疑似遭供應鏈攻擊
https://www.bleepingcomputer.com/news/security/russian-government-sites-hacked-in-supply-chain-attack/

若俄軍持續進攻烏克蘭政府將研擬轉移機密數據至他國
https://news.ltn.com.tw/news/world/breakingnews/3854626

資安公司：中國駭客發動攻擊　美至少6州政府受害
https://tw.appledaily.com/international/20220309/KUTTIHPR6FE7ZLSIFU3HJWVOA4/

肆無忌憚中共駭客入侵美國6州府系統
https://www.youtube.com/watch?v=95gltBFsQOg

美多家政府機構遭駭客攻擊？陸外交部：賊喊捉賊
https://m.match.net.tw/pc/news/international/20220309/6424677

華為暗助普丁欲建監控和人臉識別系統
https://reurl.cc/Opakb9

傳共機失事／國安局為越南記者爆料背書？張競：孤證風險高
https://cnews.com.tw/174220311a01/

沈舟：俄軍遭遇高科技對手中共傻眼
https://www.epochtimes.com/b5/22/3/10/n13635530.htm

俄羅斯入侵烏克蘭掀「史上最大網軍戰」　專家警告失控後果
https://www.setn.com/News.aspx?NewsID=1081835

匿名者駭入俄羅斯串流與電視台，播放烏克蘭戰場畫面
https://technews.tw/2022/03/07/anonymous-hack-russia-tv/

「烏克蘭版唐鳳」31歲副總理靠手機護國號召駭客抗俄
https://udn.com/news/story/122663/6144938

逾40萬名自願者加入烏駭客團隊對俄發起網攻
https://www.merit-times.com/NewsPage.aspx?unid=758021

烏克蘭IT軍團、無人機打響現代AI戰爭
https://reurl.cc/Qjl6a9

全球善款湧向烏克蘭，外加15億鉅額加密貨幣，虛擬戰場意外開啟
https://www.gvm.com.tw/article/87718

CISA與FBI警告加強防範資料抹除攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9747

Hackers Abuse Mitel Devices to Amplify DDoS Attacks by 4 Billion Times
https://thehackernews.com/2022/03/hackers-abuse-mitel-devices-to-amplify.html

Russia Releases List of IPs, Domains Attacking Its Infrastructure with DDoS Attacks
https://thehackernews.com/2022/03/russia-releases-list-of-ips-domains.html

Security Engineer (資安產品工程師)
https://www.1111.com.tw/job/98688477/

聯華電子-資安門禁安檢員(週休二日、見紅休)
https://www.518.com.tw/job-GonqXX.html

資訊部-網管工程師(海外儲備幹部)
https://www.104.com.tw/job/7ehcg?jobsource=jolist_c_date

Product Manager(WISE-PaaS AI ,內湖瑞光路)
https://tw.talent.com/view?id=668ba61756e7

資訊安全工程師(HS220310009)
https://www.104.com.tw/job/7k7f6

中華資安國際行政助理
https://worknowapp.com/jobs/a34d86c8-30d8-46b9-8aa9-b92a75b2d382

網路資安工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=6&EMPLOYER_ID=905564&HIRE_ID=11026685

徵才訊息---資訊應用管理師
https://www.cs.nycu.edu.tw/announcements/detail/8798

資安工作5年成長1.5倍！上市櫃編制人力、資安新鮮人成搶手貨
https://www.bnext.com.tw/article/68027/information-security-fresh-crew

防駭客、會抓鬼！資安人才夯　求職網統計：平均月薪53K、職缺增1.5倍
https://tw.appledaily.com/life/20220309/HDUXHN7HE5BTFHQRHDETZUZNX4/

精誠今年將擴大招募逾千人
https://ctee.com.tw/news/tech/605326.html

宏碁集團擴大徵才精誠資訊擬招募千人
https://newtalk.tw/news/view/2022-03-04/718819

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Google: Russian Hackers Target Ukrainians, European Allies via Phishing Attacks
https://thehackernews.com/2022/03/google-russian-hackers-target.html

Ukrainian CERT Warns Citizens of Phishing Attacks Using Compromised Accounts
https://thehackernews.com/2022/03/ukrainian-cert-warns-citizens-of.html

Samsung Confirms Data Breach After Hackers Leak Galaxy Source Code
https://thehackernews.com/2022/03/samsung-confirms-data-breach-after.html

中國駭客APT31針對美國政府相關的Gmail帳號發動網釣攻擊
https://twitter.com/ShaneHuntley/status/1501224764530069504

歐洲議會指中、俄操控訊息肯定台灣抗假訊息成果
https://news.pts.org.tw/article/571169

本土劇女星內衣露出照遭盜用！　急出面求刪：會讓人家斷章取義
https://star.ettoday.net/news/2205495?redirect=1

裸照外流抓不到駭客「只有內部人員」　謝忻曝心境：沮喪佔據生活
https://star.ettoday.net/news/2204721

NVIDIA 遭駭客最後通牒：開源GPU驅動程式，否則公佈機密資料
https://vitomag.com/tech/whohk.html

Nvidia遭駭客勒索100萬美元否則出售GPU LHR算力解鎖技術
https://netmag.tw/2022/03/04/nvidia-was-blackmailed-for-1-million-or-sold-gpu-lhr-to-unlock-technology

高達 190 GB 數據外洩！駭客攻擊三星，Galaxy 原始碼也外流
https://www.inside.com.tw/article/26948-hackers-stole-samsungs-galaxy-source-code

NVIDIA遭駭客入侵7萬多員工密碼遭洩露，還「順便」駭了三星釋出190GB機密資料
https://www.techbang.com/posts/94635-more-than-70000-nvidia-employee-passwords-were-leaked-the

三星電子遭駭客攻擊，未造成用戶資料外洩
https://srtechmedia.com/news/68de6502-6f91-49e8-9d2f-7ecab9038f88

千騙萬騙離不開ATM｜樹林警助民保住90萬存款
http://n.yam.com/Article/20220309995533

俄烏戰爭假消息多史丹福學者教7點辨識
https://www.worldjournal.com/wj/story/121519/6151643

俄烏及台海情勢羅致政：台灣社會需慎防假訊息
https://cnews.com.tw/%E4%BF%84%E7%83%8F%E5%8F%8A%E5%8F%B0%E6%B5%B7%E6%83%85%E5%8B%A2%E5%BA%A7%E8%AB%87%E6%9C%83-%E7%BE%85%E8%87%B4%E6%94%BF%EF%BC%9A%E5%8F%B0%E7%81%A3%E7%A4%BE%E6%9C%83%E9%9C%80%E6%85%8E%E9%98%B2%E5%81%87/

[NFT詐騙] 假MetaversePRO網站
https://blog.trendmicro.com.tw/?p=71519

虛擬投資　「詐翻」老少
https://news.housefun.com.tw/news/article/202531327350.html

遠傳friDay購物平台疑個資外洩　詐騙連分期付款都清楚
https://tw.appledaily.com/property/20220305/TJQ7DCVC2REKPNWTNGKX4B567Q/

花式Office漏洞及社交工程激增　「信賴」須重新定義郵件資安攻擊板塊位移　物流詐騙信隨疫情增25倍
https://www.netadmin.com.tw/netadmin/zh-tw/trend/0F45CFDD9DDC40E598067616356FA51F

多組駭侵者假借金援烏克蘭為由，設立加密貨幣詐騙捐款專戶
https://www.twcert.org.tw/tw/cp-104-5813-c2793-1.html

E.研究報告/工具
當資安標準遇到管理
https://www.semi.org/zh/technology_and_trends/cybersecurity_standards

老舊系統不是IT問題，而是資安折舊問題
https://www.semi.org/zh/business_and_markets/cybersecurity/legacy_software

如何取回管理權　避免再次「被駭」
https://www.mnews.tw/story/20220307rep002

資安鬼故事之Reverse shell
https://forum.gamer.com.tw/C.php?bsn=60030&snA=597736

能將 DDoS 封包放大 65 倍的全新攻擊手法橫空出世！任何新手都能輕鬆癱瘓目標
https://technews.tw/2022/03/06/hackers-begin-weaponizing-tcp-middlebox-reflection-for-amplified-ddos-attacks/

API Architecture - Performance Best Practices for REST APIs
https://abdulrwahab.medium.com/api-architecture-performance-best-practices-for-rest-apis-1d4a5922dae1

Binary Tree Pre Order Traversal using Tail Recursion
https://medium.com/@dhruvikasharma20/binary-tree-preorder-traversal-using-tail-recursion-37390dc410b9

Using Node.js for Backend Web Development in 2022
https://medium.com/geekculture/using-node-js-for-backend-web-development-in-2022-f2917c6c0a87

How I built my tech startup as a solo developer
https://medium.com/dreamwod-tech/how-i-built-my-tech-startup-as-a-solo-developer-45390f460002

How I created a Trojan Malware — Ethical Hacking
https://infosecwriteups.com/how-i-created-a-trojan-malware-ethical-hacking-82239a6b64c6

Becoming an SDET / QA Automation Test Engineer Road Map Step By Step in 2022
https://thetestlead.medium.com/becoming-an-sdet-qa-automation-test-engineer-road-map-step-by-step-in-2022-9f75cc03007c

Android Development Trends for 2022
https://betterprogramming.pub/android-development-trends-for-2022-51734382bce1

How to Exploit Current Events for Clicks
https://davidbclear.medium.com/how-to-exploit-current-events-for-clicks-bec33c246e74

6 steps to set up linux server with Nginx Docker & SSL
https://towardsdev.com/6-steps-to-set-up-linux-server-with-nginx-docker-ssl-ef501860610b

The Incident Response Plan - Preparing for a Rainy Day
https://thehackernews.com/2021/06/the-incident-response-plan-preparing.html

Understanding How Hackers Recon
https://thehackernews.com/2022/03/understanding-how-hackers-recon.html

Researchers Demonstrate New Side-Channel Attack on Homomorphic Encryption
https://thehackernews.com/2022/03/researchers-demonstrate-new-side.html

F.商業
Google Buys Cybersecurity Firm Mandiant for $5.4 Billion
https://thehackernews.com/2022/03/google-buys-cybersecurity-firm-mandiant.html

Google砸1530億收購 Mandiant！　添網路安全生力軍
https://finance.ettoday.net/news/2205628?from=amp_newslist

FedEx、博通都愛用！Okta 如何協助企業打造「去中心化」身份管理
https://www.inside.com.tw/article/26968-odin-info

鎖定關鍵任務　搭載DFMD表現更佳 Pure推旗艦儲存　效能安全兼顧
https://www.netadmin.com.tw/netadmin/zh-tw/market/ACE23C88204E43D79F8F8B4DBECB5ED8

Check Point Software 揭密企業如何應戰複雜資安威脅情勢
https://reurl.cc/DdMgWO

迎接後疫情的資料儲存、資安商機！Synology擴充20%人力：從台灣出發打世界盃
https://www.bnext.com.tw/article/68049/synology-2022

合勤投控以駭客為師，將資安轉化成企業競爭優勢
https://times.hinet.net/news/23792807

聯達資訊成為中華資安國際「SecuTex」台灣代理商
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9752

中租迪和實現安全的數位轉型之旅，資安防護網扮演幕後功臣
https://news.sina.com.tw/article/20220309/41348572.html

F5 Distributed Cloud Services 強化數位世界保護
https://reurl.cc/EpNZoR

Fortinet發布新世代防火牆FortiGate 3000F，助企業建立混合式資安架構
https://www.techbang.com/posts/94587-fortinet-announces-next-gen-firewall-fortigate-3000f

G.政府
港務公司依循資安法擴大推動資安提供更安全航運服務
https://reurl.cc/g0bW97

資策會與奧勒岡台灣工商會簽訂MOU 加強國際產業技術趨勢交流合作
https://news.sina.com.tw/article/20220310/41355874.html

烏俄戰爭顯示政府強化資安防護網的重要　台南政風處舉專業研習會
https://www.ettoday.net/news/20220311/2206049.htm

台美簽署69.9億軍購合約新型野戰資訊通信系統2024運交台灣
https://news.ltn.com.tw/news/politics/breakingnews/3856089

衛服部將推資療資安聯防機制擬納入醫院評鑑制度中
https://ibmi.taiwan-healthcare.org/zh//email.php?REFDOCID=0qexf0ecg3k504oi

調查局動員百人偵辦陸企違法挖角人才案
https://reurl.cc/Y95jXD

TWCERT/CC 2022年2月資安電子報
https://epaper.twcert.org.tw/2022_02/

唐鳳接任數位發展部召集人！掌管電信、資安，新設部門是什麼一次看懂
https://today.line.me/tw/v2/article/GgOM6rZ

中山大學「國際金融研究學院」揭牌陳其邁偕同蔡總統啟動儀式
https://news.sina.com.tw/article/20220304/41319932.html

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
Bureau Veritas取得IECEE認可IEC 62443標準資安檢測實驗室資格
https://reurl.cc/bkbXME

捷而思透析車聯網資安為當務之急需要提前部署
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=35&id=0000630299_EFG1ILK1LX1AY88B4NST9

瀚錸科技代理Remote.It為工控設備提供安全遠程連線管理服務
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=60&id=0000630256_3YR1NR2E62MCAM5RU8J0E

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

Scala Taiwan #39 - 用Scala寫基因體醫學 2022/3/15
https://www.meetup.com/Scala-Taiwan-Meetup/events/284242666/

Flutter Festival Taipei 2022/3/16
https://www.meetup.com/Flutter-Taipei/events/283785315/

【Drupal台北小聚】預防網路駭客攻擊，如何選擇一個安全又穩定的網站CMS系統 2022/03/18
https://www.accupass.com/event/2203041031371662916900

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/3/18
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3972&from_course_list_url=homepage

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：LINE 社交平台資安機制：雲端 LINE Chatting 機器人系統」2022/3/25
https://docs.google.com/forms/d/1pjgu56Qqxuo9-eQTndqLzK2oZuzAWnv3v78VvuipDwA/viewform?edit_requested=true

中部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名）2022/4/13
https://www.cisanet.org.tw/Course/Detail/2783

南部場-公部門如何揪出潛伏資安威脅研討會（限政府機關報名） 2022/4/21
https://www.cisanet.org.tw/Course/Detail/2784

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/2/28 ~ 2022/3/4

noreply@blogger.com (Unknown) — Fri, 04 Mar 2022 15:56:00 +0000

資安事件新聞週報 2022/2/28 ~ 2022/3/4

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://tools.cisco.com/security/center/publicationListing.x

Critical Patches Issued for Cisco Expressway Series, TelePresence VCS Products
https://thehackernews.com/2022/03/critical-patches-issued-for-cisco.html

Release of QRadar 7.5.0 Update Package 1 SFS (7.5.0-QRADAR-QRSIEM-2021.6.1.20220215133427)
https://reurl.cc/oeAQXV

Apache HTTP Server as used by IBM QRadar SIEM is vulnerable to
buffer overflow and denial of service (CVE-2021-44790, CVE-2021-34798, CVE-2021-39275)
https://reurl.cc/MbVNDm

Critical Bugs Reported in Popular Open Source PJSIP SIP and Media Stack
https://thehackernews.com/2022/03/critical-bugs-reported-in-popular-open.html

Critical Security Bugs Uncovered in VoIPmonitor Monitoring Software
https://thehackernews.com/2022/03/critical-security-bugs-uncovered-in.html

Linux快很多! Google 資安團隊提軟硬體與作業系統業者修補資安漏洞平均速度
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9733

GitLab出現重大漏洞，恐被用於挾持特定Token
https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/

Windows 11自動更新擾民 3招內建選項無煩惱
https://reurl.cc/k7gqbG

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
國銀ATM當機常搞烏龍　金管會下令作好2件事
https://www.cardu.com.tw/news/detail.php?45560

政清輔淡逢「五校聯盟」學程名額秒殺　中信金跨校培育金融科技人才
https://www.ctwant.com/article/170842

台灣保戶淪為重災戶？金管會回應「壽險對俄曝險逾千億」質疑
https://www.gvm.com.tw/article/87571

壽險業持有俄債壽險公會：曝險占比低風險可控
https://www.rti.org.tw/news/view/id/2125981

保險集團怡安驚傳遭到網路攻擊
https://www.bleepingcomputer.com/news/security/insurance-giant-aon-hit-by-a-cyberattack-over-the-weekend/

西方制裁俄羅斯專家：美銀行業恐遭報復性網攻
https://reurl.cc/EpeXW0

將俄逐出SWIFT 歐美出重手
https://reurl.cc/6ExL35

3.電子支付/行動支付/pay/資安
一卡通Money、街口、悠遊付…8家電子支付！儲值、轉帳、提領手續費多少
https://reurl.cc/zMErYk

全聯「全支付」獲電支營業執照，PX Pay 助力電子支付服務
https://technews.tw/2022/03/01/px-mart-to-invest-in-the-electronic-payment-institutions/

LINE Bank與一卡通合作創純網銀與電子支付結盟首例
https://udn.com/news/story/7239/6131587

行動支付權益一次看！　街口5月推提領免手續費活動
https://finance.ettoday.net/news/2199092

全家拿下電子支付執照！成全台第一間零售通路結合金融產業的電子支付
https://www.inside.com.tw/article/26820-familymart-epay

迎戰雙全進逼 icash Pay續拓餐飲通路、增線上購券功能
https://udn.com/news/story/7241/6139571?from=udn-ch1_breaknews-1-cate6-news

制裁生效！俄羅斯多家銀行無法使用電子支付
https://reurl.cc/6ExLn6

愛用電子支付者注意金管會修電支存保額度
https://www.chinatimes.com/realtimenews/20220224004282-260410?chdtv

一銀宣布結盟Samsung Pay 行動支付新里程碑
https://www.chinatimes.com/realtimenews/20220301003342-260410?chdtv

LINE Pay學會這2招！刷臉就能付錢
https://reurl.cc/e6AWYm

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
NFTs Aren’t As Stupid As You Think
https://onezero.medium.com/nfts-arent-as-stupid-as-you-think-bffab89697e3

副財長：多項原因政府不承認加密貨幣為法定貨幣
https://reurl.cc/44np2D

派盾：2月DeFi漏洞利用被盜資金達3.39億美元
https://news.cnyes.com/news/id/4822364?exp=a

TreasureDAO駭客已開始歸還被盜NFT
https://news.cnyes.com/news/id/4823208

TreasureDAO遭攻擊、100多個NFT被盜！MAGIC暴跌30%；駭客歸還部分盜竊NFT
https://www.blocktempo.com/stolen-nfts-returned-to-users-hours-after-treasure-exploit/

又一間NFT 平台被駭客攻撃損失200萬港幣
https://www.pinterest.com/pin/139822763421921715/

烏克蘭官方推特帳號貼出加密貨幣籌款地址，兩天入帳上千萬美元
https://www.techbang.com/posts/94517-ukraines-official-twitter-account-posted-a-cryptocurrency

烏克蘭政府籲對俄羅斯加密貨幣用戶實施全面打擊
https://reurl.cc/RjmOoG

成人女星 Lana Rhoades 被控涉嫌 NFT 騙局
https://hypebeast.com/zh/2022/2/lana-rhoades-cryptosis-1-5-million-usd-nft-rug-pull

分析鏈上詐騙慣性！資安公司派盾(PeckShield)：應避免這些特徵的加密貨幣或NFT專案
https://news.cnyes.com/news/id/4821585

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
駭客已對烏克蘭的各大機構部署了破壞性的惡意程式
https://www.cisa.gov/uscert/ncas/alerts/aa22-057a

殭屍網路FritzFrog捲土重來鎖定醫療、教育、政府單位
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9738

勒索軟體駭客首度提出要求，要脅Nvidia解除顯示卡挖礦限制來換回機密資料
https://www.tomshardware.com/news/nvidia-hackers-threaten-to-release-lhr-performance-limiter

Dridex 殭屍網路和 Entropy 勒索軟體的程式碼極為相似
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9740

安卓木馬TeaBot鎖定逾400個金融機構用戶，竊取帳密和簡訊內容
https://www.cleafy.com/cleafy-labs/teabot-is-now-spreading-across-the-globe

TeaBot 木馬惡意軟體再次出現在 Google Play Store 中，目標鎖定美國用戶進行金融駭侵攻擊
https://www.twcert.org.tw/tw/cp-104-5800-c8e65-1.html

實聯制要小心！QR碼掃描器藏「木馬病毒」
https://reurl.cc/DdE3Gj

Conti 和 Karma 勒索軟體同時利用 ProxyShell 漏洞攻擊醫療機構
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9741

惡意軟體FoxBlade於俄烏戰爭爆發前夕，攻擊烏克蘭軍事單位與政府機構
https://blogs.microsoft.com/on-the-issues/2022/02/28/ukraine-russia-digital-war-cyberattacks/

CERT-UA alerts of phishing campaign
https://otx.alienvault.com/pulse/6222096d5505582bf113ccb7

SharkBot: A new generation Android banking Trojan being distributed on Google Play Store
https://reurl.cc/RjmXEn

Asylum Ambuscade: State Actor Uses Compromised Private Ukrainian Military Emails
to Target European Governments and Refugee Movement
https://reurl.cc/02RXlk

俄烏戰爭爆發前夕針對烏克蘭的網路攻擊恐不只一起！惡意軟體IsaacWiper鎖定政府機關破壞資料
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/

IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine
https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/
https://go.recordedfuture.com/hubfs/reports/mtp-2022-0302.pdf

New Sandworm Malware Cyclops Blink Replaces VPNFilter
https://www.ncsc.gov.uk/news/new-sandworm-malware-cyclops-blink-replaces-vpnfilter

New information stealing malware “ColdStealer” being distributed
https://asec.ahnlab.com/ko/31703/

Arkei Infostealer Expands Reach Using SmokeLoader to Target Crypto Wallets and MFA
https://reurl.cc/qO6N20

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
https://www.cisa.gov/uscert/ncas/alerts/aa22-055a

中國駭客將後門程式Daxin埋藏於作業系統核心，攻擊政府單位與關鍵基礎設施
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage

China-linked Daxin Malware Targeted Multiple Governments in Espionage Attacks
https://thehackernews.com/2022/03/china-linked-daxin-malware-targeted.html

Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage

The Hunt for the Lost Soul: Unraveling the Evolution of the SoulSearcher Malware
https://www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware

UNC1151/GhostWriter Phishing Attacks Target Ukrainian Soldiers
https://community.riskiq.com/article/e3a7ceea/description

OutSteel, SaintBot Delivered by Spear Phishing Attacks Targeting Ukraine
https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/

Destructive Malware Targeting Organizations in Ukraine
https://reurl.cc/jkoGeL

勒索軟體Conti內部機密外洩，起因是表態支持俄羅斯
https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/

力挺俄羅斯引發烏克蘭人士不滿，勒索軟體Conti原始碼遭到洩露
https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/

Conti Ransomware Gang's Internal Chats Leaked Online After Siding With Russia
https://thehackernews.com/2022/03/conti-ransomware-gangs-internal-chats.html

TrickBot Malware Gang Upgrades its AnchorDNS Backdoor to AnchorMail
https://thehackernews.com/2022/03/trickbot-malware-gang-upgrades-its.html

Rebirth of Emotet: New Features of the Botnet and How to Detect it
https://thehackernews.com/2022/02/reborn-of-emotet-new-features-of-botnet.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
100 Million Samsung Galaxy Phones Affected with Flawed Hardware Encryption Feature
https://thehackernews.com/2022/02/100-million-samsung-galaxy-phones.html

三星手機爆資安漏洞！Galaxy系列機種皆遭殃
https://newtalk.tw/news/view/2022-03-01/716924

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
雅虎徹底退出中國 228起關閉電子信箱服務
https://www.rti.org.tw/news/view/id/2125720

從俄羅斯到中國，那些由政府外包的駭客攻擊行動
https://vocus.cc/article/621c44fefd897800015f70ff

Taiwan Platform for Ukraine Donations Hacked 台烏募款平台上線第2天遭海外駭客攻擊
https://news.pts.org.tw/article/569881

駭客廣泛運用Log4Shell漏洞發動DDoS攻擊、挖礦攻擊
https://blog.barracuda.com/2022/03/02/threat-spotlight-attacks-on-log4shell-vulnerabilities/

駭客濫用API發動的攻擊行動，在2021年爆增近7倍
https://reurl.cc/pWAZrx

輪胎大廠普利司通遭到網路攻擊而停工數日
https://www.zdnet.com/article/bridgestone-still-struggling-with-plant-closures-after-cyberattack/

Toyota 日本國內所有工廠，因供應商遭駭而全面停工
https://www.twcert.org.tw/tw/cp-104-5780-7b78f-1.html

駭客組織ShinyHunters非法獲取了哪些企業的使用者資料
https://bearask.com/ent/2237716.html

鎖定各國政府機構竊密美資安公司揪出中國絕密惡意軟體
https://news.ltn.com.tw/news/world/breakingnews/3844902

部分日本廠區遭駭環球晶：受影響機台逐步恢復生產
https://reurl.cc/GoOE9x

日本子公司遭網路攻擊環球晶：機密資料無影響
https://newtalk.tw/news/view/2022-03-03/718170

Nvidia證實遭網攻，有駭客團體宣稱是他們所為，恐嚇該公司若不解除限制與開放原始碼就洩密
https://www.ithome.com.tw/news/149674

Nvidia也遭攻擊！駭客竊取1TB的GPU軟硬體資料、要求開放顯卡挖礦
https://reurl.cc/qO6Nyy

駭客已竊取英偉達員工憑證、開始兜售解除顯卡挖礦限制方式
https://www.owlting.com/news/articles/62730

勒索未果，駭客公佈英偉達核心原始碼
https://uetie.com/tech/691077.html

美國參議院通過一攬子網絡安全議案，將要求公司上報駭客攻擊事件
https://reurl.cc/EpeXz1

772萬粉駭客籲全球「鍵盤教訓俄羅斯」　正反兩極聲音四起
https://www.taisounds.com/Global/Trend/Latest/uid5357371493

烏克蘭招募IT軍隊，鎖定俄羅斯31個關鍵基礎設施發動網路攻擊
https://www.bleepingcomputer.com/news/security/ukraine-recruits-it-army-to-hack-russian-entities-lists-31-targets/

烏克蘭網軍宣布駭入多個俄羅斯關鍵網站，使其下線
https://www.twcert.org.tw/tw/cp-104-5798-fb7eb-1.html

烏克蘭網軍出擊鎖定破壞俄羅斯電力鐵路設施
https://wantrich.chinatimes.com/news/20220302900805-420201

駭客匿名者出招！俄國家電視頻道遭入侵　播放烏克蘭歌
https://today.line.me/tw/v2/article/LXOX5jM

全球最大駭客組織「匿名者」向莫斯科宣戰！駭入俄羅斯國防部資料庫、在官媒電視台播放挺烏克蘭歌曲
https://reurl.cc/veAmXk

從烏俄之戰看「在地化」情資的重要性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9739

2022 年烏克蘭網路攻擊：網路資安地緣政治
https://blog.trendmicro.com.tw/?p=71479

駭客挺烏癱瘓俄國充電站螢幕寫「普亭是傻瓜」
https://www.worldjournal.com/wj/story/121256/6136845

匿名者：俄曾洩密提醒澤倫斯基「慎防暗殺」
https://news.ltn.com.tw/news/world/breakingnews/3847353

情報單位洩密烏克蘭總統暗殺行動？　駭客「匿名者」爆料：俄國將掀內部鬥爭
https://www.upmedia.mg/news_info.php?Type=3&SerialNo=139005

匿名者：俄國洩露暗殺澤倫斯基計畫　內部權鬥將推翻普欽
https://news.tvbs.com.tw/amp/world/1730315

針對俄羅斯對烏克蘭出兵，匿名者、Conti等駭客組織選邊站
https://www.ithome.com.tw/news/149578

調查組織《Bellingcat》數位查證掌握戰況紀錄戰爭罪行
https://tfc-taiwan.org.tw/articles/7023

俄國早看透！匿名者發起網路攻擊，普丁準備「國家級內網」應戰
https://technews.tw/2022/03/04/russia-internet/

俄網遭駭客頻發攻擊　俄媒爆：政府準備啟動Runet內網切斷全球網路
https://www.ettoday.net/news/20220302/2199405.htm

最大駭客「匿名者」：癱瘓俄航太局關閉1500個俄網站
https://udn.com/news/story/122699/6134175

「匿名者」駭客癱瘓1500個俄網站！　俄航太局也無法聯繫自家衛星
https://www.ettoday.net/news/20220302/2199138.htm

「全球暴打俄羅斯」連駭客也來了！《匿名者》宣布癱瘓普丁的間諜衛星
https://tw.appledaily.com/international/20220302/DLBALUKPIBHRBPLNUWDPBHOJ5U/

烏克蘭版「唐鳳」︰他組駭客軍團、要搜普丁錢包
https://www.gvm.com.tw/article/87568

駭客出手了？北溪2號傳破產裁員　官網「慘被攻擊到關閉」
https://www.setn.com/News.aspx?NewsID=1079009

Taiwan Can Help？烏克蘭宣布招募「網路義勇軍」癱瘓俄羅斯網路
https://times.hinet.net/news/23780110

烏克蘭用 Telegram 招募志願者，成立「IT 軍隊」對抗俄羅斯網路攻擊
https://technews.tw/2022/03/02/ukraine-recruits-volunteers-through-telegram/

烏克蘭組建黑客大軍！俄羅斯錯過網攻黃金機遇期
https://buzzorange.com/techorange/2022/03/03/ukraine-it-army/

匿名者對俄宣戰號召全球駭客網攻
https://ec.ltn.com.tw/article/breakingnews/3845123

烏俄網路大戰　專家：中國駭客也在台灣埋了「數位定時炸彈」
https://www.cw.com.tw/article/5120248

駭客組織 Anonymous 傳向俄兵喊話：交出坦克送 5 萬美元比特幣
https://www.hksilicon.com/articles/2152084

駭客組織Anonymous以比特幣作獎勵引誘俄羅斯士兵捐贈坦克
https://news.cnyes.com/news/id/4823126

俄烏戰況膠著…戰場轉往網路戰？「12萬俄軍參戰名單」疑遭匿名者外洩
https://news.sina.com.tw/article/20220302/41305674.html

俄專家：微軟若撤離俄羅斯用戶會轉向Linux
https://ec.ltn.com.tw/article/breakingnews/3847621

俄烏戰爭爆發後，逾30所烏克蘭大學WordPress網站遭到入侵
https://reurl.cc/zMEr60

俄羅斯截斷烏克蘭網路馬斯克「星鏈」解救
https://www.worldjournal.com/wj/story/121256/6129329

俄烏戰爭引台海憂慮余茂春：台灣比烏克蘭安全
https://www.soundofhope.org/post/597757?lang=b5

中共趁亂南海軍演美艦駛過台海展示支持
https://www.soundofhope.org/post/597715?lang=b5

Hackers Who Broke Into NVIDIA's Network Leak DLSS Source Code Online
https://thehackernews.com/2022/03/hackers-who-broke-into-nvidias-network.html

Hackers Try to Target European Officials to Get Info on Ukrainian Refugees, Supplies
https://thehackernews.com/2022/03/hackers-try-to-hack-european-officials.html

Hackers Begin Weaponizing TCP Middlebox Reflection for Amplified DDoS Attacks
https://thehackernews.com/2022/03/hackers-begin-weaponizing-tcp-middlebox.html

Microsoft Finds FoxBlade Malware Hit Ukraine Hours Before Russian Invasion
https://thehackernews.com/2022/03/microsoft-finds-foxblade-malware-hit.html

(LINE Bank) Application Security Engineer_應用系統安全工程師
http://www.104.com.tw/jb/104i/job/view?j=6ty6x

醫療資訊室(資訊組)院聘資訊工程師(資安)
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=48309&HIRE_ID=11031135

精誠資訊擴大徵才！全年召募逾1000名員工
https://ec.ltn.com.tw/article/breakingnews/3848332

疫後首場實體徵才登場五大金控徵才亮點一次看
https://wantrich.chinatimes.com/news/20220302900770-420101

【資安所】資安測試工程師
https://www.104.com.tw/jb/104i/job/view?j=7jsuc

【ISMS/PIMS】資安風險管理顧問
https://www.104.com.tw/job/7jpm6

【金融業】資安風險管理顧問
https://www.104.com.tw/job/7jpm4

大學甄選入學委員會徵聘資安人員1名
https://www.ccu.edu.tw/new_content_demo.php?type=bulletin&id=37905

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
假QR code行釣魚之實! 四大常見QR code騙術
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9736

OL控職場霸凌！為蒐證用主管電腦寄email遭開除　法官：解僱違法
https://tw.appledaily.com/local/20220302/JCZPIEWW6FD7TMVRTKZ757DSTU/

幣安（Binance）警告:加密貨幣投資者小心簡訊釣魚詐騙
https://blog.trendmicro.com.tw/?p=71399

網釣攻擊鎖定幫助烏克蘭難民的國家而來
https://reurl.cc/3j93eX

白俄羅斯駭客鎖定烏克蘭武裝部隊，發動網路釣魚攻擊
https://www.bleepingcomputer.com/news/security/ukraine-links-belarusian-hackers-to-phishing-targeting-its-military/

Facebook 封禁散播俄軍在烏不實資訊的虛假賬戶
https://chinese.engadget.com/facebook-takes-down-fake-accounts-boosting-russian-disinformation-in-ukraine-110040977.html

大量機密數據遭公開加州律師協會：正全力調查
https://www.epochtimes.com/b5/22/2/28/n13610394.htm

Microsoft 365 中的Power Automate，有資料外洩的疑慮
https://blog.twnic.tw/2022/02/28/21885/

E.研究報告/工具
HENNGE 邀請資策會講師分享 2022 企業資安法規概覽及法遵建議
https://hennge.com/tw/blog/security-law-webinar.html

APT36 (Earth Karkaddan) 駭客集團的攻擊手法與惡意程式分析
https://blog.trendmicro.com.tw/?p=71210

If you haven‘t heard of descriptors, you don‘t know Python
https://medium.com/@florian.rieger/if-you-haven-t-heard-of-descriptors-you-don-t-know-python-1ea4fd1614c2

Python: 5 ways to make money without a job
https://medium.com/@saadbenaicha/python-5-ways-to-make-money-without-a-job-377d2a8639c0

Researchers Demonstrate New Side-Channel Attack on Homomorphic Encryption
https://thehackernews.com/2022/03/researchers-demonstrate-new-side.html

How to Automate Offboarding to Keep Your Company Safe
https://thehackernews.com/2022/03/how-to-automate-offboarding-to-keep.html

Report: Nearly 75% of Infusion Pumps Affected by Severe Vulnerabilities
https://thehackernews.com/2022/03/report-nearly-75-of-infusion-pumps.html

Experts Create Apple AirTag Clone That Can Bypass Anti-Tracking Measures
https://thehackernews.com/2022/02/experts-create-apple-airtag-clone-that.html

OPENSSLDIR Privilege Escalation CVE-2021-2307 - Paper
https://www.exploit-db.com/docs/50747

LightSpeed Cache Vulnerability - Paper
https://www.exploit-db.com/docs/50679

Abusing LAPS - Paper
https://www.exploit-db.com/docs/50680

F.商業
Fortinet 發布新世代防火牆 FortiGate 3000F 助全球企業建立混合式資安架構，加速數位創新
https://reurl.cc/KpRQGy

新惡意程式可突破防火牆　中租迪和提高端點防護顧資安
https://finance.ettoday.net/news/2199492?from=rss&redirect=1

進用退除役官兵比例22% 旭聯資安獲頒獎座表彰
https://www.mypeoplevol.com/Article/17783

雲端人資系統「Femas HR」通過國際級資安標準ISO27001驗證，創今年全台首例
https://stock.pchome.com.tw/news/cat9/20220301/64612922013934287001.html

因應 5G 網路高密度佈署模式， NXP 攜手仁寶打造整合小型基站解決方案
https://www.cool3c.com/article/173600

G.政府
停電是駭客網攻？政院：調查報告完成前不排除任何可能
https://www.epochtimes.com/b5/22/3/3/n13618688.htm

追停電原因政院：人員疏失就咎責
https://reurl.cc/02RXYK

大停電、台電官網停擺刑事局：目前未有駭客入侵跡象
https://udn.com/news/story/7238/6136922

NCC打造國家通訊領域安全軟體實驗室提升資安防護力
https://www.peopo.org/news/573866

俄烏開戰政院：國安基金隨時因應
https://wantrich.chinatimes.com/news/20220301900433-420501

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
CISA Warns of High-Severity Flaws in Schneider and GE Digital's SCADA Software
https://thehackernews.com/2022/02/cisa-warns-of-high-severity-flaws-in.html

IoV Security車聯網資安不亞於性能安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9735

5G智慧應用下，華電聯網推動自主研發資安平台
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9734

擘劃5G智慧應用與未來先進科技服務願景，協助企業實現數位轉型及實踐ESG責任
華電聯網推動 5G 智慧應用　加速數位化願景與創新步伐
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/A366255F5EDC43C89B74317DF3C8F9EC

鴻海研究院NExT Forum 宣示守護AI生態圈
https://wantrich.chinatimes.com/news/20220303900676-420101

全球已經把 AI 安全發展當成軍備競賽，台灣跟上了嗎
https://buzzorange.com/techorange/2022/03/02/ai-security-foxconn-next-forum/

7成5醫用輸液幫浦存在已知安全漏洞
https://unit42.paloaltonetworks.com/infusion-pump-vulnerabilities/

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
https://www.exploit-db.com/exploits/50797

I.教育訓練
中華軟協-iPAS「初級」資訊安全工程師能力研習衝刺班：全面招生中
https://www.cs.nycu.edu.tw/announcements/detail/8778

2022「證券期貨資訊安全實務養成課程」即日起開始報名
https://www.sfi.org.tw/news/news-7/3589

網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
WTM International Women's Day 2022 2022/3/5
https://www.meetup.com/GDGTaipei/events/284257930/

Just a chat - with no Expectations 2022/3/5
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/284285574/

Coffee & Code 2022/3/6
https://www.meetup.com/Innovate-Taiwan/events/284285192/

區塊鏈WEB3資安管理教戰手冊 2022/3/9
https://www.accupass.com/event/2202130729525903217230

Android Code Club(Taipei) 2022/3/9
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/284070785/

科技、媒體、組織聯手共同防制不實訊息論壇 2022/3/11
https://acfd2019.kktix.cc/events/831e3194-copy-2

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

Scala Taiwan #39 - 用Scala寫基因體醫學 2022/3/15
https://www.meetup.com/Scala-Taiwan-Meetup/events/284242666/

Flutter Festival Taipei 2022/3/16
https://www.meetup.com/Flutter-Taipei/events/283785315/

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/3/18
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3972&from_course_list_url=homepage

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/5/27
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3983&from_course_list_url=homepage

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/2/21 ~ 2022/2/25

noreply@blogger.com (Unknown) — Sat, 26 Feb 2022 16:18:00 +0000

資安事件新聞週報 2022/2/21 ~ 2022/2/25

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決多個產品的安全性弱點
https://tools.cisco.com/security/center/publicationListing.x

New Flaws Discovered in Cisco's Network Operating System for Switches
https://thehackernews.com/2022/02/new-flaws-discovered-in-ciscos-network.html

CISA Alerts on Actively Exploited Flaws in Zabbix Network Monitoring Platform
https://thehackernews.com/2022/02/cisa-alerts-on-actively-exploited-flaws.html

伺服器監控工具Zabbix驚傳嚴重漏洞，恐導致繞過身分驗證在伺服器上執行任意程式碼
https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage

Apache APISIX 中存在安全弱點，該弱點源於產品的batch-requests擴充未對用戶的批次處理請求進行有效限制
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24112

Apache Cassandra 存在程式碼注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44521

Foxit PDF Reader和Foxit PDF Editor 存在緩衝區錯誤弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24954
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24955

Google Golang 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-23772

9-Year-Old Unpatched Email Hacking Bug Uncovered in Horde Webmail Software
https://thehackernews.com/2022/02/9-year-old-unpatched-email-hacking-bug.html

開源網頁郵件管理系統Horde存在XSS漏洞，恐導致用戶帳號遭挾持
https://blog.sonarsource.com/horde-webmail-account-takeover-via-email

WordPress網站備份外掛UpdraftPlus出現任意下載漏洞，攻擊者恐用來竊取網站機密
https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/

Linux快很多! Google 資安團隊提軟硬體與作業系統業者修補資安漏洞平均速度
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9733

Google Chrome與Microsoft Edge瀏覽器存在多個高風險安全漏洞
https://www.klcg.gov.tw/tw/education/3522-251964.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
中國駭客組織 APT10 竊取我國金融單位內部資料，金融單位應清查供應鏈
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9729

中共在背後資助駭客組織盯上台灣金融單位2個月
https://reurl.cc/nEXK3e

從竹科七家半導體廠遭駭　到七家金融業者遭攻擊！中國駭客全新手法　為何一般資安軟體難抓出
https://www.businesstoday.com.tw/article/category/183015/post/202202210032

從金融到半導體都不放過台灣？中國表面挖人才暗地也要派駭客
https://buzzorange.com/techorange/2022/02/22/tw-china-digital-safe/

Chinese Hackers Target Taiwan's Financial Trading Sector with Supply Chain Attack
https://thehackernews.com/2022/02/chinese-hackers-target-taiwans.html

臺灣金融業遭軟體供應鏈攻擊，奧義智慧研判為中國駭客組織所為
https://reurl.cc/nEXaAD

陸駭客持續攻擊台金融單位奧義智慧籲企業速清查供應鏈
https://ctee.com.tw/industrynews/technology/598588.html

金融詐騙鎖定有弱點的 Exchange 伺服器進行Squirrelwaffle 攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9717

烏克蘭政府機關、兩大銀行再遭DDoS、資料破壞攻擊
https://www.bleepingcomputer.com/news/security/ukrainian-government-and-banks-once-again-hit-by-ddos-attacks/

俄羅斯同步發動網路攻擊烏克蘭政府部門與金融機構網站遭癱瘓
https://www.storm.mg/article/4210608

網釣簡訊攻擊鎖定英國數位銀行Monzo用戶而來
https://www.bleepingcomputer.com/news/security/new-phishing-campaign-targets-monzo-online-banking-customers/

拚ESG 金管會修法強化產壽險業資訊揭露
https://www.cna.com.tw/news/afe/202202250284.aspx

「金融機構間資料共享指引」上路　理專違規凸顯內控重要性資料共享跨機構效益加乘　善用金融科技輔助興利除弊
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/FFDCEC24F4DA463BA9308BA826E3C15B

台新金:台新金控代子公司台新證券公告設置資安長
https://stock.pchome.com.tw/news/cat1/20220222/9700002887202202221.html

櫃買中心3月推戰略新板宣導說明會
https://www.chinatimes.com/realtimenews/20220223002432-260410?chdtv

開戶只要1分鐘！Line Bank用戶數成長第一，推手是一群白帽駭客
https://www.cw.com.tw/article/5120151

上市櫃資安金管會四路防駭
https://ctee.com.tw/news/finance/598833.html

公股銀提高消金獲客率祭數位金融服務優惠
https://news.cnyes.com/news/id/4817151

兆豐銀人事異動行資訊安全長、公司治理主管換人當
https://www.chinatimes.com/realtimenews/20220218004526-260410?chdtv

新加坡與英國簽署數位經濟協定提升數位貿易
https://udn.com/news/story/6809/6125032

3.電子支付/行動支付/pay/資安
制裁生效！俄羅斯多家銀行無法使用電子支付
https://reurl.cc/akzObQ

全家電子支付執照到手
https://money.udn.com/money/story/122229/6122740

金管會修存保額度！　電支愛用者保障將增值
https://finance.ettoday.net/news/2196119

電支電票存保合併算　儲值金最高保額3百萬
https://www.cardu.com.tw/news/detail.php?45519

【塞掐 Side Chat】EP 57｜情人節分手！從 LINE Pay、一卡通看台灣電子支付
https://www.inside.com.tw/article/26836-side-chat-e57

從LINE Pay、一卡通合作與拆夥看台灣支付政策
https://www.inside.com.tw/feature/member-exclusive/26780-linepay-and-ipass

首家零售通路結合金融業！全盈支付執照金管會准了
https://www.setn.com/News.aspx?NewsID=1076228

誰能實現一個電支App一路用到底就能稱王生態圈成電子支付指標
https://reurl.cc/KpD7Ye

LINE Pay切割一卡通、全聯攜手全家，電支玩家「黃金交叉」近了
https://www.gvm.com.tw/article/87388

全家搶先進軍「嗶市場」！全盈支付獲營業執照　今年Q2開業
https://tw.appledaily.com/property/20220224/ATYSYWUDJFEG3D24INRBYZKXPU/

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
OpenSea 帳號被盜走價值 2 百萬美元的 NFT
https://blog.trendmicro.com.tw/?p=71422

Hackers Stole $1.7 Million Worth of NFTs from Users of OpenSea Marketplace
https://thehackernews.com/2022/02/hackers-steal-17-million-worth-of-nfts.html

Opensea 的 Polygon 網路出現穩定性問題
https://news.cnyes.com/news/id/4819246

OpenSea 正針對最近發生的釣魚攻擊進行調查
https://unwire.pro/2022/02/21/opensea-2/blockchain/

控告 OpenSea！駭客鑽漏洞、低買高賣無聊猿 NFT，原藏家現求償逾 100 萬美元
https://www.blocktempo.com/bored-ape-owner-files-1m-lawsuit-against-opensea/

事件始末｜駭客得手170萬美金，被OpenSea釣魚信嚇到？官方建議可用來Revoke保護
https://news.cnyes.com/news/id/4816974

俄羅斯逃避制裁的祕密武器：加密貨幣＋駭客
https://technews.tw/2022/02/24/russia-can-ease-sanction-from-west-by-digital-currency/

工程師疑涉盜取市值5000萬元比特幣一審獲判無罪
https://udn.com/news/story/7321/6122260

當年偷走The DAO專案逾360萬個以太幣的駭客找到了
https://times.hinet.net/topic/23773256

以太坊史上最大竊案露曙光：盜走 360 萬顆 ETH 駭客遭「鏈上肉搜」現蹤
https://blocktrend.substack.com/p/428?utm_source=url

當元宇宙與區塊鏈科技發展到極致，「永續城市」的應用可能超乎想像
https://www.thenewslens.com/article/162495

駭客二選一：Coinbase 漏洞交易賺 1 億或是良心舉報賺 700 萬
https://technews.tw/2022/02/23/coinbase-debug-whitehat-hacker/

Unchained主理人：TenX 創始人疑似為2016年盜取360萬枚以太坊的駭客
https://news.cnyes.com/news/id/4818165?exp=b

110 億美元真兇！記者新書揭露2016年以太坊DAO駭客可能身份
https://news.cnyes.com/news/id/4818193

Coinbase系統出現核彈級漏洞！不同加密貨幣可等值出售
https://times.hinet.net/news/23770167

Wormhole跨鏈橋被駭事件簿
https://reurl.cc/LpDyQ3

一封詐騙郵件騙走了416萬美元！NFT防騙指南
https://www.techbang.com/posts/94369-nft-cheating

元宇宙你個頭！區塊鏈你個頭！──為什麼我們該小心「科技的話術」
https://crossing.cw.com.tw/article/15872

NFT醜聞連環爆，用戶資產被盜、假貨氾濫！各大平台下一步怎麼走
https://www.bnext.com.tw/article/67793/nft-hacker-phishing-attack?

USDC穩定幣開發商Circle市值上看90億美元，延後上市時程
https://www.ithome.com.tw/news/149461

2022年最新假加密貨幣網站及交易平台列表
https://blog.trendmicro.com.tw/?p=71281

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
勒索軟體仍為攻擊大宗 2022慎防三大資安威脅
https://www.digitimes.com.tw/iot/article.asp?cat=158&id=0000629926_c7olko201ara3x7gpn577

UpdateAgent 木馬程式在 macOS 會下載惡意檔案至電腦上並竊取機敏資訊
https://technews.tw/2022/02/08/microsoft-365-defender-threat-intelligence-macos-updateagent/

數千起駭客滲入Microsoft Teams 群組，散布惡意木馬軟體
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9731

SockDetour後門程式攻擊美國國防業者
https://unit42.paloaltonetworks.com/sockdetour/

駭客以免費贈送加密貨幣的名義，意圖散布木馬程式
https://www.zscaler.com/blogs/security-research/freecryptoscam-new-cryptocurrency-scam-leads-installation-backdoors-and

勒索軟體Cuba鎖定Exchange Server而來
https://www.mandiant.com/resources/unc2596-cuba-ransomware

駭客鎖定Microsoft Exchange Server發動「古巴」勒索軟體攻擊
https://netmag.tw/2022/02/25/hackers-lock-microsoft-exchange-server-to-launch-cuban-ransomware-attack

惡意軟體Electron Bot偽裝成遊戲程式發布到微軟市集，意圖以被感染的電腦點擊特定網站，操弄社群網站的流量
https://research.checkpoint.com/2022/new-malware-capable-of-controlling-social-media-accounts-infects-5000-machines-and-is-actively-being-distributed-via-gaming-applications-on-microsofts-official-store/

對俄羅斯制裁後美英歐警告潛在的勒索軟件攻擊
https://iknow.stpi.narl.org.tw/Post/Read.aspx?PostID=18838

美、英發現來自俄羅斯的新殭屍網路惡意程式Cyclops Blink
https://www.ithome.com.tw/news/149551

殭屍網路Cyclops Blink鎖定WatchGuard防火牆設備，美國、英國提出警告
https://www.ncsc.gov.uk/news/new-sandworm-malware-cyclops-blink-replaces-vpnfilter

華芸NAS設備遭DeadBolt勒索軟體攻擊
https://www.ithome.com.tw/news/149499

為防範 ASUSTOR NAS 遭 DeadBolt 勒索病毒攻擊，建議相關用戶立即進行資安防護
https://www.tcrc.edu.tw/new/new-list/asustor-nas-deadbolt

華芸科技 NAS產品遭 DeadBolt 勒索病毒攻擊官方提供建議措施
https://www.kocpc.com.tw/archives/428403

華碩子公司華芸NAS遭駭客入侵加密檔案　被勒索支付比特幣才能解碼
https://tw.appledaily.com/property/20220223/N7JPYYXUK5C5LI3L4RZHTLM7NY/

Warning — Deadbolt Ransomware Targeting ASUSTOR NAS Devices
https://thehackernews.com/2022/02/warning-deadbolt-ransomware-targeting.html

資安廠商發現一個會竊取 Windows 用戶加密貨幣的 Golang 僵屍網路
https://www.twcert.org.tw/tw/cp-104-5752-b041f-1.html

以Go語言開發的殭屍網路病毒Kraken，被用於散布竊密軟體RedLine
https://www.zerofox.com/blog/meet-kraken-a-new-golang-botnet-in-development/

安卓木馬Xenomorph透過Google Play市集散布，鎖定56個歐洲銀行用戶
https://www.threatfabric.com/blogs/xenomorph-a-newly-hatched-banking-trojan.html

25個NPM惡意套件偽裝成知名套件，意圖挾持受害者的Discord帳號
https://jfrog.com/blog/malware-civil-war-malicious-npm-packages-targeting-malware-authors/

25 Malicious JavaScript Libraries Distributed via Official NPM Package Repository
https://thehackernews.com/2022/02/25-malicious-javascript-libraries.html

解放 NVIDIA 顯示卡掘礦限制？！咪信！破解軟件實為惡意溫床！
https://www.pcmarket.com.hk/nvidia-rtx-lhr-v2-unlocker-is-malware/

殭屍網路FritzFrog捲土重來鎖定醫療、教育、政府單位
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9738

HP警告惡意軟體會在Discord上偽裝成Windows 11安裝程式
https://www.cool3c.com/article/173156

勒索軟體Conti併吞殭屍網路TrickBot，並集中研發惡意軟體BazarBackdoor成攻擊主要工具
https://www.advintel.io/post/the-trickbot-saga-s-finale-has-aired-but-a-spinoff-is-already-in-the-works

大型鍋具業者Meyer員工資料外洩，疑遭勒索軟體Conti攻擊所致
https://www.bleepingcomputer.com/news/security/cookware-giant-meyer-discloses-cyberattack-that-impacted-employees/

Conti latest samples Feb 2022
https://otx.alienvault.com/pulse/621a1437ff5bcc8887e08128

Emotet Malware back in Action
https://blog.cyble.com/2022/02/26/emotet-malware-back-in-action/

APT-C-58 (Gorgon Group) attack warning
https://mp.weixin.qq.com/s/X0kAIHOSldiFDthb4IsmbQ

Details of recent DDoS attacks we've seen against Ukraine and Russia
https://blog-netlab-360-com.translate.goog/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=zh-CN

Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity
https://www.mandiant.com/resources/telegram-malware-iranian-espionage

SockDetour, a Silent, Fileless, Socketless Backdoor. Targets U.S. Defense Contractors
https://unit42.paloaltonetworks.com/sockdetour/

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
https://www.cisa.gov/uscert/ncas/alerts/aa22-055a

From Dridex to Macaw, The Evolution of Evil Corp
https://gist.github.com/antonio-s1/1fc53ed220012a91e66ea939d628da84

Bvp47 Top-tier Backdoor of US NSA Equation Group
https://otx.alienvault.com/pulse/62165a9098875d0f12e0d0a8

Bvp47 Top-tier Backdoor of US NSA Equation Group
https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf

Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool
https://thehackernews.com/2022/02/chinese-experts-uncover-details-of.html

美國國家安全局製作Linux後門程式，暗中行動長達10年
https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoor_of_us_nsa_equation_group/

New Sandworm malware Cyclops Blink replaces VPNFilter
https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf

HermeticWiper, New Destructive Malware Used In Cyber Attacks on Ukraine
https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
https://www.circl.lu/doc/misp/feed-osint/b9b6dcfa-0b11-40dc-9bf4-9a36a2c1a046.json

EvilPlayout: Attack Against Iran’s State Broadcaster
https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/

Cobalt Strike Being Distributed to Vulnerable MS-SQL Servers
https://asec.ahnlab.com/en/31811/

Meet Kraken: A New Golang Botnet in Development
https://www.zerofox.com/blog/meet-kraken-a-new-golang-botnet-in-development/

Operation Cache Panda organized supply chain attack against Taiwan's financial industry
https://medium.com/cycraft/supply-chain-attack-targeting-taiwan-financial-sector-bae2f0962934

Qbot and Zerologon Lead To Full Domain Compromise
https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/

Vulnerability Attack Threats on the Cloud
https://blog.netlab.360.com/public-cloud-threat-intelligence-202201/

TeamTNT Cryptomining Explosion 🧨 - Intezer
https://www.intezer.com/blog/malware-analysis/teamtnt-cryptomining-explosion/

Technical Analysis of the DDoS Attacks against Ukrainian Websites
https://www.cadosecurity.com/technical-analysis-of-the-ddos-attacks-against-ukrainian-websites/

Arkei Infostealer Expands Reach Using SmokeLoader to Target Crypto Wallets and MFA
https://blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer?utm_medium=social&utm_source=bambu

駭客利用Cobalt Strike攻擊微軟SQL Server，植入後門程式並進行挖礦
https://asec.ahnlab.com/en/31811/

伊朗駭客MuddyWatter鎖定全球關鍵基礎設施下手，美國、英國公布駭客使用的惡意程式
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/24/iranian-government-sponsored-muddywater-actors-conducting

Iran's MuddyWater Hacker Group Using New Malware in Worldwide Cyber Attacks
https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html

Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure
https://thehackernews.com/2022/02/notorious-trickbot-malware-gang-shuts.html

TrickBot Gang Likely Shifting Operations to Switch to New Malware
https://thehackernews.com/2022/02/trickbot-gang-likely-shifting.html

U.S., U.K. Agencies Warn of New Russian Botnet Built from Hacked Firewall Devices
https://thehackernews.com/2022/02/us-uk-agencies-warn-of-new-russian.html

駭客透過惡意軟體Dridex發動勒索軟體攻擊
https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/

Dridex Malware Deploying Entropy Ransomware on Hacked Computers
https://thehackernews.com/2022/02/dridex-malware-deploying-entropy.html

Hackers Backdoor Unpatched Microsoft SQL Database Servers with Cobalt Strike
https://thehackernews.com/2022/02/hackers-backdoor-unpatched-microsoft.html

New Android Banking Trojan Spreading via Google Play Store Targets Europeans
https://thehackernews.com/2022/02/xenomorph-android-banking.html

Iranian State Broadcaster IRIB Hit by Destructive Wiper Malware
https://thehackernews.com/2022/02/iranian-state-broadcaster-irib-hits-by_21.html

Master Key for Hive Ransomware Retrieved Using a Flaw in its Encryption Algorithm
https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Hackers Exploiting Infected Android Devices to Register Disposable Accounts
https://thehackernews.com/2022/02/hackers-exploit-bug-in-sms-verification.html

三星手機存在加密缺陷，1億手機恐曝險
https://eyalro.net/publication/srw22.html

過億三星智慧手機出廠即有安全漏洞，但用戶似乎不須太擔心
https://technews.tw/2022/02/25/samsung-smartphones-security-flaw/

遠傳併亞太電信回歸中華、遠傳、台哥大真三大電信局面
https://zeekmagazine.com/archives/166437

蘋果iPhone 14 進入試產階段，最終外觀設計與規格搶先看
https://mrmad.com.tw/iphone-14-enters-trial-production-stage

DSCC：iPhone折疊手機最快2025問世，內部正研究折疊MacBook
https://mrmad.com.tw/iphone-foldable-phone-will-come-out-as-soon-as-2025

老公手機發現疑似出軌跡象！神人4步驟調出LINE完整通話紀錄，對話框被刪除照現形
https://www.storm.mg/lifestyle/4204914

準備與 Touch ID 告別？爆料：未來 iPhone 全面只用 Face ID
https://3c.ltn.com.tw/news/47781

特朗普社交 App「Truth Social」三月推出　測試員爆料：與 Twitter 相似
https://unwire.hk/2022/02/21/app-twitter/fun-tech/

10款NCC 手機資安檢測報告出爐，僅iPhone 通過安全檢驗
https://mrmad.com.tw/ncc-mobile-phone-information-security-test-report

iPhone 的 Wi-Fi 顯示安全層級薄弱怎麼加強？用這 3 個方法就能解決
https://applealmond.com/posts/132785

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
新版ISO 27002:2022出爐，資安控制措施正式修訂為4大類93項
https://www.ithome.com.tw/news/149520

2萬資安人才缺口從這找！一個暑期營隊，如何變國內資安人才搖籃
https://reurl.cc/EpDxVk

關鍵資訊基礎設施包山包海從法律到國家標準皆牽涉中國嚴管資訊建設與個資　西進者避禍須熟知法規
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/C5024143EAE64EB89B72CF79CF8E133F

【中國 IT 系統爭議新功能】預測員工何時要離職，好讓老闆可以提前 Fire 員工
https://buzzorange.com/techorange/2022/02/23/chinese-tech-system-spying-online-activities/

澳洲研究發現中國行動支付有資安、監管、法律與政治等風險
https://taronews.tw/2022/02/25/814519/

跨國物流業者Expeditors遭網路攻擊，被迫中斷大部分業務
https://www.bleepingcomputer.com/news/security/expeditors-shuts-down-global-operations-after-likely-ransomware-attack/

紐西蘭IT公司遭駭客攻擊，超過4GB數據被盜
https://visiontimes.co.nz/news/17615/

冬奧選手未被中國監控？專家：目前斷言還太早
https://udn.com/news/amp/story/122669/6115335

憂心帶回受駭風險專家建議換掉密碼
https://udn.com/news/story/7005/6114124

憂從北京冬奧帶回遭駭風險　專家建議換掉設備密碼
https://tw.appledaily.com/international/20220221/TCTMMEH3ONG4HG3F6G7FNIJHTY/

假員工真駭客華府捷運局推特遭網攻
https://www.worldjournal.com/wj/story/121277/6114863

約旦去年共發生897次網路攻擊，政府將加強網路安全措施
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=108f1612-fd30-4e68-8904-8c999d06f4f5

駭客以資料分析圖像化工具Power BI為幌子發動網釣攻擊，意圖竊取微軟帳號
https://cofensestaging.wpengine.com/blog/phishers-spoof-power-bi-to-visualize-your-credential-data?web_view=true

【威脅持續進化，密碼與壓縮檔反成攻擊者濫用手法】為何PPAP不能幫助提升資安
https://www.ithome.com.tw/news/149443

伊朗國營電視臺遭網路攻擊，駭客散播抗議政府訊息並進行破壞
https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/

美國傳出考慮對俄羅斯關鍵基礎設施進行網路攻擊，遭白宮否認
https://www.zdnet.com/article/white-house-denies-report-about-cyberattacks-against-russian-infrastructure/

NBC爆料「美國將對俄軍發動網攻」國安會否認
https://www.worldjournal.com/wj/story/121173/6126217

中共趁俄烏危機攻台？邱太三：要注意駭客網攻
https://www.epochtimes.com/b5/22/2/25/n13605049.htm

資訊戰開打烏克蘭號召駭客抵禦俄羅斯
https://reurl.cc/oeXj0M

美、英指控俄羅斯對烏克蘭發動DDoS攻擊
https://times.hinet.net/topic/23768103

俄羅斯頭大！國際刑事法院擬查“戰爭罪” 知名駭客組織也宣戰
https://m.soundofhope.org/post/597283?lang=b5

向俄羅斯網路攻擊宣戰：烏克蘭呼籲國內駭客「協助抵禦攻擊」、全球最大駭客團體對俄進行網路戰
https://www.thenewslens.com/article/163306

烏俄戰爭時間點敏感 Nvidia遭遇網路攻擊
https://news.cnyes.com/news/id/4821001

輝達內網疑遭駭客攻擊，表示正調查攻擊來源
https://technews.tw/2022/02/26/nvidia-confirmed-an-ransomware-attack-on-its-internal-network/

俄烏網軍互鬥，俄羅斯政府網站無法存取，烏克蘭網路嚴重中斷
https://www.techbang.com/posts/94468-russian-ukrainian-net-war

全球最大駭客組織「匿名者」向俄羅斯宣戰：發動網路戰爭
https://reurl.cc/NpDW06

號召國內駭客！烏克蘭用網路情蒐抵禦俄國「資訊戰」
https://www.inside.com.tw/article/26834-ukraine-russia-war-hacker

國際駭客組織 Anonymous 成功攻破並洩露了俄羅斯國防部網站的數據庫裡面竟然有中國QQ的帳號
https://twitter.com/square76567502/status/1497286881259945984

烏克蘭政府網站遭「俄網軍大隊」攻擊！　緊急求助南韓
https://www.ettoday.net/news/20220226/2197089.htm

克里姆林宮豢養的最危險駭客「沙蟲」，烏克蘭首當其衝
https://news.readmoo.com/2022/02/23/sandworm/

俄烏火線衝突網戰打先鋒攻擊軟體供應鏈
https://ctee.com.tw/news/tech/600613.html

針對烏克蘭政府近日遭駭，研究人員揭露攻擊工具細節
https://www.bleepingcomputer.com/news/security/new-data-wiping-malware-used-in-destructive-attacks-on-ukraine/

對俄制裁升級! 歐美祭科技出口管制
https://ctee.com.tw/news/global/601199.html

台灣要是淪陷　民眾黨：解放軍「核彈頭潛艦」將威脅美本土
https://www.setn.com/News.aspx?NewsID=1077029

俄烏開戰陸委會：對岸可能進行認知作戰
https://newtalk.tw/news/view/2022-02-25/715100

美情報部門網路攻擊證據被發現華春瑩：強烈敦促美方解釋
https://reurl.cc/mGXgKW

日本政府呼籲產業界落實資安防範俄羅斯報復
https://news.cnyes.com/news/id/4818566

防止中國取得國防技術日本政府收購承包商設備藍圖
https://times.hinet.net/news/23769061

中共官媒造謠布林肯反對台獨　AIT斥：對台支持堅若磐石
https://www.setn.com/News.aspx?NewsID=1075848

俄國對烏克蘭灰色地帶行動學者：中共肯定仔細觀察
https://news.ltn.com.tw/news/politics/breakingnews/3838549

多家美國國防部包商遭駭侵攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9732

朝鮮駭客組織Lazarus Group攻擊手法更加複雜
https://news.cnyes.com/news/id/4817562?exp=a

抗俄駭客澳洲擴大援烏強化網安
https://reurl.cc/dX8NAg

英國防大臣：俄國若發動網路戰，英國將隨時報復反擊
https://reurl.cc/DdDzpd

美軍「王牌飛行員」開發AR新技術應對中共威脅
https://reurl.cc/g0lVo7

美國司法部擬修改川普時代「中國計劃」
https://cn.nytimes.com/usa/20220222/justice-department-china-initiative/zh-hant/

Justice Department Appoints First Director of National Cryptocurrency Enforcement Team
https://thehackernews.com/2022/02/justice-department-appoints-first.html

Putin Warns Russian Critical Infrastructure to Brace for Potential Cyber Attacks
https://thehackernews.com/2022/02/putin-warns-russian-critical.html

亞太電信攜手蝦皮推跨界虛實融合前進校徵招募生力軍
https://www.1111.com.tw/news/jobns/144301

IEC 62443輔導顧問
https://www.104.com.tw/job/7jo2x

【資安所】嵌入式Linux軟韌體工程師
https://www.104.com.tw/job/7jo2d

鐵飯碗敲門磚高雄國稅局徵才薪水上看40K
https://news.cnyes.com/news/id/4820640

科技業搶才，台灣微軟持續推動 20 萬人才培育計畫
https://technews.tw/2022/02/25/microsoft-talent/

【運維】資安網管工程師
https://www.104.com.tw/job/7jo28

【實習計畫】資安處(暑期實習生)
https://www.104.com.tw/job/7joqd?jobsource=jolist_c_relevance

史上最大轉職潮！對手加薪搶人，104人資長親授如何不被「搶」
https://www.gvm.com.tw/article/86244

「半導體人才荒」缺口創7年新高！科技業、金融業爆搶人大戰
https://www.moneyweekly.com.tw/ArticleData/Info/Article/77723

全球半導體產業人才短缺！科技大廠提供高薪搶人
https://times.hinet.net/news/23767570

前端網頁工程師
https://www.104.com.tw/job/7jlrh

資訊安全（資深）工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=5&EMPLOYER_ID=44531&HIRE_ID=11010057

資安獵捕監控工程師
https://www.104.com.tw/job/7jlrp

Bank / 資訊前端工程師 Frontend Engineer
https://reurl.cc/Vje9o6

資安人才供不應求　企業痛悟造就大熱門職缺
https://www.ectimes.org.tw/?p=72294

全球搶台灣科技人才！疫情後更嚴重　微軟：培育不夠業界用
https://finance.ettoday.net/news/2195799

徵才40餘人集保總經理朱漢強：未來的重點是數位和數據
https://www.storm.mg/article/4209578?page=1

資安工程師
https://www.104.com.tw/job/7jdph

推廣組徵自僱人員(資安)1名
https://www.ntsec.gov.tw/User/Article.aspx?a=4043

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
俄羅斯駭客APT29鎖定土耳其大使館相關人員，發動釣魚郵件攻擊
https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage

網路釣魚攻擊駭客利用遠端桌面連線軟體，並搭配瀏覽器Kiosk模式，來繞過雙因素驗證挾持受害者帳號
https://mrd0x.com/bypass-2fa-using-novnc/

研究人員揭露鎖定區塊鏈的網釣攻擊手法Ice Phishing
https://www.microsoft.com/security/blog/2022/02/16/ice-phishing-on-the-blockchain/

「王品洩個資」被詐300多萬她爆這款APP有洞
https://reurl.cc/jkpAWM

王品App個資外洩有會員最高被詐80萬
http://www.ksnews.com.tw/index.php/news/contents_page/0001576092

誆露營行程下單系統遭駭　詐團假冒商家3分鐘騙10萬
https://www.mirrormedia.mg/story/20220226soc001/

媒體應謹慎使用外電小心俄國假訊息網站和帳號
https://tfc-taiwan.org.tw/articles/6985

假QR code行釣魚之實! 四大常見QR code騙術
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9736

簡訊及LINE誘騙入群　投資詐騙2個月達60件
https://www.cardu.com.tw/news/detail.php?45486

全聯福利中心送福利？填問卷拿10000元禮品卡？釣魚網站！切勿點擊轉發訊息
https://www.mygopen.com/2022/02/fake-pxmart.html

誰說BEC只透過電子郵件散播？美國警告濫用線上會議平臺進行的攻擊增加
https://www.ic3.gov/Media/Y2022/PSA220216

駭客利用虛擬會議發動BEC商業郵件詐騙攻擊
https://www.ithome.com.tw/news/149464

E.研究報告/工具
CISO 必懂基礎架構即代碼 IaC，現代雲構建不可或缺
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9730

How to Get Maximum from Next.js <Image/> Component
https://enlear.academy/the-right-ways-to-make-use-of-image-from-nextjs-398c48378690

Python Data Structures
https://selinyazicioglu99.medium.com/python-data-structures-c0f8102ff0fa

Machine Learning Resume that got me shortlisted for Meta, Microsoft, NVIDIA, Uber, Samsung, Intel, and Others
https://aqeel-anwar.medium.com/machine-learning-resume-that-got-me-shortlisted-for-meta-microsoft-nvidia-uber-samsung-intel-220761c1a850

The best database pagination technique is
https://itnext.io/the-best-database-pagination-technique-is-530abf2aab51

17 Stunning & Modern UNIX Tools
https://thelicato.medium.com/17-stunning-modern-unix-tools-e32d4f0efb64

macOS Tools and Apps for Development in 2022
https://medium.com/@etc088/macos-tools-and-apps-for-development-in-2022-963bd4d0f876

Building an NLP Chatbot for a restaurant with Flask
https://medium.com/@barua.aindriya/building-a-nlp-chatbot-for-a-restaurant-with-flask-b978337049f2

Best Chatbot Frameworks You Must Know About
https://medium.com/@letthedataconfess/best-chatbot-frameworks-you-must-know-about-6926d9e4d80f

I am in love with my VS Code Setup
https://blog.scriptmint.com/i-am-in-love-with-my-vs-code-setup-997e6a29f69e

From Pet Systems to Cattle Farm — What Happened to the Data Center
https://thehackernews.com/2022/02/from-pet-systems-to-cattle-farm-what.html

Network-反向代理
https://reurl.cc/OpDOn9

盤點AWS/Azure十大雷區　設置失手須自擔責任不可不慎雲端後門洞開外洩資料　組態設定錯誤成最大元兇
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/E616474B610B4CCAAB5E0BC3E7745D3C

研究人員開發破解工具馬賽克遮蓋文字瞬間還原
https://unwire.hk/2022/02/21/dont-use-mosaic-to-cover-sensitive-text/tech-secure/

F.商業
星宇航空導入Aruba 整合式網路安全方案，具體實現零信任
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9722

企業高層、IT與資安人員的參與合作能有效降低資安風險
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9718

Palo Alto Networks推出深度學習PAN-OS 10.2 Nebula
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9721

Cloudflare以1.62億美元買下雲端郵件安全業者Area 1 Security
https://cloudflare.net/news/news-details/2022/Cloudflare-to-Acquire-Area-1-Security-to-Expand-Its-Zero-Trust-Platform/default.aspx

騰訊收購波蘭遊戲開發商暨發行商1C Entertainment
https://mashdigi.com/tencent-acquired-1c-entertainment/

台灣微軟資料中心採用綠能緯穎技術可望引進
https://ec.ltn.com.tw/article/breakingnews/3840575

IBM資安報告指出針對製造業的攻擊已經超過金融服務業，且多數為勒索攻擊
https://times.hinet.net/topic/23775180

微軟推出適用Google雲的網絡安全產品版本
https://reurl.cc/WkWnmO

零壹去年獲利創高；現金殖利率達8%
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=4da2dbfe-cdcd-4f92-a897-a55790f483c2

精誠資訊2021年EPS 4.9元　營收連6年創新高、稅後淨利年減27.15％
https://finance.ettoday.net/news/2195488?redirect=1

臺灣首家公眾科技新創　應援科技打造一站式支持者關係經營平台
https://www.taiwannews.com.tw/ch/news/4453617

Check Point Software推出高速防火牆
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000629735_HL58S6N02IFZ2E6VHBROG

迎接混合工作模式新世代 AvePoint助企業做好風險控管
https://www.inside.com.tw/article/26804-avepoint_pi_2022

OM宣布結業 BlackBerry手機回歸無望
https://reurl.cc/l9XmQd

Adobe 調查：近半亞太企業未準備 Cookie 受限的數碼營銷
https://reurl.cc/LpDy5K

天睿與微軟建立夥伴關係將複雜資料分析環境簡化並現代化
https://reurl.cc/12z6XW

逸盈科技正式成為SentinelOne公司臺灣授權代理商
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=50&id=0000629126_asd0bkz33h8sem53nk27c

G.政府
率網軍辱外交官害輕生楊蕙如改判5月定讞
https://www.worldjournal.com/wj/story/121218/6124292

NCC指導辦理研討會探究5G O-RAN架構下軟體資安
https://reurl.cc/l9X1z9

110年度資安案件缺失/觀察開立統計
https://iscb.nchu.edu.tw/2022/01/110top10.html?showComment=1645871901185

民團質疑公投電子系統未上線中選會：須確認資安
https://www.cna.com.tw/news/aipl/202202240295.aspx

台灣港務公司官網突故障下午2點搶修完畢
https://news.ltn.com.tw/news/life/breakingnews/3839872

東吳大學跨域整合產學共創洞悉未來趨勢
https://www.gvm.com.tw/article/87086

發展部7月掛牌運作　府院傳內定唐鳳出任首任部長
https://www.ctwant.com/article/169580

黃偉哲積極推動產業數位轉型力促南市廠商智慧生產
https://www.tainan.gov.tw/News_Content.aspx?n=13370&s=7874526

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
broadcom NEXCOM NIO50 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-23992

Microweber 中存在操作系統命令注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-0557

Nokia BTS TRS web console 存在授權問題弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-31932

Qualcomm 多款產品存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-30323
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35069
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-30317
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-30322
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35074
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35077
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35075

schneider-electric 存在 CWE-434 CWE-120：無限制上傳具有危險類型的文件弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-22803
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-22802

tongda2000 通過DEVICE_LIST參數發現Tongda2000 v11.10在/mobile_seal/get_seal.php中存在SQL Injection弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-24206
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-23902

韋萊韜悅攜手SEMI 及全球科技龍頭共同成立資安聯盟
https://reurl.cc/e6arGK

5G軟體安全研討會　NCC：政府帶頭提升資安
https://www.ftvnews.com.tw/news/detail/2022224F11M1

資安為能源轉型的重要環節
https://ctee.com.tw/industrynews/technology/600068.html

華電聯網推動 5G 智慧應用加速數位化願景與創新
https://reurl.cc/RjD5WD

華電聯網以「超乎想像」推動5G智慧應用
https://ctee.com.tw/industrynews/technology/599423.html

依產線機台型態打造網路端點防禦製造業資安告急　工廠網路佈防
https://www.netadmin.com.tw/netadmin/zh-tw/market/E26D820A89714C51BEF3371EACBE34F6

(Daily Issue)邊緣AI巨「猩」全球淘金　寇世斌組智慧城市異業同盟
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?CnlID=1&id=0000628537_BCU4D00X497XNU6GHIXEC

ISA/IEC 62443：2018 工控系統資安認證工程師訓練課程(四日班)
https://www.isoleader.com.tw/iso-training-courses/detail/222876

Moxa MXview網路管理軟體存在多個安全漏洞(CVE-2021-38452、38454、38456、38458及38460)
https://www.klcg.gov.tw/tw/education/3522-251962.html

Moxa MXview網路管理軟體存在多個安全漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9727

英飛凌推出量子加密技術TPM晶片保護伺服器和聯網設備安全
https://reurl.cc/WkW6gx

I.教育訓練
網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：元宇宙時代：資安時代發行虛擬貨幣與NFT 2022/3/4
https://docs.google.com/forms/d/1xTUMHW1yF6nIH7YsQVTpZXXMrn0wD9lovoqbmXHfBT4/viewform?edit_requested=true

科技、媒體、組織聯手共同防制不實訊息論壇 2022/3/11
https://acfd2019.kktix.cc/events/831e3194-copy-2

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

Flutter Festival Taipei 2022/3/16
https://www.meetup.com/Flutter-Taipei/events/283785315/

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/3/18
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3972&from_course_list_url=homepage

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/2/14 ~ 2022/2/18

noreply@blogger.com (Unknown) — Fri, 18 Feb 2022 01:20:00 +0000

資安事件新聞週報 2022/2/14 ~ 2022/2/18

1.重大弱點漏洞/後門/Exploit/Zero Day
Log4j2 In The Wild | Iranian-Aligned Threat Actor TunnelVision Actively Exploiting VMware Horizon
https://reurl.cc/mGpaEW

又是鎖定Log4Shell漏洞，對VMware遠距工作平臺的攻擊行動，這次動手的是伊朗駭客TunnelVision
https://reurl.cc/mGpaEW

針對可被攻擊者用於規避掃描的弱點，微軟疑似悄悄修補了Windows防毒軟體
https://reurl.cc/g0r9LR

微軟修補了讓駭客繞過Defender掃瞄的漏洞
https://www.ithome.com.tw/news/149373

Microsoft 推出 2022 年 2 月 Patch Tuesday 資安修補包
https://blog.twnic.tw/2022/02/15/21865/

微軟Windows作業系統存在多個安全漏洞
https://ic.cgu.edu.tw/p/16-1016-86908.php?Lang=zh-tw

非關聯式資料庫Apache Cassandra出現RCE漏洞
https://reurl.cc/zMQ0x0

High-Severity RCE Security Bug Reported in Apache Cassandra Database Software
https://thehackernews.com/2022/02/high-severity-rce-security-bug-reported.html

電商平臺Magento再傳重大漏洞，且已出現攻擊行動
https://reurl.cc/9OWM2j

Critical Magento 0-Day Vulnerability Under Active Exploitation — Patch Released
https://thehackernews.com/2022/02/critical-magento-0-day-vulnerability.html

Google Chrome 緊急修復一個已遭濫用於攻擊的 0-day 漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9726

Google緊急修補已遭開採的Chrome弱點
https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html

VMware 發布多個產品的安全更新
https://reurl.cc/pWp77x

VMware虛擬化平臺存在漏洞，可被惡意軟體用於逃脫VM並攻擊主機
https://www.vmware.com/security/advisories/VMSA-2022-0004.html

VMware Issues Security Patches for High-Severity Flaws Affecting Multiple Products
https://thehackernews.com/2022/02/vmware-issues-security-patches-for-high.html

NOD32 Antivirus 存在權限許可和連接控制問題弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-37852

Radareorg Radare2 中存在資源管理錯誤弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-0139

SAP多個產品存在環境問題弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22536
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22532

美國要求聯邦機構於2週內修補Safari重大漏洞
https://reurl.cc/oevOxq

Apple 已修復 Safari 的網站歷史資料洩露 IndexedDB 隱私漏洞
https://blog.twnic.tw/2022/02/14/21845/

Security Bulletin: Polkit as used by IBM® QRadar SIEM is vulnerable to privilege escalation (CVE-2021-4034)
https://www.ibm.com/support/pages/node/6557426?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security Bulletin: OpenSSL as used by IBM QRadar SIEM is vulnerable to information disclosure (CVE-2021-3712)
https://www.ibm.com/support/pages/node/6557430?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

New Linux Privilege Escalation Flaw Uncovered in Snap Package Manager
https://thehackernews.com/2022/02/new-linux-privilege-escalation-flaw.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
台新金:台新金控代子公司台新銀行公告設置資安長
https://news.cnyes.com/news/id/4815816

開發金:中華開發金控代子公司凱基證券公告資安長就任
https://news.cnyes.com/news/id/4816590

第一金證新設資安長到任強化交易安全
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=b1bd812e-bedd-4929-a64a-e79e5093c1d1

〈玉山金法說〉科技聯隊六巨頭亮相領軍1300位人才拚數位轉型
https://news.cnyes.com/news/id/4814493

玉山銀組「科技聯隊」！科技長張智星：加密貨幣投機成分高、NFT像藝術品交易
https://www.bnext.com.tw/article/67688/e.sun-bank-2022

中華電轉投資將來銀行 3月開張
https://times.hinet.net/news/23757648

櫃買中心提醒各證券商強化資安作為
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9724

證券商資安長設置情形
https://dsp.twse.com.tw/page/security.html

集保結算所以大數據為根本，推動視訊輔助股東會平台多項數位創新
https://fnc.ebc.net.tw/fncnews/headline/146772

Spanish Police Arrest SIM Swappers Who Stole Money from Victims Bank Accounts
https://thehackernews.com/2022/02/spanish-police-arrest-sim-swappers-who.html

俄烏恐開戰！立陶宛通知國內銀行　準備好因應網攻和斷電
https://www.setn.com/News.aspx?NewsID=1072550

3.電子支付/行動支付/pay/資安
台灣第三方支付「紅綠藍」三足鼎立，綠界科技物流＋金流策略成功，預計3/15掛牌上櫃、承銷價760元
https://www.thenewslens.com/article/162915

LINE Pay 獨立 App 2/15 釋出新版，未納入一卡通 MONEY 服務
https://technews.tw/2022/02/10/to-update-new-line-app-since-february-15/

與一卡通合約明年到期！LINE Pay 好友轉帳有可能取消
https://agirls.aotter.net/post/60440

一卡通Money將打造獨立APP！LINE Pay大改版後，雙方如何受影響
https://www.bnext.com.tw/article/67692/new-line-pay-app

LINE好友轉帳明年2月恐終止一卡通年底前上架獨立APP
https://udn.com/news/story/7086/6100106

誰能實現一個電支App一路用到底就能稱王生態圈成電子支付指標
https://reurl.cc/2Da5ja

全家向金管會申請電子支付執照全聯最慢3月底前要提出
https://udn.com/news/story/7239/6089419

悠遊付會員竄升第三　全盈支付已申請執照
https://www.cardu.com.tw/news/detail.php?45402

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
火幣交易所安全嗎？PTT 網友評價彙整與分析
https://applealmond.com/posts/133098

駭客洗劫難追回買加密貨幣前要先懂資安風險
https://vip.udn.com/vip/story/121938/6103782

68%的美國人意識到加密貨幣所涉及的風險
https://news.cnyes.com/news/id/4816242

加密資產不是避風港，NFT 首次被查封
https://finance.technews.tw/2022/02/18/hmrc-nft/

美國司法部任命國家加密貨幣執法團隊負責人
https://reurl.cc/6EGWqM

AscendEX安全事件涉事駭客已經開始洗錢
https://amp-news.cnyes.com/news/id/4816448

數據：有4068個 "犯罪巨鯨「持有價值250億美元的加密貨幣
https://news.cnyes.com/news/id/4815483

Filecoin與Polygon達成合作擬共同發展NFT與元宇宙項目
https://news.cnyes.com/news/id/4815147?exp=a

249款假虛擬貨幣錢包應用程式模仿MetaMask、imToken、Bitpie和Trust Wallet，共盜取超過430萬美元
https://blog.trendmicro.com.tw/?p=71214

央行數位貨幣場景試驗預計9月完成國內銀行備戰接招
https://www.rti.org.tw/news/view/id/2124620

比特幣為何迷人，投資者不畏高風險也要買？教父級科技大神分析「加密貨幣」運作原理
https://www.businessweekly.com.tw/management/blog/3009091

大頭相放NFT更吸引首次約會用比特幣付款有第二次約會機會大增
https://reurl.cc/Wkbp3y

NFT項目AOTAVERSE回應攻擊：賠償用戶損失，開售順延兩天
https://news.cnyes.com/news/id/4814638

IRA Financial的加密退休帳戶上周被駭客攻擊，損失高達3600萬美元
https://news.cnyes.com/news/id/4814444?exp=a

搶搭元宇宙商機，供應鏈資安跟上了嗎？資料加密大解析
https://marketing.ares.com.tw/newsletter/2022-02-financial-reporting/metaverse-file-encryption

數字人民幣冬奧大成功！VISA獨占36年被打破
https://reurl.cc/jk6by2

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
「它們回來了！」FBI警告資安危機連政府機關都被攻擊
https://www.chinatimes.com/realtimenews/20220217005255-260412?chdtv

美國FBI發布勒索軟體BlackByte入侵指標，已有3種領域的關鍵基礎設施實體受害
https://www.ic3.gov/Media/News/2022/220211.pdf

新興「勒索軟體組織」重出江湖！FBI建議用6招防範電腦遭駭
https://3c.ltn.com.tw/news/47719

日本警告惡意軟體Emotet於2月初攻擊行動升溫
https://www.jpcert.or.jp/at/2022/at220006.html

惡意軟體Emotet透過以密碼保護的ZIP檔案散布
https://unit42.paloaltonetworks.com/new-emotet-infection-method/

惡意軟體TrickBot攻擊60家知名企業的顧客
https://reurl.cc/Np23Ve

TrickBot Malware Targeted Customers of 60 High-Profile Companies Since 2020
https://thehackernews.com/2022/02/trickbot-malware-targeted-customers-of.html

駭客溜進Microsoft Teams會議以大量散布木馬程式
https://www.ithome.com.tw/news/149442

駭客透過Teams討論群組散布惡意程式，恐能對數百萬人下手
https://www.avanan.com/blog/hackers-attach-malicious-.exe-files-to-teams-conversations

駭客利用惡意軟體Squirrelwaffle與Exchange重大漏洞，進行金融詐欺攻擊
https://news.sophos.com/en-us/2022/02/15/vulnerable-exchange-server-hit-by-squirrelwaffle-and-financial-fraud/

駭客以NFT為誘餌，散布木馬程式BitRAT
https://www.fortinet.com/blog/threat-research/nft-lure-used-to-distribute-bitrat

惡意軟體MyloBot捲土重來，採用極為迂迴的方法規避偵測
https://blog.minerva-labs.com/mylobot-2022-so-many-evasive-techniques-just-to-send-extortion-emails

勒索軟體Black Cat攻擊機場地勤服務業者Swissport，聲稱竊得1.6 TB資料
https://www.bleepingcomputer.com/news/security/blackcat-alphv-claims-swissport-ransomware-attack-leaks-data/

駭客組織TA2541鎖定交通與國防產業下手，散布木馬程式
https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight

運動用品業者美津濃傳出將延遲出貨，原因疑似是遭到勒索軟體攻擊
https://www.bleepingcomputer.com/news/security/sports-brand-mizuno-hit-with-ransomware-attack-delaying-orders/

歐洲大型汽車經銷商成為Hive勒索軟體的受害者
https://www.zdnet.com/article/europes-biggest-car-dealer-hit-with-ransomware-attack/

勒索軟體Vice Society攻擊派遣人力業者Parasol Group，竊得資料疑似於暗網公開
https://www.theregister.com/2022/02/11/optionis_stolen_data/

勒索軟體不法所得 74%流向俄羅斯
https://udn.com/news/story/6812/6099947

利用Office文件針對Windows Rgsvr32公用程式攻擊大量增加
https://www.ithome.com.tw/news/149351

駭客利用Regsvr32元件於受害電腦載入Qbot、Lokibot等惡意軟體
https://www.uptycs.com/blog/attackers-increasingly-adopting-regsvr32-utility-execution-via-office-documents

美式足球隊遭BlackByte勒索軟體攻擊
https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/

Cyber attack of UAC-0056 group on state organizations of Ukraine using malicious
programs SaintBot and OutSteel (CERT-UA # 3799)
https://cert.gov.ua/article/18419

New Emotet Infection Method
https://unit42.paloaltonetworks.com/new-emotet-infection-method/

Guard Your Drive from DriveGuard: Moses Staff Campaigns Against Israeli Organizations Span Several Months
https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard

木馬程式ShadowPad疑似與中國人民解放軍有關
https://www.secureworks.com/research/shadowpad-malware-analysis

Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA
https://thehackernews.com/2022/02/researchers-link-shadowpad-malware.html

ShadowPad Malware Analysis | Secureworks
https://www.secureworks.com/research/shadowpad-malware-analysis

Charting TA2541's Flight
https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight

+380-GlowSpark
https://inquest.net/blog/2022/02/10/380-glowspark

NFT Lure Used to Distribute BitRAT
https://www.fortinet.com/blog/threat-research/nft-lure-used-to-distribute-bitrat

Attackers Disguise RedLine Stealer as a Windows 11 Upgrade
https://threatresearch.ext.hp.com/redline-stealer-disguised-as-a-windows-11-upgrade/

Researchers Warn of a New Golang-based Botnet Under Continuous Development
https://thehackernews.com/2022/02/researchers-warn-of-new-golang-based.html

EU Data Protection Watchdog Calls for Ban on Pegasus-like Commercial Spyware
https://thehackernews.com/2022/02/eu-data-protection-watchdog-calls-for.html

New MyloBot Malware Variant Sends Sextortion Emails Demanding $2,732 in Bitcoin
https://thehackernews.com/2022/02/new-mylobot-malware-variant-sends.html

FritzFrog P2P Botnet Attacking Healthcare, Education and Government Sectors
https://thehackernews.com/2022/02/fritzfrog-p2p-botnet-attacking.html

PseudoManuscrypt Malware Spreading the Same Way as CryptBot Targets Koreans
https://thehackernews.com/2022/02/pseudomanuscrypt-malware-spreading-same.html

Iranian Hackers Targeting VMware Horizon Log4j Flaws to Deploy Ransomware
https://thehackernews.com/2022/02/iranian-hackers-targeting-vmware.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
獲蘋果、Meta青睞！Email提醒工具FollowUpThen好用在哪？2步驟讓行程不漏接
https://www.bnext.com.tw/article/67703/followupthen

FBI警告！掃QR Code也會出事駭客1手法秒控制銀行帳戶
https://reurl.cc/Op6d93

Google 要為 Android 用戶打造隱私沙盒！廣告商該何去何從
https://buzzorange.com/techorange/2022/02/18/google-andriod-privacy-sandbox/

Google Bringing Privacy Sandbox to Android to Limit Sharing of User Data
https://thehackernews.com/2022/02/google-bringing-privacy-sandbox-to.html

Apple Releases iOS, iPadOS, macOS Updates to Patch Actively Exploited Zero-Day Flaw
https://thehackernews.com/2022/02/apple-releases-ios-ipados-macos-updates.html

iPhone WiFi隱私權警告要怎麼解決？教你10招技巧快速修正
https://mrmad.com.tw/how-fix-iphone-wifi-privacy-warning

手機資安僅iPhone過關不合格8成是大陸品牌
https://reurl.cc/Rj2AAZ

蘋果釋出iOS 15.3.1更新！修復點字顯示器異常錯誤
https://www.sogi.com.tw/articles/apple_ios_15/6257432

蘋果WebKit漏洞也波及iPhone及iPad上的Chrome與Firefox等瀏覽器
https://www.ithome.com.tw/news/149361

macOS版Zoom驚傳臭蟲，會議結束後仍占用麥克風，恐影響用戶隱私
https://www.theverge.com/2022/2/12/22930588/zoom-update-psa-macos-monterey-mic-indicator-light-bug

比利時示警：勿用華為和小米手機資訊恐送中
https://ec.ltn.com.tw/article/breakingnews/3829768

比利時官員警告：使用中國手機恐將用戶數據送至中國
https://technews.tw/2022/02/15/huawei-xiaomi-china/

用LINE罵主管被已讀她按到致命刪除鍵神人教這招挽回
https://www.chinatimes.com/realtimenews/20220214004908-260405?chdtv

印度再封殺中國App！資安屢爆爭議北京「冬奧通」也遭疑恐有安全漏洞
https://www.youtube.com/watch?v=LPwCIFgO0RM

安全疑慮大！日本代表團長：返國後徹底刪除北京冬奧App
https://www.setn.com/News.aspx?NewsID=1071036

手機借駭客冒名向foodpanda詐訂尿布男子下場慘了
https://www.chinatimes.com/realtimenews/20220214001107-260402?chdtv

保障國民隱私資安　印度再禁逾54款中國app上架
https://reurl.cc/2Da5Ya

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
過半企業砸大錢買資安設備，專家示警：高層資安管理參與不足才是危機
https://www.bnext.com.tw/article/67693/trendmicro-report

別只是花錢消災，企業內部資安整合成降低被駭風險關鍵
https://finance.technews.tw/2022/02/15/it-enterprise/

服務及資安設備需求殷切電腦程式設計業營業額遞新猷
https://www.chinatimes.com/realtimenews/20220218001619-260410?chdtv

紅十字會遭駭調查結果出爐，疑似是國家級駭客鎖定Zoho密碼自助管理平臺漏洞下手
https://www.icrc.org/en/document/icrc-cyber-attack-analysis

傻眼！碩士班考試前一天地點反覆改　台北大學：疑有駭客入侵
https://tw.appledaily.com/life/20220213/2IDK4JQ7CFC7VACGBFLY6HCW44/

烏克蘭遭遇當地歷來最大型 DDoS 攻擊
https://unwire.pro/2022/02/17/ddos-2/security/

烏克蘭國防部與2家國營銀行，驚傳遭到DDoS攻擊
https://reurl.cc/g0r99R

才剛喊完撤軍！烏克蘭遭俄駭客網攻
https://reurl.cc/pWp74Z

烏克蘭政府網站疑遭俄羅斯網攻莫斯科否認
https://udn.com/news/story/122663/6102966

法國稱｢俄軍數量仍一樣｣愛沙尼亞情報機構：俄恐發動有限軍事攻擊
https://times.hinet.net/news/23761481

美國指控俄羅斯攻擊國防產業，竊取軍事機密
https://www.cisa.gov/uscert/ncas/alerts/aa22-047a

監測川普網路資料？柯林頓斥：塑造假醜聞
https://www.worldjournal.com/wj/story/121172/6104801

新「水門事件」曝光！希拉里僱駭客入侵川普大廈和白宮伺服器，恐面臨刑事指控
https://vitomag.com/society/tzzrw.html

隱形的間諜活動外媒披露陸駭客如何竊取F-35關鍵科技
https://www.chinatimes.com/realtimenews/20220216002107-260417?chdtv

找駭客「偷蔡英文病歷」！前國會助理淪共諜遭判刑定讞
https://today.line.me/tw/v2/article/Gg01VEY

學者：中共網路輿論戰多借力使力利用台灣多元言論進行分化
https://www.rti.org.tw/news/view/id/2124677

受到來自中共國的網路攻擊
https://gnews.org/zh-hant/2000601/

駭客組織疑似串通印度政府，攻擊人權鬥士和律師的電腦，企圖找出定罪的依據
https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/

英國外交部年初曾因嚴重網路攻擊要求支援
https://technews.tw/2022/02/14/uk-foreign-office-hit-by-cyber-attack/

美國指俄羅斯涉嫌資助駭客，攻擊美國國防承包商竊取武器技術
https://reurl.cc/veEyGa

Getting Your SOC 2 Compliance as a SaaS Company
https://thehackernews.com/2022/02/getting-your-soc-2-compliance-as-saas.html

Moses Staff Hackers Targeting Israeli Organizations for Cyber Espionage
https://thehackernews.com/2022/02/moses-staff-hackers-targeting-israeli.html

Experts Warn of Hacking Group Targeting Aviation and Defense Sectors
https://thehackernews.com/2022/02/experts-warn-of-hacking-group-targeting.html

Hackers Planted Fake Digital Evidence on Devices of Indian Activists and Lawyers
https://thehackernews.com/2022/02/hackers-planted-fake-digital-evidence.html

【資訊安全處/資安部資安技術課】課長/副理
https://www.104.com.tw/job/7j767

資安顧問
https://hunter.104.com.tw/zh-tw/job/DE02004819

【中山區】高級資安工程師
https://www.104.com.tw/job/7j2g6

集保結算所史上最大規模徵才培力青年推升永續
https://www.taiwannews.com.tw/ch/news/4443997

集保結算所擴大徵才開出資安金融數位等職缺
http://www.ksnews.com.tw/index.php/news/contents_page/0001572384

資安工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=11&EMPLOYER_ID=150030&HIRE_ID=10893063

中華電信再創高峰　1月份營收174.2億　永續新佈局招募人才
https://www.1111.com.tw/news/jobns/144100

MIS資訊主管/資深網管工程師
https://www.104.com.tw/job/7iw0w?jobsource=hotjob_chr

資安專案主管(K0600)
https://www.104.com.tw/job/5f795?jobsource=hotjob_chr

資安檢測工程師
https://www.104.com.tw/job/70fzv?jobsource=jolist_a_relevance

資安鑑識工程師
https://www.104.com.tw/job/6isjn?jobsource=jolist_a_relevance

資安專案經理/Project Manager
https://www.104.com.tw/job/2w0gs?jobsource=jolist_a_relevance

資安技術顧問(Presales)
https://www.104.com.tw/job/6kyxs?jobsource=jolist_a_relevance

政府機關駐點資安工程師(長期約聘/正職)
https://www.104.com.tw/job/2w4t5?jobsource=jolist_a_relevance

資安檢測工程師
https://www.104.com.tw/job/64myq?jobsource=jolist_a_relevance

(SOC)一線資安監控工程師(長期約聘，表現優良轉正職)
https://www.104.com.tw/job/3iqxk?jobsource=jolist_a_relevance

資安鑑識分析師
https://www.104.com.tw/job/5xtj0?jobsource=jolist_a_relevance

行動App威脅獵捕分析師
https://www.cakeresume.com/companies/cyfoundry/jobs/mobile-app-threat-hunting-analyst

財金資訊股份有限公司 111 年資訊、稽核暨文書人員
https://reurl.cc/6EGAgr

財金資訊股份有限公司 111 年資安人員
https://reurl.cc/44l2R3

資安工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=19929&HIRE_ID=10983503

產品支援工程師(Support Engineer/熟資安產品佳)
https://www.cakeresume.com/companies/teamt5-org-tw/jobs/489be8?locale=id

富邦證券-資安治理專業人員
https://www.104.com.tw/job/7iqc0

專案與資安業務專員
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=5&EMPLOYER_ID=93184&HIRE_ID=10996045

A02資安專案主管
https://www.104.com.tw/job/7jbt2

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Observed phishing indicators
https://otx.alienvault.com/pulse/620e20141e013849fc00b614

美國芝加哥地區醫院遭到網路攻擊，11.6萬病人資料外洩
https://www.scmagazine.com/analysis/breach/south-shore-hospital-network-hack-impacts-data-of-116k-patients

香港海逸飯店驚傳資料外洩，逾120萬住客受到影響
https://www.scmp.com/news/hong-kong/law-and-crime/article/3166739/cyberattack-harbour-plaza-hotels-hong-kong-exposes

5成民眾「自我感覺良好」有3類人被認為最常放消息
https://www.rti.org.tw/news/view/id/2124911

投資詐騙層出不窮金管會：1至2月中旬檢舉案達60件
https://ec.ltn.com.tw/article/breakingnews/3833433

Facebook Agrees to Pay $90 Million to Settle Decade-Old Privacy Violation Case
https://thehackernews.com/2022/02/facebook-agrees-to-pay-90-million-to.html

Puma 因 Kronos人資管理系統遭勒贖攻擊，近半員工機敏資料外洩
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9707

France Rules That Using Google Analytics Violates GDPR Data Protection Law
https://thehackernews.com/2022/02/france-rules-that-using-google.html

臺灣隱形眼鏡製造商晶碩製程機密遭前員工竊取，險外流中國
https://tw.appledaily.com/local/20220207/3TAFE6E2CRFQDNI7PGXKLKDINQ/

晶碩爆發內鬼帶槍投靠，機密技術險流入紅色供應鏈！一文解讀台廠強勢製造力
https://www.bnext.com.tw/article/67721/pegavision-production-cne

克羅埃西亞電信業者傳出資料外洩，20萬用戶恐受波及
https://www.bleepingcomputer.com/news/security/croatian-phone-carrier-data-breach-impacts-200-000-clients/

Meta又被告！德州控FB臉部辨識系統侵犯隱私
https://reurl.cc/9OWgrY

北市府抽獎網站疑出現後臺使用者管理介面，參加者個資恐外洩
https://www.ftvnews.com.tw/news/detail/2022211S07M1

新州防疫二維碼數據泄露 50萬個機構被公開
https://www.epochtimes.com/b5/22/2/14/n13576930.htm

Microsoft Warns of 'Ice Phishing' Threat on Web3 and Decentralized Networks
https://thehackernews.com/2022/02/microsoft-warns-of-ice-phishing-threat.html

中國擁百萬個資平台今起赴海外上市前須審查
https://www.worldjournal.com/wj/story/121474/6098941

駭客搭訕套路大公開，趨勢科技教你避開情人節詐騙地雷
https://reurl.cc/k7pGaG

柯文哲兒子網購書籍遭騙15萬　逮7嫌最小僅12歲！1人竟輕生亡
https://www.appledaily.com.tw/local/20220215/5QF3YUB5S5CEXLUJF3VOV3POO4/

小心 Instagram、Reddit、Grindr、Cash App 及 PayPal 上的「乾爹」詐騙
https://blog.trendmicro.com.tw/?p=71057

火辣姐姐誘網愛！他遭側錄恐嚇10萬竟回「你外流吧」　騙徒瞬間呆愣
https://tw.appledaily.com/local/20220219/CX4EVKIVMJDZ3JOQFN3FBJ4KAE/

E.研究報告/工具
萬用字元 SSL/TLS 憑證為什麼不安全
https://blog.darkthread.net/blog/wildcard-tls-cert-risk/

This New Tool Can Retrieve Pixelated Text from Redacted Documents
https://thehackernews.com/2022/02/this-new-tool-can-retrieve-pixelated.html

COVID Does Not Spread to Computers
https://thehackernews.com/2022/02/covid-does-not-spread-to-computers.html

美國兩黨議員合推NUDGE法案擬要求演算法透明化
https://tfc-taiwan.org.tw/articles/6938

商用SSL資安憑證廠牌該如何挑選，以動物園主機賣的幾個來舉例。不是免費SSL憑證喔。
https://reurl.cc/3jkG80

你的網路不是你的網路，你該改用 VPN 上網的三個理由
https://technews.tw/2022/02/17/3-reasons-for-using-surfshark-vpn/

4 Cloud Data Security Best Practices All Businesses Should Follow Today
https://thehackernews.com/2022/02/4-cloud-data-security-best-practices.html

Python Basics for Hackers, Part 1: Getting Started with Python
https://www.hackers-arise.com/post/2018/01/08/python-scripting-for-hackers-part-1-getting-started

STATIC TAINT ANALYSIS USING BINARY NINJA: A CASE STUDY OF MYSQL CLUSTER VULNERABILITIES
https://www.zerodayinitiative.com/blog/2022/2/14/static-taint-analysis-using-binary-ninja-a-case-study-of-mysql-cluster-vulnerabilities

Hadoop 3.2.2 Installation Guide for Windows 10
https://medium.com/@pedro.a.hdez.a/hadoop-3-2-2-installation-guide-for-windows-10-454f5b5c22d3

紅隊體系化學習路徑（附學習思維導圖）
https://mp.weixin.qq.com/s?__biz=MzAwMjA5OTY5Ng==&mid=2247502745&idx=1&sn=0c0f52442fc09485045c04d3c91e848f

F.商業
紅帽擴展Kubernetes平台新增含軟體定義儲存的資料服務
https://reurl.cc/Np23le

BlackBerry預料今年中小企每天被hack次數逾11次元宇宙讓舊招數重新普及
https://reurl.cc/k7pm83

Check Point Software: 2022 年應注意軟體供應鏈攻擊狂潮
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9705

SafeDNS: Cloud-based Internet Security and Web Filtering Solution for MSPs
https://thehackernews.com/2022/02/safedns-cloud-based-internet-security.html

2022年VMware預測5大趨勢：雲、安全、應用、企業區塊鏈
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9713

思科擬開價200億美元買下大數據分析業者Splunk
https://www.wsj.com/articles/cisco-made-20-billion-plus-takeover-offer-for-splunk-11644622277

勤業眾信資安科技暨鑑識分析中心再進化
https://money.udn.com/money/story/11799/6101320?from=edn_newestlist_cate_side

勤業眾信資安科技暨鑑識分析中心再進化提供ETSI EN 303 645認證服務助企業邁向國際
https://times.hinet.net/news/23756587

資安時代來臨勤業眾信搶商機
https://www.chinatimes.com/realtimenews/20220214004659-260410?chdtv

資安廠商 ESET 發表 2021 資安威脅報告
https://www.twcert.org.tw/tw/cp-104-5722-143d3-1.html

中華電信聯手 Palo Alto Networks，加速企業導入雲安全服務
https://technews.tw/2022/02/16/hicloud-palo-alto-networks/

三大事業群齊發衝營運今年尚不推低軌道衛星服務
https://news.cnyes.com/news/id/4813826

Palo Alto Networks推出深度學習PAN-OS 10.2 Nebula
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9721

全景軟體助企業資安防護
https://reurl.cc/Rj2aOr

兼具隱私與數據價值去識別技術共創民眾與企業雙贏
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=60&id=0000629376_L6V2X3IL8U7S6156K5N10

EndBlock推出全新的MDR服務平台
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=140&id=0000628455_HEM3ULMF67DSHL4VN65MD

台灣大哥大聘蔡祈岩擔任副總經理暨資訊長！曾任星展科技長、還是熱門遊戲開發者
https://www.bnext.com.tw/article/67673/taiwan-mobile-new-cio

G.政府
政院修法防核心關鍵技術外流　違者最高判12年徒刑
https://news.tvbs.com.tw/politics/1718129

高雄無人機表演連中南海都敲碗期待
https://www.storm.mg/article/4198031

「警界孔子」高哲翰認同蘇揆結合各部會齊心合力改善新型態科技犯罪
https://www.peopo.org/news/572711

調查局人事異動 11名新任副處長名單出爐
https://www.cna.com.tw/news/asoc/202202180263.aspx

政府強化資安阻禦中國網攻資安破口疑在台灣內部
https://living.taronews.tw/2022/02/14/812147/

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
D-Link 設備 DI-7200GV2.E1 v21.04.09E1 被發現在函數 proxy_client.asp 中包含命令注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46227
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46229
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46233
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46232
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46231
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46226
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46230
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46228

D-Link 設備 D-Link DIR-823-Pro v1.0.2 被發現在函數 SetStationSettings 中包含命令注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46455
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46452
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46457
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46456
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46453
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-46454

D-Link DIR-878 存在操作系統命令注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44880
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44882
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45998
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44881

Totolink 產品 A720R v4.1.5cu.470_B20200911 被發現在函數 setNoticeCfg 中存在堆記憶體溢出弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44246
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44247

Schneider Electric Easergy P3 存在緩衝區錯誤弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22725

Schneider Electric Easergy P5 V01.401.101 (含)之前韌體版本存在緩衝區錯誤弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22723

Schneider Electric Easergy 2020 (含)之前版本存在身分驗證弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22727

Synology 產品 DiskStation Manager (DSM) 7.0.1-42218-2 (含)之前版本存在 SQL 注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-43925
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-43926

針對部分已終止支援的NAS設備，威聯通將提供重大安全更新至10月
https://reurl.cc/bkdM1y

Jaguar Land Rover 與 NVIDIA 聯手　開發 AI 自動駕駛 + 2025年推出新車
https://unwire.hk/2022/02/17/jaguar-land-rover/fun-tech/

Critical Security Flaws Reported in Moxa MXview Network Management Software
https://thehackernews.com/2022/02/critical-security-flaws-reported-in.html

IT與OT加速匯流工業聯網資安威脅與日俱增
https://reurl.cc/9OWMaV

進入工廠資安領域，工控資安基本通識
http://ai-robot-stsp.tw/news/news_detail/641

眾至資訊OTS系列強化工業資安防護打造智造聯網安全
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000629114_uzs2ni3h0qyw2i5dlctca

臺廠工業級網管軟體存在重大漏洞，恐被攻擊者用於執行任意程式碼
https://www.claroty.com/2022/02/10/blog-research-securing-network-management-systems-moxa-mxview/

Google全託管機器學習平臺Vertex AI新功能，供用戶在本地端執行程式碼除錯
https://www.ithome.com.tw/news/149330

I.教育訓練
網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Android Code Club(Taipei) 2022/2/23
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/283676461/

台科大資訊安全研究社勒索軟體分析與逆向工程實務 2022/2/23
https://docs.google.com/forms/d/e/1FAIpQLSfEwnIQJ_ofXBUBZcUTGrBP5CZJQT27IUXWuCRrskvXtp1KpA/viewform

SyntaxError 2022/2/23
https://www.meetup.com/pythonhug/events/283676488/

HackingThursday 黑客星期四 - Week meetup Taipei 固定聚會台北 2022/2/24
https://www.meetup.com/hackingthursday/events/283709899/

SDN x Cloud Native Meetup #45 2022/2/25
https://www.meetup.com/CloudNative-Taiwan/events/284093238/

讀書會第三梯次申請（二月底截止）與 Solidity 子社團成立說明 2022/2/25
https://www.meetup.com/Taipei-Blockchain/events/283959317/

資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：資訊戰 & 資安攻防探究、操作與平臺」2022/2/25
https://docs.google.com/forms/d/1xcjbWS5S8zubz1NeGWAgCuq1VZ7RK7Whg356jIBuagM/viewform?edit_requested=true

資安新知科技研習課程-「資安鑑識課程-系列Ⅰ初級課程：元宇宙時代：資安時代發行虛擬貨幣與NFT 2022/3/4
https://docs.google.com/forms/d/1xTUMHW1yF6nIH7YsQVTpZXXMrn0wD9lovoqbmXHfBT4/viewform?edit_requested=true

科技、媒體、組織聯手共同防制不實訊息論壇 2022/3/11
https://acfd2019.kktix.cc/events/831e3194-copy-2

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

Flutter Festival Taipei 2022/3/16
https://www.meetup.com/Flutter-Taipei/events/283785315/

國家高速網路與計算中心教育訓練「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/3/18
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3972&from_course_list_url=homepage

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/2/7 ~ 2022/2/11

noreply@blogger.com (Unknown) — Fri, 11 Feb 2022 14:38:00 +0000

資安事件新聞週報 2022/2/7 ~ 2022/2/11

1.重大弱點漏洞/後門/Exploit/Zero Day
Samba 漏洞 CVE-2021-44142 分析與修補
https://blog.trendmicro.com.tw/?p=71235

企業應立即修補Samba 開放原始碼軟體漏洞
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9698

Samba 產品存在多個安全性弱點
https://www.samba.org/samba/security/CVE-2022-0336.html

Samba Out-of-Bounds Heap R/W 遠端執行代碼弱點（RCE）
https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin

Citrix發布針對Hypervisor的安全更新
https://support.citrix.com/article/CTX337526

Fortinet FortiWeb 6.4.1及以下版本、6.3.15及以下版本中的作業系統命令（'os command injection'）
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-41018

Cisco 發布 RV 系列路由器的安全性更新
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Cisco 路由器被發現嚴重漏洞　對企業造成威脅
https://unwire.pro/2022/02/09/cisco-13/security/

思科修補中小企業路由器產品的多項重大漏洞
https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-bugs-in-smb-routers-exploits-available/

Cisco Small Business RV160、RV260、RV340及RV345系列路由器存在安全漏洞(CVE-2022-20699~20712及CVE-2022-20749)
https://www.klcg.gov.tw/tw/education/3522-251496.html

Argo CD修補涉及所有版本的機密資訊外洩漏洞
https://www.ithome.com.tw/news/149227

CISA Orders Federal Agencies to Patch Actively Exploited Windows Vulnerability
https://thehackernews.com/2022/02/cisa-orders-federal-agencies-to-patch.html

Linux PolicyKit 嚴重安全漏洞：Pwnkit被揭露
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9696

apache Groovy 程式碼注入和 SpEL 注入導致遠端程式碼執行。此問題影響 Apache ShenYu 2.4.0 和 2.4.1
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45029

ASUS VivoMini/Mini PC 設備存在不正確的輸入驗證弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21933

Dell EMC AppSync 版本 3.9 至 4.3 包含可從 UI 和 CLI 中利用的過度身份驗證嘗試弱點的不當限制
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22553

Dell EMC Unity、Dell EMC UnityVSA 和 Dell EMC Unity XT 5.1.2.0.5.007 之前的版本包含操作系統 (OS) 命令注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-43589

IBM 產品 Cognos Controller 版本 (10.4.0~10.4.2) 存在遠端驗證弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-4879
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-4877

TP-Link 產品 Archer C90 1.0.6 Build 20200114 rel.73164(5553) 路由器安裝存在 RCE 弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35003
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35004

Microsoft and Other Major Software Firms Release February 2022 Patch Updates
https://thehackernews.com/2022/02/microsoft-and-other-major-software.html

微軟2月Patch Tuesday修補51個漏洞
https://www.zerodayinitiative.com/blog/2022/2/8/the-february-2022-security-update-review

郵件伺服器Zimbra驚傳零時差XSS漏洞，且已出現攻擊行動
https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

SAP產品的核心元件驚傳重大漏洞，美國呼籲用戶儘速修補
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/08/critical-vulnerabilities-affecting-sap-applications-employing

WordPress的PHP外掛程式驚傳RCE漏洞
https://www.wordfence.com/blog/2022/02/critical-vulnerabilities-in-php-everywhere-allow-remote-code-execution/

Critical RCE Flaws in 'PHP Everywhere' Plugin Affect Thousands of WordPress Sites
https://thehackernews.com/2022/02/critical-rce-flaws-in-php-everywhere.html

Adobe 多個產品存在安全性弱點
https://www.cisa.gov/uscert/ncas/current-activity/2022/02/08/adobe-releases-security-updates-multiple-products

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
春節防駭不打烊證交所籲資安防範
https://reurl.cc/3j4dD9

推動上市（櫃）公司及證券商資通安全管理強化措施
https://news.m.pchome.com.tw/public/fsc/20220206/index-64407680006508110016.html

金管會強化管理上市櫃公司及券商資安
https://www.chinatimes.com/realtimenews/20220207000686-260410?chdtv

證交所：春節假期國際股市表現穩定　證期周邊單位審慎以對
https://finance.ettoday.net/news/2183712

「沒資安就沒業務」證交所五招盯券商資安控管
https://news.cnyes.com/news/id/4810875

強化券商資安證交所祭出五措施
https://udn.com/news/story/7239/6086121

股市交易熱駭客趁機入券商對客戶雙認證擬Q2完成
https://www.rti.org.tw/news/view/id/2124278

2021年台灣金融業資訊安全投資觀測
https://mic.iii.org.tw/AISP/ReportS?docid=CDOC20211011002

以色列與美洲開發銀行合作成立200萬美元資安防護基金
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=5f2e94e5-b604-42b5-bf4e-6c10cd7eae52

ECB傳對銀行示警防範俄羅斯網路攻擊
https://turnnewsapp.com/livenews/finance/@@www.chinatimes.com--realtimenews--20220209003089-260410

防俄羅斯大舉網攻歐洲央行將資安工作列為優先事項
https://news.ltn.com.tw/news/world/breakingnews/3823841

逾500個採用舊版Magento軟體的網路商城遭鎖定，被側錄交易資料
https://www.bleepingcomputer.com/news/security/wave-of-magecart-attacks-target-hundreds-of-outdated-magento-sites/

中國駭客組織鎖定臺灣金融與製造業，埋伏在受害組織近250天
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks

Chinese Hackers Target Taiwanese Financial Institutions with a new Stealthy Backdoor
https://thehackernews.com/2022/02/chinese-hackers-target-taiwanese.html

Russia Cracks Down on 4 Dark Web Marketplaces for Stolen Credit Cards
https://thehackernews.com/2022/02/russia-cracks-down-on-4-dark-web.html

3.電子支付/行動支付/pay/資安
聚焦數位支付，Visa提2022五大趨勢
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9694

LINE於日本境內限期測試以LINE Pay服務使用自有加密貨幣LINK
https://mashdigi.com/line-pay-can-use-crypto-currency-link-in-japan-now/

全家向金管會申請電子支付執照全聯最慢3月底前要提出
https://udn.com/news/story/7239/6089419

LINE Pay將在15日推新獨立版本App 與電子支付分離
https://udn.com/news/story/7086/6089114

LINE Pay新版APP 2/15上線！正式移除一卡通MONEY，分道揚鑣內幕有哪些
https://www.bnext.com.tw/article/67628/line-pay-taiwan-new-app

Apple推出「Tap to Pay」功能　讓iPhone直接變成電子支付工具
https://reurl.cc/2DQ81O

iPhone變身行動收銀機新支付功能美國率先上路
https://news.pts.org.tw/article/566788

【電子支付】Visa研究：香港小微企對業務前景樂觀度高於全球平均值 95%冀今年加快接收數碼支付
https://reurl.cc/LpnXyy

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
因應洗錢防制法金管會公布防洗錢聲明通過業者名單
http://n.yam.com/Article/20220207594797

Kraken推出Proof of Reserves稽核服務，允許客戶驗證其加密貨幣餘額
http://www.businesswirechina.com/hk/news/49467.html

Meter跨鏈橋遭駭「損失超 440 萬美元」，官方賠全額以 MTRG 代幣支付
https://www.blocktempo.com/cross-chain-bridge-meter-passport-was-hacked-for-4-4-million-over-1391-eth-and-2-btc/

周杰倫粉絲買NFT　被駭客騙上百萬
https://news.sina.com.tw/article/20220206/41160272.html

Crypto.com 證實 483 名用戶加密貨幣資金遭不當存取，損失達 3,400 萬美元
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9691

紅衫資本也投入Web 3.0！領投區塊鏈技術新創Polygon，與a16z較勁
https://www.bnext.com.tw/article/67586/polygon-raises-450m-from-sequoia-capital-india-softbank-and-tiger-global

買周杰倫NFT卻遭騙上百萬！官方急發聲明曝「補救措施」
https://star.setn.com/news/1067793

36 億美元！美國破大規模比特幣洗錢案，扣押金額史上最高
https://www.inside.com.tw/article/26627-us-officials-seize-bitcoin-from-2016-bitfinex-hac

U.S. Arrests Two and Seizes $3.6 Billion Cryptocurrency Stolen in 2016 Bitfinex Hack
https://thehackernews.com/2022/02/us-arrests-two-and-seizes-36-million-in.html

XREX引入國際級區塊鏈安全技術捍衛用戶安全
https://wantrich.chinatimes.com/news/20220208900739-420201

加密貨幣漲聲響板卡族群High翻
https://ctee.com.tw/news/stocks/591703.html

香港本土NFT有哪些
https://www.thenewslens.com/article/162099

虛擬房產240萬美金成交加密貨幣認受性大增虛保搶攻NFT市場
https://www.edigest.hk/338127/?utm_campaign=ED_ContentCopy&utm_source=Web-inventory&utm_medium=Content-Copy_ED

加密貨幣跌勢衝擊澳RPG遊戲執行長資產蒸發7成
https://udn.com/news/story/6811/6085483

Bitfinex被駭119,754 BTC追回八成，Bitfinex：80%用於回購平台幣LEO
https://news.cnyes.com/news/id/4810746

美司法部破獲史上最大加密貨幣竊案追回Bitfinex竊案9.4萬枚比特幣
https://reurl.cc/7eK0QQ

幫駭客洗錢千億比特幣女子想當投資型網紅，遭警方逮捕
https://ccc.technews.tw/2022/02/09/bitcoin-laundry-woman-arrested/

DAO 為解放維基解密創始人阿桑奇籌集逾4600萬美元，稱為自由而戰
https://theinitium.com/roundtable/20220210-roundtable-international-AssangeDAO/

史上最大比特幣竊案鴛鴦盜洗錢45億美金.可判25年
https://reurl.cc/Kp9X1M

BSC | Qubit、PancakeBunny 團隊 Mound 破產！經營權移交 DAO 自主管理
https://www.blocktempo.com/pancakebunny-mound-bankruptcy-return-to-dao-mode/

數位人民幣實測體驗…類似行動支付
https://udn.com/news/story/7333/6078264

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
針對大型製造業，竊取登入資訊! 卡巴斯基發現多起使用SMTP的間諜軟體攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9692

微軟資安團隊揭露新木馬危機，但這次攻擊對象是 Mac
https://technews.tw/2022/02/08/microsoft-365-defender-threat-intelligence-macos-updateagent/

要求受害者安裝Windows 10市集App來散布惡意程式的情況時有所聞，線上安裝市集App的通訊協定遭禁用
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479

微軟打算針對5款Office應用程式加強巨集的管控，計畫對於自網路下載的文件全面封鎖巨集功能
https://www.bleepingcomputer.com/news/microsoft/microsoft-plans-to-kill-malware-delivery-via-office-macros/

CSV檔案也遭到濫用！駭客搭配Excel來散布BazarBackdoor惡意軟體
https://www.bleepingcomputer.com/news/security/malicious-csv-text-files-used-to-install-bazarbackdoor-malware/

勒索軟體Black Cat對德國大型石油運輸業者下手
https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/

報告指八成安全專家表示組織曾在去年遭受勒索軟件攻擊
https://unwire.pro/2022/02/10/claroty/security/

駭客將可竊取機密資訊的RedLine Stealer偽裝成Windows 11更新程式
https://www.ithome.com.tw/news/149295

駭客以提供Windows 11升級為誘餌，散布竊密軟體RedLine
https://threatresearch.ext.hp.com/redline-stealer-disguised-as-a-windows-11-upgrade/

安卓木馬Flubot、Medusa大肆透過網釣簡訊，攻擊銀行用戶
https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html

惡意軟體Qbot在入侵後的30分鐘內，即竊取受害電腦的敏感資訊
https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/

以受害電腦數量收費的惡意軟體散布服務業者，透過PrivateLoader發動攻擊
https://intel471.com/blog/privateloader-malware

北韓駭客Kimsuky利用xRAT後門程式攻擊南韓組織
https://asec.ahnlab.com/en/31089/

會竊取各種資訊並發動金融詐騙攻擊的 Android 惡意軟體 Medusa 正在大舉感染中
https://www.twcert.org.tw/tw/cp-104-5710-3167f-1.html

因人資系統業者遭勒索軟體攻擊，運動用品業者Puma近半數員工資料外洩
https://www.bleepingcomputer.com/news/security/puma-hit-by-data-breach-after-kronos-ransomware-attack/

沈寂一年的殭屍網路FritzFrog重返市場，單月感染激增10倍
https://www.ithome.com.tw/news/149312

殭屍網路FritzFrog鎖定醫療、教育、政府單位，受害伺服器一個月內爆增10倍
https://www.akamai.com/blog/security/fritzfrog-p2p

FritzFrog P2P Botnet Attacking Healthcare, Education and Government Sectors
https://thehackernews.com/2022/02/fritzfrog-p2p-botnet-attacking.html

FBI Liaison Alert System (FLASH) - Indicators of Compromise Associated with Lockbit 2.0 Ransomware
https://www.ic3.gov/Media/News/2022/220204.pdf

Qbot Likes to Move It, Move It
https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/

New CapraRAT Android Malware Targets Indian Government and Military Personnel
https://thehackernews.com/2022/02/new-caprarat-android-malware-targets.html

Roaming Mantis reaches Europe | Securelist
https://securelist.com/roaming-mantis-reaches-europe/105596/

PrivateLoader: The first step in many malware schemes
https://intel471.com/blog/privateloader-malware

Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage
https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage

Several Malware Families Using Pay-Per-Install Service to Expand Their Targets
https://thehackernews.com/2022/02/several-malware-families-using-pay-per.html

'Roaming Mantis' Android Malware Targeting Europeans via Smishing Campaigns
https://thehackernews.com/2022/02/roaming-mantis-android-malware.html

Medusa Android Banking Trojan Spreading Through Flubot's Attacks Network
https://thehackernews.com/2022/02/medusa-android-banking-trojan-spreading.html

Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign
https://thehackernews.com/2022/02/iranian-hackers-using-new-marlin.html

Modified Elephant APT and a Decade of Fabricating Evidence
https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt

CISA, FBI, NSA Issue Advisory on Severe Increase in Ransomware Attacks
https://thehackernews.com/2022/02/cisa-fbi-nsa-issue-advisory-on-severe.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
安卓用戶注意！你以為安全的兩步驟驗證竟然暗藏危機還會偷錢
https://wantrich.chinatimes.com/news/20220206900249-420101

中美 5G 戰白熱化！美企更換華為設備速度加快，三個月就增加三倍
https://www.inside.com.tw/article/26592-fcc-china-5g

LINE隱藏功能整理｜2022必學15招超實用技巧大公開
https://mrmad.com.tw/line-hidden-function

Meta放話可能退出歐洲　法、德官員：4年沒用臉書了感覺很讚
https://www.mirrormedia.mg/story/20220208edi027/

不用開相機也能掃實聯制 iPhone必學小技巧一次看懂
https://www.sogi.com.tw/articles/apple_iphone/6257401

對抗惡意駭客攻擊！Meta擬全新政策防個資外洩
https://times.hinet.net/news/23748682

NCC：5款手機資安複測未通過有4款為中國製
https://www.cna.com.tw/news/afe/202202090182.aspx

搶修 Bug 及 Safari 嚴重資安！蘋果發佈 iOS、iPadOS 緊急更新
https://3c.ltn.com.tw/news/47639

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
破解 Switch 的駭客慘了入獄3年罰款千萬！任天堂致謝美國官方
https://news.xfastest.com/others/107618/others-143/

電信業者Vodafone葡萄牙子公司遭到網路攻擊，4G、5G服務中斷
https://www.bleepingcomputer.com/news/security/vodafone-portugal-4g-and-5g-services-down-after-cyberattack/

微軟聲稱只有22%的Azure AD用戶採用強大身分認證機制
https://www.ithome.com.tw/news/149225

2021年國內上市櫃公司14件資安事件重大訊息，平均每月一起
https://www.ithome.com.tw/news/149271

30萬帳戶受影響 Switch玩家被駭客入侵
https://www.mensuno.tw/special_column.php?special_column_classify_sn=100&special_column_sn=182

人權機構譴責中共用維吾爾族運動員洗白其罪惡
https://www.soundofhope.org/post/591136?lang=b5

美新聞集團郵件帳戶遭中共黑客入侵
https://gnews.org/zh-hant/1959261/

新聞集團遭駭客入侵部分電郵和檔被中共關聯人員竊取
https://gnews.org/zh-hant/1973087/

UN報告：北韓持續發展核武網攻提供重要收入
https://www.cna.com.tw/news/aopl/202202060052.aspx

北韓研發飛彈錢從哪來？聯合國報告：竊取海外加密貨幣
https://news.ltn.com.tw/news/world/breakingnews/3821112

北韓網路遭DDoS攻擊，原因疑似是資安人員不滿美國政府毫無反制作為，逕自挾怨報復
https://www.wired.com/story/north-korea-hacker-internet-outage/

一個月「癱瘓北韓網路」2次！他被北韓駭客攻擊太不爽…一年苦研究「狂挖漏洞」就是要復仇
https://news.pchome.com.tw/internation/ctinews/20220205/index-64403251557716309011.html

北韓駭客Kimsuky疑似鎖定國際原子能源總署下手
https://asia.nikkei.com/Spotlight/N-Korea-at-crossroads/North-Korea-targeted-IAEA-in-cyberattacks-draft-U.N.-report

北韓駭客向聯合國請求庇護慘遭平壤特務綁架結局曝光
https://www.chinatimes.com/realtimenews/20220211002472-260408?chdtv

北韓「天才IT軍官」趁駐俄時脫北！涉多項機密遭逮　超慘結局曝光
https://www.ettoday.net/news/20220211/2187226.htm

網站驚現俄入侵烏克蘭標題《彭博社》欠公眾一個交代
https://reurl.cc/Y947px

俄羅斯駭客組織Gamaredon鎖定烏克蘭下手，資安業者提出更多發現
https://www.bleepingcomputer.com/news/microsoft/microsoft-russian-fsb-hackers-hitting-ukraine-since-october/

孫曉雅：遏中威脅推動軍購案盡快交付
https://news.ltn.com.tw/news/politics/paper/1499214

中國全運會前遭駭客駭入伺服器
https://www.ithome.com.tw/news/149247

英國草擬新法案成人網站必須核實用戶身份及年齡
https://www.pcmarket.com.hk/new-bill-drafted-in-uk-adult-websites-must-verify-user-identity-and-age/

英國外交部年初曾因嚴重網絡攻擊要求支援
https://unwire.pro/2022/02/11/uk-foreign-office-cyber-incident/security/

美智庫指北韓在邊界建造飛彈基地　離中國僅25公里
https://www.appledaily.com.tw/international/20220208/JXFR7Z3UQZHOXKANIL3D2JNACM/

波蘭成立網路防衛軍部門
https://www.ithome.com.tw/news/149290

印媒WION：以色列借網戰製造伊朗動亂
https://news.pts.org.tw/article/567048

Hackers Backdoored Systems at China's National Games Just Before Competition
https://thehackernews.com/2022/02/hackers-backdoored-systems-at-chinas.html

Russian APT Hackers Used COVID-19 Lures to Target European Diplomats
https://thehackernews.com/2022/02/russian-apt-hackers-used-covid-19-lures.html

Palestine-Aligned Hackers Use New NimbleMamba Implant in Recent Attacks
https://thehackernews.com/2022/02/palestinian-hackers-using-new.html

COVID Does Not Spread to Computers
https://thehackernews.com/2022/02/covid-does-not-spread-to-computers.html

資安事件分析師 Security Event Analyst
https://www.cakeresume.com/companies/teamt5-org-tw/jobs/security-event-analyst?locale=fr

資安工程師
https://www.104.com.tw/job/7imkz

LINE Bank加入「搶人」行列！年後轉職「金飯碗」大徵才
https://finance.ettoday.net/news/2157650

資訊專員(資訊安全)
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=11&EMPLOYER_ID=252&HIRE_ID=10902073

資安事件分析師 Security Event Analyst
https://www.cakeresume.com/companies/teamt5-org-tw/jobs/security-event-analyst?locale=zh-CN

資安軟體研發工程師 (Network and Security)
https://www.cakeresume.com/companies/onwardsecurity/jobs/zian-software-development-engineer

上市櫃-資安工程師
https://www.104.com.tw/job/7iojr

技術工程師(BU2)-若沒經驗有學習企圖心,可接受培訓(約聘)
https://www.104.com.tw/job/7ipvv

行政管理處_副工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?R2=6&EMPLOYER_ID=2456585&HIRE_ID=10955283

資安顧問
https://www.104.com.tw/job/7iu8k

資安技術專案助理工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=528812&HIRE_ID=10968713

資安監控工程師
https://www.104.com.tw/job/7iu9z

資安稽核資深專員(內湖)
https://www.104.com.tw/job/7iwwq

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
你還在用這組密碼？全世界超過1億人使用小心個資外洩
https://news.ebc.net.tw/news/living/301531

【錯誤】網傳「有人送新年禮物來囉🧧🐯虎年貼圖刮刮樂,立即接收下載」
https://tfc-taiwan.org.tw/articles/6904

你還在用這組密碼？全世界超過1億人使用小心個資外洩
https://reurl.cc/44LrvL

最常見密碼排行曝光！最愛用前3名全是「連續數字」
https://reurl.cc/NpYQL9

台南交警涉「查個資給徵信業」　南檢警自檢搜索2人聲押
https://www.ettoday.net/news/20220209/2185663.htm

多數人並未意識到自己帳號被盜用的風險
https://blog.twnic.tw/2022/02/09/21697/

Facebook因資料糾紛考慮在歐洲關閉服務，歐盟官員回應：沒有Facebook生活一樣很美好
https://www.techbang.com/posts/94030-facebook-and-instagram-may-be-shut-down-in-europe-due-to-data

Google 聲稱啟用二步驟認證後降低五成的用戶帳號被駭率
https://www.cool3c.com/article/172666

海逸酒店網絡被Hack報警 120萬人資料受影響
https://reurl.cc/OpYWbr

LINE情人節貼圖「有假」別下載！　趨勢科技揭駭客3大套路
https://www.ettoday.net/news/20220210/2186432.htm

駭客透過Unicode特殊字元誤導附件內容，對Microsoft 365用戶進行網釣攻擊
https://www.vadesecure.com/en/blog/how-hackers-are-using-a-20-year-old-text-trick-to-phish-microsoft-365-users

網釣簡訊攻擊Roaming Mantis同時鎖定iPhone和Android用戶，範圍從亞洲擴及歐洲國家
https://securelist.com/roaming-mantis-reaches-europe/105596/

Puma因軟體商被勒索軟體攻擊外洩逾6千員工資料
https://www.ithome.com.tw/news/149288

Puma 因 Kronos人資管理系統遭勒贖攻擊，近半員工機敏資料外洩
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9707

扯！北市抽獎活動個資外洩千人電話全都露
https://reurl.cc/nEYZdl

駭客搭訕套路大公開趨勢科技教你避開情人節詐騙地雷
https://www.cdns.com.tw/articles/534002

Fremont一學院遭駭客攻擊資料外洩
https://reurl.cc/dXae4V

E.研究報告/工具
如何清除 Google 搜尋記錄
https://blog.trendmicro.com.tw/?p=70880

強化 NAS 安全性：防範轉戰 NAS 領域的威脅
https://blog.trendmicro.com.tw/?p=71186

VPN是什麼？什麼時候需要使用VPN？使用VPN時需要注意哪些問題
https://texch.net/blog/post/what-is-vpn

控管策略方法論逐步調整實作　增進數位化應用場景安全審視新常態工作風險　融合零信任強化資安韌性
https://www.netadmin.com.tw/netadmin/zh-tw/trend/9EDD627B14E7476EAD1319D65E5BB9D9

【別出心裁】圖像處理器有助跨網站追蹤網民身份
https://www.wepro180.com/gpu220208/

雲端建構安全高效工作空間　ML輔助解析行為活動避免遭駭混合辦公引爆零信任需求　持續動態調配管控風險
https://www.netadmin.com.tw/netadmin/zh-tw/trend/3400163BBB644A8080025EED1CF01883

FB「你可能認識的朋友」演算法怎麼來的？揭祕臉書內部權力最大的神祕小隊
https://www.wealth.com.tw/articles/7d90dbbf-9dbd-490b-980a-5021ba44c3a8

有人把《Wordle》移植到了 Game Boy 上
https://chinese.engadget.com/wordle-game-boy-port-113039729.html

如何開發Z世代有感的網路服務設計？這五點建議趕快筆記
https://www.bnext.com.tw/article/67577/z-generation-online-service

疑似為防堵駭客濫用，微軟將從Windows 10移除WMI命令列工具
https://www.ithome.com.tw/news/149314

How Attack Surface Management Preempts Cyberattacks
https://thehackernews.com/2022/02/how-attack-surface-management-preempts.html

Guide: Alert Overload and Handling for Lean IT Security Teams
https://thehackernews.com/2022/02/guide-alert-overload-and-handling-for.html

F.商業
可同時管理容器與虛擬機器，SUSE打造新世代超融合架構
https://www.ithome.com.tw/review/149206

Sophos發布 Sophos ZTNA 零信任網路存取產品
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9697

Check Point Software 推出超高速防火牆 Quantum Lightspeed
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9695

HiNet WAF網站應用防火牆協助企業抵禦撞庫攻擊
https://times.hinet.net/news/23746855

迎戰「密碼撞庫」中華電端資安良方
https://wantrich.chinatimes.com/news/20220209900533-420101

逸盈科技成為SentinelOne公司臺灣授權代理商
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9700

以風險為基礎制定應用控管政策　統一身分安全平台逐步實踐 CI/CD整合金鑰管理　避免惡意程式盜取冒用
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/AF488C0019A644ECBCE39CBD009D3629

加強資安防護微軟傳洽談收購網路安全公司Mandiant
https://ec.ltn.com.tw/article/breakingnews/3823882

整合身分認證即服務擴展辨識力　最低權限套用漸進零信任從應用層限縮攻擊面　防個資外洩遭憑證填充
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/D7494F0E0EFF4B3CA686EA5F26D55681

微軟SIEM平臺Sentinel整合GitHub，可持續監控企業儲存庫安全
https://www.ithome.com.tw/news/149233

資安需求增安碁資訊1月營收翻倍漲
https://wantrich.chinatimes.com/news/20220211900386-420101

Check Point Software: 2022 年應注意軟體供應鏈攻擊狂潮
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9705

SolarWinds 奠定基礎，2021 年起掀起供應鏈網路攻擊狂潮
https://technews.tw/2022/02/10/check-point-research-cyber-security/

G.政府
桃園市府導入混合雲打造市政資料治理暨大數據分析平台加速推動亞洲‧矽谷計劃
https://market.ltn.com.tw/article/11894

要搭公車APP先查擁擠度高雄iBus全國首創
https://reurl.cc/7e4gzb

台北通App用阿里雲資安爆疑慮
https://udn.com/news/story/7323/6090000

北市府網域託管中國「阿里雲」　違約廠商將遭議處
https://www.setn.com/News.aspx?NewsID=1069574

北市府網域託管中國阿里雲違約廠商將遭議處
http://www.ksnews.com.tw/index.php/news/contents_page/0001571056

台北通App又惹議議員質疑放任中國竊取北市資料
https://newtalk.tw/news/view/2022-02-10/708064

台北通伺服器在香港？資訊局：誤解
https://times.hinet.net/news/23750823

「.taipei」主機違規掛香港　議員再爆：柯市府根本未驗收也沒查驗
https://www.appledaily.com.tw/life/20220211/V47BTQ3RYZANLAMW5LQBFOAKLE/

立院三讀通過「資通安全產品或服務」納入抵減項目
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9711

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
物聯網世代資安保護的熱門選擇——新型「加密金鑰」PUF 技術
https://pansci.asia/archives/341115

IoT/connected Device Discovery and Security Auditing in Corporate Networks
https://thehackernews.com/2022/02/iotconnected-device-discovery-and.html

Tenda AC15 V1.0存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44971

TOTOLINK A720R v4.1.5cu.470_B20200911 存在指令注入弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45742
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45740
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45739
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45741
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45736
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45738
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45733
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45734

在 Western Digital My Cloud 設備上發現了一個遠端執行程式碼弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22994
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22992

Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)
https://www.exploit-db.com/exploits/50738

Huawei DG8045 Router 1.0 - Credential Disclosure
https://www.exploit-db.com/exploits/50701

5G專網將釋照智慧工廠建置尚缺這把火
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=10&id=0000629183_38g2np3070xqf54q3eafx

I.教育訓練
網路時代人人要學的資安基礎必修課 (How Cybersecurity Really Works)
https://www.tenlong.com.tw/products/9786263240384?list_name=p-r-zh_tw

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

Write Once, Deploy Anywhere 的智能合約虛擬機 2022/2/12
https://www.meetup.com/Taipei-Blockchain/events/282521718/

《數位人權研討會》剖析元宇宙發展痛點：資訊安全與數位人權 2022/2/14
https://www.accupass.com/event/2201050729181065808149

車聯網供應鏈資安研討會 2022/2/15 (二) 14:00~16:30 (13：30開始報到)
https://www.teema.org.tw/education.aspx?infoid=37800

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

國家高速網路與計算中心教育訓練【資安初階課程】ISO 27001資產盤點暨風險評鑑實務課程 2022/2/24
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3969&from_course_list_url=homepage

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/1/31 ~ 2022/2/4

noreply@blogger.com (Unknown) — Sat, 05 Feb 2022 13:52:00 +0000

資安事件新聞週報 2022/1/31 ~ 2022/2/4

1.重大弱點漏洞/後門/Exploit/Zero Day
Samba Out-of-Bounds Heap R/W 遠端執行代碼弱點（RCE） CVE-2021-44142
https://www.samba.org/samba/security/CVE-2021-44142.html

Samba 修補高風險漏洞，不讓攻擊者藉此以root權限遠端執行程式碼
https://www.ithome.com.tw/news/149175

CVE-2021-44142: DETAILS ON A SAMBA CODE EXECUTION BUG DEMONSTRATED AT PWN2OWN AUSTIN
https://reurl.cc/ZrVKdl

The Samba Vulnerability: What is CVE-2021-44142 and How to Fix It
https://reurl.cc/dXyNb8

UEFI韌體程式碼爆23項漏洞，影響微軟、Dell、HPE等業者
https://www.ithome.com.tw/news/149203

Apache Log4j存在安全漏洞(CVE-2021-44228)，允許攻擊者遠端執行任意程式碼
https://ic.cgu.edu.tw/p/16-1016-90950.php?Lang=zh-tw

Log4j漏洞引爆開源軟體安全議題，OpenSSF基金會扛起重擔，推動修補大量軟體漏洞的計畫
https://www.ithome.com.tw/news/149179

Log4j exploit hits again: vulnerable Unifi Network application (Ubiquiti)
https://blog.morphisec.com/log4j-exploit-targets-vulnerable-unifi-network-applications

CISA Warns of Critical Vulnerabilities Discovered in Airspan Networks Mimosa
https://thehackernews.com/2022/02/cisa-warns-of-critical-vulnerabilities.html

安全危機擴大，5 款 Cisco 路由器有「致命」漏洞
https://technews.tw/2022/02/05/cisco-router-vulnerable/

Critical Flaws Discovered in Cisco Small Business RV Series Routers
https://thehackernews.com/2022/02/critical-flaws-discovered-in-cisco.html

Dozens of Security Flaws Discovered in UEFI Firmware Used by Several Vendors
https://thehackernews.com/2022/02/dozens-of-security-flaws-discovered-in.html

Critical Bug Found in WordPress Plugin for Elementor with Over a Million Installations
https://thehackernews.com/2022/02/critical-bug-found-in-wordpress-plugin.html

Google釋出Chrome 98，修補27項安全漏洞
https://www.ithome.com.tw/news/149183

Mozilla Firefox 67 - Array.pop JIT Type Confusion
https://www.exploit-db.com/exploits/50691

別為了急於省電而犧牲安全性，微軟建議Windows電腦至少要持續連網8小時，否則無法完整安裝更新
https://www.ithome.com.tw/news/149164

耗時27個月，全錄終於揭露可導致印表機停擺的資安漏洞
https://www.ithome.com.tw/news/149163

PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
https://www.exploit-db.com/exploits/50702

PHPIPAM 1.4.4 - SQLi (Authenticated)
https://www.exploit-db.com/exploits/50684

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
以色列與美洲開發銀行合作成立資安防護基金
https://reurl.cc/Kpl7Yy

股市小白！證交所推宅在家學習網
https://times.hinet.net/news/23738898

金融資安篇資安防護從滴水不漏進化為快速復原
https://taiwanbanker.tabf.org.tw/paperDetail?id=3679

《金融股》合庫銀申設捷克代表人辦事處獲准進軍中東歐市場拔頭籌
https://turnnewsapp.com/livenews/finance/@www.chinatimes.com--realtimenews--20220128001165-260410

因應春節9天連假金管會成立應變小組緊盯國內外重大輿情
https://ec.ltn.com.tw/article/breakingnews/3817168

金管會抽測7縣市金融機構ATM 運作順暢
https://money.udn.com/money/story/5613/6072293

金管會春節抽檢10家ATM 領現金打客服均順暢
https://reurl.cc/Mbja93

金管會秘密客除夕出動　緊盯ATM運作
https://finance.ettoday.net/news/2181744

預防網路安全威脅嚴重影響金融體系的穩定，歐洲系統風險委員會提議建立泛歐網路事件協調框架
https://www.ithome.com.tw/news/149155

核釋「保險業資金辦理專案運用公共及社會福利事業投資管理辦法」
第 2 條第 7 款所稱其他配合政府政策之資金運用項目之相關規定，自即日生效
https://www.lawbank.com.tw/news/NewsContent.aspx?AID=3&kw=&TY=21&sd=&ed=&total=71&NCLID=&lsid=

還有人在用提款卡領錢？網揭超強好處
https://reurl.cc/qOvx6D

假鈔流竄難防…民眾氣炸：還會變色「8招防偽辨識」秘訣大公開
https://reurl.cc/bkYLAr

儲蓄3招讓小資族每月多儲10％　刪網購綁定的信用卡令洗錢變困難
https://reurl.cc/Nplk95

3.電子支付/行動支付/pay/資安
掃碼支付夯金管會：2大關鍵促「掃經濟」興起
https://udn.com/news/story/7241/6077340?from=udn-catebreaknews_ch2

包紅包免現金沒對方帳號也能轉帳
https://reurl.cc/9O3jaX

美國參議院司法委員會正式批准「公開應用程式市場法案」，將迫使 Apple 全面開放第三方安裝與支付管道
https://reurl.cc/7edgmk

學者稱電子利是功能有助發展電子支付惟本港未算普及
https://reurl.cc/dXyEAq

推廣"電子交易" 日銀行存錢要收手續費
https://news.cts.com.tw/cts/international/202201/202201182069145.html

新科院士蔣昌俊：在防控網路支付風險中做到「以不變應萬變」
https://news.sina.com.tw/article/20220204/41152578.html

【電子支付】轉數快帳戶登記去年急增4成日均交易涉54億元
https://reurl.cc/rQvm2E

Visa發布2022五大支付趨勢，感應支付、先買後付BNPL興起
https://www.techbang.com/posts/93834-visa-announces-five-payment-trends-for-2022

北京冬奧禁用支付寶？中國力推數位人民幣的大戰略
https://opinion.udn.com/opinion/story/120491/6064045

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
DeFi平台蟲洞被駭89億史上第4大加密幣劫案
https://www.cna.com.tw/news/ait/202202030196.aspx

加密貨幣平臺Wormhole遭駭，損失價值3.2億美元的以太幣
https://www.ithome.com.tw/news/149200

Solana出大事！跨鏈橋Wormhole遭駭3.2億鎂WETH，官方提供駭客「1000萬鎂獎金」籲其歸還
https://www.blocktempo.com/wormhole-hit-with-a-320-million-hack/

史上最搞笑NFT！3D版羊駝Alpacadabraz 2月12日問市，跟著Snoop Dogg與Pranksy大鬧元宇宙
https://www.gq.com.tw/life/article/alpacadabraz

以太坊智慧合約程式碼缺陷致Qubit DeFi平台被竊取8000萬美元加密貨幣
https://www.techbang.com/posts/93909-ethereum-smart-contract-code-flaws-caused-the-qubit-defi

加密貨幣圈又見驚天盜案！駭客攻擊導致蟲洞損失逾3億美元
https://www.aatnews.com/finance/57205.html

耕宏熊出包？網友控訴：點擊假PhantaBear遭騙 ETH 後，還被官方當成駭客公審
https://www.blocktempo.com/phantabear-embroiled-in-controversy/

狗狗幣 Dogecoin AirDrop 2X 空投兩倍返還詐騙手法（Dogecoin2050）
https://www.vedfolnir.com/dogecoin-airdrop-scam-49121.html

駭客入侵?比特幣披薩日?加密貨幣你必須知道的事!除了比特幣還有什麼加密貨幣?區塊鏈和元宇宙關聯性為何
https://www.youtube.com/watch?v=BHg4VCNuVuk

NFT 市場夯、比特幣價格大跌！幣圈氣氛兩樣情，錢還能投入市場
https://reurl.cc/qOvxYy

為杜絕免費鑄造的NFT浮濫，OpenSea祭限制令，但又臨時收回成命
https://www.ithome.com.tw/news/149153

香港小動物「被人道」，NFT項目讓牠們「永存」區塊鏈
https://www.thenewslens.com/article/162265

什麼是 DAO 分布式自治組織？它為何被說成「工作的未來」
https://unwire.pro/2022/01/29/dao-explained/feature/

資金體量繼續增加 BTC&ETH加強築底存量資金在繼續堆積
https://reurl.cc/WkN5M7

數位貨幣爭霸戰，各國央行態度大相逕庭
https://finance.technews.tw/2022/01/20/digital-currency-battle/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
UEFI惡意程式MoonBounce現身，格式化、重灌系統都沒用
https://www.techbang.com/posts/93749-the-uefi-malicious-program-moonbounce-appeared-and-the

Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
https://reurl.cc/3j4gbR

Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine
https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/
https://raw.githubusercontent.com/pan-unit42/iocs/master/Gamaredon/Gamaredon_IoCs_JAN2022.txt

Russian Gamaredon Hackers Targeted 'Western Government Entity' in Ukraine
https://thehackernews.com/2022/02/russian-gamaredon-hackers-targeted.html

CoinStomp Malware Family Targets Asian Cloud Service Providers
https://reurl.cc/44dKbY

中國駭客集團以xPack後門鎖定臺灣金融與製造業
https://times.hinet.net/news/23742034

中國駭客集團以xPack後門鎖定臺灣金融與製造業Antlion持續攻擊至少長達18個月
https://www.insoler.com/forum/topic/16439879102393.htm

Antlion: Chinese APT Uses Custom Backdoor to Target Financial Institutions in Taiwan
https://reurl.cc/qOv7KR

Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
https://reurl.cc/OprZR9

Another Israeli Firm, QuaDream, Caught Weaponizing iPhone Bug for Spyware
https://thehackernews.com/2022/02/another-israeli-firm-quadream-caught.html

New SEO Poisoning Campaign Distributing Trojanized Versions of Popular Software
https://thehackernews.com/2022/02/new-seo-poisoning-campaign-distributing.html

New Variant of UpdateAgent Malware Infects Mac Computers with Adware
https://thehackernews.com/2022/02/new-variant-of-updateagent-malware.html

New Wave of Cyber Attacks Target Palestine with Political Bait and Malware
https://thehackernews.com/2022/02/new-wave-of-cyber-attacks-target.html

New Malware Used by SolarWinds Attackers Went Undetected for Years
https://thehackernews.com/2022/02/new-malware-used-by-solarwinds.html

Hacker Group 'Moses Staff' Using New StrifeWater RAT in Ransomware Attacks
https://thehackernews.com/2022/02/hacker-group-moses-staff-using-new.html

SolarMarker Malware Uses Novel Techniques to Persist on Hacked Systems
https://thehackernews.com/2022/02/solarmarker-malware-uses-novel.html

North Korean Hackers Using Windows Update Service to Infect PCs with Malware
https://thehackernews.com/2022/01/north-korean-hackers-using-windows.html

North Korean Hackers Return with Stealthier Variant of KONNI RAT Malware
https://thehackernews.com/2022/01/north-korean-hackers-return-with.html

威聯通科技遭駭客勒索，要求支付比特幣做為贖金
https://technews.tw/2022/01/29/deadbolt-hackers-blackmail-qnap-for-bitcoins/

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
快刪！安卓「這款APP」入侵銀行帳戶錢全遭盜領光
https://reurl.cc/Nplvd6

安卓用戶快砍！這款APP能入侵銀行帳戶盜光你的錢
https://wantrich.chinatimes.com/news/20220205900094-420101

看似安全卻是危險，這款 Android 第三方雙重驗證 App 會偷你錢
https://technews.tw/2022/01/30/android-2fa-authenticator/

付費詐騙App日益猖獗，出現已下載到1億支Android手機進行斂財的惡意軟體
https://times.hinet.net/topic/23739427

年終、紅包通通白領小心安卓這款APP先盜領再重置手機
https://reurl.cc/Ddlzr6

美國參議院司法委員會正式批准「公開應用程式市場法案」，將迫使 Apple 全面開放第三方安裝與支付管道
https://www.kocpc.com.tw/archives/425486

另一家以色列業者QuaDream也利用零點擊攻擊程式自遠端攻陷iPhone
https://www.ithome.com.tw/news/149197

北京冬奧App「冬奧通」　日本政府籲代表團盡量少用
https://www.setn.com/News.aspx?NewsID=1066885

日本也籲冬奧選手分開使用個人裝置
https://news.ltn.com.tw/news/world/breakingnews/3819742

憂中國APP竊取個資　7國破千名冬奧選手不使用個人手機
https://www.setn.com/News.aspx?NewsID=1066698

網民改裝AirTag eBay發售　或衍生更嚴重私隱問題
https://reurl.cc/pWvl0b

Meta旗下社交平台加入虛擬頭像　可錄動畫+變表情貼圖
https://reurl.cc/nEv91e

小米充電器的資安問題沒人擔心
https://ptthito.com/hatepolitics/m-1644045171-a-581/

如何判斷您的手機是否被駭
https://nordvpn.com/zh-tw/blog/shouji-bei-hai-ma/

電話駭客　嚴重威脅社會安全
https://www.bg3.co/a/luo-shi-tou-tiao-dian-hua-hai-ke-yan-zhong-wei-xie-she-hui-an-quan.html

APP資安漏洞多，輸入「明碼」是最危險
https://reurl.cc/bkYLmo

口罩版Face ID要來了 iOS 15.4測試版藏新功能
https://times.hinet.net/news/23735968

蘋果曝 AirPods 防盜新專利　「耳道生物識別技術」辨識用戶身分
https://finance.ettoday.net/news/2182166

數位疫苗健康證明透過 QR Code 就能直接加入 iPhone 錢包的方法
https://applealmond.com/posts/131425

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
【麥當勞菜單．我創造】黑(駭)客松網路大賽等你來挑戰
https://www.worldjournal.com/wj/story/121388/6075682

駭客入侵憂資安漏洞 3招自保不被割韭菜
https://reurl.cc/k7yRpn

全天候監控機制資安專家：可建立韌性
https://news.ltn.com.tw/news/politics/paper/1498703

不容中國網軍破壞// 關鍵基礎設施 24小時監控
https://news.ltn.com.tw/news/politics/paper/1498707

面對OAuth程式也須驗證真偽！惡意活動OiVaVoii以假冒的OAuth程式鎖定C級高階主管
https://www.ithome.com.tw/news/149154

物流公司總經理遭解職後登入公司系統稱駭客行為被法官打臉
https://www.chinatimes.com/realtimenews/20220204001355-260402?chdtv

疫情災難多一樁公校資料庫屢遭駭勒贖
https://reurl.cc/jkyN3M

史上最大 DDoS 攻擊亞洲 Azure 用戶！微軟表示：成功緩解 3.47Tbps 破紀錄洪流
https://technews.tw/2022/01/28/microsoft-mitigated-a-record-3-47-tbps-ddos-attack-on-azure-users/

Azure 擋 3.47Tbps DDoS 破紀錄　專攻亞洲和遊戲業
https://www.pcmarket.com.hk/azure-record-3-47tbps-ddos-in-2021-2nd-half/

防監控大作戰記者帶新筆電、千名選手教練用拋棄式手機
https://vip.udn.com/vip/story/121937/6075095

網路監控、防疫規定… 北京冬奧選手狀況複雜創紀錄
https://www.worldjournal.com/wj/story/121187/6073354

「老大哥」冬奧會盯上你？西方多國預警防諜防竊聽
https://www.peoplenews.tw/news/d375acfa-fa2d-4c54-875f-bf39e12c30ba

為何北京早一步申請CPTPP？專家疑機密洩漏
https://www.secretchina.com/news/b5/2022/02/03/996870.html

從2008北京奧運到2022北京冬奧，幕後推手都是他！尋求第三屆任期的「萬能主席」習近平
https://reurl.cc/qOv7An

新聞集團遭遇可能與中國有關的網絡攻擊，記者等僱員郵件成為目標
https://reurl.cc/OprlpR

新聞集團記者遭網攻駭客疑為中國收集情資
https://www.rti.org.tw/news/view/id/2123793

華爾街日報母公司遭持續網攻疑中國政府鎖定記者資料
https://www.worldjournal.com/wj/story/121186/6077687

華爾街日報母公司遭持續網攻疑中國政府鎖定記者資料
https://reurl.cc/rQvmgb

「泰晤士報」、「華爾街日報」等外媒遭網攻　初步調查恐與中國有關
https://www.taiwannews.com.tw/ch/news/4432131

駭客疑與中國有關？媒體集團成箭靶有前例
https://globalnewstv.com.tw/202202/179184/

新聞集團遭網攻疑駭客來自中國
https://www.ftvnews.com.tw/news/detail/2022205W0003

梅鐸新聞集團旗下媒體遭網攻傳幕後黑手是中國
https://news.ltn.com.tw/news/world/breakingnews/3820452

《華爾街日報》母公司「新聞集團」遭網攻　控駭客與中國有關
https://tw.appledaily.com/international/20220205/MFTLKLPIBBCRJPINYEZXD2OXXA/

美國黑客反擊朝鮮全國網絡一個月癱瘓兩次
https://www.ntdtv.com/b5/2022/02/04/a103339975.html

一個月「癱瘓北韓網路」2次！他被北韓駭客攻擊太不爽…一年苦研究「狂挖漏洞」就是要復仇
https://gotv.ctitv.com.tw/2022/02/2010839.htm

美國黑客反擊朝鮮全國網絡一月癱瘓兩次
https://tw.aboluowang.com/2022/0205/1704736.html

北韓剋星是他！美國駭客逆襲　一人癱瘓北韓全國網路
https://tw.appledaily.com/international/20220204/32JXDGZT25GRVFICIR763DSHKM/

遭到北韓駭客入侵的美國資安研究人員，以一己之力癱瘓北韓網路
https://www.ithome.com.tw/news/149189

朝鮮官網頻遭駭一度癱瘓神秘客策劃更大規模襲擊
https://m.soundofhope.org/post/590584?lang=b5

北京冬奧開幕日販賣器官被聚焦法國會再瞄準中共
https://www.soundofhope.org/post/590677

日本下議院通過決議關切中國疆港人權
https://news.cts.com.tw/cts/international/202202/202202012070601.html

英國發布「2022 年國家網路安全戰略」
https://blog.twnic.tw/2022/02/03/21635/

FBI局長：中共參與了針對美國科技公司的大規模駭客行動
https://gnews.org/zh-hant/1956430/

FBI局長：中共“更明目張膽”的盜竊美知識產權
https://www.soundofhope.org/post/589933?lang=b5

美國聯邦調查局長：中國政府威脅西方更加肆無忌憚，是美國經濟安全最大威脅
https://www.storm.mg/article/4178166

歐洲燃油運輸儲存公司遭駭客入侵專家：不見得是預謀攻擊
https://www.taiwannews.com.tw/ch/news/4431542

網路霸凌、肢體暴力樣樣來駐中國記者遭打壓情況惡化
https://news.ltn.com.tw/news/world/breakingnews/3818210

從俄羅斯到中國，那些由政府外包的駭客攻擊行動
https://udn.com/umedia/amp/story/12828/5963001

美國及歐洲盟友討論向烏克蘭提供網絡安全援助
https://reurl.cc/nEv9rl

美國五角大廈報告美軍應優先培育資安人力
https://reurl.cc/Rjep9r

Microsoft Mitigated Record-Breaking 3.47 Tbps DDoS Attack on Azure Customers
https://thehackernews.com/2022/01/microsoft-mitigated-record-breaking-347.html

DeepDotWeb News Site Operator Sentenced to 8 Years for Money Laundering
https://thehackernews.com/2022/01/deepdotweb-news-site-operator-sentenced.html

Apple Pays $100,500 Bounty to Hacker Who Found Way to Hack MacBook Webcam
https://thehackernews.com/2022/01/apple-pays-100500-bounty-to-hacker-who.html

German Court Rules Websites Embedding Google Fonts Violates GDPR
https://thehackernews.com/2022/01/german-court-rules-websites-embedding.html

Reasons Why Every Business is a Target of DDoS Attacks
https://thehackernews.com/2022/01/reasons-why-every-business-is-target-of.html

Researchers Uncover New Iranian Hacking Campaign Targeting Turkish Users
https://thehackernews.com/2022/01/researchers-uncover-new-iranian-hacking.html

Iranian Hackers Using New PowerShell Backdoor in Cyber Espionage Attacks
https://thehackernews.com/2022/02/iranian-hackers-using-new-powershell.html

Ukraine Continues to Face Cyber Espionage Attacks from Russian Hackers
https://thehackernews.com/2022/02/ukraine-continues-to-face-cyber.html

財團法人大學入學考試中心求才啟事
https://reurl.cc/AK2VrQ

品牌雙A搶各路好手宏碁今年推員工持股信託福利
https://reurl.cc/vevlQk

【知名財團法人】資安所-資訊技術專業服務人員(派遣)
https://www.104.com.tw/job/7huy7

元宇宙揭開搶人才大戰序幕盤點金虎年五大熱門產業職務
https://news.cnyes.com/news/id/4808223

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
U.S. Authorities Charge 6 Indian Call Centers Scamming Thousands of Americans
https://thehackernews.com/2022/02/us-authorities-charge-6-indian-call.html

Hackers Using Device Registration Trick to Attack Enterprises with Lateral Phishing
https://thehackernews.com/2022/01/hackers-using-device-registration-trick.html

留意社群媒體風險！政院：「4個小撇步」聰明網購過好年
https://www.ettoday.net/news/20220203/2177821.htm

複雜的密碼規則？強制修改密碼？這些措施對防範駭客不一定有幫助
https://www.techbang.com/posts/93865-password-rules-mandatory-password-change-are-not-necessarily

假新聞瘋傳、撼動民主⋯平台應該管控內容，還是尊重言論自由
https://www.wealth.com.tw/articles/d52af924-6101-4df9-bba3-5b0a28967b04

報告顯示社群平台詐騙案件大多來自於「網路購物」
https://hypebeast.com/zh/2022/2/social-media-scammers-770-million-usd-2021

詐騙花招層出不窮刑事局秀3軟體防詐
https://www.cna.com.tw/news/asoc/202202030044.aspx

主播粉專遭盜拿護照驗明正身　台灣臉書甩鍋美國總部：你才「非本人」
https://www.mirrormedia.mg/story/amp/20220128ent020/

小心有問題釣魚網站，Mac都不例外
https://www.rfa.org/cantonese/firewall_features/mac-01282022083715.html

澳洲總理微信賬號被易名引發對中共滲透的擔憂
https://www.voacantonese.com/a/ysl-intervenes-in-democracy-WeChat-removed-Australian-PM-s-account-20220128-ry/6416505.html

第三名「假網拍」！常見詐騙手法一次看　把握「3C」避免上當
https://www.ettoday.net/news/20220129/2177417.htm

接到「健保卡被盜用停卡」電話詐騙老梗別上當
https://www.rti.org.tw/news/view/id/2122792

6旬翁領430萬現金　因為檢察官要記鈔票號碼查洩密案
https://cnews.com.tw/204220130a02/

小心投資詐騙搶搭 NFT 熱潮　揭發三種常見 NFT 詐騙手法
https://news.sina.com.tw/article/20220131/41143118.html

個資、手機SIM卡遭掌握！歹徒冒用身分　受害者百萬積蓄沒了
https://news.tvbs.com.tw/life/1705527

「詐騙之島」汙名怎麼洗？年抓3萬餘犯嫌　專家點出關鍵
https://www.ettoday.net/news/20220203/2177099.htm

E.研究報告/工具
Cynet Log4Shell Webinar: A Thorough - And Clear - Explanation
https://thehackernews.com/2022/02/cynet-log4shell-webinar-thorough-and.html

Cynet's Keys to Extend Threat Visibility
https://thehackernews.com/2022/02/cynets-keys-to-extend-threat-visibility.html

How SSPM Simplifies Your SOC2 SaaS Security Posture Audit
https://thehackernews.com/2022/02/how-sspm-simplifies-your-soc2-saas.html

Researchers Use Natural Silk Fibers to Generate Secure Keys for Strong Authentication
https://thehackernews.com/2022/01/researchers-use-natural-silk-fibers-to.html

How Wazuh Can Improve Digital Security for Businesses
https://thehackernews.com/2022/01/how-wazuh-can-improve-digital-security.html

分享駭客松(Hackathon)比賽奪冠後一點心得分享
https://www.dcard.tw/f/softwareengineer/p/238046000

關於駭客這件事
https://www.dcard.tw/f/3c/p/229967058

如何刪除我的整個雅虎帳戶？原由是媒體說30億雅虎賬戶都受到2013年駭客攻擊事件的影響
https://reurl.cc/xOvyQz

我們能證明這個世界不是被電腦模擬出來的嗎？從《駭客任務》說起
https://www.techbang.com/posts/93928-prove-world-simulation

新技術 PGPP 問世，將能保障通訊網路的資安問題與個資隱私性
https://pansci.asia/archives/341081

F.商業
兩大 VPN 服務 Nord 與 Surfshark 宣布合併
https://www.pcmarket.com.hk/vpn-provider-nord-merge-with-surfshark/

用 Surfshark VPN 看片不限裝置與人數，放大你的春節 Netflix 影片庫
https://www.cool3c.com/article/172031

不只虛擬鄧麗君　趨勢科技：未來「數位分身」爭議將更多
https://finance.ettoday.net/news/2156841

Google Cloud的NoSQL資料庫服務新增自動擴展功能
https://www.ithome.com.tw/news/149149

Google推出不需綁Gmail的Workspace免費服務
https://times.hinet.net/news/23742227

Google雲端推無伺服器Spark服務，還可在BigQuery編輯程式碼無縫執行
https://www.ithome.com.tw/news/149202

加強資安、網管效能　合勤智慧雲端「星雲」更新功能
https://www.bg3.co/a/jia-qiang-zi-an-wang-guan-xiao-neng-he-qin-zhi-hui-yun-duan-xing-yun-geng-xin-gong-neng.html

Citrix以165億美元出售並下市，將和Tibco合併
https://www.ithome.com.tw/news/149169

G.政府
建立期貨商資通安全檢查機制
http://www.selaw.com.tw/LawArticleRef.aspx?LawID=G0101501&ModifyDate=1101230&LawNO=10000

國發基金投資逾20億助攻160多家企業讓新創遍地開花
https://udn.com/news/story/7238/6076253

首任數位發展部長傳內定郭耀煌
https://reurl.cc/QjErqZ

數位發展部拚年中掛牌　首任部長若是她⋯⋯別具歷史意義
https://www.cmmedia.com.tw/home/articles/31897

陳家欽新春坦言未來務必強化「科技犯罪偵查能量」
https://www.peopo.org/news/571271

建置專業軟體鑑定深偽影音　林建隆超前部署推警科偵教育
https://www.ettoday.net/news/20220202/2172460.htm

不在籍投票擴及公職人員選舉綠委：須防中國介入
https://news.ltn.com.tw/news/politics/paper/1498844

考選部啟動10年國考數位轉型　「申論題電腦作答」先上路
https://www.ettoday.net/news/20220202/2182253.htm

資訊巨量伴隨網路亂象叢生　陳菊示警隱私權挑戰更巨大
https://www.ettoday.net/news/20220130/2181262.htm

關鍵基礎設施防駭年底大規模演習
https://reurl.cc/6Ed19V

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
Web 3.0來了！聯網汽車變駭客眼中新肥羊？11個資安必懂趨勢
https://www.bnext.com.tw/article/67542/2022-trend-internet-security

車載、元宇宙新應用萌芽光學二線廠迎轉型曙光
https://www.cna.com.tw/news/afe/202202040040.aspx

【IOT韌體檢測】你家的泰迪熊安全嗎？來UFO一下吧！ feat. 陳智偉
https://player.soundon.fm/p/8fdc3e51-8bfb-4bfa-9c65-8ea2ce5a6eb7/episodes/a7c0ed86-33b7-4ce9-8633-5363b9f92470

農業物聯網感測設備：氣象站、土壤感測器、縮時攝影機和訊號閘道器
https://www.cool3c.com/article/171806

AI、IoT新創投資旋風風靡全台灣
https://ctee.com.tw/news/tech/588314.html

AI導入能源轉型慎防資安漏洞
https://ctee.com.tw/news/tech/588315.html

電動機車系統遭駭！怒控維修無期業者：修復中
https://www.youtube.com/watch?v=skk0EYDb0IQ

本地化AI資料擷取工具　針對辨識繁體中文
https://reurl.cc/9O3jL8

I.教育訓練
不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
SyntaxError 2022/2/9
https://www.meetup.com/pythonhug/events/283677361/

HackingThursday 黑客星期四 - Week meetup Taipei 固定聚會台北 2022/2/10
https://www.meetup.com/hackingthursday/events/283710908/

Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

Write Once, Deploy Anywhere 的智能合約虛擬機 2022/2/12
https://www.meetup.com/Taipei-Blockchain/events/282521718/

《數位人權研討會》剖析元宇宙發展痛點：資訊安全與數位人權 2022/2/14
https://www.accupass.com/event/2201050729181065808149

車聯網供應鏈資安研討會 2022/2/15 (二) 14:00~16:30 (13：30開始報到)
https://www.teema.org.tw/education.aspx?infoid=37800

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

國家高速網路與計算中心教育訓練【資安初階課程】ISO 27001資產盤點暨風險評鑑實務課程 2022/2/24
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3969&from_course_list_url=homepage

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/1/24 ~ 2022/1/28

noreply@blogger.com (Unknown) — Fri, 28 Jan 2022 12:51:00 +0000

資安事件新聞週報 2022/1/24 ~ 2022/1/28

1.重大弱點漏洞/後門/Exploit/Zero Day
Patching the CentOS 8 Encryption Bug is Urgent – What Are Your Plans
https://thehackernews.com/2022/01/patching-centos-8-encryption-bug-is.html

Apple Releases iOS and macOS Updates to Patch Actively Exploited 0-Day Vulnerability
https://thehackernews.com/2022/01/apple-releases-ios-and-ipados-updates.html

12-Year-Old Polkit Flaw Lets Unprivileged Linux Users Gain Root Access
https://thehackernews.com/2022/01/12-year-old-polkit-flaw-lets.html

Linux PolicyKit 嚴重安全漏洞：Pwnkit被揭露
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9696

Linux 12年漏洞可讓駭客以根權限執行程式碼，影響所有發行版
https://www.ithome.com.tw/news/149096

Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion
https://www.exploit-db.com/exploits/50688

PHPIPAM 1.4.4 - SQLi (Authenticated)
https://www.exploit-db.com/exploits/50684

駭客大肆收集存在Log4Shell漏洞的VMware遠端工作平臺名單，用戶應加速修補的腳步
https://blogs.blackberry.com/en/2022/01/log4u-shell4me

McAfee Agent含有可讓用戶以系統權限執行程式碼的安全漏洞
https://www.ithome.com.tw/news/149034

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
傳統金融大革命！無限制支付、開放銀行、GameFI，交易世界還有哪些變化
https://www.bnext.com.tw/article/67502/2022-trend-financial-technology

星展銀揭併購花旗4大策略考量 3500名員工續任
https://reurl.cc/9OvNXj

金管會成立春節應變小組黃天牧坐鎮緊盯三件事
https://news.cnyes.com/news/id/4809132

春節九天連假金融服務不打烊
https://turnnewsapp.com/livenews/finance/A08614002022012717445081

金管會開放保險業3大管道投資6大核心戰略產業
https://ec.ltn.com.tw/article/breakingnews/3816068

7-11結盟美廉國泰人壽　直球對決「兩全」支付
https://www.cardu.com.tw/news/detail.php?45309

證券商頻遭駭客攻擊千萬投資人獲通知「限期改密碼」
https://reurl.cc/QjRAAZ

你的券商網頁密碼改了嗎？小心明天恐無法電子下單
https://reurl.cc/LpWrv7

強化下單安全 1362萬帳戶完成密碼更新
https://ec.ltn.com.tw/article/breakingnews/3813147

網路下單應採雙因子驗證證交所呼籲落實資安防範
https://www.sinotrade.com.tw/richclub/news/61f0a41c8859b9d8221c433c

近3萬張台灣信用卡資料在暗網兜售！防損失學這「三招」
https://www.nownews.com/news/5699912

關鍵業務 4 小時復原！國泰金取得「BSI 營運持續管理系統認證」
https://finance.technews.tw/2022/01/24/business-continuity-management/

確保春節期間ATM運作順暢央行攜手金管會出招
https://www.cna.com.tw/news/afe/202201240260.aspx

春節使用ATM注意5大事　銀行3700億銀彈上膛
https://www.cardu.com.tw/news/detail.php?45300

央行+金管會祭3招春節ATM提款、跨行轉帳不中斷
https://ec.ltn.com.tw/article/breakingnews/3811676

春節9天假即將開始金管會要求金融四不
https://ctee.com.tw/news/finance/588861.html

金管會成立應變小組緊盯春節期間重大金融輿情
https://reurl.cc/Vjzx0y

證交所電腦規劃部經理林志清：導入資安認證提供安全交易
https://reurl.cc/AKjr1d

林志清：導入資安認證提供安全交易
https://ctee.com.tw/news/stocks/587349.html

防證券網路下單平台遭駭掌握「三二一」原則提升資安防護
https://news.cnyes.com/news/id/4808179

個人信評轉交更便捷！加密直傳P2P　Q2上路　
https://finance.ettoday.net/news/2177934

8家P2P信貸業者有意加入聯徵新機制　兩分鐘取得個人信用評分
https://tw.appledaily.com/property/20220125/TXSWSERM2VHYFGJJVPUTZB3EFU/

個人聯徵信用評分資料　開放直傳P2P借貸平台
https://www.cardu.com.tw/news/detail.php?45310

國泰金:代子公司國泰綜合證券公告資安長異動
https://news.cnyes.com/news/id/4808635

三星發表資安晶片，為信用卡加入指紋辨識
https://technews.tw/2022/01/27/samsung-smart-fingerprint-security-ic/

3.電子支付/行動支付/pay/資安
政院通過廢止「電子票證發行管理條例」
https://www.ey.gov.tw/Page/9277F759E41CCD91/75ddda5b-9173-4820-b582-3bf357994701

「疫」外新高！行動支付常用度逼近實體卡
https://udn.com/news/story/7239/6051622

大陸行動支付消費占比一線城市8成、五線城市9成
https://www.chinatimes.com/realtimenews/20220127003987-260409?chdtv

包紅包免現金沒對方帳號也能轉帳
https://reurl.cc/02vqQY

「手機轉紅包」正夯善用APP轉帳免手續費
https://ec.ltn.com.tw/article/breakingnews/3813131

疫情升溫！一次看懂如何用行動支付發「數位紅包」
https://www.bnext.com.tw/article/67442/2022-digital-red-envelope

傳政府擬再派消費券與電子支付營運商「吹風」
https://reurl.cc/VjzxQb

科大教授：推廣電子支付需先了解市民消費習慣
https://reurl.cc/RjqVQG

超商拚電子支付大戰開打
https://udn.com/news/story/7239/6060890

首選偏好度達50% 常用度逼近七成創新高　近六成消費者於疫情期間增加使用行動支付
https://www.sogi.com.tw/articles/mic_iii/6257347

入侵雲端竊電子支付帳戶10萬儲值金男子被判刑6月
https://udn.com/news/story/7321/6055170

詐騙也用電子支付嫌犯利用網遊詐騙線上玩家逾百萬
https://reurl.cc/RjqVgn

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
NFT如何從「紙手」變到「鑽石手」他建議：社群先做好這件事
https://ctee.com.tw/industrynews/financesmanage/588605.html

NFT 交易所 Opensea 被駭，駭客鑽漏洞低買高賣 NFT
https://technews.tw/2022/01/27/opensea-hacked/

研究顯示DeFi成為日益流行的洗錢工具
https://reurl.cc/l9QrrA

忘記冷錢包密碼？工程師成功繞過安全防護、取回 200 萬美元加密資產
https://www.blocktempo.com/forget-trezor-pin-password-engineer-crack-the-protection-and-recover-2-million-crypto-asset/

用Defi放大你的壓歲錢
https://news.sina.com.tw/article/20220127/41119952.html

Crypto.com證實因2FA被破而遭駭，將提升成MFA
https://www.ithome.com.tw/news/149078

OpenSea 漏洞讓駭客以遠低於市價購買知名NFT 再高價轉售
https://hypebeast.cn/2022/1/opensea-bug-nft-hackers-cheap-resale

HKCERT教路保護NFT資產
https://www.pcmarket.com.hk/hkcert_nft/

Crypto.com 證實 483 名用戶加密貨幣資金遭不當存取，損失達 3,400 萬美元
https://blog.twnic.tw/2022/01/25/21666/

Z世代注意！先買後付BNPL讓你無形中買爆？看懂如何運作、風險有哪些
https://www.bnext.com.tw/article/67338/how-bnpl-work

XREX取得加拿大MSB牌照為開拓北美市場打根基
https://turnnewsapp.com/livenews/tech/A06659002022012708545981

全球第四大加密貨幣交易所 Crypto.com 疑似遭駭，損失以太幣達 1,500 萬美元
https://www.twcert.org.tw/tw/cp-104-5619-9bdd5-1.html

加密貨幣崛起！Visa調查：消費者希望銀行提供相關產品
https://reurl.cc/Goj6DA

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
勒索軟體LockBit鎖定VMware虛擬化平臺而來
https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html

網釣簡訊被用於散布手機木馬程式FluBot、TeaBot
https://threatpost.com/threat-actors-androids-flubot-teabot-campaigns/177991/

駭客利用逾800個WordPress網站，向巴西民眾散布銀行木馬Chaes
https://www.bleepingcomputer.com/news/security/chaes-banking-trojan-hijacks-chrome-with-malicious-extensions/

中國駭客APT27鎖定德國企業下手，使用HyperBro後門程式發動攻擊
https://www.bleepingcomputer.com/news/security/german-govt-warns-of-apt27-hackers-backdooring-business-networks/

惡意軟體利用MSHTML漏洞，攻擊西亞政府高官與國防產業人士
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html

白俄羅斯鐵路公司遭到加密軟體攻擊，駭客要求釋放50名政治犯
https://www.bleepingcomputer.com/news/security/hackers-say-they-encrypted-belarusian-railway-servers-in-protest/

駭客組織APT36運用安卓木馬程式，鎖定印度軍事與外交單位下手
https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html

安卓惡意軟體Brata鎖定網路銀行用戶，並在竊密後重置手機
https://www.bleepingcomputer.com/news/security/android-malware-brata-wipes-your-device-after-stealing-data/

駭客透過加殼軟體鎖定足球迷，散布多種竊密木馬
https://threatpost.com/donald-trump-packer-malware-infostealers/177887/

惡意軟體Emotet透過十六進位、八進位的IP位址來散布
https://www.trendmicro.com/en_us/research/22/a/emotet-spam-abuses-unconventional-ip-address-formats-spread-malware.html

QNAP發現勒索軟體會攻擊暴露於外網的 NAS 提醒用戶確認路由器及 NAS 的安全設定
https://www.kocpc.com.tw/archives/424638

美國指控勒索軟體Diavol出自使用TrickBot的駭客組織
https://www.bleepingcomputer.com/news/security/fbi-links-diavol-ransomware-to-the-trickbot-cybercrime-group/

4成勒索軟體受害者選擇支付贖金
https://www.infosecurity-magazine.com/news/two-fifths-ransomware-victims/

資安廠商發現多起間諜軟體攻擊，針對大型製造業竊取各種登入資訊
https://www.twcert.org.tw/tw/cp-104-5623-1c3a7-1.html

第三款UEFI惡意程式MoonBounce現身
https://pttdigit.com/pc_shopping/M.1643208393.A.B3E.html

鎖定烏克蘭政府的惡意軟體WhisperGate，與勒索軟體NotPetya攻擊手法雷同
https://www.cyberscoop.com/whisper-gate-notpetya-ukraine-russia/

勒索軟體駭客意圖收買目標組織的內部員工，以利進行攻擊
https://www.bleepingcomputer.com/news/security/ransomware-gangs-increase-efforts-to-enlist-insiders-for-attacks/

Emotet Now Using Unconventional IP Address Formats to Evade Detection
https://thehackernews.com/2022/01/emotet-now-using-unconventional-ip.html

New espionage attack by Molerats APT targeting users in the Middle East
https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east

How BRATA is monitoring your bank account
https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account

Prime Minister’s Office Compromised: Details of Recent Espionage Campaign
https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html

Hackers Infect macOS with New DazzleSpy Backdoor in Watering-Hole Attacks
https://thehackernews.com/2022/01/hackers-infect-macos-with-new-dazzlespy.html

TrickBot Malware Using New Techniques to Evade Web Injection Attacks
https://thehackernews.com/2022/01/trickbot-malware-using-new-techniques.html

Mobile Banking Trojan BRATA Gains New, Dangerous Capabilities
https://thehackernews.com/2022/01/mobile-banking-trojan-brata-gains-new.html

Watering hole deploys new macOS malware, DazzleSpy, in Asia
https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/

Hacktivist group shares details related to Belarusian Railways hack
https://www.curatedintel.org/2022/01/hacktivist-group-shares-details-related.html

Cobalt Strike, a Defender’s Guide - Part 2
https://thedfirreport.com/2022/01/24/cobalt-strike-a-defenders-guide-part-2/

AsyncRAT Introduces a New Delivery Technique
https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign

APT 27 group targets German commercial companies
https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf?__blob=publicationFile&v=10

Chaes Banking Trojan Hijacks Chrome Browser with Malicious Extensions
https://thehackernews.com/2022/01/chaes-banking-trojan-hijacks-chrome.html

Widespread FluBot and TeaBot Malware Campaigns Targeting Android Devices
https://thehackernews.com/2022/01/widespread-flubot-and-teabot-malware.html

Hackers Using New Evasive Technique to Deliver AsyncRAT Malware
https://thehackernews.com/2022/01/hackers-using-new-evasive-technique-to.html

Observations from the StellarParticle Campaign
https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/

North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign
https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Apple 修補10大 iPadOS / iOS 15.3安全漏洞，舊版快更新
https://mrmad.com.tw/apple-fix-ios-153-patches-10-security-flaws

網頁瀏覽器Safari存在漏洞，恐曝露蘋果裝置的視訊鏡頭和用戶資料
https://www.wired.com/story/safari-flaws-webcam-online-accounts-mic/

macOS Monterey 12.2 更新，主要修復 Safari 資安漏洞
https://applefans.today/macos-monterey-12-2/

為什麼台北通不送去MAS資安認證
https://ptthito.com/gossiping/m-1643341942-a-e8b/

安卓騙錢App上億用戶受害，損失數億美元
https://blog.zimperium.com/dark-herring-android-scamware-exceeds-100m-installations/

新版iOS Face ID進化戴口罩可解鎖iPhone
https://ctee.com.tw/news/tech/589533.html

Verizon的TracFone用戶報告駭客攻擊，電話號碼遭盜用
https://reurl.cc/zM1RaQ

疫苗接種數位證明如何存入Apple錢包？兩步驟用Pass2U輕鬆搞定
https://mrmad.com.tw/digital-vaccine-certification-apple-wallet-pass2u

Google Pixel手機只支援3年安全更新遭批評
https://www.ithome.com.tw/news/149094

台電App改版升級！線上地址停電報修超便利
https://finance.ettoday.net/news/2179865

「為了秀手上這支」！老爸出門都搶著付錢　網筆記：趕快學起來
https://www.ettoday.net/news/20220127/2177579.htm

直接信用卡感應，蘋果要把 iPhone 變成「行動刷卡機」
https://technews.tw/2022/01/27/iphones-credit-cards-nfc/

傳蘋果iOS 15.4推收款終端功能商戶可用iPhone直接接受信用卡支付
https://reurl.cc/jkWEYy

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
2021年企業網路遭駭次數較前一年度激增50%
https://blog.twnic.tw/2022/01/27/21750/

比前年增38%! 2021年台灣受網路攻擊每周平均2644次
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9684

防範惡意濫用，微軟正式關閉Excel 4.0巨集
https://www.ithome.com.tw/news/149028

系統遭駭客攻擊 Gogoro：今天起恢復交車
https://reurl.cc/AKjmrQ

駭客藉由入侵WordPress網站，使造訪者電腦被植入惡意的Chrome擴充程式
https://www.ithome.com.tw/news/149113

台達電日前遭到駭客攻擊對營運無重大影響
https://udn.com/news/story/7240/6065931

傳台達遭勒索 4.1 億元、萬台電腦被加密，台達：與事實不符
https://technews.tw/2022/01/27/delta-hacker-2/

台達電也遭駭客入侵！ 1,500 台伺服器、12,000 台電腦都逃不過 Conti 勒索軟體的攻擊
https://buzzorange.com/techorange/2022/01/28/delta-electronics-hacker/

台達電:(補充公告)說明部份資訊系統遭受駭客網路攻擊
https://news.cnyes.com/news/id/4809243

台達電駁斥大量電腦與伺服器被Conti勒索加密的傳聞，但網站迄今仍無法運作
https://www.ctwant.com/article/165246

台達資訊系統遭駭客攻擊，官網遲未復原？官方澄清：掃描檢測即能運作，與重要營運無關
https://www.bnext.com.tw/article/67556/delta-it-hack-attack

Gogoro驚傳「駭客攻擊系統」延誤交車！官方：已提高資安層級
https://speed.ettoday.net/news/2178395

諾貝爾基金會網站於頒獎日遭到DDoS攻擊
https://www.bleepingcomputer.com/news/security/nobel-foundation-site-hit-by-ddos-attack-on-award-day/

Azure用戶遭到大規模DDoS攻擊，3.47 Tbps流量再創新高
https://azure.microsoft.com/en-us/blog/azure-ddos-protection-2021-q3-and-q4-ddos-attack-trends/

台灣4選手備戰冬奧會避談北京人權、資安等爭議
https://reurl.cc/KpeYpy

法國警告冬奧選手赴北京「個資恐外洩」　建議刪除政治敏感內容
https://www.ettoday.net/news/20220125/2177298.htm

加拿大外交部遭駭客攻擊部分服務停擺至今
https://www.worldjournal.com/wj/story/121257/6062228

美國要求政府機關採用零信任的資安防護戰略，於1月26日正式實施
https://www.whitehouse.gov/omb/briefing-room/2022/01/26/office-of-management-and-budget-releases-federal-strategy-to-move-the-u-s-government-towards-a-zero-trust-architecture/

德國指控中國駭客組織，擬入侵藥廠與科企
https://reurl.cc/e6zl5M

德國情報機構指控中國黑客「貓熊使者」入侵
https://www.secretchina.com/news/b5/2022/01/28/996322.html

德企遭中國駭客盯上北韓網路兩星期二度癱瘓
http://www.ksnews.com.tw/index.php/news/contents_page/0001568137

希臘議會60個電子郵件帳號遭駭，緊急關閉郵件伺服器
https://www.tovima.gr/2022/01/21/international/greek-parliament-authorities-probe-hacking-of-60-email-accounts/

北韓遭大規模網攻官媒、外務省全遭殃
https://news.ltn.com.tw/news/world/breakingnews/3814568

北韓駭客Lazarus利用Windows Update躲避偵測、還以GitHub遠端控制
https://www.ithome.com.tw/news/149130

北韓多個機構官網遭黑客攻擊
https://reurl.cc/LpWr0e

北韓連兩天遭駭客攻擊各大網站卡卡
https://www.rti.org.tw/news/view/id/2123247

俄國駭客APT29藉由竊取瀏覽器Cookie，繞過雙因素驗證接管Office 365帳號
https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/

中共網軍壓境！台灣去年遭網路攻擊大增38％遠高亞太平均值
https://news.ltn.com.tw/news/politics/breakingnews/3815742

美國或禁阿里巴巴？分析人士:“阿里雲”難逃中共資安控制
https://www.voacantonese.com/a/Alibaba-Cloud-services-could-be-banned-in-the-US-20210125/6411448.html

歐洲安全被滲透？中國安檢設備大廠「同方威視」遭控與解放軍、共產黨有密切關聯
https://www.storm.mg/article/4166787?page=1

High-Severity Rust Programming Bug Could Lead to File, Directory Deletion
https://thehackernews.com/2022/01/high-severity-rust-programming-bug.html

Experts Find Strategic Similarities b/w NotPetya and WhisperGate Attacks on Ukraine
https://thehackernews.com/2022/01/experts-find-strategic-similarities-bw.html

Initial Access Broker Involved in Log4Shell Attacks Against VMware Horizon Servers
https://thehackernews.com/2022/01/initial-access-broker-involved-in.html

資安工程師
https://www.104.com.tw/job/5wav0?jobsource=jolist_a_date

ISO 27001資訊安全稽核專員(台北)
https://www.cakeresume.com/companies/sgs-_/jobs/iso-27001-information-security-auditor-taipei?locale=zh-TW

AD10407 資安管理師
https://www.104.com.tw/job/7ebd5?jobsource=m104

中華郵政招考資訊類人員63名月入可達41K
https://www.1111.com.tw/news/jobns/143970

資安駐點工程師20002503
https://www.104.com.tw/job/7ie21

資訊部：資訊工程師 / 資安工程師（八德）
https://www.104.com.tw/job/7igtw?jobsource=jolist_d_relevance

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
疫情加速電子紅包滿天飛，警覺防範犯罪分子財務詐欺
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9688

你怎會有我的LINE！行員竟向保全洩露客戶個資，金管會要求台新銀改善3件事
https://www.storm.mg/lifestyle/4172375

趨勢科技揭露三種常見NFT詐騙手法
https://reurl.cc/7e0QeN

北韓駭客Lazarus以航太職缺發動網釣攻擊，並濫用Windows Update元件進駐受害電腦
https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/

資安專家︰設雙重驗證勿用懶人密碼
https://news.ltn.com.tw/news/society/paper/1497601

Omicron疫情有關的網釣攻擊在3個月裡爆增5倍
https://blog.barracuda.com/2022/01/20/threat-spotlight-covid-19-test-related-email-scams/

美國警告竄改QR Code的攻擊行動
https://www.bleepingcomputer.com/news/security/fbi-warns-of-malicious-qr-codes-used-to-steal-your-money/

防投資詐騙納第三方資訊業
https://ctee.com.tw/news/finance/587311.html

快遞公司通知補繳費用？如何視破網路釣魚詐騙
https://www.techbang.com/posts/93507-email-phishing-scams

春節網購留意一頁式網站詐騙9特徵
https://ec.ltn.com.tw/article/breakingnews/3816207

詐騙手法翻新「假投資」排第一
https://www.rti.org.tw/news/view/id/2123060

小心有詐！內政部春節連假前公布最多的3種詐騙手法
https://times.hinet.net/news/23728548

詐騙集團新騙術搶搭NFT熱　趨勢科技揭這3種常見詐騙手法
https://www.appledaily.com.tw/property/20220125/SXNNA4GDEVCSPAPW76CGDOBIDE/

E.研究報告/工具
網際網路緩慢步向全HTTPS　協定更新追不上駭客濫用部署加密卻未達安全　大量伺服器TLS只做半套
https://www.netadmin.com.tw/netadmin/zh-tw/trend/1237AD03B53B4DF4A2A171D5DE13EC27

IIS log 位置
https://reurl.cc/Wkxmxy

ZTNAs Address Requirements VPNs Cannot. Here's Why
https://thehackernews.com/2022/01/ztnas-address-requirements-vpns-cannot.html

Hackers Creating Fraudulent Crypto Tokens as Part of 'Rug Pull' Scams
https://thehackernews.com/2022/01/hackers-creating-fraudulent-crypto.html

Hackers Exploited MSHTML Flaw to Spy on Government and Defense Targets
https://thehackernews.com/2022/01/hackers-exploited-mshtml-flaw-to-spy-on.html

Google Drops FLoC and Introduces Topics API to Replace Tracking Cookies for Ads
https://thehackernews.com/2022/01/google-drops-floc-and-introduces-topics.html

LightSpeed Cache Vulnerability - Paper
https://www.exploit-db.com/docs/50679

Abusing LAPS - Paper
https://www.exploit-db.com/docs/50680

F.商業
中華資安國際奪五A評鑑
https://ieknet.iek.org.tw/ieknews/news_more.aspx?actiontype=ieknews&indu_idno=0&nsl_id=72e9ca324f9c4ecdbd59be49a6009bb5

業師助攻網紅資安平台以優越UX體驗創造利基巿場
https://money.udn.com/money/story/11799/6055795

2021年資安產值超過600億！2022年安碁資訊（6690）營收繼續讓政府養
https://www.wantgoo.com/blog/343059/post/32

G.政府
產創條例三讀智機、5G投抵延長三年至2024年底
https://udn.com/news/story/7238/6065551

議員質疑台北通市府資訊局澄清非「強推使用」
https://reurl.cc/MbO5Y3

台北通個資疑慮　4天近萬人連署拒北市府強迫推銷
https://news.tvbs.com.tw/politics/1699869

苗博雅google表單連署反「台北通」網友實測「假帳號要多少有多少」
https://times.hinet.net/news/23729517

台北通累計近240萬會員數北市資訊局感謝議員關心個資議題
https://www.mypeoplevol.com/Article/15718

央廣多媒體資料庫開放歡迎來挖寶
https://www.rti.org.tw/news/view/id/2123185

科技部改制國科會將上路！吳政忠點名量子科技、資安等三大領域邁向國際
https://www.bnext.com.tw/article/67506/last-most-2022

關注太空產業，科技部：未來大型衛星每年發射數至少成長 2 倍
https://technews.tw/2022/01/26/space-quantum-technology-most-taiwan/

去年三大科學園區營業額上看3.5兆元科技部組改後有四大任務
https://news.cnyes.com/news/id/4808607

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
再生能源領域之6大資安風險
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9690

攻擊者鎖定工控系統下手，企圖竊取企業帳密
https://securelist.com/hunt-for-corporate-credentials-on-ics-networks/105545/

針對大型製造業，竊取登入資訊! 卡巴斯基發現多起使用SMTP的間諜軟體攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9692

全球將有1億支智慧路燈！46科技廠攜手打國際戰，童子賢：現在有市場缺標準
https://www.bnext.com.tw/article/67488/th-smart-street-lamp

Moxa取得工控首張IEC 62443-4-2認證開啟工業資安新思維
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000628246_WU01FMA45V65695N3JRJD

I.教育訓練
【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

伊雲谷、中山大學產學合作累積雲端資安人才能量
https://ctee.com.tw/industrynews/technology/587459.html

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Scala Taiwan Mokumoku #14 2022/1/29
https://www.meetup.com/Scala-Taiwan-Meetup/events/283372428/

Android Code Club(Taipei) 2022/2/2
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/283524461/

Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

Write Once, Deploy Anywhere 的智能合約虛擬機 2022/2/12
https://www.meetup.com/Taipei-Blockchain/events/282521718/

《數位人權研討會》剖析元宇宙發展痛點：資訊安全與數位人權 2022/2/14
https://www.accupass.com/event/2201050729181065808149

車聯網供應鏈資安研討會 2022/2/15 (二) 14:00~16:30 (13：30開始報到)
https://www.teema.org.tw/education.aspx?infoid=37800

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

國家高速網路與計算中心教育訓練【資安初階課程】ISO 27001資產盤點暨風險評鑑實務課程 2022/2/24
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3969&from_course_list_url=homepage

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/1/17 ~ 2022/1/21

noreply@blogger.com (Unknown) — Fri, 21 Jan 2022 12:30:00 +0000

資安事件新聞週報 2022/1/17 ~ 2022/1/21

1.重大弱點漏洞/後門/Exploit/Zero Day
微軟推出 2022 年一月份 Patch Tuesday 軟體更新修補包
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9675

Microsoft 已發布安全更新，以解決多版本 Windows HTTP 遠端程式碼執行弱點
https://github.com/antx-code/CVE-2022-21907

Microsoft Exchange Server 遠端指令的弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21846

Microsoft 已發布安全更新，以解決多版本 Windows HTTP 遠端程式碼執行弱點
https://www.klcg.gov.tw/tw/education/3522-250411.html

Windows IKE Extension 存在拒絕服務的弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21848

Oracle Critical Patch Update for January 2022
https://reurl.cc/mGZD0W

Citrix發布針對Hypervisor的安全更新
https://support.citrix.com/article/CTX335432

checkpoint Enterprise Endpoint Security E86.20 Windows Clients 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-30360

Cisco Unified Contact Center Management Portal 和Cisco Unified Contact Center Domain Manager 存在安全弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20658

Cisco Issues Patch for Critical RCE Vulnerability in RCM for StarOS Software
https://thehackernews.com/2022/01/cisco-issues-patch-for-critical-rce.html

Google Details Two Zero-Day Bugs Reported in Zoom Clients and MMR Servers
https://thehackernews.com/2022/01/google-details-two-zero-day-bugs.html

High-Severity Vulnerability in 3 WordPress Plugins Affected 84,000 Websites
https://thehackernews.com/2022/01/high-severity-vulnerability-in-3.html

New Unpatched Apple Safari Browser Bug Allows Cross-Site User Tracking
https://thehackernews.com/2022/01/new-unpatched-apple-safari-browser-bug.html

FTP伺服器軟體Serv-U遭到Log4Shell漏洞攻擊
https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/#CVE-2021-35247

SolarWinds 的 Serv-U Web 登錄允許未經身份驗證清理機制
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-35247

Trendmicro 產品 Apex One 和企業 Worry-Free 版 (10.0 SP1) 存在一個特權驗證弱點
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45440
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45231

McAfee端點代理程式存在漏洞，攻擊者可取得作業系統最高權限
https://www.bleepingcomputer.com/news/security/mcafee-agent-bug-lets-hackers-run-code-with-windows-system-privileges/

ASUS VivoMini/Mini PC - improper input validation
https://www.twcert.org.tw/tw/cp-132-5547-34bc4-1.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
FIN8 Hackers Spotted Using New 'White Rabbit' Ransomware in Recent Attacks
https://thehackernews.com/2022/01/fin8-hackers-spotted-using-new-white.html

元大證傳逾15萬交易戶未配合資安新制 24日起線上交易卡卡
https://www.wealth.com.tw/articles/265819bb-005d-4729-a55e-b0453bfab95c

駭客「撞庫」攻擊冒名買股坑殺散戶
https://feed.easybranches.com/tw/business/37411859

證券密碼限期更改》駭客避開券商轉向用戶手機下手　邵之雋：駭客不是「撞庫」而是侵門踏戶
https://www.cmmedia.com.tw/home/articles/31945

防駭客趁春節蠢動證交所盯複委託資安
https://udn.com/news/story/7251/6051569

避免駭客攻擊投資人1月24日前須更新密碼
https://wantrich.chinatimes.com/news/20220122900090-420101

券商1月底無法修改系統 24日前應要求客戶換密碼
https://newtalk.tw/news/view/2022-01-21/700191?

證交所：證券商無法如期完成系統修改應要求客戶限期更新密碼
https://www.mypeoplevol.com/Article/15366

證交所呼籲投資人更新下單密碼，防撞庫攻擊，券商應採雙因子驗證
https://reurl.cc/AKyA6Q

證券電子下單帳戶限期改密碼　邵之雋：防駭治本須靠民眾做一件事
https://www.ctwant.com/article/163606

面對金融科技新樣態要知變、應變和馭變
https://wantrich.chinatimes.com/news/20220123900006-420101

將來銀行試營運！3月開業喊出兩年百萬戶目標，後發先至靠這招
https://www.bnext.com.tw/article/67352/next-bank-goals

國內第三家純網銀本週六試營運將來銀行預計3月底正式開業
https://cnews.com.tw/134220118a03/

將來銀行二年要拼百萬戶總座許柏林透露有「秘密武器」
https://turnnewsapp.com/livenews/finance/A95645002022011812292399

將來銀行建構資安三大防護網
https://money.udn.com/money/story/5613/6043303?from=edn_next_story

用戶自保勤換密碼、聯徵註記
https://udn.com/news/story/122653/6046189

兼顧資安與合規需求 IaC助攻國泰金控踏穩上雲之路
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000628231_8FL1REHW4MP4J90FC44BL

網路交易盜刷太猖獗　刷滿3千元須即時通知
https://www.cardu.com.tw/news/detail.php?45258

銀行數位存款帳戶衝破千萬戶 LINE Bank奪第5
https://reurl.cc/Zr1yGM

3.電子支付/行動支付/pay/資安
疫情升溫！一次看懂如何用行動支付發「數位紅包」
https://www.bnext.com.tw/article/67442/2022-digital-red-envelope

7成台灣人結帳選電子支付！從四大趨勢看台灣行動支付發展
https://www.bnext.com.tw/article/67423/mic-mobile-payment-report-2022

電子支付業績續新高　悠遊付會員數坐4望3
https://www.cardu.com.tw/news/detail.php?45222

黑客無處不在？　FBI警告QR code付費或被盜取金錢
https://reurl.cc/EpX1Ga

電子支付大落後　推廣一味得把口
https://hk.on.cc/hk/bkn/cnt/commentary/20220123/bkn-20220123000338852-0123_00832_001.html

詐騙也用電子支付嫌犯利用網遊詐騙線上玩家逾百萬
https://reurl.cc/GoXKe3

政院通過廢止「電子票證發行管理條例」
https://www.ey.gov.tw/Page/9277F759E41CCD91/75ddda5b-9173-4820-b582-3bf357994701

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Crypto.com 遭駭損失超過 3 千萬美元，5 千顆比特幣和以太幣被盜
https://today.line.me/tw/v2/article/VxQqJG1

Multichain駭客事件仍有價值近150萬美元的以太坊未歸還
https://news.cnyes.com/news/id/4806749

周杰倫NFT暴起暴落？想追名人NFT，先小心四大殘酷真相
https://www.beautimode.com/article/content/88865/

你的券商網頁密碼改了嗎？小心明天恐無法電子下單
https://udn.com/news/story/7251/6054839

BlueNoroff 駭侵團體利用假 MetaMask 錢包竊取加密貨幣
https://www.twcert.org.tw/tw/cp-104-5543-427f1-1.html

加密貨幣很好賺，卻也一堆人被割韭菜！它曾名列全球百大，如今價格剩不到1美元
https://www.storm.mg/lifestyle/4160597?page=1

白帽駭客：2025年區塊鏈遊戲市場規模可能會增長到397億美元
https://news.cnyes.com/news/id/4807133

新加坡打壓加密貨幣禁業者大肆推廣
https://www.chinatimes.com/realtimenews/20220117004430-260410?chdtv

貨幣革命．中｜「零售數字港元」應用超乎想像　惟金管局仍未拍板
https://reurl.cc/qOZ0LD

推特引入NFT頭像功能，為什麼遭馬斯克批「煩人且浪費資源」
https://www.bnext.com.tw/article/67440/twitter-um-nft-criti-musk

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
物聯網攻擊：勒索病毒 vs.殭屍網路惡意程式的同與不同
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9668

木馬程式StrRAT以物流送貨通知的名義散布
https://www.fortinet.com/blog/threat-research/new-strrat-rat-phishing-campaign

駭客組織Molerats鎖定中東發動後門程式攻擊
https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east

Mirai殭屍網路利用Log4Shell漏洞，鎖定Zyxel網路設備下手
https://www.akamai.com/blog/security/mirai-botnet-abusing-log4j-vulnerability

勒索軟件攻擊再襲 QNAP NAS 設備　 HKCERT 教路保護數據安全
https://www.pcmarket.com.hk/hkcert-advice-qnap-nas-user-to-protect-their-data/

針對 QNAP NAS 裝置攻擊的 Qlocker 勒贖軟體，再度發動大規模攻擊
https://www.twcert.org.tw/tw/cp-104-5549-6bea3-1.html

鎖定Linux平臺的惡意程式在2021年增加了35%
https://www.ithome.com.tw/news/148948

跨國國防工業製造廠 Hensoldt 證實遭勒贖軟體 Lorenz 攻擊
https://www.twcert.org.tw/tw/cp-104-5550-dd334-1.html

How does threat intelligence solve security problems on the cloud
https://blog.netlab.360.com/public-cloud-threat-intelligence-202112/

BlackCat Ransomware | Highly-Configurable, Rust-Driven RaaS On The Prowl For Victims
https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/

Operation Falcon II: Unit 42 Helps INTERPOL Stop SilverTerrier BEC Actors
https://unit42.paloaltonetworks.com/operation-falcon-ii-silverterrier-nigerian-bec/

MoonBounce: the dark side of UEFI firmware
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/

Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk
https://blog.morphisec.com/log4j-exploit-hits-again-vulnerable-vmware-horizon-servers-at-risk

New STRRAT RAT Phishing Campaign
https://www.fortinet.com/blog/threat-research/new-strrat-rat-phishing-campaign

Brazil emails pushing Astaroth/Guildma malware
https://github.com/pan-unit42/tweets/blob/master/2022-01-17-IOCs-for-Astaroth-Guildma-infection.txt
https://twitter.com/malware_traffic/status/1409683375430922254

OceanLotus uses Glitch to spread malware
https://mp.weixin.qq.com/s/1L7o1C-aGlMBAXzHqR9udA

AvosLocker Ransomware Linux Version Targets VMware ESXi Servers
https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/

Tracking A Renewable Energy Intelligence Gathering Campaign
https://blog.bushidotoken.net/2022/01/tracking-renewable-energy-intelligence.html

PerSwaysion Threat Actor Updates Their Techniques and Infrastructure
https://blog.scarletshark.com/perswaysion-threat-actor-updates-their-techniques-and-infrastructure-e9465157a653

FIN7 Uses Flash Drives to Spread Remote Access Trojan
https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/

Delving Deep: An Analysis of Earth Lusca’s Operations
https://reurl.cc/qOZLN0

Destructive malware targeting Ukrainian organizations
https://www.cadosecurity.com/resources-for-dfir-professionals-responding-to-whispergate-malware/
https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

New BHUNT Password Stealer Malware Targeting Cryptocurrency Wallets
https://thehackernews.com/2022/01/new-bhunt-password-stealer-malware.html

Russian Hackers Heavily Using Malicious Traffic Direction System to Distribute Malware
https://thehackernews.com/2022/01/russian-hackers-heavily-using-malicious.html

DDoS IRC Bot Malware Spreading Through Korean WebHard Platforms
https://thehackernews.com/2022/01/ddos-irc-bot-malware-spreading-through.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Researchers Bypass SMS-based Multi-Factor Authentication Protecting Box Accounts
https://thehackernews.com/2022/01/researchers-bypass-sms-based-multi.html

如何在智慧手機上使用 VPN？有什麼優點
https://m.eprice.com.tw/smartos/talk/4504/5704754/1/

QR Code 別亂掃，FBI 示警：恐落入駭客圈套
https://lihkg.com/thread/2854862/page/1

繼英國、荷蘭，美國也要求北京奧運參賽選手使用一次性手機
https://www.securityweek.com/us-olympians-told-use-burner-phones-china

Telegram成駭客偏好銷贓金融帳號資料的重要管道
https://www.bleepingcomputer.com/news/security/telegram-is-a-hotspot-for-the-sale-of-stolen-financial-accounts/?

推特執行長大刀闊斧重整資安團隊，兩名高層遭解雇
https://www.inside.com.tw/article/26466-twitter-security-reorganization

蘋果釋出iOS 15.3版更新　搶救Safari嚴重資安漏洞
https://finance.ettoday.net/news/2175940

北京冬季奧運App存在資安風險，資料傳輸安全性不足，言論審查功能也惹議
https://citizenlab.ca/2022/01/cross-country-exposure-analysis-my2022-olympics-app/

多倫多公民實驗室分析北京冬奧APP「冬奧通」有資安問題
https://news.ltn.com.tw/news/world/breakingnews/3805288

德國之聲獨家：資訊傳輸未加密，甚至內附敏感詞清單—北京冬奧官方APP暗藏資安風險
https://www.storm.mg/article/4156833

小米拚歐龍頭德國背書資安「無異常」
https://www.chinatimes.com/realtimenews/20220118002467-260410?chdtv

Apple 修復可能造成 iPhone、iPad 無法使用的 doorLock DoS 漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9678

你沒看過的微軟「Andromeda」手機作業系統曝光支援手寫功能、Cortana數位助理但最後還是用了 Android
https://www.cool3c.com/article/171834

Android 12 可以禁用 2G 防資安攻擊了，iOS 呢
https://technews.tw/2022/01/21/disable-2g-android-ios/

密碼全盜光！快關iPhone「這設定」保命　爆危險漏洞
https://news.tvbs.com.tw/life/1693590

帳號密碼、照片恐外洩！iPhone爆重大漏洞，快取消「這設定」自救
https://www.storm.mg/lifestyle/4156022

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
提升資安防護設置資安長刻不容緩
https://www.chinatimes.com/newspapers/20220121000362-260210?chdtv

資安跨業聯防讓人民免於恐懼
https://udn.com/news/story/122653/6046213

雲服務資安規範成新焦點
https://money.udn.com/money/story/11162/6053362?from=edn_previous_story

網路攻擊猖獗，台灣去年受攻擊次數較 2020 年大增 38%
https://technews.tw/2022/01/20/log4j-check-point/

研究：台灣機構去年每周平均遭網攻2644次年增38%
https://www.worldjournal.com/wj/story/121475/6048993

AccessPress 遭受駭客攻擊，93 款 WordPress 主題和外掛被植入後門
https://www.kocpc.com.tw/archives/424030

臺灣疑首宗SIM Swapping攻擊出現！有民眾手機號碼遭詐騙集團掛失補辦，存款被盜，電信公司客戶身分查驗有破口
https://udn.com/news/story/122653/6046119

出事了！中職官方頻道被盜兄弟拋彩帶影片遭刪
https://sports.ltn.com.tw/news/breakingnews/3804188

官方YT被盜「直播比特幣」！球迷全看傻：出事了
https://www.ftvnews.com.tw/news/detail/2022118W0040

台達電部分資訊系統遭受駭客攻擊
https://reurl.cc/NpG0bQ

達電遭駭客網路攻擊！受影響資訊系統回復中　已通報政府
https://finance.ettoday.net/news/2175524

部分資訊系統遭駭台達電：無重大影響
https://ctee.com.tw/news/tech/585836.html

台達電資訊系統遭駭客攻擊　已啟動防禦機制並通報資安單位
https://tw.appledaily.com/property/20220122/7OOCP6JGCFDGXBYX35WJOKGQLM/

台達電:說明部份資訊系統遭受駭客網路攻擊
https://news.cnyes.com/news/id/4806935

網頁、內勤系統遭駭客攻擊台達電：生產線未受影響
https://reurl.cc/mGZDY1

針對可再生能源公司、環境保護組織的網釣攻擊，臺灣也有政府機關遭到鎖定
https://www.bleepingcomputer.com/news/security/cyber-espionage-campaign-targets-renewable-energy-companies/

中國網軍發動「蔡政府防疫無能」認作知戰！竄改PTT文章製假訊息
https://newtalk.tw/news/view/2022-01-21/699754

敵對勢力認知戰升級調查局查出400臉書假帳號
https://www.rti.org.tw/news/view/id/2122680

調查局抓包北京認知戰假帳號立委痛斥
https://www.secretchina.com/news/b5/2022/01/23/995849.html

調查局：三級警戒期間境外敵對勢力發動「政府無能」認知戰
https://www.rti.org.tw/news/view/id/2122551

盜PTT帳號攻3Q、林昶佐查不到　蔡易餘籲正視資安問題
https://www.ctwant.com/article/163873

境外假帳號混入卡提諾「散播疫情、政治假消息」　調查局循線追查
https://www.mirrormedia.mg/story/20220121edi017/

認知作戰挑對立！境外假帳號滲「卡提諾、PTT」狂發高端假消息
https://news.tvbs.com.tw/local/1697081

假的！「高端開打、5天死6人」別轉傳　陸網軍散布假消息
https://www.setn.com/News.aspx?NewsID=1061414

殖民油管遭駭客攻擊支付440萬美元贖金
https://sangpou.com/classify/life/2902v2.html

中國駭客組織Winnti再度針對UEFI韌體下手，打造惡意軟體MoonBounce發動攻擊
https://www.bleepingcomputer.com/news/security/new-moonbounce-uefi-malware-used-by-apt41-in-targeted-attacks/

Winnti附屬組織鎖定政府機關與加密貨幣公司發動攻擊
https://www.trendmicro.com/en_us/research/22/a/earth-lusca-sophisticated-infrastructure-varied-tools-and-techni.html

中共若投資元宇宙專家：將對每位用戶進行極端監視
https://reurl.cc/g0QaM7

中俄駭客竊取疫苗機密！資安專家：這是「智慧財產權戰爭」
https://reurl.cc/aka4GQ

駭客組織Donot Team鎖定南亞軍事組織和外交單位發動攻擊
https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/

美俄外長談烏克蘭局勢，布林肯允書面答覆俄羅斯提出的北約安全要求
https://www.thenewslens.com/article/161914

涉國安風險或被禁用美審查阿里巴巴雲端
https://www.ntdtv.com.tw/b5/20220119/video/316780.html

孫力軍罪名增加預示習近平與曾慶紅臨近決戰時刻
https://hk.epochtimes.com/news/2022-01-23/33460835

原中央警衛局長王少軍現身黨校高官會議引猜測
https://reurl.cc/44XW1X

陸國家電網擬投資逾人民幣5千億創新高
https://www.chinatimes.com/realtimenews/20220123000743-260410?chdtv

政府網站遭駭癱瘓烏克蘭：有證據是俄羅斯所為
https://news.sina.com.tw/article/20220117/41041698.html

烏克蘭遭網攻控俄國發動「混合戰」
https://www.epochtimes.com/b5/22/1/17/n13510742.htm

北約與烏克蘭簽協議深化網路合作
https://news.sina.com.tw/article/20220117/41047624.html

外媒說北韓駭客2021年竊取了近4億美元加密貨幣
https://reurl.cc/GoXKEA

北韓駭客疑竊 30 億加密貨幣，疑與北韓軍方偵察總局有關
https://technews.tw/2022/01/18/lazarus-group-bitcoin/

Chinese Hackers Spotted Using New UEFI Firmware Implant in Targeted Attacks
https://thehackernews.com/2022/01/chinese-hackers-spotted-using-new-uefi.html

U.S. Sanctions 4 Ukrainians for Working with Russia to Destabilize Ukraine
https://thehackernews.com/2022/01/us-sanctions-4-ukrainians-for-working.html

DoNot Hacking Team Targeting Government and Military Entities in South Asia
https://thehackernews.com/2022/01/donot-hacking-team-targeting-government.html

Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
https://thehackernews.com/2022/01/ukraine-recent-cyber-attacks-part-of.html

Europol Shuts Down VPNLab, Cybercriminals' Favourite VPN Service
https://thehackernews.com/2022/01/europol-shuts-down-vpnlab.html

Dark Web's Largest Marketplace for Stolen Credit Cards is Shutting Down
https://thehackernews.com/2022/01/dark-webs-largest-marketplace-for.html

Ukrainian Government Officially Accuses Russia of Recent Cyberattacks
https://thehackernews.com/2022/01/ukrainian-government-officially-accuses.html

誠徵▼資安工程師(待過相關產業)★
https://www.1111.com.tw/job/98611872/

資安工程師
https://www.104.com.tw/job/7i78v

資訊安全售前架構師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=152364&HIRE_ID=10931687

資安系統工程師
https://www.104.com.tw/job/7ia31

資安體系管理師
https://www.104.com.tw/job/7id4t

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Interpol Busted 11 Members of Nigerian BEC Cybercrime Gang
https://thehackernews.com/2022/01/interpol-busted-11-members-of-nigerian.html

近四分之一網釣攻擊冒用DHL的名義出手
https://blog.checkpoint.com/2022/01/17/dhl-replaces-microsoft-as-most-imitated-brand-in-phishing-attempts-in-q4-2021/

Whoscall 公開詐騙電話簡訊趨勢年度報告，投資詐騙躍居榜首，股票推銷與一接就掛變多了
https://www.kocpc.com.tw/archives/424105

年終最後採購！電商網站系統應該注意的3件事
https://www.techbang.com/posts/93472-3things-you-should-pay-attention-to-in-the-e-commerce-website

為什麼網路廣告都知道我去過哪些地方？手機通訊的資安隱憂與個資保護新技術
https://reurl.cc/6EL5Xb

去年詐騙高風險賣場　誠品書局近千件居冠
https://news.housefun.com.tw/news/article/110825323666.html

克蘭詩遭駭客入侵個資外洩　官方火速補漏洞建議會員改密碼
https://tw.appledaily.com/entertainment/20220119/SAFJWUDMCFAN3J63HEB3P4GNEY/

「邀請你加入一個股票群組...」！從股市到防疫都能詐騙，還有哪些新趨勢
https://www.bnext.com.tw/article/67388/whoscall-2021-annual-report

帳號遭盜變網軍可更改分享器密碼降低風險
https://www.cna.com.tw/news/aipl/202201200281.aspx

紅十字國際委員會洩機密訊息新冠病毒測試釣魚攻擊不斷增加
https://reurl.cc/dXem5y

又見「買點數解除設定」詐騙老梗　三重警急奔超商聯合店員成功阻詐
https://reurl.cc/VjR4ER

5大高風險賣場排名曝光　刑事局揭歹徒詐騙手法
https://www.mirrormedia.mg/story/20220122soc006/

哪個品牌最容易被網釣駭客相中？DHL取代微軟居冠
https://www.ithome.com.tw/news/148950

E.研究報告/工具
【Log4j爆核彈級漏洞】端點裝置是否有遭到 Log4Shell 攻擊的危險
https://blog.trendmicro.com.tw/?p=70837

「不知攻、焉知防」，目標導向的紅隊演練提升台灣資安能量
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9669

攻擊的駭客倫理
https://wp.taronews.tw/2022/01/18/807076/

iOS時間線分析恐遭誤導　重要位置紀錄深藏不露數位鑑識工具仍有疏漏　破解刻意滅證須見招拆招
https://www.netadmin.com.tw/netadmin/zh-tw/technology/B952375A74CC43B8AD9C81C52A88C4C0

如何安全私密地看成人影片
https://blog.trendmicro.com.tw/?p=70943

最複雜的漏洞攻擊 !! Google 團隊發現間諜軟件 Pegasus 只靠一個 GIF 檔入侵 Apple 設備
https://hk.xfastest.com/140030/pegasus-hack-apple-device/

大資訊時代也是大駭客時代！——你該認識的駭客新興手法
https://pansci.asia/archives/341012

5個免費練習駭客/黑客技術的網站
https://reurl.cc/DdXoXO

A Trip to the Dark Site — Leak Sites Analyzed
https://thehackernews.com/2022/01/a-trip-to-dark-site-leak-sites-analyzed.html

Cyber Threat Protection — It All Starts with Visibility
https://thehackernews.com/2022/01/cyber-threat-protection-it-all-starts.html

Don't Use Public Wi-Fi Without DNS Filtering
https://thehackernews.com/2022/01/dont-use-public-wi-fi-without-dns.html

Earth Lusca Hackers Aimed at High-Value Targets in Government and Private Sectors
https://thehackernews.com/2022/01/earth-lusca-hackers-aimed-at-high-value.html

Chrome Limits Websites' Direct Access to Private Networks for Security Reasons
https://thehackernews.com/2022/01/chrome-limits-websites-access-to.html

F.商業
Sophos 發表 Sophos Switch 系列，加強和簡化存取層的連線性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9665

LINE台灣強化資安技術與企業治理獲英國標準協會雙項驗證
https://wantrich.chinatimes.com/news/20220119900501-420501

K8s維運、直播、CLOVA AI中文化到NFT新平臺，Line臺灣工程團隊要將四大類產品和技術在地化
https://times.hinet.net/topic/23719768

從McAfee看資安產業在品牌溝通的突破
https://www.process-group.com/taiwan/news-entry/mcafee/

中菲行物流系統資安層級取得BSI全台首張NIST CSF認證
https://wantrich.chinatimes.com/news/20220119900492-420101

量子電腦強大算力也是關鍵鴻海提前布局搶占先機
https://news.cnyes.com/news/id/4804784

全球勒索病毒風險飆升！Pure Storage助企業建立完善資料保護策略
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9681

中飛科技宣布取得SailPoint 台灣區獨家代理
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9680

無懼疫情分散布局資拓宏宇營收年增26%
https://news.ustv.com.tw/newsdetail/20220120A094

近年資安漏洞蓋亞資訊分享如何透過Imperva防患未然
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000627753_6ZU8FB8J4A4Y68483J1BI

McAfee 與 FireEye 將合併成新公司 Trelix 以植物內部格狀結構象徵確保企業安全
https://www.cool3c.com/article/171726

Openfind AEP 正式更名為 SecuShare Pro 企業雲端儲存平台
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9676

G.政府
金管會修法要公司詳細揭露重大資安事件
https://udn.com/news/story/7238/6043240

配合中央政策黃偉哲積極推動國家級資安產業新聚落臺南沙崙資安服務基地領航產業發展
https://www.tainan.gov.tw/News_Content.aspx?n=13370&s=7867898

駁大數據中心資安疑慮　柯文哲：使用資料都有監督
https://news.tvbs.com.tw/politics/1694812

台北大數據中心議員要求把關個資
https://news.ltn.com.tw/news/life/paper/1496826

台北市政府強化資安治理有效落實曝險最小化
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=41&id=0000627284_neh1r1ur9ak4e63r7mjy8

疫苗護照有資安疑慮？歐美推動後釀分化社會、侵犯公民權爭議
https://city.gvm.com.tw/article/86371

資安無虞！區間測速恢復執法 | 新北警呼籲行車注意安全駕駛
https://www.tcpttw.com/police/2022/01/20/8633/

科技部承載更大責任推動國家數位轉型大計
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=140&id=0000628108_R8926ZSVLJKCLN9SA4595

扶植資安新創「資安鑄造公司」，資策會攜科專計畫成果進行商轉
https://www.ithome.com.tw/news/148998

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
Sony電動車項目負責人：計畫將車輛轉變成提供資訊與娛樂內容的移動平台
https://mashdigi.com/sony-seeks-new-partners-for-transformative-ev-project-says-exec/

SEMI：成立資安委員會助產業因應法規挑戰
https://www.owlting.com/news/articles/49404

練就可視化與零信任基本功決勝OT資安攻防戰
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000626824_y8p99uv514xqe75hvum8w

2021下半年台灣AI生態系地圖揭曉：企業合作是機會，資安隱私則是挑戰
https://meet.bnext.com.tw/articles/view/48682

掌握五大步驟可望提升工控資安防禦力
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000627219_U781TCD42DBTZG856FO6C

Moxa取得台灣工控首張IEC 62443-4-2認證開啟次世代工業網路資安新思維
https://reurl.cc/NpG0z6

全面彙集OT網路與設備資訊建立完整工控資安視圖
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000627520_VO5656EL1BFN0T1VMD0LW

EP.7駭客入侵自動車、自動駕駛的分級、玩命關頭的汽車瀑布、自動化車輛分級系統、德國少年David Colombo
https://player.soundon.fm/p/33e721d1-1254-4f24-9682-9e1b53476ff7/episodes/37d0676c-872c-4a3a-a397-4142c630745f

國外開發者展示在 Tesla 成功運行 CarPlay 的成果，透過樹莓派就能實現
https://www.kocpc.com.tw/archives/423395

I.教育訓練
【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
【Python 金融思辨首部曲–科技菁英理財營】全台唯一社會科學為基底的程式開發課程！經濟學X社會學X資訊科學 2022/1/24
https://www.accupass.com/event/2110150640421591980420

Android Code Club(Taipei) 2022/1/26
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/283378375/

Flutter Puzzel Hack 2022 ！ 2022/1/26
https://www.meetup.com/Flutter-Taipei/events/283416438/

SyntaxError 2022/1/26
https://www.meetup.com/pythonhug/events/283378387/

HackingThursday 黑客星期四 - Week meetup Taipei 固定聚會台北 2022/1/27
https://www.meetup.com/hackingthursday/events/283401390/

Scala Taiwan Mokumoku #14 2022/1/29
https://www.meetup.com/Scala-Taiwan-Meetup/events/283372428/

Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

Write Once, Deploy Anywhere 的智能合約虛擬機 2022/2/12
https://www.meetup.com/Taipei-Blockchain/events/282521718/

《數位人權研討會》剖析元宇宙發展痛點：資訊安全與數位人權 2022/2/14
https://www.accupass.com/event/2201050729181065808149

車聯網供應鏈資安研討會 2022/2/15 (二) 14:00~16:30 (13：30開始報到)
https://www.teema.org.tw/education.aspx?infoid=37800

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

國家高速網路與計算中心教育訓練【資安初階課程】ISO 27001資產盤點暨風險評鑑實務課程 2022/2/24
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3969&from_course_list_url=homepage

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/1/10 ~ 2022/1/14

noreply@blogger.com (Unknown) — Sat, 15 Jan 2022 06:31:00 +0000

資安事件新聞週報 2022/1/10 ~ 2022/1/14

1.重大弱點漏洞/後門/Exploit/Zero Day
HP發布多款HP雷射印表機、多功能事務機及掃描器存在安全弱點
https://support.hp.com/us-en/document/ish_5000124-5000148-16

Citrix Workspace app存在安全性弱點
https://support.citrix.com/article/CTX338435

BeyondTrust Secure Remote Access Base Software 6.0.1 可讓攻擊者使用 XSS/CSRF 攻擊使管理員創建一個新的管理員帳戶
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-31589

sun_moon_jingyao Shockwall系統的服務器請求接收器功能存在不正確的身份驗證漏洞
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-45917

transloadit uppy易受伺服器端請求偽造（SSRF）的攻擊
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-0086

Microsoft Windows Defender - Detections Bypass
https://www.exploit-db.com/exploits/50654

Microsoft Windows .Reg File - Dialog Spoof / Mitigation Bypass
https://www.exploit-db.com/exploits/50653

微軟推出 2022 年一月份 Patch Tuesday 軟體更新修補包，共修補 97 個漏洞
https://reurl.cc/AKK4Dd

可俘虜數十億臺系統與設備！超級資安漏洞風暴正在席捲全球
https://www.ithome.com.tw/news/148753

偷錄監聽還會竊取信用卡！macOS系統遭微軟揭發資安漏洞
https://3c.ltn.com.tw/news/47339

Google Chrome與Microsoft Edge瀏覽器存在多個高風險安全漏洞
https://www.klcg.gov.tw/tw/education/3522-249822.html

VMware 發布多個產品的安全更新，建議請管理者儘速評估更新
https://www.klcg.gov.tw/tw/education/3522-249823.html

ASUS RT-AX56U - Path Traversal
https://www.twcert.org.tw/tw/cp-132-5508-59251-1.html

樂衍樂晴牙醫管理系統 - Hard-coded Credentials
https://www.twcert.org.tw/tw/cp-132-5510-45d71-1.html

樂衍樂晴牙醫管理系統 - SQL Injection
https://www.twcert.org.tw/tw/cp-132-5509-80f05-1.html

Cisco Releases Patch for Critical Bug Affecting Unified CCMP and Unified CCDM
https://thehackernews.com/2022/01/cisco-releases-patch-for-critical-bug.html

Meeting Patching-Related Compliance Requirements with TuxCare
https://thehackernews.com/2022/01/meeting-patching-related-compliance.html

New KCodes NetUSB Bug Affect Millions of Routers from Different Vendors
https://thehackernews.com/2022/01/new-kcodes-netusb-bug-affect-millions.html

Microsoft Details macOS Bug That Could Let Attackers Gain Access to User Data
https://thehackernews.com/2022/01/microsoft-details-macos-bug-that-could.html

NHS Warns of Hackers Targeting Log4j Flaws in VMware Horizon
https://thehackernews.com/2022/01/nhs-warns-of-hackers-targeting-log4j.html

Microsoft SQL Server 將終止支援企業應把握轉型契機
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000627885_GO59QR8B7X755Z6OY2CFG

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
證交所：台股去年有交易人數550萬人續創紀錄，年輕族群最為熱烈
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=539d67ad-7d2c-42f1-9c3b-1216a0a61b5b

證交所邀券商研議強化資安
https://ctee.com.tw/news/stocks/578270.html

證交所召集供網路下單證券商研議強化資安防護能力
https://money.udn.com/money/story/5607/6021850?from=edn_newest_index

證交所：所有提供網路下單服務證券商，已採行或進行雙因子驗證機制系統修改
https://reurl.cc/Ddd4NE

證交所學習網股民按讚
https://udn.com/news/amp/story/7251/6023609

不怕找不到保單金管會第4季建置保單存摺平台
https://newtalk.tw/news/view/2022-01-13/696309

金融業獲利創新高黃天牧提醒四個字
https://ctee.com.tw/news/finance/580684.html

台金管會主題式監理沙盒試辦瞄準金融身分驗證需求
https://www.epochtimes.com/b5/22/1/14/n13504775.htm

金管會六新政促進永續獲利
https://ctee.com.tw/news/finance/581079.html

金管會談重點施政將推視訊股東會
https://www.anntw.com/articles/20220113-Q56g

元大金對桃園18個據點下達四大防疫指令
https://turnnewsapp.com/livenews/finance/A95634002022011318434816

臺銀董座呂桔誠取經以色列設創新實驗室
https://money.udn.com/money/story/5613/6021386?from=edn_subcatelist_cate

新安東京產強化資安治理已通過ISO 27001與27701國際雙認證
https://turnnewsapp.com/livenews/finance/A78817002022011011175013

金融業停辦尾牙、聚餐！　一銀提供桃園行員「有薪照顧假」
https://finance.ettoday.net/news/2168568?redirect=1

新光銀行資訊作業嚴謹獲聯徵中心金質獎肯定
https://udn.com/news/story/7239/6022794

保護銀行員金管會移請銀行公會研議「不脫口罩確認本人」
https://udn.com/news/story/7239/6031349

首家非金融業者完成移工匯兌沙盒實驗取得金管會執照統振搶食移工匯兌大餅劍指電支市場
https://reurl.cc/Gooj4v

聯邦銀分行13行員確診！總行曾去查帳恐有群聚風險　公司回應了
https://tw.appledaily.com/property/20220113/YBJO2HER5JBM7PCGNS3SKNX3JU/

3.電子支付/行動支付/pay/資安
LINE Pay推出商店管理後台「好夥伴」App上線
https://udn.com/news/story/7239/6034255?from=udn-ch1_breaknews-1-cate6-news

本土疫情再起過年數位紅包這麼發
https://reurl.cc/oeeR5Q

手機發紅包只要 3 步驟設定！「數位紅包」全台 30 家銀行開通一次看
https://www.managertoday.com.tw/articles/view/64487

巴菲特也投資的「印度支付寶」上市第一天就暴跌
https://www.gvm.com.tw/article/86051

蘋果挑戰PayPal？ iPhone被看好可成為終極財務管理工具
https://udn.com/news/story/7086/6021731

香港金融管理專員對三三金融服務有限公司違反《支付系統及儲值支付工具條例》採取紀律處分行動
https://www.info.gov.hk/gia/general/202201/14/P2022011400511.htm

中華電信Hami Pay與網家Pi拍錢包結盟深化
https://www.chinatimes.com/realtimenews/20220110003380-260410?chdtv

動動嘴就可以結帳，「語音支付」有何市場潛力
https://fc.bnext.com.tw/articles/view/1963

全球跨境支付公司Thunes任命新高層，助力中國跨境電商賣家
https://www.thehubnews.net/archives/74588

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
數位貨幣爭霸戰各國央行態度大相逕庭
https://ec.ltn.com.tw/article/breakingnews/3795105

虛擬貨幣現實中可用嗎？網友親測驚：麥當勞、星巴克竟都通
https://reurl.cc/6EEv7d

比特幣、加密貨幣投資入門：幣圈防詐騙、防盜基礎指南
https://www.bnext.com.tw/article/66958/cryptocurrency-fraud

全台都認識他！不老抓漏傳說「陳財佑」攻進元宇宙，經典娃娃臉發行NFT
https://www.bnext.com.tw/article/67296/ks-chen-nft

育人才！北科大成立全台首座元宇宙XR研發中心
https://reurl.cc/OppGgA

鎖定元宇宙｢送禮｣商機！啟雲科技開發AR平台攜手世新大學打入國際
https://times.hinet.net/news/23708735

Certik：2021年DeFi項目因駭客攻擊損失金額達13億美元
https://news.cnyes.com/news/id/4802962

前Twitter執行長成立比特幣法律防禦基金，協助加密貨幣開發者面對訴訟
https://mashdigi.com/jack-dorsey-proposes-a-legal-defense-fund-for-bitcoin-developers/

印尼大學生933 張「每日自拍」NFT 系列總交易量突破百萬美金
https://hypebeast.cn/2022/1/ghozali-ghozalo-opensea-nft-surge-news

以宇宙為舞台之新作《Rise of Stars》開放預先註冊強調導入區塊鏈技術及 NFT
https://gnn.gamer.com.tw/detail.php?sn=226692

CityDAO Discord管理員帳戶遭駭客入侵，被盜95000美元資金
https://news.cnyes.com/news/id/4803943?exp=a

這次沒有輸韓國！耗時一年半，台灣區塊鏈BaaS基礎服務平台完工
https://news.knowing.asia/news/5e9965c6-1bcc-4cdb-a5d2-e7394e3fa124

web 3.0概念像「百貨公司點數」！區塊鏈交易平台XREX創辦人這樣解釋
https://www.bnext.com.tw/article/67244/what-is-web-3

區塊瀏覽器霸主Etherscan回顧2021年的21項產品功能
https://news.cnyes.com/news/id/4801249

「元宇宙」電商遭駭！嫌落網稱想證明「我很行」
https://reurl.cc/5GGv2G

首例元宇宙公司遭駭損失500萬
https://reurl.cc/2DDYom

LCX 交易所遭駭客攻擊，損失或超 600 萬美元
https://news.cnyes.com/news/id/4799318

LCX交易所：由於熱錢包被盜用，目前已將基於以太坊的資產安全轉移
https://news.cnyes.com/news/id/4799535

Monkey Kingdom社群遭駭客攻擊損失約130萬美元
https://reurl.cc/qOOVZ0

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
殭屍網路變種病毒 Twizt 已盜取價值 50 萬美元的加密貨幣
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9659

全球幾百萬台Wi-Fi分享器驚爆有漏洞駭客入侵恐讓裝置被接管、植入惡意軟體
https://times.hinet.net/topic/23709720

網路犯罪黑市存取服務交易攀升，助長勒索病毒攻擊事件
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000627354_FYE4GT6X4GBF4H5TIGR45

dnSpy出現惡意版，瞄準開發者及資安研究人員
https://times.hinet.net/news/23703064

殭屍網路Abcbot與挖礦惡意軟體Xanthe的攻擊者身分，疑似為同一組駭客
https://thehackernews.com/2022/01/abcbot-botnet-linked-to-operators-of.html

諾頓、Avira防毒在用戶電腦安裝挖礦軟體，且疑似預設啟用惹議
https://krebsonsecurity.com/2022/01/500m-avira-antivirus-users-introduced-to-cryptomining/

防毒軟體擅自支援挖礦且關不掉！「諾頓360」引用戶不滿
https://3c.ltn.com.tw/news/47337

波蘭執政黨坦承購買間諜軟體Pegasus，否認用於監控政敵
https://apnews.com/article/technology-business-poland-hacking-warsaw-8b52e16d1af60f9c324cf9f5099b687e

印度駭客組織Patchwork冒充巴基斯坦政府，發動RAT木馬攻擊
https://www.bleepingcomputer.com/news/security/oops-cyberspies-infect-themselves-with-their-own-malware/

.NET逆向工程工具dnSpy出現惡意版本，並透過Google搜尋廣告散布
https://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/

iOS 惡意軟體可假裝重開機，以盜用相機鏡頭與麥克風進行盜錄監視
https://www.twcert.org.tw/tw/cp-104-5488-30ac3-1.html

The BlueNoroff cryptocurrency hunt is still on
https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/

Abusing Microsoft Office Using Malicious Web Archive Files
https://www.netskope.com/blog/abusing-microsoft-office-using-malicious-web-archive-files
https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/MHTGlitch/IOCs

Iranian intel cyber suite of malware uses open source tools
https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/
https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/

New SysJoker Backdoor Targets Windows, Linux, and macOS
https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/

New SysJoker Espionage Malware Targeting Windows, macOS, and Linux Users
https://thehackernews.com/2022/01/new-sysjoker-espionage-malware.html

APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit
https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/

FluBot’s Authors Employ Creative and Sophisticated Techniques to Achieve Their Goals
https://www.f5.com/labs/articles/threat-intelligence/flubots-authors-employ-creative-and-sophisticated-techniques-to-achieve-their-goals-in-version-50-and-beyond

Trojanized dnSpy app drops malware cocktail
https://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/

COVID Omicron Variant Lure Used to Distribute RedLine Stealer
https://www.fortinet.com/blog/threat-research/omicron-variant-lure-used-to-distribute-redline-stealer

Husband-Wife Arrested in Ukraine for Ransomware Attacks on Foreign Companies
https://thehackernews.com/2022/01/husband-wife-arrested-in-ukraine-for.html

Researchers Decrypted Qakbot Banking Trojan's Encrypted Registry Keys
https://thehackernews.com/2022/01/researchers-decrypted-qakbot-banking.html

Iranian Hackers Exploit Log4j Vulnerability to Deploy PowerShell Backdoor
https://thehackernews.com/2022/01/iranian-hackers-exploit-log4j.html

Hackers Use Cloud Services to Distribute Nanocore, Netwire, and AsyncRAT Malware
https://thehackernews.com/2022/01/hackers-use-cloud-services-to.html

Abcbot Botnet Linked to Operators of Xanthe Cryptomining malware
https://thehackernews.com/2022/01/abcbot-botnet-linked-to-operators-of.html

BADNEWS! Patchwork APT Hackers Score Own Goal in Recent Malware Attacks
https://thehackernews.com/2022/01/badnews-patchwork-apt-hackers-score-own.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Signal CEO Resigns, WhatsApp Co-Founder Takes Over as Interim CEO
https://thehackernews.com/2022/01/signal-ceo-resigns-whatsapp-co-founder.html

立陶宛稱小米手機內建審查功能德國：查無實據
https://www.rti.org.tw/news/view/id/2122091

小米手機內建審查機制？德國 BSI：沒有證據
https://technews.tw/2022/01/14/xiaomi-phones-bsi/

德國聯邦政府資訊安全部表示在小米手機內沒有發現任何內容審查功能
https://www.cool3c.com/article/171356

德國BSI公布檢測結果！無法證明小米10T 5G內建審查機制
https://www.sogi.com.tw/articles/xiaomi_10t_5g/6257292

小米被冤枉？德國：沒有發現手機內建審查機制
https://times.hinet.net/news/23710279

德國聯邦資安監管機構調查未發現異常小米：感到欣慰
https://money.udn.com/money/story/5612/6033983?from=edn_related_storybottom

NCC指旗下手機有資安疑慮小米再發聲明回應
https://www.chinatimes.com/realtimenews/20220115001414-260410?chdtv

小米手機暴露資安風險疑助中共實施境外數字監控
https://reurl.cc/1223pG

國安沒有在分公私部門的！請政府嚴肅看待中國小米手機資安問題
https://reurl.cc/e66zm7

母胎單身大增手機是元兇？谷歌效應害人類變笨，一招救數位失憶
https://city.gvm.com.tw/article/86165

美國聯邦航空局公布50個機場名單要求設置5G網路緩衝區塊
https://udn.com/news/story/7098/6020290?from=udn-catebreaknews_ch2

NVIDIA Shield TV 電視盒全數都會獲得 Android 11 升級
https://chinese.engadget.com/nvidia-update-shield-tv-android-11-060041808.html

Apple資安又出問題？女模驚曝差點被跟蹤，大量女性粉絲回覆：「小心，我也遇過！
https://www.tatlerasia.com/power-purpose/technology/apple-airtag-safety-concern-stalker-use-to-track

AirTag成尾隨犯罪工具一道手續就能反跟蹤
https://www.worldjournal.com/wj/story/121473/6027788

瑞士軍方禁用所有外國製即時通訊軟體，僅開放國產的 Threema
https://www.twcert.org.tw/tw/cp-104-5490-63fbd-1.html

Clubhouse 推出網頁版新功能！不需下載、註冊也能進包廂房間收聽
https://3c.ltn.com.tw/news/47320

手機弄丟，沒開機也能靠「定位」找回來！怎麼做到
https://www.businessweekly.com.tw/careers/blog/3008852

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
這支 5 萬元隨身碟，竟能通行半導體廠禁區
https://technews.tw/2022/01/15/txone-usb/

去年企業網路每周遭到網路攻擊的次數增加50%
https://www.ithome.com.tw/news/148848

Lovelyz社群軟體遭駭客入侵結果是被經紀公司利用粉絲氣炸
https://reurl.cc/jkkWGL

附帶勒贖條件的 DDoS 攻擊，2021年大幅增加，製造業是主要受害者
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9671

10個2022年必知的科技關鍵字：元宇宙、低軌衛星通訊，DeFi、NFT
https://www.techbang.com/posts/93127-10-scientific-and-technological-keywords-that-must-be-known-in

「不知攻、焉知防」，目標導向的紅隊演練提升台灣資安能量
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9669

EA確認《FIFA》帳戶受到駭客攻擊並將對此事負責
https://reurl.cc/jkk3eL

熱門NPM套件疑遭破壞，原因是開發者對大型企業無償使用不滿所為
https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

中國第一駭客怎麼玩遊戲?被朋友催著上號,打架帶24個奶媽
https://raolve.com/tech/757368.html

Windows系統容易被勒索！？酒店PC轉向Chrome OS
https://news.xfastest.com/windows/106506/chrome-os/

犯罪即服務成主流，駭客攻擊從加密錢包延伸至外太空
https://technews.tw/2022/01/14/fortinet-cve/

大數據時代，三大資訊價值讓惡意攻擊虎視眈眈
https://news.sina.com.tw/article/20220113/41025756.html

愛心捐款遭盯上! 百家公益團體爆資安疑慮
https://news.ustv.com.tw/newsdetail/20220111A122

北京冬奧倒數　美議員憂選手資安風險無言論自由
https://www.setn.com/News.aspx?NewsID=1057433

憂北京冬奧期間失言論自由美議員：選手應受到保護
https://m.soundofhope.org/post/584281?lang=b5

憂資安風險德國建議冬奧選手別帶個人手機
https://www.rti.org.tw/news/view/id/2122189

多國外交抵制、疫情多點開花、中共網路監控，北京冬奧還能順利舉辦嗎
https://www.thenewslens.com/article/161464

區塊鏈公司調查：北韓駭客去年狂竊加密貨幣價值上百億
https://ec.ltn.com.tw/article/breakingnews/3800760

資安報告：北韓駭客 2021 一整年偷了 4 億美元的虛擬貨幣
https://www.inside.com.tw/article/26360-north-korean-hackers-stole-nearly-400-million-in-crypto-last-year

北韓駭客升級　美調查：去年竊取超過100億加密貨幣
https://reurl.cc/e66L4M

北韓駭客洗錢手法更精進！去年駭取「虛擬貨幣」價值4億美元
https://www.ettoday.net/news/20220114/2168952.htm

北韓駭客2021竊取逾百億加密貨幣投入軍備研發
https://udn.com/news/story/6809/6034295

卡巴斯基：朝鮮駭客在長達數月的網路犯罪活動中瞄準了加密初創公司
https://news.cnyes.com/news/id/4803344?exp=a

美國網戰司令部聲稱駭客集團MuddyWater受伊朗情報暨安全局管轄
https://times.hinet.net/topic/23709146

中國網軍好便宜
https://living.taronews.tw/2022/01/14/806257/

美執法部門加重「打駭」，最大被盜信用卡暗網市場 UniCC 關閉
https://technews.tw/2022/01/13/stolen-credit-cards-dark-web-shuts-down/

美國推出智能手槍　需要使用指紋及手機解鎖
https://www.pcmarket.com.hk/smart-guns-with-fingerprint-sensor-and-phone-lock/

美國監獄安全軟件遭攻擊　監控鏡頭無法正常使用
https://reurl.cc/xOOa9E

關係好轉？俄應美要求搗毀橫行全球的駭客組織REvil
https://udn.com/news/story/6809/6035361

烏克蘭政府網站傳遭大規模駭客攻擊
https://www.rti.org.tw/news/view/id/2122140

烏克蘭遭俄重兵包圍　駭客政府網站留警語「害怕最壞狀況」
https://news.tvbs.com.tw/world/1690891

北約將與烏克蘭簽協議共同對抗網路駭客
https://news.sina.com.tw/article/20220114/41032424.html

烏克蘭遭大規模網攻俄部署更多部隊
http://www.ksnews.com.tw/index.php/news/contents_page/0001563944

藏鏡人曝光朝鮮去年駭虛擬貨幣達逾百億
https://www.secretchina.com/news/b5/2022/01/15/995111.html

印度駭客中了自己放的RAT致內部系統曝光
https://www.pttweb.cc/bbs/Gossiping/M.1642062953.A.7F5

前副總統揭中國5條紅線：台灣製造核武、美軍駐紮台灣
https://www.setn.com/News.aspx?NewsID=1054787

駐港部隊司令換人首次來自中共武警
https://reurl.cc/Goo4My

North Korean Hackers Stole Millions from Cryptocurrency Startups Worldwide
https://thehackernews.com/2022/01/north-korean-hackers-stole-millions.html

U.K. Hacker Jailed for Spying on Children and Downloading Indecent Images
https://thehackernews.com/2022/01/uk-hacker-jailed-for-spying-on-children.html

GootLoader Hackers Targeting Employees of Law and Accounting Firms
https://thehackernews.com/2022/01/gootloader-hackers-targeting-employees.html

US Cyber Command Links 'MuddyWater' Hacking Group to Iranian Intelligence
https://thehackernews.com/2022/01/us-cyber-command-links-muddywater.html

Europol Ordered to Delete Data of Individuals With No Proven Links to Crimes
https://thehackernews.com/2022/01/europol-ordered-to-delete-data-of.html

FBI, NSA and CISA Warns of Russian Hackers Targeting Critical Infrastructure
https://thehackernews.com/2022/01/fbi-nsa-and-cisa-warns-of-russian.html

icash資安工程師
https://www.104.com.tw/job/7cta5?jobsource=keyword2Keyword

【資訊專才】網路暨資安規劃師
https://www.104.com.tw/job/7clcb

資訊安全工程師
https://www.yourator.co/companies/Optoma/jobs/21773

C#資安軟體開發工程師(台南)
https://www.104.com.tw/job/7hxhb

【IT】資安工程師【林口】
https://www.104.com.tw/jb/104i/job/view?j=7b8gx

網路資安工程師-新店區
https://www.104.com.tw/job/7hxbj

資訊工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=2222361&HIRE_ID=10922177

Trapa Security招募研發工程師
https://www.cs.nycu.edu.tw/announcements/detail/8580

永豐銀行啟動首波徵才招60名MA 培訓期間月薪6萬起
https://www.1111.com.tw/news/jobns/143577

永豐銀MA徵才啟動培訓月薪6萬起跳、加獎金年薪上看百萬
https://news.cnyes.com/news/id/4802117

科技產業園區超前部署轉職潮釋逾600個職缺
https://www.1111.com.tw/news/jobns/143551

中華電退休潮今年將徵1,900人鎖定3領域
https://ctee.com.tw/news/tech/578438.html

兌現加薪承諾！中華電信：今年調薪範圍、幅度比往年大
https://www.1111.com.tw/news/jobns/143572

日本進攻搶東協數位人才！盼5年爭取5萬人到日企工作
https://www.nownews.com/news/5683920

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
美國政府要求企業必須保障客戶資料不受 Log4j 漏洞攻擊影響
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9660

搶搭紓困便車PNR探個資　黑圖天書混預算
https://www.ctwant.com/article/162363

俄羅斯外交部受北韓駭客釣魚攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9674

別讓你的隱私在網路上裸奔！防詐騙達人教你：大數據時代的生存之道
https://www.gvm.com.tw/article/86174

國泰世華銀行防詐不遺餘力春節將至提醒民眾提高防詐意識
https://ctee.com.tw/industrynews/financesmanage/580870.html

數據保護又一槍！歐盟一執法機構被命令刪除大量非法收集的個人資訊
https://news.knowing.asia/news/9e32c038-cd3f-4897-be99-e0c8068c59f9

匿名發言助長網路暴力政大生遭公審尋短
https://reurl.cc/Mbb4rp

網路購物遇詐騙應多方求證勿輕信
https://reurl.cc/RjjWax

年關將近詐騙橫行請民眾謹記預防策略
https://www.kmdn.gov.tw/1117/1271/1272/339517

泰國大型醫院Siriraj傳出資料外洩，近4千萬筆病人記錄流入地下論壇
https://www.bangkokpost.com/thailand/general/2245063/huge-patient-data-leak-from-siriraj-hospital

美國加州草谷市遭駭，市府員工與市民資料外洩
https://portswigger.net/daily-swig/city-of-grass-valley-california-suffers-data-breach-employee-and-citizen-information-exposed

Facebook Launches 'Privacy Center' to Educate Users on Data Collection and Privacy Options
https://thehackernews.com/2022/01/facebook-launches-privacy-center-to.html

E.研究報告/工具
Azure VM 延伸功能建立Antimalware (反惡意程式)模組
https://reurl.cc/AKK48Z

憑證安全管理須強化，網路犯罪黑市存取服務AaaS助長勒索攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9658

HDMI 2.1a規格釋出全新SBTM功能強化HDR表現
http://www.ctimes.com.tw/DispNews/tw/HDMI/2201111440KF.shtml

什麼是 Apache Log4j 安全漏洞，資安防護服務如何幫助你防範 Log4j 漏洞攻擊
https://www.techbang.com/posts/93398-gaia-information-teaches-you-how-to-prevent-apache-log4j

iOS版Chrome瀏覽器傳更新後死當這招教你暫時解決
https://reurl.cc/3jjX3L

2022 Cybersecurity Predictions from Lookout: Work From Anywhere Ends On-Premises Security
https://thehackernews.com/2022/01/2022-cybersecurity-predictions-from.html

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries
https://thehackernews.com/2022/01/researchers-find-bugs-in-over-dozen.html

DDoS Attack Trends for Q4 2021
https://radar.cloudflare.com/notebooks/ddos-2021-q4

How to Analyze Malicious Microsoft Office Files
https://www.intezer.com/blog/malware-analysis/analyze-malicious-microsoft-office-files/

F.商業
XDR: Redefining the game for MSSPs serving SMBs and SMEs
https://thehackernews.com/2022/01/xdr-redefining-game-for-mssps-serving.html

戴爾科技展望2022，IT、電信、半導體業積極參與資安協作
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9661

Fortinet 發布《2022 全球資安威脅預測》犯罪服務興起、加密貨幣與邊緣網路將成新目標
https://reurl.cc/3jj7b8

微軟攜手桃園市府，率先全台導入Azure混合雲解決方案
https://www.techbang.com/posts/93436-microsoft-helps-taoyuan-city-government-import-azure

桃園導入微軟 Azure 混合雲　衝「資料治理」第一棒
https://finance.ettoday.net/news/2169058

全球超級電腦大競賽富士通最快、惠普最大
https://ec.ltn.com.tw/article/breakingnews/3801258

Mandiant 獨立自 FireEye 後出首個保安預測
https://unwire.pro/2022/01/13/mandiant/security/

雲端佈局搶佔先機！中華電信打造多雲致勝戰略
https://www.cw.com.tw/article/5119215

智慧網路維運趨勢明確　AI驅動建構端到雲體驗顛覆傳統維運觀念　以使用者體驗為著眼點
https://www.netadmin.com.tw/netadmin/zh-tw/trend/50F91F1FE2084CC29A41ABFC61833EC8

艾訊攜手眾至資訊整合智慧製造資安系統即時監控及防護
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000626431_O403KABB4ZA1EI0PWQXHV

工業電腦產業回溫今年營運展望正面
https://ec.ltn.com.tw/article/paper/1495011

全面瓦解駭客攻擊　富士通構築「全方位資安生態系統」
https://futurecity.cw.com.tw/article/2367

兆勤推WiFi 6新品、WiFi CNP，攻中小企業市場
https://ctee.com.tw/industrynews/technology/578914.html

宏碁投資華城電能布局電動車充電樁市場
https://ec.ltn.com.tw/article/breakingnews/3796276

以 Oracle 打造雲端災備　伊雲谷為景碩科技實現營運不中斷
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/E3A67D3F706D4780838DADAED75FFF48

被控侵 Sonos 專利敗訴　 Google Home 改靭體避免禁止入口美國
https://www.pcmarket.com.hk/sonos-win-lawsuit-against-google-for-patent-infringement/

Meta 租下德州奧斯汀最高大樓過半使用空間目前德州員工已超過 2000 人未來將持續招募超過 400 人
https://www.cool3c.com/article/171161

Sophos 發表 Sophos Switch 系列，加強和簡化存取層的連線性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9665

應對資安事件「零信任」精神是關鍵勤業眾信：秉持「永不信任，始終驗證」概念引領企業數位轉型
https://times.hinet.net/picNews/23704127

研勤推升級版人臉辨識引擎獲多家政商機構採用
https://udn.com/news/story/7240/6028795?from=udn-catebreaknews_ch2

DEVCORE以駭客攻擊想法協助企業建立系統安全防護機制
https://mashdigi.com/devcore-talks-red-team-assessment/

原生支援ARM 64！Win11第三方檔案總管上線新版本
https://news.xfastest.com/windows/106457/arm-64-win11/

混合辦公下惡意攻擊倍增如何防？微軟分享軟體使用和企業資安觀點
https://technews.tw/2022/01/13/exclusive-interview-with-microsoft-taiwan-yi-fang-chu/

前Arm首席CPU架構師Mike Filippo從蘋果跳槽至微軟
https://www.ithome.com.tw/news/148867

G.政府
美 FCC 與 NCC 舉辦線上會談，討論 5G 網路部署及資安
https://technews.tw/2022/01/14/fcc-ncc/

科技部短期科研探空火箭發射場域啟用 13日起接受申請
https://reurl.cc/Ddd48O

行政院DIGI+小組民委會成立資安應用服務聯盟
https://www.bg3.co/a/digi-xiao-zu-min-wei-hui-cheng-li-zi-an-ying-yong-fu-wu-lian-meng.html

強化機關防護銓敘部將成立資安專責單位
https://today.line.me/tw/v2/article/WBl5nkJ

強化資訊安全防護銓敘部增4員額成立資安科
https://www.cna.com.tw/news/aipl/202201130313.aspx

陳家欽期許警察教育積極培養新科技警察人才
https://www.peopo.org/news/569264

高階警人事異動陳家欽拔擢資安人才
https://www.chinatimes.com/newspapers/20220113000529-260106?chdtv

【MOST計畫徵求】發展智慧製造及半導體先進製程資安實測場域專案計畫
https://www.rd.ntust.edu.tw/p/16-1055-93506.php?Lang=zh-tw

台灣科技部司長許增如帶團參加CES展順道訪矽谷
https://www.worldjournal.com/wj/story/121519/6022465

臺北市政府資訊局 110 年第 8 次局務會議紀錄
https://reurl.cc/7ee039

資安很重要！ NCC呼籲消費者購買資安認證過關的手機
https://udn.com/news/story/7240/6029049?from=udn-catelistnews_ch2

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
在2022年：物聯網將轉變成一種服務
https://www.taics.org.tw/LatestNewsForm.aspx?News_id=18472

特斯拉共同創辦人：電動車銷售將起飛但產能恐跟不上
https://www.worldjournal.com/wj/story/121477/6032120

15歲就成立資安公司！天才少年駭進全球25輛特斯拉，如何揭發巨頭漏洞
https://www.bnext.com.tw/article/67313/german-teen-hijack-tesla

駭客找到漏洞　25輛特斯拉任他擺布
https://today.line.me/tw/v2/article/pe6rpw6

特斯拉系統有漏洞？德國19歲駭客稱可遠端控制25輛車
https://newtalk.tw/news/view/2022-01-13/695922

研究人員可遠端控制25臺Tesla，但說並非出於系統安全漏洞
https://www.ithome.com.tw/news/148887

工業電腦整合OT+IT資安解決方案
https://udn.com/news/story/11726/6028805

OT資安根本問題？TXOne劉榮太：人才短缺
https://www.digitimes.com.tw/iot/article.asp?cat=10&id=0000627558_V436A3JN4GBWXT9ZZM1IW

I.教育訓練
【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
Taiwan Digital Drinks - Quarterly General Mixer 2022/1/19
https://www.meetup.com/taiwan-digital-drinks/events/282778206/

資訊安全攻防、應變與管理趨勢 2022/1/21(五)，下午2:00～5:00
https://www.caa.org.tw/newsdetail-16160.html

「人工智慧的數位身分認證與隱私安全挑戰」資安鑑識課程-系列Ⅰ初級課程2022/1/21(五)
https://inc.ntub.edu.tw/p/404-1011-88123-1.php?Lang=zh-tw

企業防駭最前線―建立 Google 也在用的零信任資安模型 2022/1/21
https://www.accupass.com/event/2111170951285938629810

資訊安全攻防、應變與管理趨勢 2022/1/21
https://www.caa.org.tw/coursedetail-36059.html

《歐立威 x Elastic 系列講座》Elastic Cloud : 彈性 x 安全，全面託管 Elastic 集群 2022/1/22
https://www.accupass.com/event/2111100816227444523630

【 AIOT推薦】業界最夯的物聯網無線技術應用『ARM LoRa 通訊傳輸』資訊傳遞不受限 2022/1/23
https://www.accupass.com/event/2112090610056057465750

【Python 金融思辨首部曲–科技菁英理財營】全台唯一社會科學為基底的程式開發課程！經濟學X社會學X資訊科學 2022/1/24
https://www.accupass.com/event/2110150640421591980420

Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

車聯網供應鏈資安研討會 2022/2/15 (二) 14:00~16:30 (13：30開始報到)
https://www.teema.org.tw/education.aspx?infoid=37800

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

2022嘉藥反毒與資安機器人競賽 2022/3/12
https://reurl.cc/9OO7kj

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

風險導向資安稽核 2022/7/20
https://www.cisanet.org.tw/Course/Detail/2756

資安事件新聞週報 2022/1/3 ~ 2022/1/7

noreply@blogger.com (Unknown) — Sat, 08 Jan 2022 13:06:00 +0000

資安事件新聞週報 2022/1/3 ~ 2022/1/7

1.重大弱點漏洞/後門/Exploit/Zero Day
Log4j 事件會延燒數個月,甚至數年?這漏洞為何如此危險
https://blog.trendmicro.com.tw/?p=70925

美國政府要求企業必須保障客戶資料不受 Log4j 漏洞攻擊影響
https://www.twcert.org.tw/tw/cp-104-5447-b5264-1.html

中國駭客組織疑利用 Log4j 漏洞攻擊
https://technews.tw/2022/01/04/china-based-group-used-log4j-flaw-in-attack/

New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
https://thehackernews.com/2021/12/new-apache-log4j-update-released-to.html

Log4Shell-like Critical RCE Flaw Discovered in H2 Database Console
https://thehackernews.com/2022/01/log4shell-like-critical-rce-flaw.html

Microsoft Warns of Continued Attacks Exploiting Apache Log4j Vulnerabilities
https://thehackernews.com/2022/01/microsoft-warns-of-continued-attacks.html

Microsoft Issues Fix for Exchange Y2K22 Bug That Crippled Email Delivery Service
https://thehackernews.com/2022/01/microsoft-issues-fix-for-exchange-y2k22.html

已有駭客著手開採微軟本月未修補完全的Windows Installer漏洞
https://reurl.cc/bkzA3l

Security bulletin: Security Bulletin: There are multiple vulnerabilities
in the Apache Log4j used in IBM® QRadar Risk Manager that may allow for remote code execution (RCE)
https://reurl.cc/dXVlND

VMware 發布多個產品的安全更新
https://www.vmware.com/security/advisories/VMSA-2022-0001.html

VMware Patches Important Bug Affecting ESXi, Workstation and Fusion Products
https://thehackernews.com/2022/01/vmware-patches-important-bug-affecting.html

Google Releases New Chrome Update to Patch Dozens of New Browser Vulnerabilities
https://thehackernews.com/2022/01/google-releases-new-chrome-update-to.html

Google Chrome 97 正式發佈　修補重大漏洞．加入完全刪除資料工具
https://www.pcmarket.com.hk/google-chrome-97-released/

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
證交所召集券商研議強化資安防護能力
https://www.chinatimes.com/realtimenews/20220107004486-260410?chdtv

金融業遠距辦公，可行嗎？遠銀數金：資料機密分級，解決法遵和資安疑慮
https://www.managertoday.com.tw/articles/view/64420

金管會元月首周已開四張單罰鍰174萬
https://ctee.com.tw/news/finance/577129.html

臺銀證券違反證交法，遭處糾正及72萬元罰鍰
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=3833ade9-f41c-405e-90c8-f6099b604670

網路下單「強制」改登入密碼股民做這一動作遇駭客恐自行負責
https://reurl.cc/e69lrL

證交所召集券商　更新憑證強化資安防護
https://tw.appledaily.com/property/20220108/M3ONCYBINJCURHUK5O3ANV7FCQ/

用ATM見「1神功能」！他驚：好先進
https://reurl.cc/7ey8ry

3.電子支付/行動支付/pay/資安
電子支付戰國迎來「兩個千萬」、零售也搶著加入！下一步會怎麼走
https://www.bnext.com.tw/article/67065/taiwan-2021-digital-payment

電支業大洗牌 3大超商來勢洶洶
https://ec.ltn.com.tw/article/paper/1493516

揭密悠遊卡「黑科技」　邱昱凱：疫情讓各界看見悠遊卡的科技力
https://finance.ettoday.net/news/2156535

跨境支付迎福音人行擬將跨境支付範圍擴至「經常項」
https://udn.com/news/story/7333/6017836

支付新戰局/拚突圍靠「共通碼」？銀行嘆：現實骨感
https://money.udn.com/money/story/5613/6001769?from=edn_hottestlist_cate_side

陸跨境結算鬆綁電商利多
https://udn.com/news/story/7333/6017980

統振轉型金融科技搶攻移工商機
https://udn.com/news/story/6850/6013829

行動支付加速普及看準小額付費潛力
https://udn.com/news/story/7239/6004004

陳建文：行動支付大戰四關鍵制勝
https://ctee.com.tw/people/interview/554508.html

2022台灣Pay優惠活動！綁哪張信用卡回饋高
https://reurl.cc/qOmRmE

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
哈薩克的網路斷線，衝擊全球15%的比特幣挖礦活動
https://www.ithome.com.tw/news/148768

SAILFISH System to Find State-Inconsistency Bugs in Smart Contracts
https://thehackernews.com/2022/01/sailfish-system-to-find-state.html

中共急推數字人民幣專家揭背後風險
https://www.epochtimes.com/b5/22/1/4/n13480801.htm

數字人民幣APP點外賣、打車！與微信支付寶有啥不同？
http://finance.people.com.cn/BIG5/n1/2022/0108/c1004-32326686.html

APP上架數位人民幣產業鏈吃補
https://reurl.cc/X4e86D

涵蓋五大消費場景數字人民幣（試點版）APP上架各大應用商店
http://finance.people.com.cn/BIG5/n1/2022/0105/c1004-32324764.html

為什麼不存在所謂的「電子貨幣」
http://big5.ftchinese.com/story/001094959?full=y&archive

如果我的臉或圖「被盜上架」成其他人的 NFT，法律上怎麼辦
https://www.inside.com.tw/article/26249-legal-issues-of-nft

Harmony 2022年將向DAO分配5000萬-1億美元資金，並推出比特幣橋接
https://news.cnyes.com/news/id/4796681

Illuvium合約疑雲：漏洞讓駭客大量取幣，官方呼籲勿買sILV、幣價下跌99%
https://www.abmedia.io/20220105-illuviumilv-hack

【NFT安全風險】「馬騮NFT」項目損失逾一千萬元　專家：預覽超連結防入侵
https://reurl.cc/ve5A7a

ACE榮獲第四屆區塊鏈價值權威榜「最佳中心化交易所」殊榮！台灣在地ACE雙重信託！用新台幣投資虛擬貨幣安心有保障
https://news.knowing.asia/news/a8faff52-a98b-4466-9bb4-761ab68b66dd

以太坊開發社群ETHGlobal將於1/14-16舉辦NFT黑客松：NFT HACK
https://news.cnyes.com/news/id/4797312

比特幣大漲60%成抗通膨工具？分析師：年輕一代的新黃金
https://cnews.com.tw/209220106a01/

Monkey Kingdom 社群被駭客攻擊損失價值約 130 萬美元
https://unwire.pro/2022/01/06/hong-kong-nft-project-monkey-kingdom-loses-us13-million-hack/blockchain/

去年加密貨幣犯罪金額達140億美元創歷史新高
https://news.cnyes.com/news/id/4798193

加密貨幣遭駭網路變種病毒竊近50萬美元
https://ctee.com.tw/news/global/577449.html

加密貨幣犯罪規模劇增涉及金額超過3900億創歷史新高
https://reurl.cc/rQaA3N

又一家！Konami宣布進軍NFT 推出14款《惡魔城》相關產品開放競標
https://game.udn.com/game/story/122089/6016039?form=udn_ch2_common3_cate

NFT空投接不接？　當心喜從天降變竊案
https://reurl.cc/jkqorm

StoboxCompany遭遇駭客攻擊，Token跌幅96.93%
https://news.cnyes.com/news/id/4798467

犯罪集團的虛擬貨幣錢包去年進帳140億美元，創紀錄
https://www.ithome.com.tw/news/148756

元宇宙概念席捲全球 MaiCoin 集團縝密佈局迎接區塊鏈技術應用新高度
https://news.knowing.asia/news/e6ad0ba2-4a28-4c5d-bb03-ea3b3ed04053

余文樂也在用！庫幣科技宣布冷錢包將支援NFT平台，一鍵進入OpenSea與Rarible
https://meet.bnext.com.tw/articles/view/48639

人權基金會將把4.25枚BTC分發給不同的捐贈者
https://news.cnyes.com/news/id/4798732

PayPal考慮推出穩定幣：推進加密貨幣戰略
https://reurl.cc/Vj3Orn

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Check Point：殭屍網路變種病毒 Twizt 已盜取價值 50 萬美元的加密貨幣
https://news.xfastest.com/others/106243/others-140/

網路犯罪黑市存取服務交易攀升助長勒索病毒攻擊事件
https://reurl.cc/ak5AMl

修改SSD預留空間難被偵測惡意軟件入侵可持續存活
https://www.wepro180.com/ssd220107/

North Korean Hackers Start New Year with Attacks on Russian Foreign Ministry
https://thehackernews.com/2022/01/north-korean-hackers-start-new-year.html

North Korean group “Konni” targets the Russian diplomatic sector
https://cluster25.io/wp-content/uploads/2022/01/Konni_targeting_Russian_diplomatic_sector.pdf

IKO activation - Malware campaign
https://cert-pl.translate.goog/posts/2021/12/aktywacja-aplikacji-iko/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=es

Malicious Telegram Installer Drops Purple Fox Rootkit
https://blog.minerva-labs.com/malicious-telegram-installer-drops-purple-fox-rootkit

New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk
https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/

New Zloader Banking Malware Campaign Exploiting Microsoft Signature Verification
https://thehackernews.com/2022/01/new-zloader-banking-malware-campaign.html

Elephant Beetle: UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION
https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf

Attackers test CAB-less 40444 exploit in a dry run
https://news.sophos.com/en-us/2021/12/21/attackers-test-cab-less-40444-exploit-in-a-dry-run/
https://github.com/sophoslabs/IoCs/blob/master/Troj-DocDL-AEOL.csv

NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/

New Trick Could Let Malware Fake iPhone Shutdown to Spy on Users Secretly
https://thehackernews.com/2022/01/new-trick-could-let-malware-fake-iphone.html

Beware of Fake Telegram Messenger App Hacking PCs with Purple Fox Malware
https://thehackernews.com/2022/01/beware-of-fake-telegram-messenger-app.html

Detecting Evasive Malware on IoT Devices Using Electromagnetic Emanations
https://thehackernews.com/2022/01/detecting-evasive-malware-on-iot.html

Are Medical Devices at Risk of Ransomware Attacks
https://thehackernews.com/2022/01/are-medical-devices-at-risk-of.html

New iLOBleed Rootkit Targeting HP Enterprise Servers with Data Wiping Attacks
https://thehackernews.com/2021/12/new-ilobleed-rootkit-targeting-hp.html

Ongoing Autom Cryptomining Malware Attacks Using Upgraded Evasion Tactics
https://thehackernews.com/2021/12/ongoing-autom-cryptomining-malware.html

Lapsus$ ransomware gang hits SIC, Portugal’s largest TV channel
https://therecord.media/lapsus-ransomware-gang-hits-sic-portugals-largest-tv-channel/

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Researchers Detail New HomeKit 'doorLock' Bug Affecting Apple iOS
https://thehackernews.com/2022/01/researchers-detail-new-homekit-doorlock.html

iOS存在HomeKit漏洞會癱瘓iPhone、iPad，教你2招避免和解決
https://mrmad.com.tw/ios-doorlock

睡覺「手機放床上」充電！下秒燒出大洞　專家曝超NG行為
https://www.setn.com/News.aspx?NewsID=1052301

中國修訂應用程式規定　App 平台需建立更嚴格監測評估機制
https://unwire.pro/2022/01/05/china-apps/news/

小米手機內建具政治敏感詞彙審查？它可能不是表面看起來這樣，外媒剖析分享
https://www.kocpc.com.tw/archives/421584

NCC驚曝小米內建千筆「詞彙審查」蔡英文、近平都上榜
https://news.cts.com.tw/cts/politics/202201/202201062068016.html

NCC 點名 Mi 10T 5G 手機有資安疑慮，小米：從來沒有、未來也不會
https://technews.tw/2022/01/06/ncc-mi-10t-5g-security/

小米手機資安疑慮若屬實朝野促限期改正、禁售
https://udn.com/news/story/7240/6015466

遭NCC發現內建APP具有政治詞彙檢查功能台灣小米發聲明否認
https://news.pts.org.tw/article/562263

NCC爆小米手機內建政治敏感詞審查功能公司火速聲明引發PTT網友論戰
https://cnews.com.tw/134220107a04/

小米手機涉資安審查？國際資訊網站實測：看來可怕，但事實並非如此
https://udn.com/news/story/7086/6017568

NCC檢測10款手機資安風險初測僅iPhone 12通過
https://www.cna.com.tw/news/ahel/202201060403.aspx

小米遭 NCC 點名不安全！五款中國手機資安也差點沒過
https://3c.ltn.com.tw/news/47295

不只點名小米！立陶宛政府還點名華為P40爆資安疑慮
https://cnews.com.tw/%E4%B8%8D%E5%8F%AA%E9%BB%9E%E5%90%8D%E5%B0%8F%E7%B1%B3%EF%BC%81%E7%AB%8B%E9%99%B6%E5%AE%9B%E6%94%BF%E5%BA%9C%E9%82%84%E9%BB%9E%E5%90%8D%E8%8F%AF%E7%82%BAp40%E7%88%86%E8%B3%87%E5%AE%89%E7%96%91/

NCC爆小米手機有安全疑慮？來看外媒去年的分析與小米此次說法一致：只是針對廣告商的管理
https://www.ettoday.net/news/20220107/2164182.htm

不用怕被爆雷了！Telegram 開發「防劇透」實用新功能
http://n.yam.com/Article/20220107483503

vivo X70 Pro 安全性系統更新，修補 Android 多項資訊安全漏洞
https://www.eprice.com.tw/mobile/talk/4902/5701490/1/

BlackBerry OS作業系統今起走入歷史停止支援電話、簡訊等服務
https://news.cnyes.com/news/id/4796598

5G 上路再延 2 週！Verizon 和 AT&T 與美政府達成協議
https://www.inside.com.tw/article/26259-faa-dot-verizon-fcc-att-5g-c-band-delay-airplane-safety

超危險！NoReboot 惡意程式偷偷啟動 iPhone 的相機錄影，即便關機也無效
https://applealmond.com/posts/128344

iPhone木馬工具問世 NoReboot 能偷開鏡頭和麥克風監控用戶
https://mrmad.com.tw/iphone-noreboot-malicious-tool

美裁定谷歌侵權Sonos的產品進口禁令 Pixel與Pixelbook等恐遭殃
https://news.cnyes.com/news/id/4798222

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
2022資安預測：駭客四重勒索擴大供應鏈攻擊、個資外洩風險攀升
https://www.ctwant.com/article/159939

韓團DRIPPIN宣傳出新碟搞到INFINITE疑遭駭客入侵
https://reurl.cc/g08yO7

EOS網路基金會成立Recover+核心工作組，建立完善駭客攻擊危機處理框架
https://news.cnyes.com/news/id/4797414

抓包攻擊林昶佐空白文！四叉貓酸「誰家網軍又出包」　帳號本尊回應了
https://tw.appledaily.com/local/20220108/7X6N2AJSGJA4NPFY5QDYQGB3RY/

利用 Twitch 的小奇點洗黑錢近千萬美金，實況主及40餘人遭警方逮捕
https://www.league-funny.com/gossiping/article-209454

駭客借道雲端影片平臺於房地產網站植入側錄工具，竊取訪客支付資訊
https://www.ithome.com.tw/news/148722

你的愛心捐款被駭客盯上了！百間公益團體系統為何爆資安風險
https://www.cw.com.tw/article/5119624

微軟資安研究團隊發現 BulletProofLink 駭侵團體，提供訂閱制釣魚攻擊「服務」
https://www.twcert.org.tw/tw/cp-104-5117-78883-1.html

Woollim所屬藝人SNS突然遭到駭客攻擊！出現未知神秘照片
https://www.koreastardaily.com/tc/news/139304

解散2個月…女團Lovelyz社群全遭駭！真相曝光粉氣炸「沒有良心」
https://ent.ltn.com.tw/news/breakingnews/3792371

從網路上複製/貼上命令列要小心遭駭
https://www.ithome.com.tw/news/148701

網路犯罪黑市存取服務交易攀升，助長勒索攻擊氣焰
https://technews.tw/2022/01/06/aaas-vpn/

2022年美國企業將面臨更嚴格網絡安全規定
https://reurl.cc/AKgYRe

德國反壟斷機構擬加強對谷歌的審查
https://news.cnyes.com/news/id/4797753

伊朗將領遇刺2週年美軍遭襲擊以色列媒體被駭
https://money.udn.com/money/story/5599/6006899

中日美等將成立打擊盜版的國際組織
https://zh.cn.nikkei.com/politicsaeconomy/politicsasociety/47189-2022-01-04-09-15-38.html

【方菲訪談】程曉農：中共千人計劃和網絡攻擊
https://www.epochtimes.com/b5/22/1/4/n13481553.htm

竊取商業機密給中國公司華裔藥物研究員認罪
https://reurl.cc/qOm6LD

中國再頒布監管新法！擁百萬用戶的軟體業海外上市得先接受安全審查
https://www.inside.com.tw/article/26266-china-cac-data

美網路安全遭威脅自中俄境外攻擊暴增
https://globalnewstv.com.tw/202201/176754/

Researchers Uncover Hacker Group Behind Organized Financial-Theft Operation
https://thehackernews.com/2022/01/researchers-uncover-hacker-group-behind.html

Hackers Target Real Estate Websites with Skimmer in Latest Supply Chain Attack
https://thehackernews.com/2022/01/hackers-target-real-estate-websites.html

Chinese APT Hackers Used Log4Shell Exploit to Target Academic Institution
https://thehackernews.com/2021/12/chinese-apt-hackers-used-log4shell.html

Experts Detail Logging Tool of DanderSpritz Framework Used by Equation Group Hackers
https://thehackernews.com/2021/12/experts-detail-logging-tool-of.html

MoD training academy targeted by a 'sophisticated' cyber attack
from a hostile state or criminal organisation in bid to access UK military secrets
via a 'backdoor', Air Marshal reveals
https://www.dailymail.co.uk/news/article-10365137/MoD-training-academy-targeted-sophisticated-cyber-attack-hostile-state.html

[FTC] 資安管理師
https://www.104.com.tw/job/7hqvu

資安網路工程師(台北/台中/台南/高雄)-U11A
https://www.104.com.tw/job/7hrch

Security Engineer 資安工程師
https://www.104.com.tw/job/7hqq9

資安網管工程師
https://www.104.com.tw/job/7hsjz

資訊專員(資訊安全)
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=252&HIRE_ID=10902073

臨時人員2(資安)
https://www.1111.com.tw/job/98594311/

資安工程師
http://www.104.com.tw/jb/104i/job/view?j=7gvd6

AD10507 資安分析師
https://www.104.com.tw/job/7fipf

111學年度第1學期聘任專任教師(資安)徵才公告
https://ifm.ntut.edu.tw/p/404-1083-115220.php?Lang=zh-tw

資安工程師(常日班)
https://www.104.com.tw/job/7hthf

約聘-工程師(台南)-1FS106
https://www.104.com.tw/job/7hw5x

2022年轉職看這裡！月薪超過4萬，從資安工程師到帶貨直播主，還有哪些亮點
https://www.bnext.com.tw/article/67026/2022-key-jobs-

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
France Fines Google, Facebook €210 Million Over Privacy Violating Tracking Cookies
https://thehackernews.com/2022/01/france-fines-google-facebook-210.html

大型釣魚攻擊研究指出，企業經常舉辦資安教育訓練恐有反效果
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9653

美國公衛系統Broward Health外洩近136萬名用戶資料
https://times.hinet.net/topic/23691469

印度醫學協會推特被駭客利用冒充馬斯克宣傳加密騙局
https://news.cnyes.com/news/id/4796240

習慣用 Chrome 記住密碼，遠端工作恐成駭客破口
https://technews.tw/2022/01/04/chrome-edge-password/

懶得重新輸入直接把密碼存瀏覽器？專家爆多人遭駭客入侵竊取機密
https://cnews.com.tw/134220104a02/

貪方便讓瀏覽器記密碼！專家警告：容易遭駭防毒軟體公司也難防
https://newtalk.tw/news/view/2022-01-04/691218

Uber 傳資安漏洞，駭客可假裝官方發送 Mail 盜取用戶個資
https://technews.tw/2022/01/04/uber-elsallamy/

刑事警察局統計：去年1至11月誠品網購個資外洩逾900件
https://news.pts.org.tw/article/562082

電商平台個資外洩立委籲主管機關加強規範
https://www.epochtimes.com/b5/22/1/6/n13486347.htm

詐騙集團假冒書店詐財近千件　經濟部要求誠品改善：不排除裁罰
https://www.ettoday.net/news/20220106/2162792.htm

110年釣魚網站列表
https://www.twcert.org.tw/tw/cp-152-5373-24099-1.html

網傳影片「一大早台軍大亂！一槍幹掉長官！然後投降解放軍
https://tfc-taiwan.org.tw/articles/6808

刁難使用者 Google、臉書遭法國開罰天價
https://ctee.com.tw/news/global/577428.html

高盛投資的英國數位銀行Starling抵制臉書因未嚴審詐欺廣告
https://news.cnyes.com/news/id/4798937

炎亞綸遭盜用「詐財騙情」網破盲點：開場這樣才對
https://reurl.cc/bkz8LE

SEGA 其中一個歐洲伺服器被發現「中門大開」，25 萬用戶資料受影響
https://chinese.engadget.com/sega-data-breach-europe-s-3-averted-103024645.html

Government data breach in Rhode Island leads to AG investigation
https://www.zdnet.com/article/rhode-island-attorney-general-opening-investigation-into-transit-authority-after-data-breach/

E.研究報告/工具
我們與駭的距離 The Hacks Between Us
https://open.firstory.me/user/thehacksbetweenus/voicemails

資料控制者（data controller）
https://choson.lifenet.com.tw/?p=1273

Attackers test “CAB-less 40444” exploit in a dry run
https://news.sophos.com/en-us/2021/12/21/attackers-test-cab-less-40444-exploit-in-a-dry-run/

NIST Cybersecurity Framework: A Quick Guide for SaaS Security Compliance
https://thehackernews.com/2022/01/nist-cybersecurity-framework-quick.html

ipsourcebypass: bypass IP source restrictions using HTTP headers
https://securityonline.info/ipsourcebypass-bypass-ip-source-restrictions-using-http-headers/

XORHEX
https://blog.xorhex.com/blog/

イエラエセキュリティ CSIRT支援室第 16 回小規模CSIRT向けWindowsイベントログで押さえておくこと
https://scan.netsecurity.ne.jp/article/2022/01/07/46918.html

EDR Parallel-asis through Analysis
https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/

F.商業
強化網路安全，Google 收購以色列資安新創業者 Siemplify
https://technews.tw/2022/01/05/google-siemplify/

精誠定期幫企業資安「健檢」，全方位強化防禦實力
https://tw.systex.com/case-security/

敦陽科去年獲利創高可期，擁高殖利率題材
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=5683a256-bdb8-455d-84d3-4d7a9e5135ca

Check Point打造Infinity資安防護架構強化醫療網路與IoMT安全
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=26&id=0000626177_JHS2ZS436QTG1582GY2IL

G.政府
調查班第58期結業總統期勉掌握科技成優秀尖兵
https://reurl.cc/jkqogn

熊好券抽籤台北通又當機　北市府要追究相關責任
https://www.ftvnews.com.tw/news/detail/2022104W0084

台印度簽署備忘錄深化資安技術合作
https://www.cna.com.tw/news/ait/202201030309.aspx

捷克施政綱領強化對台合作外交部：續深化關係
https://www.rti.org.tw/news/view/id/2121608

端點偵測及應變機制(EDR)專區
https://www.nccst.nat.gov.tw/EDR?lang=zh

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
SEMI晶圓設備資安標準朝四大重點發展，建立半導體韌性供應鏈
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9652

Claroty披露Log4j相關之OT漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9655

確保終極憑證自始可信　IoT安全設計須從晶片起
https://www.netadmin.com.tw/netadmin/zh-tw/trend/A5ED7F6C6D5B4B7B881814802BD263E1

物聯網防禦刻不容緩　安全晶片守護根本密鑰
https://www.netadmin.com.tw/netadmin/zh-tw/trend/21BD9CAC2339415F8AE41369D73F9B27

納入5G架構安全/供應鏈信任性　物聯網革新抵禦場域威脅
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/58CFCACDBE8E427787FA75F043E62537

智慧機械雲重視工業應用安全　IoT結合雲平台抗資安威脅
https://www.netadmin.com.tw/netadmin/zh-tw/trend/0F5803DC5ABC439C8B0692E2251D4739

不只硬體層更涵蓋機房到混合多雲　訂閱模式輕鬆免買斷整合AIOps四大領域　生態系續增OT構件
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/250CEB85CD2642DFA55E9A905ADD3343

半導體國際資安標準出爐
https://www.chinatimes.com/newspapers/20220105000329-260208?chdtv

零接觸、可攜帶健康醫療裝置成CES熱門題材！從人類到毛小孩都能遠端監控
https://www.bnext.com.tw/article/67185/itri-ces-2022

納入5G架構安全/供應鏈信任性　物聯網革新抵禦場域威脅
https://www.chtsecurity.com/news/1b62ce16-1739-4ade-968d-cd8cbe729e7b

5G公共安全與智慧教育應用研討會剖析垂直應用趨勢
https://www.peopo.org/news/568208

I.教育訓練
【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
強化資安韌性 – 超前領先戰勝資安威脅 2022/1/11
https://www.isaca.org.tw/news/newsDetail/16165

元宇宙、資安&隱私、資安保險與資安鑑識論壇暨ACFD第二屆第三次會員大會 2022/01/14(五)
https://acfd2019.kktix.cc/events/831e3194-copy-1

資安政策法規標準 2022/01/13(四) - 2022/01/14(五)
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19499

Global AI Bootcamp in Taiwan- 2022/01/14(五)
https://www.meetup.com/rladies-taipei/events/282500807/

SubQuery - Web3 區塊鏈網路中的數據整合搜尋引擎 2022/1/15
https://www.meetup.com/Taipei-Blockchain/events/282357267/

2022 青年國家安全論壇 2022/1/15
https://www.accupass.com/event/2112151844242075727800

Taiwan Digital Drinks - Quarterly General Mixer 2022/1/19
https://www.meetup.com/taiwan-digital-drinks/events/282778206/

資訊安全攻防、應變與管理趨勢 2022/1/21(五)，下午2:00～5:00
https://www.caa.org.tw/newsdetail-16160.html

企業防駭最前線―建立 Google 也在用的零信任資安模型 2022/1/21
https://www.accupass.com/event/2111170951285938629810

資訊安全攻防、應變與管理趨勢 2022/1/21
https://www.caa.org.tw/coursedetail-36059.html

《歐立威 x Elastic 系列講座》Elastic Cloud : 彈性 x 安全，全面託管 Elastic 集群 2022/1/22
https://www.accupass.com/event/2111100816227444523630

【 AIOT推薦】業界最夯的物聯網無線技術應用『ARM LoRa 通訊傳輸』資訊傳遞不受限 2022/1/23
https://www.accupass.com/event/2112090610056057465750

【Python 金融思辨首部曲–科技菁英理財營】全台唯一社會科學為基底的程式開發課程！經濟學X社會學X資訊科學 2022/1/24
https://www.accupass.com/event/2110150640421591980420

Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html

資安事件新聞週報 2021/12/27 ~ 2021/12/31

noreply@blogger.com (Unknown) — Fri, 31 Dec 2021 06:27:00 +0000

資安事件新聞週報 2021/12/27 ~ 2021/12/31

1.重大弱點漏洞/後門/Exploit/Zero Day
駭客利用漏洞攻入使用 AMD EPYC 的 HP 伺服器進行挖礦， 8 天獲利超過 10 萬美金
https://www.cool3c.com/article/170421

apache http_server CVE-2021-44790
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-44790

Nvidia、HPE、IBM公布受Log4j漏洞影響的產品
https://www.ithome.com.tw/news/148586

New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
https://thehackernews.com/2021/12/new-apache-log4j-update-released-to.html

Apache Log4j爆發近十年最大漏洞，微軟、蘋果都受波及
https://www.techbang.com/posts/92910-f-secure-incident-response-guidance-log4j-2-vulnerability

利用 Log4j Java 嚴重零日漏洞發動的勒索攻擊已被發現
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=9637

中國駭客組織疑使用 Log4j 漏洞進行攻擊
https://unwire.pro/2021/12/30/china-based-group-used-log4j-flaw-in-attack/security/

未及時向中國政府通報Log4j漏洞，阿里雲稱未意識漏洞嚴重性
https://times.hinet.net/news/23678474

Apache HTTP伺服器存在安全漏洞：CVE-2021-44224與44790
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9647

Apache Log4j2 2.14.1 - Information Disclosure
https://www.exploit-db.com/exploits/50590

Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
https://www.exploit-db.com/exploits/50581

Raspberry Pi 5.10 - Default Credentials
https://www.exploit-db.com/exploits/50576

Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)
https://www.exploit-db.com/exploits/50591

Microsoft Internet Explorer / ActiveX Control - Security Bypass
https://www.exploit-db.com/exploits/50598

微軟推出 2021 年 12 月 Patch Tuesday 更新修補包
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9646

Ubuntu的帳號服務元件存在漏洞，恐讓攻擊者能取得Root權限
https://www.tcrc.edu.tw/new/new-list/ubuntu-root

耕莘醫院健檢報告查詢系統 - Authorization Bypass Through User-Controlled Key
https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html

全景 MOTP(Mobile One Time Password) - SQL Injection
https://www.twcert.org.tw/tw/cp-132-5423-84a13-1.html

2.銀行/金融/保險/證券/支付系統/金融監理新聞及資安
【IT與OT資安分享會】主題二：如何落實金融業電腦系統組態基準
https://easybranches.com/amp/youtube/rZm1DcorLTk

跨年連假倒數金管會要求保戶服務不中斷保險公司加強資安防駭
https://news.cnyes.com/news/id/4792950

明年7大項金檢重點　緊盯銀行不動產授信
https://www.cardu.com.tw/news/detail.php?45072

證券期貨商若資安出包　2022起年報需揭露
https://finance.ettoday.net/news/2156704

證交所公布明年公司治理評鑑指標修正17項
https://news.cnyes.com/news/id/4794289

中信銀展數位金融實力 Discovery解密4大技術
https://www.storm.mg/lifestyle/4126680

金融犯罪防制研討會當今金融犯罪大翻新　打擊犯罪要與時俱進
https://news.sina.com.tw/article/20211227/40902612.html

信用交易優質聯徵中心表揚39機構
https://money.udn.com/money/story/122232/5978592

監委巡察財金資訊公司及央行
https://reurl.cc/aklm8G

金融業皮繃緊！服務差評名單 2023年全現形
https://reurl.cc/VjaOoN

3.電子支付/行動支付/pay/資安
電子支付戰國迎來「兩個千萬」、零售也搶著加入！下一步會怎麼走
https://www.bnext.com.tw/article/67065/taiwan-2021-digital-payment

北市府推無現金支付商攤爆料「不裝就不給續約」
https://reurl.cc/pWD024

全聯+全家聯手電子支付將通用
https://udn.com/news/story/7239/5978986

LINE Pay Money易與LINE Pay混淆改名一卡通MONEY
https://www.cna.com.tw/news/firstnews/202112210077.aspx

一卡通電子支付更名一卡通MONEY
https://reurl.cc/Kp6Y5m

騰訊據報取得「掌紋支付設備」相關專利　微信支付日後或可掃手掌畀錢
https://reurl.cc/bk68o6

歐買尬聚焦開發應用型支付工具持續規劃遊戲NFT商品
https://reurl.cc/e65lom

傳收購遠東旗下電子票證全聯急出聲
https://udn.com/news/story/7239/5986056

虛擬健保卡繳費不便健保署擬推動「健保Pay」電子支付
https://udn.com/news/story/7266/5935047

巴菲特、孫正義投資的「印度支付寶」Paytm上市首日就暴跌，散戶投資人學到了什麼
https://www.thenewslens.com/article/160928

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約資安
Crypto safety tips and another technique to evaluate rebase tokens
https://medium.com/@bludex/crypto-safety-tips-and-another-technique-to-evaluate-rebase-tokens-22c76c2eab27

元宇宙熱度升！銀行業翻轉　應用區塊鏈技術走向「去中心化金融」
https://finance.ettoday.net/news/2154005

NFT項目遭駭失千萬！女星也有投資
https://times.hinet.net/news/23677561

NFT項目「Monkey Kingdom」遭駭損千萬！蔡詩芸也有投資
https://www.nownews.com/news/5487095

泰國科技公司進軍比特幣挖礦今年股價已飆升67倍
https://news.cnyes.com/news/id/4792910

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
AvosLocker 勒索軟體在安全模式下使用 AnyDesk 發動攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=11&aid=9642

Sophos發現勒索軟體在安全模式下使用AnyDesk發動攻擊
https://reurl.cc/Y9lNEl

【Spider-Man】假冒提供《蜘蛛俠：不戰無歸》電影免費下載　黑客挾帶惡意軟件入侵挖礦
https://reurl.cc/3j1ldR

QNAP 發表資安通報，指出有惡意軟體攻擊其 NAS 裝置以挖掘比特幣
https://www.twcert.org.tw/tw/cp-104-5425-7951b-1.html

新惡意程式利用合法憑證冒充Windows執行檔流傳
https://www.itcheck.com.tw/h/NewsInfo?key=w5vx7&cont=335656

利用組態權限設定失誤漏洞　竊取憑證四出盜用還偷挖礦惡意腳本鎖定AWS用戶　駭客狂攻雲端基礎架構
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/2ABC0FF306134FEBBC7F7381E517DE67

日美認勒索軟體威脅國安擬合力採取防禦對策
https://turnnewsapp.com/livenews/global/A20211226131925

挪威出版商遭勒索軟體攻擊當地報紙出刊陷癱瘓
https://www.cna.com.tw/news/aopl/202112300234.aspx

Agent Tesla Updates SMTP Data Exfiltration Technique
https://isc.sans.edu/diary/rss/28190

Flagpro: The new malware used by BlackTech
https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech

BLISTER malware campaign discovered
https://www.elastic.co/es/blog/elastic-security-uncovers-blister-malware-campaign

Establishing the TigerRAT and TigerDownloader malware families
https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/

Cases of Lockis ransomware infection
https://asec.ahnlab.com/ko/30284/

Example of how attackers are trying to push crypto miners via Log4Shell
https://isc.sans.edu/forums/diary/Example+of+how+attackers+are+trying+to+push+crypto+miners+via+Log4Shell/28172/

Strategically Aged Domain Detection: Using DNS Traffic Trends
https://unit42.paloaltonetworks.com/strategically-aged-domain-detection/

Ongoing Autom Cryptomining Malware Attacks Using Upgraded Evasion Tactics
https://thehackernews.com/2021/12/ongoing-autom-cryptomining-malware.html

New iLOBleed Rootkit Targeting HP Enterprise Servers with Data Wiping Attacks
https://thehackernews.com/2021/12/new-ilobleed-rootkit-targeting-hp.html

'Spider-Man: No Way Home' Pirated Downloads Contain Crypto-Mining Malware
https://thehackernews.com/2021/12/spider-man-no-way-home-pirated.html

New Android Malware Targeting Brazil's Itaú Unibanco Bank Customers
https://thehackernews.com/2021/12/new-android-malware-targeting-brazils_27.html

Expert Details macOS Bug That Could Let Malware Bypass Gatekeeper Security
https://thehackernews.com/2021/12/expert-details-macos-bug-that-could-let.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
iOS 15.2更新了嗎？　iPhone這3大功能不可不知
https://tw.appledaily.com/gadget/20211228/7DSFPB5IRFFHBPXIXPJNK4HHRY/

蘋果 iOS 15.2 修補 RCE 漏洞，防駭客 15 秒入侵奪取裝置控制權
https://technews.tw/2021/12/27/apple-rec/

LINE安全嗎？這3套加密通訊軟體各有特異功能！全程端到端加密、無法截圖、去中心化也無法反向追蹤
https://www.techbang.com/posts/91951-encrypted-instant-message

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
SEMICON Taiwan 2021 國際半導體展遭爆，報名系統網域註冊在中國
https://technews.tw/2021/12/29/semicon-taiwan-2021-domain-registration-was-reported-in-china/

微軟Log4j漏洞掃瞄工具引發Defender假警報
https://times.hinet.net/news/23684475

新北檢聲請安博盒子網域扣押獲准，如何向TWNIC申請DNS RPZ排除特定域名
https://www.techbang.com/posts/93007-new-taipei-prosecutors-request-for-ambow-box-domain-seizure-is

別讓非資訊類採購成破口，需從潛藏需求及風險考量並納入契約
https://www.ithome.com.tw/news/148549

世界級FIRST機器人賽事！新北攜鴻海辦台灣區域賽
https://reurl.cc/Dd1k9N

國內如何推廣數位身分皮夾業者提點先了解資安風險
https://money.udn.com/money/story/122229/5992170

臺灣第一批醫院資安長現身，披露醫療資安管理者的兩難
https://www.ithome.com.tw/news/148550

中榮院級IT危機應變作法大公開，更靠3招心法鞏固資安體質
https://times.hinet.net/news/23678388

資安緊急應變不只要制度化，應變演練的溝通協調更是關鍵
https://times.hinet.net/news/23678384

林秉樞維基修改手竟是公總連江監理站雇員
https://news.ltn.com.tw/news/society/paper/1492344

公總IP修改林秉樞維基！連江監理站員工稱好奇　事發第一時間刪光瀏覽紀錄
https://tw.appledaily.com/life/20211227/MZGAFL6QB5ELFBWSH7AR6W3LIE/

防資料外洩中國！民團籲文化部：一併禁止《壹週刊》跨境傳輸個資
https://newtalk.tw/news/view/2021-12-27/687605

英國媒體：中共拉攏台灣原住民但他們不買帳
https://reurl.cc/7e2v69

NHK：中國解放軍唆使留學生日本買專用防毒軟體找弱點　日警發通緝逮人
https://www.taiwannews.com.tw/ch/news/4390713

日本防機密外洩中共經濟安保法擬對民間加罰則
https://reurl.cc/g0vy4Q

資訊戰只防守不夠！陽明交通大學資工教授林盈達：應公布中國駭客照片展現反擊能力
https://musou.watchout.tw/read/sZZWMRPnHroPpfA7Qo1v

巴西郵政系統“崩了” 回應：駭客攻擊可能性不大
https://brazilhr.com/2021/12/795429/

北韓領導人金正恩的網軍部隊！靠「駭客入侵」賺637億元　突破封鎖研發核武
https://www.ettoday.net/news/20211226/2154752.htm

英國推出產品安全和電信基礎設施法案，以保護民眾使用智慧設備免受駭客攻擊
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=0400f787-0e3b-4271-84ad-30b1cd3779dd

Experts Detail Logging Tool of DanderSpritz Framework Used by Equation Group Hackers
https://thehackernews.com/2021/12/experts-detail-logging-tool-of.html

Garrett Walk-Through Metal Detectors Can Be Hacked Remotely
https://thehackernews.com/2021/12/garrett-walk-through-metal-detectors.html

Chinese APT Hackers Used Log4Shell Exploit to Target Academic Institution
https://thehackernews.com/2021/12/chinese-apt-hackers-used-log4shell.html

Microsoft Offers TPM 2.0 Bypass to Install Windows 11 on Unsupported PCs
https://medium.com/pcmag-access/microsoft-offers-tpm-2-0-bypass-to-install-windows-11-on-unsupported-pcs-67fc8180893

中華電信加薪4%　再加發一次性激勵金5千元
https://www.1111.com.tw/news/jobns/143176

如何挑選「潛力」工作？2022年十大亮點職務出爐
https://www.moneyweekly.com.tw/ArticleData/Info/Article/76227/

盤點 10 大高含金量職務：元宇宙推動 AR、VR 工程師需求，年薪上看 120 萬
https://buzzorange.com/techorange/2021/12/28/2022-10-hot-jobs/

(JP)-資安經理(年薪可談)
https://www.104.com.tw/job/7h2jc

全國農業金庫111年新進人員甄試
https://svc.tabf.org.tw/111agribank01/Exam/List?ProductID=480652

產品支援工程師(Support Engineer/熟資安產品佳)
https://www.cakeresume.com/companies/teamt5-org-tw/jobs/489be8

資安工程師 (Security Engineer)
https://www.104.com.tw/job/7hjgw

合庫2022年徵才近400人首波鎖定年後轉職潮
https://www.cna.com.tw/news/afe/202112300335.aspx

合庫銀年終逾7個月　明年徵才400人
https://tw.appledaily.com/property/20211230/LOAPCYZ2RBB2FPSANBYEPKUX6Y/

【資訊類】資安工程師 (桃園廠)
http://202.153.190.13/job/98542462/

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
明年供應鏈資安更嚴峻，TSP及 IT業者當心「文字電郵」釣魚
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9636

台政府出手護台蘋敏感個資港方突拋買方.遭曝控制者
https://reurl.cc/RjdG4z

港方清盤台蘋立委促文化部主動擬計畫.現場護個資
https://reurl.cc/12QAx9

「1qaz2wsx」這密碼不易破解?2021 超過一億人愛用的危險密碼是
https://blog.trendmicro.com.tw/?p=70903

東京警方遺失兩磁碟　涉38名市民個人資料
https://reurl.cc/yQyNnq

虛擬性騷擾元宇宙成灰色地帶
https://www.taiwannews.com.tw/ch/news/4391995

投資股票穩賺不賠　龜山警阻詐成功
https://reurl.cc/QjpAZO

大型釣魚攻擊研究指出，企業經常舉辦的各種資安教育訓練有反效果
https://www.twcert.org.tw/tw/cp-104-5427-acffa-1.html

【謠言風向球】LINE瘋傳假「獨家」消息小心掉入惡作劇陷阱
https://tfc-taiwan.org.tw/articles/6763

詐騙金額創新高　刑事局長籲以高獎金鼓勵窩裡反
https://news.sina.com.tw/article/20211230/40928664.html

駭客滲透Ikea內部及供應商，寄送網釣郵件
https://reurl.cc/AK1mbE

E.研究報告/工具
APNIC文摘— DNS安全機制部署率與開銷、部署簡易度成正比
https://blog.twnic.tw/2021/12/27/21236/

EP6 ▊弱點掃描助攻企業妨駭!資安三點不露絕招公開
https://player.soundon.fm/p/b74d5df6-a583-4790-9d25-e556817b0956/episodes/7269ebe5-f5c2-4eb6-a14e-1f4c859da0f2

開源LogonTracer視覺化過濾　再用系統事件檢視器細察二刀流Windows日誌分析　精準掌握資安蛛絲馬跡
https://www.netadmin.com.tw/netadmin/zh-tw/technology/84E5EAA4BC494BB6A4B15607E62418A0

Cymetrics首度公布臺灣十大電商資安曝險調查報告
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000625699_MMM7OD428HSSMFLFQFDSC

SIM 卡交換攻擊是什麼？不用繞過手機安全機制，直接竊取用戶個資
https://technews.tw/2021/12/30/t-mobile-sim-swap-attacks/

對圖像進行視覺加解密之軟體實作流程
https://www.netadmin.com.tw/netadmin/zh-tw/technology/81FE07C957A84E0DAFA51D3186AC4707

政府專案資安注意事項
https://www.tpisoftware.com/tpu/articleDetails/2754

用Python寫一個炫酷的駭客帝國程式碼雨，裝×利器（附完整程式碼）
https://read01.cc/article/3441376

CurveBall Windows CryptoAPI Spoofing - Paper
https://www.exploit-db.com/docs/50605

Polkit CVE-2021-3560 - Paper
https://www.exploit-db.com/docs/50584

Mail Information Gathering AppScript - Paper
https://www.exploit-db.com/docs/50575

Apache HTTP Server 2.4.50 Path Traversal and Code Execution - Paper
https://www.exploit-db.com/docs/50552

PECB Certified Lead Ethical Hacker: Take Your Career to the Next Level
https://thehackernews.com/2021/12/pecb-certified-lead-ethical-hacker-take.html

Why I Returned My M1 MacBook Pro (and What I Got Instead)
https://jeff-48490.medium.com/why-i-returned-my-m1-macbook-pro-and-what-i-got-instead-b80b63660aac

Weapons in my quiver: Tools and extension I use in bounties
https://manasharsh.medium.com/weapons-in-my-quiver-tools-and-extension-i-use-in-bounties-d8e2e0265fb

How to use grep with regex like a Pro
https://bhichher.medium.com/how-to-use-grep-with-regex-like-a-pro-a2ea4302364e

Why Did Facebook Shut Down Artificial Intelligence
https://medium.com/geekculture/why-did-facebook-shut-down-artificial-intelligence-5dede53ceded

How to Web Scrape Morningstar Financial Statements (or any others)
https://medium.com/@trent.alleyne99/how-to-web-scrape-morningstar-financial-statements-or-any-others-87f01e0ae9f2

1000 eyes that don’t want to check open-source code
https://medium.com/@Code_Analysis/1000-eyes-that-dont-want-to-check-open-source-code-e4e5f91fe158

F.商業
AI主動資安管控、一致性安全調適控管是2022應用服務防禦首務
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=12&aid=9643

世界資安趨勢研討會提升臺灣資安防護能力
https://news.ebc.net.tw/news/living/294743

元宇宙是第三波科技趨勢？林百里：商機遍地開花
https://www.gvm.com.tw/article/85610

資通電腦舉辦人資線上課程分享 HCP 因應 IE 停用作法
https://www.ares.com.tw/events/hcp-workshop-20211217

從負載均衡到雲原生應用服務與安全整合 NGINX Plus 與 BIG-IP　F5 為現代微服務架構把關
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/961D60027E754BC4BD963786FA0C236F

世界資安趨勢研討會剖析5G網路軟體應用安全
https://money.udn.com/money/story/5635/5991020

中華資安國際進軍南非市場
https://readers.ctee.com.tw/cm/20211228/a37ac1/1162850/5952d982329178ee54553d3f1429bb9d/share

奧義智慧助SEMI推廣資安
https://readers.ctee.com.tw/cm/20211228/a77asa7/1162903/share

中華電信學院與佐臻股份有限公司布局5G元宇宙智慧應用攜手合作AR XR培訓共同簽署合辦訓練課程協議書
https://times.hinet.net/news/23680473

景碩科技採用Oracle Cloud 災備方案，落實業務連續性計劃
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9648

這家新創把雲端資安「全自動化」了！ Dazz 如何抓準疫後新資安商機
https://buzzorange.com/techorange/2021/12/29/dazz/

台哥大併台灣之星林之晨：共組台灣5G國家隊
https://reurl.cc/Wk4QRy

G.政府
電子連署系統尚須加強資安防護李進勇：盼明年10月上線
https://www.rti.org.tw/news/view/id/2120496

台灣中選會：公投無任何資安事件電子連署明年4月加強防護
https://www.epochtimes.com/b5/21/12/27/n13462494.htm

資安法成醫院評鑑依據，公立及CI醫院需設資安長
https://www.ithome.com.tw/news/148548

科技部資安暨智慧科技研發大樓進駐及收益要點
https://law.most.gov.tw/LawContentSearch.aspx?id=GL000455

科技部資安暨智慧研發大樓正式啟用，加速南台灣數位轉型
https://technews.tw/2021/12/27/tta-information-security/

我國資安法A、B級機關修法重點說明
https://tprc.tanet.edu.tw/tpnet2021/training/1100802.pdf

保護民眾個資北市警局導入國際性資安、隱私雙證照
https://www.chinatimes.com/realtimenews/20211227003672-260402?chdtv

司法聯盟區塊鏈驗證成果發表　「數位證據」運用成四大主軸
https://www.mirrormedia.mg/story/20211227inv011/

疫苗數位證明將上線國際疫情嚴峻.台二級警戒延長
https://reurl.cc/nEVdzv

不用小黃卡！「數位疫苗證明」開放下載　8大QA教你辦
https://www.ftvnews.com.tw/news/detail/2021C28W0045

數位發展部將立法成立　民眾黨籲把人民血汗錢花在刀口上
https://www.ctwant.com/article/159110

立院三讀行政院組織法增設數位發展部
https://www.cna.com.tw/news/firstnews/202112280217.aspx

民眾黨團樂見數位發展部促政府具備數位治理能力
http://www.ksnews.com.tw/index.php/news/contents_page/0001558379

立法院三讀數位發展部組織法　下設資安署和數位產業發展署
https://www.setn.com/News.aspx?NewsID=1048978

數位發展部即將成立黃偉哲力促臺南成為資安及數位轉型重鎮
https://times.hinet.net/news/23681420

數位發展部要來了！政院：加速數位轉型、做好資安工作
https://www.ettoday.net/news/20211228/2156627.htm

立院三讀通過政院設「數位發展部」　科技部改「國科會」
https://reurl.cc/NpadZe

「數位發展部」下設3機構顧資安、帶動產業發展
https://news.ltn.com.tw/news/politics/breakingnews/3783104

數位發展部組織法三讀過關，外界期待2022年520前能掛牌，新成立「資通安全署」與「數位產業署」
https://www.ithome.com.tw/news/148620

NCC資安長孫雅麗：臺灣3G時代就禁中國產品領先世界，但中國開源碼已成隱憂
https://musou.watchout.tw/read/3IjPhre6UDCqqOFfb0uv

NCC、數發部如何分工？陳耀祥：需等「數發部」成立才能進一步討論
https://www.rti.org.tw/news/view/id/2120769

台灣「數位發展部」首位部長由誰出任？行政院：待確定後再對外說明
https://www.taiwannews.com.tw/ch/news/4391076

數位發展部三讀！部長人選鎖定唐鳳、郭耀煌與吳政忠
https://www.rti.org.tw/news/view/id/2120689

趕在2021年結束之前，金管會正式要求臺灣上市櫃大型企業都需設置資安長，讓此要求擴及各類傳產與電子產業
https://www.ithome.com.tw/news/148662

數通法規範網路平台 Google臉書擬納管
https://www.epochtimes.com/b5/21/12/30/n13469195.htm

小心荷包！區間測速資安標準出爐農曆春節前可望重啟
https://udn.com/news/story/7266/5996530

出席「2021總統盃黑客松頒獎典禮」　蔡英文盼：讓台灣成為堅韌之島
https://www.ftvnews.com.tw/news/detail/2021C26W0145

【H-ISAC新進展：衛福部】會員規章制度化也大秀醫院參與成果，兩策略擴大聯防規模
https://www.ithome.com.tw/news/148572

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安
半導體供應鏈資安聯盟啟動設四大目標
https://udn.com/news/story/7240/5993672?from=udn-ch1_breaknews-1-cate6-news

捍衛半導體命脈台首推資安標準
https://ec.ltn.com.tw/article/paper/1492754

工業電腦整合OT+IT資安解決方案
https://reurl.cc/pWD0gl

SECPAAS集結18家業者共同展示臺灣資安堅強實力
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9650

推動產業供應鏈安全工業局偕同半導體產業協會率先發布半導體國際資安標準
https://www.moea.gov.tw/MNS/populace/news/News.aspx?kind=1&menu_id=40&news_id=98353

SECPAAS 資安整合服務平台如何成為台灣高科技產業的守護者
https://buzzorange.com/techorange/2021/12/28/secpaas/

台積、日月光、鴻海、台灣應材、微軟宣示成立資安聯盟
https://udn.com/news/story/7240/5994552

資安成國際半導體展要角，勒索軟體eCh0raix於聖誕節前夕攻擊威聯通NAS
https://www.ithome.com.tw/news/148622

奧義智慧助SEMI推廣資安
https://www.chinatimes.com/newspapers/20211228000380-260210?chdtv

併用NPB與SaaS NDR 讓OT資安威脅無所遁形
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=16&id=0000625986_KQK8KT9I9G4IE054ZV3KM

SEMICON 中華資安國際展示OT防護心法
https://ctee.com.tw/industrynews/technology/572601.html

FUSO科技卡車　植入駕駛輔助科技系統
https://www.setn.com/News.aspx?NewsID=1047515

提高汽車安全性　NXP看好分散式架構前景
https://www.mem.com.tw/arti.php?sn=2112240009

AI和資安竟對不上話資安獨角獸狂吸金
https://turnnewsapp.com/livenews/finance/A83205002021122617051835

I.教育訓練
【資安管理國際證照懶人包】學習心得、考試要點一次整理！2022 轉職夢幻工作看這篇
https://buzzorange.com/techorange/2021/12/30/isaca/

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

110年新進人員「校園資訊安全講座」教材
https://cc.nccu.edu.tw/p/406-1001-740,r18.php

【訓練教材D】資訊安全技術教育訓練教材
https://iscb.nchu.edu.tw/2019/07/d.html

109資通安全管理法數位教育訓練
https://reurl.cc/ARlmqp

110-1初級資訊安全工程師-資訊安全管理概論
https://yamol.tw/exam.php?id=104050

中大信息工程學系栽培資訊科技領導人才
https://reurl.cc/ARZKDK

SANS Cyber Aces Online Tutorials
https://tutorials.cyberaces.org/tutorials.html

Free Online Cybersecurity Courses (MOOCs)
https://www.cyberdegrees.org/resources/free-online-courses/

Develop Your Cybersecurity Skills
https://www.cybrary.it/catalog/cybersecurity/

Mobile App Security
https://www.cybrary.it/course/mobile-app-security/

Introduction to Cybersecurity
https://reurl.cc/bnaj6d

How to Tackle SaaS Security Misconfigurations
https://thehackernews.com/2021/11/how-to-tackle-saas-security.html

How to Build a Security Awareness Training Program that Yields Measurable Results
https://thehackernews.com/2021/11/how-to-build-security-awareness.html

Common Attacks
https://choson.lifenet.com.tw/?p=1174

6.近期資安活動及研討會
資訊安全治理簡介 2022/1/1
https://www.accupass.com/event/2101210228111179979342

Just a chat - with no Expectations 2022/1/1
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/282879341/

Coffee & Code 2022/1/2
https://www.meetup.com/Innovate-Taiwan/events/282768136/

《歐立威 x Elastic 系列講座》Elastic Security : 監測 x 告警，揪出潛在威脅 2022/1/7
https://www.accupass.com/event/2111100816091650042558

元宇宙、資安&隱私、資安保險與資安鑑識論壇暨ACFD第二屆第三次會員大會 2022/01/14(五)
https://acfd2019.kktix.cc/events/831e3194-copy-1

資安政策法規標準 2022/01/13(四) - 2022/01/14(五)
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X19499

Global AI Bootcamp in Taiwan- 2022/01/14(五)
https://www.meetup.com/rladies-taipei/events/282500807/

SubQuery - Web3 區塊鏈網路中的數據整合搜尋引擎 2022/1/15
https://www.meetup.com/Taipei-Blockchain/events/282357267/

2022 青年國家安全論壇 2022/1/15
https://www.accupass.com/event/2112151844242075727800

Taiwan Digital Drinks - Quarterly General Mixer 2022/1/19
https://www.meetup.com/taiwan-digital-drinks/events/282778206/

資訊安全攻防、應變與管理趨勢 2022/1/21(五)，下午2:00～5:00
https://www.caa.org.tw/newsdetail-16160.html

企業防駭最前線―建立 Google 也在用的零信任資安模型 2022/1/21
https://www.accupass.com/event/2111170951285938629810

資訊安全攻防、應變與管理趨勢 2022/1/21
https://www.caa.org.tw/coursedetail-36059.html

《歐立威 x Elastic 系列講座》Elastic Cloud : 彈性 x 安全，全面託管 Elastic 集群 2022/1/22
https://www.accupass.com/event/2111100816227444523630

【 AIOT推薦】業界最夯的物聯網無線技術應用『ARM LoRa 通訊傳輸』資訊傳遞不受限 2022/1/23
https://www.accupass.com/event/2112090610056057465750

【Python 金融思辨首部曲–科技菁英理財營】全台唯一社會科學為基底的程式開發課程！經濟學X社會學X資訊科學 2022/1/24
https://www.accupass.com/event/2110150640421591980420

Global AI Bootcamp in Taiwan 2022/2/12
https://www.meetup.com/rladies-taipei/events/282500807/

簡化 Active Directory 網域服務建置步驟―認識代管式 Windows AD 2022/2/18
https://www.accupass.com/event/2112070607012873372200

OSCP 高階滲透測試精進班 2022-02-12~2022-03-20
https://college.itri.org.tw/course/all-events/35FC13F1-05A3-44CF-85B1-2D01B6F92632.html