###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2022/8/8 ~ 2022/8/12

1.重大弱點漏洞/後門/Exploit/Zero Day
F5發佈08月份安全性公告
https://support.f5.com/csp/article/K14649763

F5修補21個漏洞，過半不需身分驗證就能利用
https://www.securityweek.com/f5-fixes-21-vulnerabilities-quarterly-security-patches

Cisco 發布 RV 系列路由器的安全更新
https://www.cisa.gov/uscert/ncas/current-activity/2022/08/04/cisco-releases-security-updates-rv-series-routers

思科修補防火牆設備的RSA金鑰曝露漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz

思科修補中小企業路由器重大漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR

PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)
https://www.exploit-db.com/exploits/51005

VMware 發布安全性更新
https://www.vmware.com/security/advisories/VMSA-2022-0022.html

VMware針對一星期前修補的漏洞CVE-2022-31656、CVE-2022-31659提出警告，已出現攻擊行動
https://www.bleepingcomputer.com/news/security/vmware-warns-of-public-exploit-for-critical-auth-bypass-vulnerability/

Adobe 已發布安全更新
https://www.cisa.gov/uscert/ncas/current-activity/2022/08/09/adobe-releases-security-updates-multiple-products

美國警告DogWalk、UnRAR漏洞已遭駭客利用
https://www.bleepingcomputer.com/news/security/cisa-warns-of-windows-and-unrar-flaws-exploited-in-the-wild/

CISA Issues Warning on Active Exploitation of UnRAR Software for Linux Systems
https://thehackernews.com/2022/08/cisa-issues-warning-on-active.html

微軟發布8月每月例行更新，提供緩解121個漏洞的措施
https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2022-patch-tuesday-fixes-exploited-zero-day-121-flaws/

Windows八月份安全更新修補上百個漏洞 包括零時差漏洞DogWalk
https://netmag.tw/2022/08/11/microsoft-august-patch-tuesday-patch-of-windows-vulnerable-dogwalk

Microsoft Issues Patches for 121 Flaws, Including Zero-Day Under Active Attack
https://thehackernews.com/2022/08/microsoft-issues-patches-for-121-flaws.html

IBM發布更新程式，修補雲端服務、語音、資安產品的漏洞
https://www.securityweek.com/ibm-patches-high-severity-vulnerabilities-cloud-voice-security-products

Security bulletin: Security Bulletin: Multiple vulnerabilities in Jquery-Ui,
highcharts, and datatables are affecting QRadar User Behavior Analytics
(CVE-2021-41182, CVE-2021-41183, CVE-2021-41184, CVE-2021-23445, CVE-2021-29489)
https://www.ibm.com/support/pages/node/6610741?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Security bulletin: Security Bulletin: Apache log4j vulnerabilities in
Spark and Zookeeper affect QRadar User Behavior Analytics(CVE-2021-4104)
https://www.ibm.com/support/pages/node/6610729?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E

Critical Flaws Disclosed in Device42 IT Asset Management Software
https://thehackernews.com/2022/08/critical-flaws-disclosed-in-device42-it.html

GitHub Dependabot Now Alerts Developers On Vulnerable GitHub Actions
https://thehackernews.com/2022/08/github-dependabot-now-alerts-developers.html

協作平臺Zimbra密碼洩露漏洞遭到駭客積極利用
https://www.bleepingcomputer.com/news/security/hackers-are-actively-exploiting-password-stealing-flaw-in-zimbra/

駭客組織TAC-040鎖定Atlassian Confluence重大漏洞，於受害組織部署後門
https://www.deepwatch.com/labs/deepwatch-ati-detects-and-responds-to-never-before-discovered-backdoor-deployed-using-confluence-vulnerability-for-suspected-espionage/

丹麥學生找到Cloudflare尚未正式推出的服務漏洞，獲得6千美元獎金
https://albertpedersen.com/blog/hijacking-email-with-cloudflare-email-routing/

SAP修補BusinessObjects的資訊洩露漏洞
https://www.securityweek.com/sap-patches-information-disclosure-vulnerabilities-businessobjects

Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
https://www.exploit-db.com/exploits/50998

2.銀行/金融/保險/證券/支付系統/金融監理 新聞及資安
企業生日快樂/財金公司 讓金流服務接地氣
https://money.udn.com/money/story/5613/6516076

兩行庫遭駭 財部延長監控
https://reurl.cc/LMM1Ox

驚傳駭客攻擊台銀兆豐銀 財政部延長監控
https://ctee.com.tw/news/finance/696276.html

頻寬被占！台銀、兆豐銀遭駭客攻擊 狀況已排除
https://reurl.cc/kEE5eq

上海商銀委託台灣IBM建置 新核心系統今啟動
https://udn-com.cdn.ampproject.org/c/s/udn.com/news/amp/story/7239/6527428

主機代管業者提供的網域預覽功能遭到濫用，駭客用來攻擊印度銀行用戶
https://cloudsek.com/threatintelligence/hostingers-preview-domain-feature-abused-to-launch-phishing-campaigns-and-evade-detection/

金融業資安須提升警戒
https://ec.ltn.com.tw/article/paper/1533712

LogoKi病毒再度猖獗 金融機構資安要當心
https://www.technice.com.tw/infosecurity/14084/

電子申報繳稅系統自111年10月20日起將全面調整「簡易電子認證」密碼強度確保資訊安全
https://www.ntbna.gov.tw/singlehtml/374fe8c4b18e48c691a6806ac02b9984?cntId=c049172510aa4b6f9c71837336599eca

戰時股匯市沙盤推演　國民黨喊話政府：推金融漢光演習
https://www.upmedia.mg/news_info.php?Type=24&SerialNo=151579

中共軍演、兩行庫遭駭 藍委籲政院跨部會研擬金融兵推
https://money.udn.com/money/story/5613/6532311?from=edn_newest_index

駭客鎖定新加坡網路賣家竊取線上購物的信用卡資料，並試圖透過OTP洗劫銀行帳戶
https://www.group-ib.com/media/classiscam-singapore-global-scam-operation/

詐騙猖獗華南金被冒名　呼籲小心這網頁
https://www.appledaily.com.tw/property/20220808/0A027241D50CED9D5FE25BEB80

駭客攻擊？「電子發票平台」突無法連線 財政部曝原因
https://reurl.cc/MNNvK3

電子發票整合服務平台無法正常連線　財政部找到原因了
https://www.appledaily.com.tw/property/20220807/159FAB9950F6C71B03B3D7F0C2

台海緊張 金管會啟動金融資安戒嚴
https://ctee.com.tw/news/finance/693763.html

開放銀行所衍生之 資料賦權探討
https://udn.com/news/story/6877/6531677

公銀擴編資安部門 民銀強化對內資安防護
https://ec.ltn.com.tw/article/paper/1531804

3.電子支付/行動支付/pay/資安
網絡付費網關供應商iPay88確認網絡安全出現漏洞，並坦承這可能導致用戶的卡資料外洩
https://lihkg.com/thread/3109850/page/1

數位支付公司管理後台遭駭客入侵，平台方資安觀念薄弱恐陷危機
https://www.technice.com.tw/infosecurity/13682/

別搞混了！秒懂行動支付、第三方支付、電子支付有什麼不同
https://www.cardu.com.tw/mpay/detail.php?39548

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約 資安
U.S. Sanctions Virtual Currency Mixer Tornado Cash for Alleged Use in Laundering
https://thehackernews.com/2022/08/us-sanctions-virtual-currency-mixer.html

駭客攻擊加密貨幣平臺的目標轉向跨鏈橋系統
https://blog.chainalysis.com/reports/cross-chain-bridge-hacks-2022/

跨鏈橋平臺Nomad祭出近200萬美元獎金緝兇，並表明駭客歸還9成贓款就不追究法律責任
https://www.cryptotimes.io/nomad-bridge-announces-10-bounty-for-hackers-to-recover-funds/

研調示警駭客鎖定區塊鏈 下半年恐現元宇宙資安事件
https://money.udn.com/money/story/5599/6529352

Google Sites、Azure Web App遭到濫用，駭客架設加密貨幣詐騙網站
https://www.netskope.com/blog/abusing-google-sites-and-microsoft-azure-for-crypto-phishing

Slope：無確鑿證據表明Solana駭客攻擊事件與自身安全漏洞有關
https://news.cnyes.com/news/id/4933997

Slope：無確鑿證據將超400萬美元的Solana駭客攻擊與其自身的安全漏洞關聯
https://news.cnyes.com/news/id/4934086

Elliptic：自2020年起，RenBridge 跨鏈橋洗「駭客黑錢」已超5.4億美元
https://www.blocktempo.com/more-than-half-a-billion-dollars-has-been-laundered-through-renbridge/

Tornado Cash 遭制裁後用戶已提走 6,200 萬美元，MakerDAO 創辦人：可能會出售協議中所有 USDC
https://blockcast.it/2022/08/12/makerdao-founder-says-its-almost-inevitable-dai-will-abandon-usd-peg-after-tornado-cash-listed-sdn/

美國制裁替北韓駭客Lazarus洗錢的混幣平臺Tornado Cash
https://www.ithome.com.tw/news/152376

Tornado cash被制裁後還能用嗎？其代幣 TORN 未來的價格如何
https://www.btcc.com/zh-TW/academy/research-analysis/what-is-the-future-price-of-torn

用加密貨幣交易 伊朗鑽經濟制裁漏洞
https://www.1111.com.tw/news/jobns/147088

數位錢包供應商Dana籌資2.5億美元，積極擴張印尼金融版圖
https://reurl.cc/2mm01m

中國郵儲銀行採購5.75萬張數字人民幣准帳戶硬錢包
https://news.cnyes.com/news/id/4934325

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
最容易被勒索病毒盯上的四種目標
https://blog.trendmicro.com.tw/?p=71482

中國駭客TA428使用後門程式PortDoor、CotSam等多個惡意軟體，攻擊東歐組織
https://ics-cert.kaspersky.com/publications/reports/2022/08/08/targeted-attack-on-industrial-enterprises-and-public-institutions/

阿爾巴尼亞政府疑遭到伊朗駭客的勒索軟體攻擊
https://www.mandiant.com/resources/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against?1

惡意程式LogoKit透過知名網站重新導向未設限的漏洞，發動網釣攻擊
https://resecurity.com/blog/article/logokit-update-the-phishing-kit-leveraging-open-redirect-vulnerabilities

北韓駭客組織Andariel將勒索軟體Maui、惡意軟體DTrack用於攻擊南韓企業
https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/

勒索軟體GwisinLocker鎖定韓國醫療生技產業而來
https://www.bleepingcomputer.com/news/security/new-gwisinlocker-ransomware-encrypts-windows-and-linux-esxi-servers/

惡意軟體Bumblebee透過檔案共享服務散布
https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/

思科坦承遭網路攻擊，公布完整攻擊鏈
https://www.ithome.com.tw/news/152437

思科證實遭勒索軟體駭客閰羅王入侵，駭客聲稱竊得2.75 GB資料
https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html

勒索軟體組織Conti旗下駭客利用BazarCall網釣攻擊，企圖取得受害組織初始存取的管道
https://www.advintel.io/post/bazarcall-advisory-the-essential-guide-to-call-back-phishing-attacks-that-revolutionized-the-data

勒索軟體BlueSky採用Conti的程式碼，具備多執行緒提升加密受害電腦檔案的速度
https://unit42.paloaltonetworks.com/bluesky-ransomware/

LockBit、Hive、BlackCat多個勒索軟體接連施暴，對汽車供應商發動攻擊
https://news.sophos.com/en-us/2022/08/09/multiple-attackers-increase-pressure-on-victims-complicate-incident-response/

駭客在發動Cuba勒索軟體攻擊的過程裡，利用新的RAT木馬程式情蒐及竊密
https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/

為了防堵駭客濫用ISO、LNK檔案，微軟打算在Windows 11加入相關封鎖功能
https://www.ithome.com.tw/news/152295

為規避偵測，殭屍網路Orchard濫用比特幣交易資訊來產生網域名稱
https://www.ithome.com.tw/news/152468

陸股：美的集團工廠電腦遭勒索病毒攻擊，盤中股價下跌0.6%
https://ww2.money-link.com.tw/RealtimeNews/NewsContent.aspx?SN=1812873002&PU=0010

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike
https://isc.sans.edu/diary/rss/28934

VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges
https://securelist.com/vilerat-deathstalkers-continuous-strike/107075/

BlueSky Ransomware: Fast Encryption via Multithreading
https://unit42.paloaltonetworks.com/bluesky-ransomware/

Cisco Talos shares insights related to recent cyber attack on Cisco
https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html

Novel News on Cuba Ransomware aka Greetings From Tropical Scorpius
https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/

Targeted attack on industrial enterprises and public institutions
https://ics-cert.kaspersky.com/publications/reports/2022/08/08/targeted-attack-on-industrial-enterprises-and-public-institutions/

Andariel deploys DTrack and Maui ransomware
https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/

Meta's Quarterly Adversarial Threat Report
https://about.fb.com/wp-content/uploads/2022/08/Quarterly-Adversarial-Threat-Report-Q2-2022.pdf

Monero CoinMiner Being Distributed via Webhards
https://asec.ahnlab.com/en/37526/

Linux Malware RapperBot Brute Forcing SSH Servers
https://socradar.io/linux-malware-rapperbot-brute-forcing-ssh-servers/

Targeted attack on industrial enterprises and public institutions
https://ics-cert.kaspersky.com/publications/reports/2022/08/08/targeted-attack-on-industrial-enterprises-and-public-institutions/

BumbleBee Roasts Its Way to Domain Admin
https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/

New Orchard Botnet Uses Bitcoin Founder's Account Info to Generate Malicious Domains
https://thehackernews.com/2022/08/new-orchard-botnet-uses-bitcoin.html

研究人員發現10個惡意PyPI套件，竊取開發者的帳密與簽章
https://research.checkpoint.com/2022/cloudguard-spectral-detects-several-malicious-packages-on-pypi-the-official-software-repository-for-python-developers/

10 Credential Stealing Python Libraries Found on PyPI Repository
https://thehackernews.com/2022/08/10-credential-stealing-python-libraries.html

Hackers Behind Cuba Ransomware Attacks Using New RAT Malware
https://thehackernews.com/2022/08/hackers-behind-cuba-ransomware-attacks.html

Zeppelin Ransomware
https://www.cisa.gov/uscert/ncas/alerts/aa22-223a
https://www.cisa.gov/uscert/sites/default/files/publications/Zeppelin.yar

APT-C-35: New Windows Framework Revealed
https://blog.morphisec.com/apt-c-35-new-windows-framework-revealed

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Slack Resets Passwords After a Bug Exposed Hashed Passwords for Some Users
https://thehackernews.com/2022/08/slack-resets-passwords-after-bug.html

推特坦承日前駭客竊取540萬用戶資料的管道是零時差漏洞
https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anonymous-accounts

Hackers Exploit Twitter Vulnerability to Exposes 5.4 Million Accounts
https://thehackernews.com/2022/08/hackers-exploit-twitter-vulnerability.html

Meta Cracks Down on Cyber Espionage Operations in South Asia Abusing Facebook
https://thehackernews.com/2022/08/meta-cracks-down-on-cyber-espionage.html

7款惡意軟體偽裝成生產力APP　資安人員籲：盡快刪除
https://www.ctwant.com/article/200221

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
打造擁抱所有資安愛好者的平台！總召親自帶你認識 HITCON PEACE 2022 台灣駭客年會
https://www.yourator.co/articles/308

資安攻擊再升溫 台灣駭客年會揭網路戰生存指南
https://money.udn.com/money/story/10860/6529903

紀寶如設立公益協會遭駭　資料被綁架無奈付贖金
https://www.ftvnews.com.tw/news/detail/2022812L09M1

這次只是小打小鬧！中共網攻台灣有這5層面 專家曝解決方法
https://newtalk.tw/news/view/2022-08-12/800365

有駭客組織聲稱近期臺灣政府機關的攻擊事故是他們所為
https://udn.com/news/story/7320/6519124

中國駭客攻擊不斷　台長老教會官網遭駭
https://www.ftvnews.com.tw/news/detail/2022809S08M1

民視節目網路直播內容遭到竄改，起因是影片來源主機遭到入侵
https://newtalk.tw/news/view/2022-08-07/797712

民視遭資安攻擊4次通報NCC 無線電視播出不影響
https://www.cna.com.tw/news/aipl/202208100227.aspx

民視密集遭駭客網攻四天　高層重視要求調查
https://www.peoplenews.tw/articles/7cbe030098

臺灣大學部分網頁遭到竄改，圖片皆變為「世界上只有一個中國」的恐嚇訊息
https://www.ettoday.net/news/20220807/2311348.htm

台灣資安出了大漏洞？裴洛西來台，從小七、台鐵面板都遭駭，真正問題出在被中國壟斷的 LED 產業
https://buzzorange.com/techorange/2022/08/10/momitor-being-hacked-when-pelosi-came/

全是中國軟體惹的禍？專家從「裴洛西滾出台灣」看見更大的資安警訊
https://www.bnext.com.tw/article/71140/china-hack-pelosi-bt

APT27駭客組織對台宣戰，政府與關鍵基礎設施該如何抵禦資安攻擊
https://www.thenewslens.com/article/171422

APT27駭進台灣需量系統？ 台電：宜蘭某校能管系統異常
https://ec.ltn.com.tw/article/breakingnews/4018854

APT27駭客團稱入侵警政核電金融系統　警政署打臉揭「斷網原因」
https://www.ettoday.net/news/20220807/2311303.htm

自稱網攻台灣駭客宣布行動暫時結束　「若挑起局勢會再回來」
https://www.appledaily.com.tw/international/20220807/A1CFD796A623EE742840E8B547

台海網戰開打　開發防禦技術提升資安能量
https://www.mnews.tw/story/20220810rep003

台灣的資安認知，真的準備好要應對兩岸之間的軍事衝突了嗎
https://www.thenewslens.com/article/171428

中箭！俄駭客組織KILLNET攻陷洛克希德馬丁
https://www.chinatimes.com/realtimenews/20220812001316-260417?chdtv

丹麥7-11便利商店疑遭網路攻擊而暫停營業
https://www.bleepingcomputer.com/news/security/7-eleven-stores-in-denmark-closed-due-to-a-cyberattack/

北韓駭客Lazarus佯稱提供Coinbase職缺發動網釣攻擊
https://www.bleepingcomputer.com/news/security/north-korean-hackers-target-crypto-experts-with-fake-coinbase-job-offers/

英國執政黨決定延後首相選舉，起因是駭客可能會發動攻擊影響結果
https://www.ithome.com.tw/news/152301

烏克蘭資安高層 意外現身黑帽駭客大會
https://www.rti.org.tw/news/view/id/2141344

英國NHS的MSP業者Advanced證實遭到勒索軟體攻擊
https://www.oneadvanced.com/cyber-incident/

英國國民保健署遭駭客攻擊 醫生看診像盲人
https://www.technice.com.tw/infosecurity/14327/

英國NHS的緊急通報系統111專線服務中斷，起因是代管服務業者遭網路攻擊
https://www.bleepingcomputer.com/news/security/uk-nhs-suffers-outage-after-cyberattack-on-managed-service-provider/

The U.S. Department of Homeland Security (DHS) Emergency Alert System Flaws Could Let Attackers Transmit Fake Messages
https://thehackernews.com/2022/08/emergency-alert-system-flaws-could-let.html

Iranian Hackers Likely Behind Disruptive Cyberattacks Against Albanian Government
https://thehackernews.com/2022/08/iranian-hackers-likely-behind.html

Researchers Uncover Classiscam Scam-as-a-Service Operations in Singapore
https://thehackernews.com/2022/08/researchers-uncover-classiscam-scam-as.html

Chinese Hackers Targeted Dozens of Industrial Enterprises and Public Institutions
https://thehackernews.com/2022/08/chinese-hackers-targeted-dozens-of.html

Experts Uncover Details on Maui Ransomware Attack by North Korean Hackers
https://thehackernews.com/2022/08/experts-uncover-details-on-maui.html

The Business of Hackers-for-Hire Threat Actors
https://thehackernews.com/2022/08/the-business-of-hackers-for-hire-threat.html

資訊安全工程師
https://www.cakeresume.com/companies/yics-9cc0b1/jobs/information-security-engineer-2b7494?locale=zh-TW

系統全端工程師-(工讀/實習)
https://www.104.com.tw/job/7nikf

工研院產科國際所_資安領域產業分析師(0C200)
https://www.cakeresume.com/companies/itri-org/jobs/gong-yan-yuan-chan-ke-guo-ji-suo-zi-an-ling-yu-chan-ye-fen-xi-shi-0C200

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
婦團: 台灣女性應對「數位跟蹤騷擾」案件　宜提升個人資安•及時截圖蒐證
https://www.taiwannews.com.tw/ch/news/4623491

雲端客戶溝通系統Twilio遭到入侵，駭客使用網釣簡訊騙得員工帳號
https://www.twilio.com/blog/august-2022-social-engineering-attack

Hackers Behind Twilio Breach Also Targeted Cloudflare Employees
https://thehackernews.com/2022/08/hackers-behind-twilio-breach-also_10.html

繼Twilio因員工遭到網釣簡訊攻擊而遭駭，Cloudflare員工也收到攻擊簡訊
https://blog.cloudflare.com/2022-07-sms-phishing-attacks/

手機破解公司Cellebrite遭駭，外洩4 TB資料
https://www.hackread.com/anonymous-leaks-4tb-cellebrite-data-cyberattack/

駭客濫用Snapchat、美國運通網站的重新導向功能，來騙取受害者的微軟、Google帳號
https://www.inky.com/en/blog/phishers-bounce-lures-off-unprotected-snapchat-amex-sites

電子郵件行銷業者Klaviyo資料外洩，駭客疑鎖定加密貨幣業者而來
https://www.bleepingcomputer.com/news/security/email-marketing-firm-hacked-to-steal-crypto-focused-mailing-lists/

165專線公布第二季高風險賣場，博客來通報件數破2千
https://www.facebook.com/165bear/posts/359921669512230

協作平臺Slack要求部分用戶重設密碼，起因是系統處理密碼的方式存在弱點
https://slack.com/intl/zh-tw/blog/news/notice-about-slack-password-resets

網傳連結「LINE輔助認證」要求提供簡訊認證碼
https://tfc-taiwan.org.tw/articles/8012

十大常見的網路詐騙
https://blog.trendmicro.com.tw/?p=72242

上海隨申碼被駭 4850萬用戶個資外洩
https://udn.com/news/story/7332/6533327?from=udn_ch2_menu_v2_main_cate

親友請你幫LINE輔助認證？盜用帳號！簡訊認證碼不要提供給任何人
https://www.mygopen.com/2022/08/line-otp.html

假冒衛福部電郵釣魚網站 「紓困4.0」成誘餌填完錢被盜光
https://reurl.cc/ZbbOL6

E.研究報告/工具
NIST資通安全框架2.0改版聚焦雲端服務、開源軟體使用、供應鏈風險管理
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9992

資安事件應變小組論壇公布新版資安事故資訊分享標準TLP 2.0
https://www.ithome.com.tw/news/152352

暗黑危險新工具！Dark Utilities「C2 即服務」採用IPFS星際檔案系統
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10002

DDoS 攻擊怎麼防？ 4 招 DDoS Mitigation 緩解及防禦手段
https://blog.cloudmax.com.tw/4-ways-ddos-mitigation/

Npm打算透過開源軟體認證專案Sigstore強化開發安全
https://github.blog/2022-08-08-new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open/

我對臺灣資安的期待和看法
https://talk.ltn.com.tw/article/paper/1533656

副本證據能力須可「驗真」　保留原件載體/公證上鏈都管用 告洩密侵權全靠數位證據　拷貝時要找見證人錄影
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/3163B42C799A4D5DABFBE3F833FC4F0E

網路世界的鑑識英雄 資安事件分析工程師
https://www.chinatimes.com/realtimenews/20220811000010-260421?chdtv

當 XDR 遇上身份威脅檢測和響應
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10007

智慧工廠最完整防護網！部署資安場域、加強製造業防禦體質
https://si.taiwan.gov.tw/Home/citizensSay/view/1479

18家IT業者聯手成立資安系統共通資料規格專案，目的是讓資安團隊能在不同系統進行互通
https://www.businesswire.com/news/home/20220810005251/en/Cybersecurity-and-Technology-Industry-Leaders-Launch-Open-Source-Project-to-Help-Organizations-Detect-and-Stop-Cyberattacks-Faster-and-More-Effectively

十多家業者發表開放資安框架以標準化不同產品的監控資料
https://www.ithome.com.tw/news/152444

揭露最新微軟 IIS 三大漏洞研究 DEVCORE 連五年站上 Black Hat USA 黑帽大會
https://techsaydigi.com/2022/08/62574.html

群眾募資救不了所有人！網路募款為什麼不能成為社會安全網？
https://www.bnext.com.tw/article/70999/crow-fund-scm-

換個角度想！ F5看網頁置換攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10011

駭客威脅日增 分享網路安全大餅建構安全框架
https://www.technice.com.tw/infosecurity/14164/

面對中國網路攻擊 台灣不能心存僥倖
https://reurl.cc/Qbbdv5

Open Cybersecurity Schema Framework
https://github.com/ocsf/

Mastering Python as a Beginner
https://medium.com/@Chamika_Jayasinghe/mastering-python-as-a-beginner-14d8671d409d

Little Known Secret About What is Happening in Crypto Right Now
https://scottdebevic.medium.com/little-known-secret-about-what-is-happening-in-crypto-right-now-63c99aa488b4

Extensions used by Hackers
https://medium.com/@iabhipathak/extensions-used-by-hackers-bfdcfa793af2

Data Analyst Skills You Need for Your Next Promotion
https://towardsdatascience.com/data-analyst-skills-you-need-for-your-next-promotion-479275b80bad

How to write a Data Science blog from scratch? ~Things I did!
https://medium.com/dssimplified/how-to-start-a-data-science-blog-from-scratch-things-i-did-9c8c2c67dd9a

Python, The Easiest Way to Earn Money From Remote Work
https://faun.pub/python-the-easiest-way-to-earn-money-from-remote-work-2fb3a526840

Earn Money with Useless Bandwidth and a 25$ single-board-computer
https://medium.com/the-side-hustle-club/earn-money-with-useless-bandwidth-and-a-25-single-board-computer-329bfc0ba055

My Data Analysis Portfolio
https://medium.com/@musataofik01/my-data-analysis-portfolio-ba9d9d1ffdad

Another day, Another IDOR vulnerability— $5000 Reddit Bug Bounty
https://infosecwriteups.com/another-day-another-idor-vulnerability-5000-reddit-bug-bounty-22a75003d999

10 Killer Automation Scripts You Should Try Using Python
https://medium.com/pythoneers/10-killer-automation-scripts-you-should-try-using-python-8d9ae153f3f0

Python-Pandas cheat sheet: 30 functions-methods
https://jyoti05iitd.medium.com/python-pandas-cheat-sheet-30-functions-methods-b1176f2e37da

Resolving Availability vs. Security, a Constant Conflict in IT
https://thehackernews.com/2022/08/resolving-availability-vs-security.html

The Benefits of Building a Mature and Diverse Blue Team
https://thehackernews.com/2022/08/the-benefits-of-building-mature-and.html

The Truth About False Positives in Security
https://thehackernews.com/2022/08/the-truth-about-false-positives-in.html

What the Zola Hack Can Teach Us About Password Security
https://thehackernews.com/2022/08/what-zola-hack-can-teach-us-about.html

F.商業
近80%受訪之關鍵基礎設施型企業尚未採用零信任策略
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9991

老牌備份軟體如何幫助客戶一鍵數位轉型再創價值
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9990

網路犯罪產生成本超過 69 億美元，微軟推情資服務及攻擊面管理新方案
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9996

Fortinet 推出可運行於 AWS 的雲原生防護方案 FortiCNP
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9994

安碁資訊客戶資防需求、詢問度大增 營收可望續戰新高
https://today.line.me/tw/v2/article/GgYjenL

中華電信攜手Cisco推出「新雲端守護方案」
https://www.taiwannews.com.tw/ch/news/4624497

「立足當下、成就未來」製造業論壇現場直擊 Palo Alto Networks 實踐零信任　反制勒索軟體大舉來襲
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/E620590E72214FAC807F0F1C597A571E

G.政府
禁用中國資安設備 陳其邁：盤點來自中國資安設備、軟體
https://news.ltn.com.tw/news/politics/breakingnews/4023262

全台發生網路攻擊事件 TWNIC密集監控 .tw國碼網域
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9993

因應最近境外網路攻擊，為提高資安防護效能，降低資料傳輸外洩風險，本分署將進行資安檢測
https://www.pty.moj.gov.tw/259849/259862/1195334/post

數位發展部部長唐鳳提出網站採用Web3與IPFS防範DDoS攻擊，引發熱議
https://news.ltn.com.tw/news/politics/paper/1532959

中國慘了？網攻我國台鐵、超商看板　唐鳳：著手修法納管
https://www.nownews.com/news/5901458

政府資安問題再度浮上檯面！ 抵擋網路攻擊需有「白帽駭客」思維
https://reurl.cc/vWWDmN

資安攻擊頻傳議員關心台中市如何因應
https://reurl.cc/jGG7lq

跟上資安能力 中市議員籲立數位治理局
https://reurl.cc/O441Vg

時力轟政院低估資安威脅　譴責中共對台
https://ptthito.com/gossiping/m-1660127088-a-c1d/

公私共探開放資料 國科會：應兼顧個資、資安等保障
https://udn.com/news/story/7238/6529293

資安馬達啟動了 資安系統禁用中國製軟硬體設備
https://enn.tw/?p=128011

公所贈羅東警局「中國製」警示燈 民代憂資安疑慮
https://reurl.cc/4ppR6R

數位部27日掛牌 致力加強全民數位韌性
http://www.ksnews.com.tw/index.php/news/contents_page/0001639557

數位部將成立 大招資安人才 月薪48K起
https://www.ptt.cc/bbs/Soft_Job/M.1660228737.A.E1D.html

國中畢業即可!數位部600員額 約聘占一半
https://ctee.com.tw/news/policy/695732.html

防心理戰 唐鳳：公家場域禁用危害資安產品
https://www.rti.org.tw/news/view/id/2141296

阻中共網攻 台數發部長唐鳳：攜友國資安聯防
https://reurl.cc/oQQLmv

蘇貞昌︰各部會防止任何資安攻擊發生 確保國家安全
https://news.ltn.com.tw/news/politics/breakingnews/4022095

議員蔡筱薇業務報告質詢-對岸網攻爆量 籲南市府提升資安能力
https://www.tncc.gov.tw/page.asp?mainid=C8A40B2B-F893-4E69-8F37-10BBAF27CF01

防範資安事件 陳其邁：加強機關人才培訓 落實資安觀念
https://www.kcg.gov.tw/CityNews_Detail1.aspx?n=3A379BB94CA5F12D&ss=DF7E2FE4DA2244D1

110 年國家資通安全報告出爐，APT 攻擊與社交工程仍為資安重點項目
http://www.pcdiy.com.tw/detail/24711

數位發展部公布組織規畫，預告年底將成立國家資安研究院
https://www.ithome.com.tw/news/152433

數位部即將掛牌 前召集人郭耀煌提對資安四點期許
https://www.yucc.org.tw/info/4131

數位發展部成立 資安學者憂「數位身分證一定會再來 」
https://news.ltn.com.tw/news/politics/breakingnews/4022752

國科會整合多元資料 提供活用個案兼顧資安
https://www.1111.com.tw/news/jobns/147063

南市府︰近期遭網攻次數增3倍 單日最高90多萬次
https://today.line.me/tw/v2/article/NvZ7oGp

台灣遭中共網攻 政府機構資安受關注
https://www.epochtimes.com/b5/22/8/12/n13800852.htm

資通安全管理法相關執行事項
https://hackmd.io/@nfu-johnny/SJ8gZ4s5c

傳遭駭客入侵 中油澄清：官網很正常
https://ec.ltn.com.tw/article/breakingnews/4022629

中油官網傳被駭？原來是錯連到舊網址
https://bccnews.com.tw/archives/284571

中油澄清：官網運作一切正常 並未被駭客入侵
https://times.hinet.net/news/24075340

阻中共網攻 台數發部長唐鳳：攜友國資安聯防
https://www.ntdtv.com.tw/b5/20220811/video/338080.html?%E9%98%BB%E4%B8%AD%E5%85%B1%E7%B6%B2%E6%94%BB%20%E5%8F%B0%E6%95%B8%E7%99%BC%E9%83%A8%E9%95%B7%E5%94%90%E9%B3%B3%EF%BC%9A%E6%94%9C%E5%8F%8B%E5%9C%8B%E8%B3%87%E5%AE%89%E8%81%AF%E9%98%B2

憶當年抗駭客遭陸批判 張善政嗆綠營：當時你們在哪
https://reurl.cc/m33n1A

中共駭客網路攻擊不斷 綠議員呼籲市府注意資訊安全
https://newtalk.tw/news/view/2022-08-09/798816

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
New IoT RapperBot Malware Targeting Linux Servers via SSH Brute-Forcing Attack
https://thehackernews.com/2022/08/new-iot-rapperbot-malware-targeting.html

西門子、施耐德電機發布每月例行修補
https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-fix-only-11-vulnerabilities

智慧製造 OT資安不容忽視
https://view.ctee.com.tw/processing/43378.html

Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) - Remote Code Execution
https://www.exploit-db.com/exploits/50987

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

我國網路資安狂被駭 監委申請自動調查
https://www.chinatimes.com/realtimenews/20220810003152-260407?chdtv

6.近期資安活動及研討會
【資安演訓實作課程】IoT資安檢測實務 2022/8/16
https://www.accupass.com/event/2207210707117495644880

Taipei dbt Meetup #5 (in-person👫 & online 👨‍💻)2022/8/17
https://www.meetup.com/taipei-dbt-meetup/events/287305953/

資安檢測實務 2022/8/17
http://www.asia-learning.com/course/itemlist/104256

資安策略規劃（資安專業課程訓練） 2022/8/18
https://moltke.nccu.edu.tw/Registration/registration.do?action=conferenceInfo&conferenceID=X20278

物聯網資安研討會暨場域參訪 2022/8/18
https://www.accupass.com/event/2207210724541325124050

國家高速網路與計算中心教育訓練 「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/8/19
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4001&from_course_list_url=homepage

HITCON PEACE 2022 台灣駭客年會 2022/8/19 ~ 2022/8/20
https://hitcon.kktix.cc/events/hitcon-peace-2022

GO! Jira Community Taipei Meetup Aug 2022/8/20
https://www.meetup.com/taipei-atlassian-community-events/events/287421661/

資通安全成熟度合規(CMMC)研討會 2022/8/23
https://www.accupass.com/event/2207220933091173574427

【資安演訓實作課程】太陽光電系統資安風險評估機制之建立與應用 2022/8/25
https://www.accupass.com/event/2207211030451484008829

迎戰駭客威脅，建構製造業資安防禦網 2022/8/25
https://www.accupass.com/event/2207130547201900731660

NISRA Enlightened 2022 2022/8/22 ~ 2022/8/26
https://nisra.kktix.cc/events/2022enlightened

讀書會 The Software Craftsman ( by Sandro Mancuso) 2022/8/26
https://www.meetup.com/taipei-swift-language-meetup-group/events/287393101/

體驗高效雲端作業環境！Chrome x Google Workspace 辦公攻略 2022/8/26
https://www.accupass.com/event/2207150626088107856280

【創客小聚】影像辨識 x MQTT，趣玩 AIoT 2022/8/27
https://www.accupass.com/event/2207211250569268478070

資策會舉辦「2022第一屆資安新秀大賽」（報名至111年8月28日止）
https://www.csie.ntnu.edu.tw/index.php/2022/08/11/2022-08-11/

自拜登數位資產政策，一探臺灣數位金融之機會與挑戰 2022/8/29
https://reurl.cc/m33d2A

2022國泰金控技術年會－DeFi開源創世紀 2022/9/1
https://edm.bnext.com.tw/2022cathaycon/

遠距辦公資安趨勢｜以零信任安全模型迎接後疫情時代 2022/9/2
https://www.accupass.com/event/2207290127311257987165

PyCon APAC 2022 2022/9/3 ~ 2022/9/4
https://tw.pycon.org/2022/zh-hant

Quarterly Professional Networking Event (Q3) 2022/9/15
https://www.meetup.com/taiwan-digital-drinks/events/287479309/

DevOpsDays Taipei 2022 2022/9/15 ~ 2022/9/16
https://devopsdays.tw/

2022 CYBERSEC 資安大會 Jamf 攤位講座 2022/9/20 ~ 2022/9/22
https://jamf.kktix.cc/events/cybersec2022jamf

關鍵基礎設施實作課程(含攻防演練實作) 2022/9/27
https://www.acw.org.tw/News/Detail.aspx?id=3229

OCF 培訓活動: 如何建立安全的網路架構 2022/10/1
https://ocftw.kktix.cc/events/ocftot2022

MOPCON 2022 2022/10/15 ~ 2022/10/16
https://mopcon.org/

Kubernetes Summit 2022 2022/10/18 ~ 2022/10/19
https://k8s.ithome.com.tw/

資訊安全與人工智慧實作 2022/10/28
https://www.cisanet.org.tw/Course/Detail/2867

行動應用APP 安全檢測（APK/IPA）2022-11-18 09:00 ~ 2022-11-18 12:00
https://www.cisanet.org.tw/Course/Detail/2865