###### tags: `資安事件新聞週報`

# 資安事件新聞週報 2023/8/7 ~ 2023/8/11

1.重大弱點漏洞/後門/Exploit/Zero Day
研究人員揭露WD、群暉NAS漏洞細節，駭客有可能竊取資料或是發動RCE攻擊
https://www.securityweek.com/western-digital-synology-nas-vulnerabilities-exposed-millions-of-users-files/
https://claroty.com/team82/research/a-pain-in-the-nas-exploiting-cloud-connectivity-to-pwn-your-nas-wd-pr4100-edition
https://claroty.com/team82/research/a-pain-in-the-nas-exploiting-cloud-connectivity-to-pwn-your-nas-synology-ds920-edition

SAP修補業務流程與資料建模系統PowerDesigner的重大漏洞
https://www.securityweek.com/sap-patches-critical-vulnerability-in-powerdesigner-product/

列印管理系統PaperCut修補重大漏洞
https://www.bleepingcomputer.com/news/security/new-papercut-critical-bug-exposes-unpatched-servers-to-rce-attacks/
https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/
https://www.papercut.com/kb/Main/securitybulletinjuly2023/

Researchers Uncover New High-Severity Vulnerability in PaperCut Software
https://thehackernews.com/2023/08/researchers-uncover-new-high-severity.html

五眼聯盟公布 2022 年遭駭最嚴重 12 個漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10614

五眼聯盟公布2022年最常被利用的漏洞，Fortinet SSL VPN、微軟Exchange漏洞上榜
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a

FBI Alert: Crypto Scammers are Masquerading as NFT Developers
https://thehackernews.com/2023/08/fbi-alert-crypto-scammers-are.html

攻擊者可利用惡意擴充套件觸發Visual Studio Code弱點，竊取開發者的帳密資料
https://cycode.com/blog/exposing-vscode-secrets/

微軟發布8月例行更新，修補Office、Visual Studio、.NET的零時差漏洞
https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2023-patch-tuesday-warns-of-2-zero-days-87-flaws/

Microsoft Releases Patches for 74 New Vulnerabilities in August Update
https://thehackernews.com/2023/08/microsoft-releases-patches-for-74-new.html

微軟修補Azure程式碼開發平臺Power Platform漏洞
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-flaw-after-being-called-irresponsible-by-tenable-ceo/
https://msrc.microsoft.com/blog/2023/08/microsoft-mitigates-power-platform-custom-code-information-disclosure-vulnerability/
https://www.tenable.com/security/research/tra-2023-25

CISA Adds Microsoft .NET Vulnerability to KEV Catalog Due to Active Exploitation
https://thehackernews.com/2023/08/cisa-adds-microsoft-net-vulnerability.html

Malicious Campaigns Exploit Weak Kubernetes Clusters for Crypto Mining
https://thehackernews.com/2023/08/malicious-campaigns-exploit-weak.html

Google將每週發布 Chrome 安全更新
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10620

Adobe於8月例行更新修補30個Acrobat及Reader漏洞
https://www.securityweek.com/patch-tuesday-adobe-patches-30-acrobat-reader-vulns/

美國、挪威公布Ivanti行動裝置管理平臺零時差漏洞攻擊細節
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a

美國政府承包商Serco證實遭到MOVEit Transfer零時差攻擊
https://www.bleepingcomputer.com/news/security/us-govt-contractor-serco-discloses-data-breach-after-moveit-attacks/

研究人員揭露Downfall漏洞，影響Skylake至Tiger Lake架構的Intel處理器
https://www.bleepingcomputer.com/news/security/new-downfall-attacks-on-intel-cpus-steal-encryption-keys-data/
https://downfall.page/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html

AMD處理器存在Inception、Phantom漏洞，可被用於竊取敏感資料，1至4代的Zen處理器都可能曝險
https://www.bleepingcomputer.com/news/security/new-inception-attack-leaks-sensitive-data-from-all-amd-zen-cpus/

2.銀行/金融/保險/證券/金融監理 新聞及資安
農業金庫打造資安防護網 吳明敏出席 ISO 授證儀式
https://www.sinotrade.com.tw/richclub/news/64d5c75c271c1d594500fcc2

金融數據上雲 資安、控管3考驗
https://udn.com/news/story/7238/7348164

高盛投資的英國數位銀行Starling將進軍亞太市場
https://news.cnyes.com/news/id/5287501

金控及旗下銀行壽險違反法令　共遭金管會罰4000萬
https://finance.ettoday.net/news/2558328

花旗44家分行走入歷史，5大服務下午3點半喊卡！併入星展，金融卡、網銀要重新申請？異動一次看
https://www.businesstoday.com.tw/article/category/183011/post/202308110003/

3.信用卡/電子支付/行動支付/pay/支付系統/資安
旅遊注意 Apple Pay 海外盜刷頻傳！綁定信用卡「擋刷」真正原因曝光
https://finance.technews.tw/2023/08/09/fraudulent-2/

詐團踢鐵板 兆豐銀實施綁卡新制3日簡訊詐騙「清零」
https://ec.ltn.com.tw/article/breakingnews/4393436

阻詐出絕招！兆豐銀推嗶手機刷信用卡需限本人門號 國銀第一家
https://reurl.cc/AAZRbE

防詐再出招 行動支付嚴把關
https://wantrich.chinatimes.com/news/20230811900405-420501

夜間是詐騙高峰 元大銀宣布午夜至清晨6點暫停行動支付
https://udn.com/news/story/7239/7359697

古巴推電子支付救貨幣 民眾仍寧緊抱現金
https://reurl.cc/2LqoaX

古巴強推電子支付救通膨，民眾與商家對銀行抱持戒心，寧願緊抱現金
https://www.thenewslens.com/article/190077

彎道超車的中國電子支付　如何變成詐騙溫床
https://www.cw.com.tw/article/5126869

拉貨力道強，電子支付系統廠擴產因應
https://reurl.cc/o7Gxmg

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
NYC Couple Pleads Guilty to Money Laundering in $3.6 Billion Bitfinex Hack
https://thehackernews.com/2023/08/nyc-couple-pleads-guilty-to-money.html

OpenAI執行長推「世界幣」 以虹膜驗證身分引個資憂慮
https://news.pts.org.tw/article/650585

Telegram Bot代幣兩月飆漲100倍，鏈上資安公司CertiK：未知風險高
https://abmedia.io/telegram-bots-token-price-surge-safety-worry

Tether CTO：將推出基於USDT和XAUT的行動支付應用程式
https://reurl.cc/x7qEK4

電子支付龍頭Paypal發行穩定幣，持續進軍Web3金融
https://vocus.cc/article/64d25678fd8978000103bc18

電子支付開戶查核手機號碼 警示電支帳戶大降9成
https://wantrich.chinatimes.com/news/20230801901124-420501

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
勒索軟體攻擊導致美國多家醫院關閉急診室
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10616

勒索軟體破壞Prospect Medical Holdings醫療體系的資訊系統，部分醫院改以紙本作業、暫停急診業務
https://www.nbcnews.com/tech/security/hackers-force-hospital-system-take-national-computer-system-offline-rcna98212
https://apnews.com/article/cyberattack-hospital-emergency-outage-4c808c1dad8686458ecbeababd08fecf
https://www.nytimes.com/2023/08/05/us/cyberattack-hospitals-california.html

老舊兆勤路由器漏洞遭到殭屍網路Gafgyt鎖定
https://www.bleepingcomputer.com/news/security/gafgyt-malware-exploits-five-years-old-flaw-in-eol-zyxel-router/
https://fortiguard.fortinet.com/outbreak-alert/zyxel-router-command-injection
https://www.cisa.gov/news-events/alerts/2023/08/07/cisa-adds-one-known-exploited-vulnerability-catalog

惡意軟體QBot擴大攻擊規模，架設15個新的C2伺服器
https://www.team-cymru.com/post/visualizing-qakbot-infrastructure-part-ii-uncharted-territory

勒索軟體Mallox結合木馬及加殼工具，攻擊微軟SQL Server
https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html

勒索軟體LockBit聲稱攻擊了醫療器材業者Varian Medical Systems
https://securityaffairs.com/149307/cyber-crime/varian-medical-systems-lockbit-ransomware.html

俄羅斯導彈製造商遭北韓駭客ScarCruft入侵，植入後門程式OpenCarrot
https://www.sentinelone.com/labs/comrades-in-arms-north-korea-compromises-sanctioned-russian-missile-engineering-company/

美國科羅拉多州教育機構證實遭到勒索軟體攻擊，師生資料外洩
https://cdhe.colorado.gov/news-article/colorado-department-of-higher-education-provides-notice-of-data-incident

勒索軟體Rhysida鎖定醫療產業下手
https://www.bleepingcomputer.com/news/security/rhysida-ransomware-behind-recent-attacks-on-healthcare/

小白駭客成為其他駭客網路攻擊目標！假借提供OpenBullet的組態檔案名義，目的是引誘他們植入惡意程式
https://www.kasada.io/threat-intel-openbullet-malware/

勒索軟體Yashma針對保加利亞、中國、越南等國家而來
https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/

勒索軟體駭客Clop透過Torrent洩露竊得資料
https://www.bleepingcomputer.com/news/security/clop-ransomware-now-uses-torrents-to-leak-data-and-evade-takedowns/

韓國Linux主機遭到鎖定，駭客企圖植入名為Reptile的Rootkit
https://asec.ahnlab.com/en/55785/

Redis伺服器遭到殭屍網路SkidMap鎖定，用於挖礦牟利
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-new-variant-of-skidmap-targeting-redis/

駭客透過惡意NPM套件，鎖定加密貨幣用戶散布竊資軟體，目的是竊取組織的原始碼及機密資料
https://blog.phylum.io/targeted-npm-malware-attempts-to-steal-developers-source-code-and-secrets/

惡意軟體DecoyDog濫用DNS與C2進行通訊
https://blogs.infoblox.com/cyber-threat-intelligence/decoy-dog-is-no-ordinary-pupy-distinguishing-malware-via-dns/

惡意PyPI套件假冒VMware vSphere連接器元件散布
https://blog.sonatype.com/malicious-pypi-package-vmconnect-imitates-vmware-vsphere-connector-module

VMConnect: Malicious PyPI packages imitate popular open source modules
https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules

LOLKEK Unmasked | An In-Depth Analysis of New Samples and Evolving Tactics
https://www.sentinelone.com/blog/lolkek-unmasked-an-in-depth-analysis-of-new-samples-and-evolving-tactics/

MAR-10454006.r4.v2 SEASPY and WHIRLPOOL Backdoors
https://www.cisa.gov/news-events/analysis-reports/ar23-221a

Reptile Malware Targeting Linux Systems
https://asec.ahnlab.com/en/55785/

New threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomware
https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/
https://github.com/Cisco-Talos/IOCs/blob/main/2023/08/new-threat-actor-using-yashma-ransomware.txt

Latest Batloader Campaigns Use Pyarmor Pro for Evasion
https://reurl.cc/lD6Rrq
https://www.trendmicro.com/en_us/research/23/h/batloader-campaigns-use-pyarmor-pro-for-evasion.html

Gootloader: Why your Legal Document Search May End in Misery
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gootloader-why-your-legal-document-search-may-end-in-misery/

Focus on DroxiDat/SystemBC
https://securelist.com/focus-on-droxidat-systembc/110302/

Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems
https://thehackernews.com/2023/08/reptile-rootkit-advanced-linux-malware.html

New SkidMap Linux Malware Variant Targeting Vulnerable Redis Servers
https://thehackernews.com/2023/08/new-skidmap-redis-malware-variant.html

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries
https://thehackernews.com/2023/08/new-yashma-ransomware-variant-targets.html

New Malware Campaign Targets Inexperienced Cyber Criminals with OpenBullet Configs
https://thehackernews.com/2023/08/new-malware-campaign-targets.html

New Report Exposes Vice Society's Collaboration with Rhysida Ransomware
https://thehackernews.com/2023/08/new-report-exposes-vice-societys.html

QakBot Malware Operators Expand C2 Network with 15 New Servers
https://thehackernews.com/2023/08/qakbot-malware-operators-expand-c2.html

New SystemBC Malware Variant Targets Southern African Power Company
https://thehackernews.com/2023/08/new-systembc-malware-variant-targets.html

New Statc Stealer Malware Emerges: Your Sensitive Data at Risk
https://thehackernews.com/2023/08/new-statc-stealer-malware-emerges-your.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Android 14將針對行動網路安全提供IT管理政策，網管可禁用2G網路
https://security.googleblog.com/2023/08/android-14-introduces-first-of-its-kind.html

New Android 14 Security Feature: IT Admins Can Now Disable 2G Networks
https://thehackernews.com/2023/08/new-android-14-security-feature-it.html

Encryption Flaws in Popular Chinese Language App Put Users' Typed Data at Risk
https://thehackernews.com/2023/08/encryption-flaws-in-popular-chinese.html

Google發布安卓8月例行更新，修補4個零時差漏洞
https://www.securityweek.com/40-vulnerabilities-patched-in-android-with-august-2023-security-updates/

廣告詐欺App鎖定韓國安卓使用者，在待機狀態擅自顯示廣告
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/invisible-adware-unveiling-ad-fraud-targeting-android-users/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
資安專家從紅隊演練實例剖析企業如何強化邊界、供應鏈安全
https://www.ithome.com.tw/news/158188

卡巴斯基：地緣政治仍是APT攻擊的驅動主因
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10613

SSH仍是最熱門的雲端攻擊目標
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10615

駭客打造AI網路犯罪工具DarkBART、DarkBERT
https://slashnext.com/blog/ai-based-cybercrime-tools-wormgpt-and-fraudgpt-could-be-the-tip-of-the-iceberg/

駭客濫用Cloudflare Tunnels服務的攻擊行動升溫
https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/

英國選舉委員會證實遭駭客入侵2年，2014至2022年選民資料曝光
https://www.electoralcommission.org.uk/privacy-policy/public-notification-cyber-attack-electoral-commission-systems

駭客組織Mysterious Team Bangladesh鎖定印度、以色列網站下手，發動DDoS攻擊、竄改網頁內容
https://www.group-ib.com/blog/mysterious-team-bangladesh/

被報導遭中國駭客入侵　日本防衛省擬廣招500名資安人員
https://www.taisounds.com/news/content/84/74868

中國駭客傳出曾於3年前滲透日本國防網路環境，恐影響美日軍事情資共享
https://www.washingtonpost.com/national-security/2023/08/07/china-japan-hack-pentagon/
https://reurl.cc/N0eZq6

日本國安現漏洞！外媒曝中國駭客竊機密情資
https://news.ttv.com.tw/news/11208090034700L/amp

中國駭客入侵日本國防網路，五角大廈：美日持續分享情報
https://technews.tw/2023/08/09/china-hacked-japans-sensitive-defense-networks-officials-say/

連盟友都駭？路透：北韓駭進俄羅斯火箭研發公司系統　數個月後傳多項飛彈發展
https://www.taiwannews.com.tw/ch/news/4966951

美國監理機構開始把資安的重點轉向雲端服務業
https://www.moneydj.com/funddj/yb/yp052001.djhtm?a=0D0D4F3C-2280-4410-8E98-7279909B7188

美國國土安全部投注3.75億美元提升地方政府資安
https://therecord.media/dhs-grants-millions-to-local-governments

美國白宮發起為期2年的大型AI網路安全競賽
https://fedscoop.com/white-house-ai-cyber-challenge-def-con/
https://www.darpa.mil/news-events/2023-08-09
https://www.whitehouse.gov/briefing-room/statements-releases/2023/08/09/biden-harris-administration-launches-artificial-intelligence-cyber-challenge-to-protect-americas-critical-software/

怕AI毀滅世界？拜登政府舉辦資安挑戰賽，總獎金2000萬美元
https://www.blocktempo.com/biden-launches-ai-technology-competition/

美國CISA公布未來3年的網路安全戰略
https://www.securityweek.com/cisa-unveils-cybersecurity-strategic-plan-for-next-3-years/

美國推動K-12學校的網路安全防禦措施
https://www.bankinfosecurity.com/white-house-pushes-cybersecurity-defense-for-k-12-schools-a-22745

New Attack Alert: Freeze[.]rs Injector Weaponized for XWorm Malware Attacks
https://thehackernews.com/2023/08/new-attack-alert-freezers-injector.html

North Korean Hackers Targets Russian Missile Engineering Firm
https://thehackernews.com/2023/08/north-korean-hackers-targets-russian.html

Researchers Shed Light on APT31's Advanced Backdoors and Data Exfiltration Tactics
https://thehackernews.com/2023/08/researchers-shed-light-on-apt31s.html

China-Linked Hackers Strike Worldwide: 17 Nations Hit in 3-Year Cyber Campaign
https://thehackernews.com/2023/08/china-linked-hackers-strike-worldwide.html

系統/網路資安工程師(公用-技術支援)
https://job.taiwanjobs.gov.tw/internet/index/JobDetail.aspx?R2=11&EMPLOYER_ID=150820&HIRE_ID=12178685

資安工程師
https://job.taiwanjobs.gov.tw/internet/index/JobDetail.aspx?EMPLOYER_ID=33845&HIRE_ID=12074901&R2=5

新埔廠-資管部-資安工程師
https://www.104.com.tw/job/82uaq?jobsource=googlejobs

資安工程師(台南)
https://job.taiwanjobs.gov.tw/internet/index/JobDetail.aspx?EMPLOYER_ID=150820&HIRE_ID=12180333&R2=5

台北網路資安工程師
https://www.104.com.tw/job/82wbw?jobsource=googlejobs

資深資安規劃工程師
https://www.104.com.tw/job/82vmb?jobsource=googlejobs

國網中心/網路與資安組/專案計畫人員/1人(112_04_2)
https://www.104.com.tw/job/7z0nj?jobsource=jolist_c_relevance

網路資安產品經理
https://www.104.com.tw/job/7n69u?jobsource=jolist_b_relevance

雲端資安專案管理師/PM/產品經理/專員/助理/秘書
https://www.104.com.tw/job/81z4f?jobsource=jolist_b_relevance

專任網路資安工程師(高雄)
https://www.104.com.tw/job/7w4kk?jobsource=jolist_b_relevance

資安顧問-中芯
https://www.104.com.tw/job/7tinz?jobsource=jolist_b_relevance

網路工程師(Q20)
https://www.104.com.tw/job/5ruo0?jobsource=jolist_b_relevance

資安專案經理-台北(中芯)
https://www.104.com.tw/job/7ylcz?jobsource=jolist_b_relevance

專案經理
https://www.7-11.com.tw/careers/join/search_3_job.asp?SerialID=00003096

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
U.K. Electoral Commission Breach Exposes Voter Data of 40 Million Britons
https://thehackernews.com/2023/08/uk-electoral-commission-breach-exposes.html

Interpol Busts Phishing-as-a-Service Platform '16Shop,' Leading to 3 Arrests
https://thehackernews.com/2023/08/interpol-busts-phishing-as-service.html

「手寫」竄改發票號碼 2男騙過40家超商.銀行
https://www.youtube.com/watch?v=5vAUg3m3Ols

網釣工具包EvilProxy針對高階主管的Microsoft 365帳號而來
https://www.proofpoint.com/us/blog/email-and-cloud-threats/cloud-account-takeover-campaign-leveraging-evilproxy-targets-top-level

竊資軟體已盜走逾40萬組企業組織的雲端服務帳密
https://flare.io/learn/resources/stealer-logs-and-corporate-access/

竊資軟體Rilide透過瀏覽器延伸套件散布
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/new-rilide-stealer-version-targets-banking-data-and-works-around-google-chrome-manifest-v3/

已被淘汰、轉售的二手醫療輸液泵浦恐曝露醫療機構的Wi-Fi資料
https://www.rapid7.com/blog/post/2023/08/02/security-implications-improper-deacquisition-medical-infusion-pumps/

駭客假借提供OpenBullet的組態檔案，意圖散布竊資軟體
https://www.kasada.io/threat-intel-openbullet-malware/

歐洲刑警組織撤下網釣攻擊服務平臺16shop
http://www.interpol.int/News-and-Events/News/2023/Notorious-phishing-platform-shut-down-arrests-in-international-police-operation

偽冒 Flipper Zero 的詐騙網站以免費裝置誘騙用戶安裝惡意軟體
https://www.twcert.org.tw/tw/cp-104-7298-b7292-1.html

E.研究報告/工具
Entra ID跨租戶同步功能有可能被用於橫向移動
https://www.vectra.ai/blogpost/microsoft-cross-tenant-synchronization

研究人員利用AI模型收集鍵盤輸入的敲擊聲，號稱能成功辨識95%輸入的內容
https://arxiv.org/pdf/2308.01074.pdf

研究人員揭露攻擊處理器的手法Sacrf
https://eprint.iacr.org/2022/1228

研究人員發現Office應用程式Outlook、Access、Publisher的執行檔可被用於寄生攻擊
https://www.bleepingcomputer.com/news/security/hackers-can-abuse-microsoft-office-executables-to-download-malware/

新註冊的PyPI開發者必須啟用雙因素驗證，才能上傳套件、建置專案
https://blog.pypi.org/posts/2023-08-08-2fa-enforcement-for-new-users/

MDR: Empowering Organizations with Enhanced Security
https://thehackernews.com/2023/08/mdr-empowering-organizations-with.html

Microsoft Addresses Critical Power Platform Flaw After Delays and Criticism
https://thehackernews.com/2023/08/microsoft-addresses-critical-power.html

Enhancing Security Operations Using Wazuh: Open Source XDR and SIEM
https://thehackernews.com/2023/08/enhancing-security-operations-using.html

New 'Deep Learning Attack' Deciphers Laptop Keystrokes with 95% Accuracy
https://thehackernews.com/2023/08/new-deep-learning-attack-deciphers.html

Understanding Active Directory Attack Paths to Improve Security
https://thehackernews.com/2023/08/understanding-active-directory-attack.html

LOLBAS in the Wild: 11 Living-Off-The-Land Binaries That Could Be Used for Malicious Purposes
https://thehackernews.com/2023/08/lolbas-in-wild-11-living-off-land.html

Continuous Security Validation with Penetration Testing as a Service (PTaaS)
https://thehackernews.com/2023/08/continuous-security-validation-with.html

Emerging Attacker Exploit: Microsoft Cross-Tenant Synchronization
https://thehackernews.com/2023/08/emerging-attacker-exploit-microsoft.html

Cybercriminals Increasingly Using EvilProxy Phishing Kit to Target Executives
https://thehackernews.com/2023/08/cybercriminals-increasingly-using.html

Collide+Power, Downfall, and Inception: New Side-Channel Attacks Affecting Modern CPUs
https://thehackernews.com/2023/08/collidepower-downfall-and-inception-new.html

16 New CODESYS SDK Flaws Expose OT Environments to Remote Attacks
https://thehackernews.com/2023/08/15-new-codesys-sdk-flaws-expose-ot.html

F.商業
數聯資安「零信任」架構獲政府雙認證
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10610

臺灣資安新創池安量子資安成立亞洲首座量子安全遷移中心
https://www.ithome.com.tw/news/158213

資料管理業者Rubrik斥資1億美元，買下新創業者Laminar，強化企業與Saas雲端資料安全
https://www.rubrik.com/company/newsroom/press-releases/23/rubrik-acquires-dspm-leader-laminar-to-accelerate-cloud-data-security

G.政府
交通部聯手中芯數據，打造資安防護網
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10608

資安院與工研院攜手，預計年底成立「AI產品與系統評測中心」
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10604

與竹市調查站簽署MOU 新竹馬偕：提升資安 讓醫療服務更安全
https://www.chinatimes.com/realtimenews/20230809003022-264228?chdtv

高捷公司與法務部調查局高雄市調查處簽署資通安全合作備忘錄
https://focusnews.com.tw/2023/08/523674/

共諜頻傳！數位部聯手10企業演練「駭客攻防」　強化網路危機處理
https://www.setn.com/News.aspx?NewsID=1336806

網路危機處理中心首辦資安演練 中華電等10業者參與
https://money.udn.com/money/story/5612/7361179?from=edn_next_story

南市社會局辦理資安及公務保密研習　落實黃偉哲清廉施政的安全公務環境
https://www.tainan.gov.tw/News_Content.aspx?n=13371&s=8580931

百貨超商無會員個資安全計畫罰1500萬　新制重點一次看
https://tyenews.com/2023/08/418582/

網路詐騙開罰數掛零 陳揆：均在規定時間內下架
https://www.rti.org.tw/news/view/id/2176447

陸製監視器「貼牌MIT」流入新竹工業區 監察院要求經濟部改善
https://udn.com/news/story/7314/7347067?from=udn-referralnews_ch2artbottom

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
Enovix標準物聯網/穿戴裝置電池全面上市
https://reurl.cc/8jm24o

SEMI E187國際資安標準由台灣主導 工研院：半導體業資安意識抬頭
https://reurl.cc/65zDEd

工業路由器Milesight UR32L存在重大漏洞，可被用於執行任意程式碼
https://blog.talosintelligence.com/router-researcher-vulnerability-spotlight-23/
https://www.securityweek.com/dozens-of-rce-vulnerabilities-impact-milesight-industrial-router/

研究人員發現特斯拉車載系統有可能被破解並解鎖付費功能
http://www.blackhat.com/us-23/briefings/schedule/#jailbreaking-an-electric-vehicle-in--or-what-it-means-to-hotwire-teslas-x-based-seat-heater-33049

研究人員針對今年上半CISA公告的670個ICS、OT漏洞進行分析，逾三分之一缺少修補程式或緩解措施
https://14520070.fs1.hubspotusercontent-na1.net/hubfs/14520070/Collateral/SynSaber+ICS-Advisory-Project_ICS-Vulnerabilities_First-Half-2023.pdf

西門子發布8月例行更新，修補RuggedCom工控網路系統漏洞
https://www.securityweek.com/ics-patch-tuesday-siemens-fixes-7-vulnerabilities-in-ruggedcom-products/

TP-Link Archer AX21 - Unauthenticated Command Injection
https://www.exploit-db.com/exploits/51677

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

EC-Council CEH Practical / Master 準備心得 — 讓理論與實作相輔相成的學習
https://medium.com/blacksecurity/ceh-practical-master-3e80cac180a2

EC-Council CEHP考試準備心得
https://hackmd.io/@9dCJrgb6QHGd8dRfgHO0zg/r14xNn1po

ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials
https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4

EC-Council ECSA資安分析專家 v10 考試心得分享
https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html

20180817 EC-Council ECSA v10 PASS
https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html

關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享
https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

CPENT 從暴力到破解
https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295

Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master
https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f

CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證
https://ucom.uuu.com.tw/web/Testimony/Article/4404

kaizensecurity/CPENT
https://github.com/kaizensecurity/CPENT/tree/master

CPENT : Pentesting like NO OTHERS !
https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/

Journey of My CPENT Exam
https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享
https://hackmd.io/@henry-ko/HyQ56e8eF

ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年
https://reurl.cc/aVLoX9

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」
https://www.ithome.com.tw/news/156754

用證照證明自己實力之餘，更應將證照視為督促學習的最大動力
https://www.ithome.com.tw/news/156756

打破證照誤解與迷思，資安專家帶你釐清資安證照的意義
https://www.ithome.com.tw/news/156755

Accelerate Your Career with the Global Leader in Cyber Security Training
https://www.sans.org/mlp/promo-partnership-hacker-news/

6.近期資安活動及研討會
DEF CON 32 2023/8/10 ~ 2023/8/13
https://defcon.org/index.html

2023網路信賴基礎環境應用導入論壇 2023/8/15
https://www.accupass.com/event/2307130333072035570544

國家高速網路與計算中心 台灣杉一號用戶教育訓練 2023/8/15
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4044&from_course_list_url=homepage

國家高速網路與計算中心 台灣杉三號用戶教育訓練 2023/8/16
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4040&from_course_list_url=homepage

Zero Trust 新世代資安防線-零信任部署分享座談 2023/8/16
https://jamf.kktix.cc/events/zerotrust0816

【Monosparta】②⓪②③ 第三梯次 軟體開發實戰訓練營➠線上說明會 2023/8/16
https://trunk-studio.kktix.cc/events/monosparta-202309

【文件加密軟體免費試用】 線上資安研討會，保護研發機密這樣做 2023/8/16
https://www.accupass.com/event/2307071251221833519225

AIoT應用實作研習班 2023/8/16 ~ 2023/8/17
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=601

HITCON CMT 2023 2023/08/18 ~ 2023/08/19
https://hitcon.org/2023/CMT/

GO!!JIRA 社團實體日 2023/08/19
https://www.meetup.com/taipei-atlassian-community-events/events/294803808/

WordPress - 桃園午茶小聚 #27 2023/08/19
https://www.meetup.com/taoyuan-wordpress-meetup/events/294930398/

行政人員個資行政檢查研習 2023/8/21
https://stli.iii.org.tw/news-event.aspx?d=1232&no=16

騰雲資安暑期營 2023/8/21
https://tengyun-security.kktix.cc/events/409411b1

大數據分析進階班 (台中) 2023/8/21 ~ 2023/8/22
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=612

AIoT應用實作研習班 (台中) 2023/8/23 ~ 2023/8/24
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=604

5G+AIOT機器人智慧生活應用科學營 2023/8/23 ~ 2023/8/25
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=625

產業資安經驗傳承及國際資安需求講座課程 2023/8/23
https://www.tca.org.tw/exhibit_info1.php?n=2003

全面備戰資安韌性 雲端資安全攻略 2023/8/24
https://www.accupass.com/event/2307190344132041357276

NISRA Enlightened 2023 2023/8/28 ~ 2023/8/31
https://nisra.kktix.cc/events/2023enlightened

【資安課程】數位鑑識工具與實務課程｜ACW SOUTH數位產業署沙崙資安服務基地 2023/8/31
https://ievents.iii.org.tw/EventS.aspx?t=0&id=2170

臺美TTIC智慧製造資安韌性座談會 2023/8/31
https://seminar.tier.org.tw/SignupForm.aspx?GUID=CAE0920D-FA97-4B85-9989-0EFF310143A8

2023中部製造業資安論壇 2023/9/1
https://www.informationsecurity.com.tw/seminar/2023_TCM/register.aspx

PyCon TW 2023 2023/9/2 ~ 2023/9/3
https://tw.pycon.org/2023/zh-hant/registration/tickets

IR系列課程：惡意程式獵捕與網路封包探索｜ACW SOUTH數位產業署沙崙資安服務基地 2023/9/6
https://ievents.iii.org.tw/EventS.aspx?t=0&id=2191

Web應用滲透測試 2023/9/7 ~ 2023/9/8
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=631

KNIME Data Connect: Taiwan (Onsite/Hybrid) 2023/9/14
https://www.meetup.com/knime-users-taiwan/events/295003668/

Secure Our Streets 2023 2023/9/14
https://www.meetup.com/automotive-security-research-group-taipei/events/292175225/

[GDG] Artificial Intelligence Information Security Day 2023/9/16
https://gdg-taipei.kktix.cc/events/artificial-intelligence-information-security-day

Hou.Sec.Con 2023/10/12 ~ 2023/10/13
https://web.cvent.com/event/76d46ccb-fe00-4fe5-ba46-e4a77c807f21/summary

國家高速網路與計算中心 平行計算程式設計基礎課程 2023/10/17
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4033&from_course_list_url=homepage

OCF 培訓活動: 如何建立安全的網路架構 II 2023/10/21
https://ocftw.kktix.cc/events/ocftot2023

(ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27
https://www.isc2.org/Congress-2023

【亞洲最具指標供應鏈高峰會】Supply Chain Summit 2023 2023/11/14 ~ 2023/11/15
https://www.accupass.com/event/2307070154211343470512