###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2021/5/31 ~ 2021/6/4

1.重大弱點漏洞/後門/Exploit/Zero Day
Fortinet fixed a Post-Auth RCE in FortiWeb (CVE-2021-22123)
https://www.fortiguard.com/psirt/FG-IR-20-120

Researchers Warn of Critical Bugs Affecting Realtek Wi-Fi Module
https://thehackernews.com/2021/06/researchers-warn-of-critical-bugs.html

Open Source Vulnerabilities Converging DevOps & SecOps
https://cybersecdn.com/index.php/2021/05/31/open-source-vulnerabilities-converging-devops-secops/

FBI警告APT組織廣泛開採各類已知漏洞，廠商給修補但使用者無作為，等於坐等被入侵
https://www.ithome.com.tw/news/144692

SonicWall產品存在安全性弱點
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0014

Newly Discovered Bugs in VSCode Extensions Could Lead to Supply Chain Attacks
https://thehackernews.com/2021/05/newly-discovered-bugs-in-vscode.html

CSS-WHAT PACKAGE 直到5.0.0 於NODE.JS ATTRIBUTE 未知漏洞
https://vuldb.com/zh/?id.176096

RHEL 7 : kernel-alt (RHSA-2021:1379)
https://www.tenable.com/plugins/nessus/149235

Hackers‌ ‌Actively‌ ‌Exploiting‌ ‌0-Day‌ ‌in WordPress Plugin Installed on Over ‌17,000‌ ‌Sites
https://thehackernews.com/2021/06/hackers-actively-exploiting-0-day-in.html

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
防疫優先 擬開放交易員居家辦公
https://www.chinatimes.com/newspapers/20210529000126-260202?chdtv

國泰產導入Open ID多元身分驗證，金控業子公司雙向身分認證產險首家
https://reurl.cc/ZG7bRl

新光產又被罰60萬元！資安爆多項瑕疵遭懲處　今年已吞3張罰單「業界最多」
https://www.phew.tw/article/cont/phewpoint/current/topic/11361/2021053111361

疫情期間別跑銀行　線上金融服務免出門免紙本都能搞定
https://www.mirrormedia.mg/story/20210601money004/

政大金融科技研究中心與勤業眾信聯手發表第一份臺灣金融科技趨勢展望報告，提出10項Fintech發展建議
https://www.ithome.com.tw/news/144679

疫情推動數位金融 星展銀：疫後7成轉帳透網銀或行動銀
https://money.udn.com/money/story/5617/5507054

How Cybercriminals are Hacking ATM Machines? Here's a Quick Look
https://www.ehackingnews.com/2021/05/how-cybercriminals-are-hacking-atm.html

Interpol intercepts $83 million fighting financial cyber crime
https://www.bleepingcomputer.com/news/security/interpol-intercepts-83-million-fighting-financial-cyber-crime/#.YLOfObzLhOU.twitter

Hackers steal ₹39.6 lakh from 3 ATMs of bank in Kolkata
https://www.hindustantimes.com/india-news/hackers-steal-rs-39-6-lakh-from-3-atms-of-bank-in-kolkata-101622396502287.html

Boss of ATM Skimming Syndicate Arrested in Mexico
https://krebsonsecurity.com/2021/05/boss-of-atm-skimming-syndicate-arrested-in-mexico/

Breached companies facing higher interest rates and steeper collateral requirements
https://www.zdnet.com/article/breached-companies-facing-higher-interest-rates-and-steeper-collateral-requirements/

The Vulnerabilities of the Past Are the Vulnerabilities of the Future
https://thehackernews.com/2021/06/the-vulnerabilities-of-past-are.html

3.電子支付/行動支付/pay/資安
電子付款 App Venmo 有私隱漏洞　拜登私人好友清單全曝光
https://unwire.hk/2021/05/29/venmo-private-friends-list/fun-tech/

疫情促升電子支付 未來5年成長翻倍
https://www.chinatimes.com/realtimenews/20210603001097-260410?chdtv

怕拿現金傳病毒 中市推電子支付倍增創「零接觸商機」
https://udn.com/news/story/7325/5503863

疫情加速電子支付發展　資誠調查：亞洲無現金交易總額5年內增109%
https://tw.appledaily.com/property/20210531/JG3N4J755ZFJHDORIESRC2OLKI/

中國央行：一季度移動支付業務量保持增長態勢 銀行共處理電子支付業務710萬億元
https://big5.sputniknews.cn/economics/202106031033820306/

倚天資訊、酷碁科技正式合併，首發行動支付⼿環展開募資
https://technews.tw/2021/06/01/acer-gadget-beads/

防疫零接觸！Acer Gadget行動支付手環募資登場
https://udn.com/news/story/7266/5497716

信用卡綁定行動支付 有額外驚喜
https://money.udn.com/money/story/12040/5493092

Coinbase宣布 卡片可綁定Apple Pay與Google Pay
https://news.cnyes.com/news/id/4654531

新冠疫情推波助瀾 數位貨幣、行動支付激增
https://www.chinatimes.com/newspapers/20210530000117-260203?chdtv

隨著退出手機市場，LG Pay 也要下台一鞠躬
https://www.eprice.com.tw/mobile/talk/4531/5649439/1/

台灣大電支服務不變 Wali智慧錢包移轉至行動客服APP
https://udn.com/news/story/7240/5501497

4.加密貨幣/挖礦/區塊鍊/智能合約 資安
虛擬通貨納管洗錢防制7月上路，共有5大類業者須遵循
https://www.ithome.com.tw/news/144682

外匯天眼：經濟學家再轟比特幣/毫無用處，終將破滅
https://reurl.cc/0jO6Dx

比特幣今年4月已短期見頂
http://www.hkcd.com/content/2021-05/28/content_1271218.html

BSC上閃電貸攻擊再現！BurgerSwap 被駭技術分析 — 我竟騙了我自己
https://www.blocktempo.com/burgerswap-hit-by-flash-loan-attack/

BSC官方：8起閃電貸攻擊恐為「同一駭客組織」所為
https://www.blocktempo.com/binance-bsc-over-8-flashloan-hacks-well-organized-hackers-targeting/

加密貨幣市場的成長潛力到底有多大
https://news.knowing.asia/news/e6f4c93b-5d71-415f-b2e5-124786264ca6

持續完善加密貨幣服務！PayPal 將開放「提幣到外部錢包」
https://reurl.cc/XWkql7

印度央行聲明：銀行不得引用「失效的加密貨幣禁令」拒絕客戶交易；BTC聞訊回升13.7%
https://www.blocktempo.com/india-says-banks-cannot-restrict-crypto-transactions/

區塊勢推出狗狗幣文章 NFT，成台灣首家發行「內容 NFT」的媒體
https://buzzorange.com/techorange/2021/06/02/nft-taiwan-blocktrend-oursong/

俄央行總裁：數位貨幣是金融體系的未來
https://reurl.cc/gW8V3R

Mt. Gox 清償方案開放投票！14.1 萬枚比特幣將以「7 千美元」計價賠償
https://technews.tw/2021/06/02/mtgox-settlement-plan-is-open-for-voting/

美國加密貨幣產業參與方，目前所面臨的監管方式為何
https://news.knowing.asia/news/b0a41f94-615d-4a3d-b145-3e3c42725ada

防毒軟體｜諾頓 LifeLock 推「以太坊挖礦」功能， 供客戶用 PC 挖礦賺ETH
https://www.blocktempo.com/antivirus-nortonlifelock-launches-eth-mining-services-for-customers/

英國數位銀行 Starling 臨時禁令：用戶不得「入金」加密貨幣交易所，有金融犯罪疑慮
https://www.blocktempo.com/uk-bank-bans-crypto-exchange-deposits-due-to-suspected-financial-crime/

美國 | 白宮發言人：正擴大「加密貨幣金流」追蹤；SEC 再推遲 WisdomTree 比特幣 ETF 審核
https://www.blocktempo.com/biden-white-house-ransomware-cryptocurrency-sec-delay-btc-etf/

歐洲央行報告 | 肯定「央行數位貨幣」可助升國際地位，欠缺CBDC恐面金融穩定風險
https://www.blocktempo.com/erc-central-bank-digital-currency-report/

競爭Robinhood！中國 “老虎、富途證券” 進軍加密貨幣，計畫往美國、新加坡拓展海外交易
https://www.blocktempo.com/tiger-futu-brokers-launching-offshore-cryptocurrency-trading-service/

DeFi獲投資者追捧，助推加密貨幣市場繁榮的同時引發波動
https://reurl.cc/KAA1lp

NortonLifeLock Unveils Norton Crypto
https://www.businesswire.com/news/home/20210602005361/en/NortonLifeLock-Unveils-Norton-Crypto

Cybercriminals Hold $115,000-Prize Contest to Find New Cryptocurrency Hacks
https://thehackernews.com/2021/06/cybercriminals-hold-115000-prize.html

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Avaddon 勒索軟體攻擊防範須知
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9261

上膛的武器落入壞人手中：合法工具變成勒索病毒的超級武器
https://blog.trendmicro.com.tw/?p=68278

惡意軟體勒贖衝擊經濟 為何難擋? 政府真沒轍
https://www.worldjournal.com/wj/story/121469/5505412

富士軟片遭勒索軟體攻擊
https://www.ithome.com.tw/news/144803

美國FBI指控REvil涉嫌網路攻擊巴西肉品商JBS
https://reurl.cc/Nrr6rn

目標式勒索病毒攻擊特徵大解析，混淆技術、無檔案式與修改OS內建程式等手法越來越常見
https://www.ithome.com.tw/news/144813

勒索軟體威脅增 美擬提升調查至類恐攻層級
https://www.cna.com.tw/news/aopl/202106040124.aspx

SolarWinds Hackers Target Think Tanks With New 'NativeZone' Backdoor
https://thehackernews.com/2021/05/solarwinds-hackers-target-think-tanks.html

Malvertising Campaign On Google Distributed Trojanized AnyDesk Installer
https://thehackernews.com/2021/05/malvertising-campaign-on-google.html

Facefish Backdoor Steals Login Credentials & Execute Arbitrary Commands on Linux Systems
https://gbhackers.com/facefish-backdoor/

Suspected Iranian Ransomware Group Targets Israeli Firms
https://www.infosecurity-magazine.com/news/suspected-iranian-ransomware-group/

Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/

Malware Can Use This Trick to Bypass Ransomware Defense in Antivirus Solutions
https://thehackernews.com/2021/06/malware-can-use-this-trick-to-bypass.html

Windows Moriya rootkit used in highly targeted attacks
https://securityaffairs.co/wordpress/117626/malware/moriya-rootkit-operation-tunnelsnake.html

Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware
https://cybersecdn.com/index.php/2021/06/02/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware/

SharpPanda Targets Southeast Asian Government With Previously Unknown Backdoor
https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/

SkinnyBoy Bear’s BackDoor
https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
測血氧App爆紅！印度警方警告「資安問題」：資料可能被盜用
https://www.ftvnews.com.tw/news/detail/2021530W0014

下載APP用手機閃光燈可量血氧？專家曝恐怖結果：遭盜個資
https://www.chinatimes.com/realtimenews/20210530003507-260402?chdtv

手機測血氧 Careplix Vitals 是真假？實測存在4個資安外洩隱憂
https://mrmad.com.tw/careplix-vitals

網傳可用APP測血氧 查核中心：數值只能參考
https://news.ltn.com.tw/news/life/breakingnews/3554377

「測量血氧的App原理與資安」之專家意見
https://smctw.tw/9959/

手機測血氧App「CarePlix Vitals」3大疑點是真是假？官方有話要說
https://udn.com/news/story/11017/5499390

舊版 Android 系統新漏洞 黑客可利用藍牙盜取手機資料
https://today.line.me/hk/v2/article/n2785x

社交距離App沒用？　負責人籲勿刪：資料將開始大量上傳
https://tw.appledaily.com/life/20210531/A3X6HVSK3BCP5O7IJIEPWZ2RDM/

台灣社交距離App上傳率僅0.5%，網友喊已刪？負責人：現在刪除就失去了自己的寶貴紀錄
https://www.techbang.com/posts/87201-taiwan-social-distance-app

路透：義大利政府將有條件開放華為5G設備
https://news.cnyes.com/news/id/4654036

中國瀏覽器 App 遭爆追蹤用戶！無痕模式擋不了、還知道你住哪
https://3c.ltn.com.tw/news/44631

台灣社交距離App下載數破7百萬人 為什麼民眾使用後沒感覺
https://www.cmmedia.com.tw/home/articles/27859

掃店家QR Code後，注意簡訊是否傳到1922！避免發送到不明號碼
https://www.mygopen.com/2021/06/qr-code1922.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
2021年5月10大資安新聞
https://times.hinet.net/topic/23355934

勒索油管一戰成名 「黑暗面」兜售作案教學
https://udn.com/news/story/6812/5502897?from=udn-catelistnews_ch2

疫情期間網購大增 資安專家籲戒掉2項帳密惡習
https://www.cna.com.tw/news/ahel/202106033001.aspx

FBI 與 Have I Been Pwned 合作，擴大查詢外洩密碼情況的來源資料
https://reurl.cc/no0l6n

數百萬網安職位求才孔急，但有錢也找不到
https://www.worldjournal.com/wj/story/121477/5497161

駭客攻擊如病毒　供應鏈、基建資安防護2大要素
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=10&id=0000611590_YEL6P2YI8I4I0112IN4QS

富士通代管平臺被駭，影響眾多日本政府單位
https://www.ithome.com.tw/news/144686

小心駭客！微軟示警：俄國主使的駭客 鎖定政府機構
https://ec.ltn.com.tw/article/breakingnews/3549591

麻州往返鱈魚角、瑪莎葡萄園島渡輪 訂票系統遭駭勒贖
https://www.worldjournal.com/wj/story/121469/5505317

事隔3年 阿蘇薩警局再遭駭客勒索、損失慘重
https://www.worldjournal.com/wj/story/121359/5508318

北韓駭客大軍搶銀行、竊情報 比核武更具威脅
https://vip.udn.com/vip/story/121937/5507285

拜登總統簽署行政命令 以加強美國網路安全
https://www.aili.com.tw/message2_detail/122.htm

俄羅斯駭客組織肆虐多國組織 疑為美俄會談情蒐
https://news.ttv.com.tw/news/11005290025200L

蒐集外交情報　微軟：俄駭客鎖定美政府智庫發動網攻
https://tw.appledaily.com/international/20210530/NGUWPEOQNFEAPIYJHNSAII4BYA/

俄國駭客捲土重來！微軟：全球150多個組織遭殃
https://newtalk.tw/news/view/2021-05-31/581781

再有美企遭黑客勒索 拜登：將研究報復方式
http://www.hkcd.com/content/2021-06/03/content_1272301.html

全球最大肉品加工業者JBS遭俄羅斯駭客攻擊，週三可望恢復運作
https://reurl.cc/qgm7ky

JBS疑似遭到俄羅斯駭客的勒索軟體攻擊，美國政府介入協商
https://www.ithome.com.tw/news/144768

白宮：拜登正檢視勒索軟體威脅 將與蒲亭峰會討論
https://udn.com/news/story/6813/5504971

美國司法部將展開為期120天的網路安全挑戰審查
https://blog.twnic.tw/2021/06/02/18655/

紐約大都會運輸署4月遭入侵，駭客據信與中國政府有關
https://cn.nytimes.com/usa/20210603/mta-cyber-attack/zh-hant/

此地無銀三百兩! 華為稱「已無關係」還替間諜案被告付訴訟費
https://newtalk.tw/news/view/2021-06-01/582501

美攻防兼備 肆應網路灰色地帶威脅
https://reurl.cc/YOWyqX

APT 駭侵團體針對東南亞某國政府發動後門監聽攻擊長達三年
https://twcert.pixnet.net/blog/post/332520492

Hackers Using Fake Foundations to Target Uyghur Minority in China
https://thehackernews.com/2021/05/hackers-using-fake-foundations-to.html

US announces new security directive after critical pipeline hack
https://www.bleepingcomputer.com/news/security/us-announces-new-security-directive-after-critical-pipeline-hack/

A Holistic and Collaborative Approach to DNS Security in the Asia Pacific Region
https://blog.twnic.tw/2021/05/31/18864/

SolarWinds Hackers Targets Individual Accounts Across 150 Organizations Worldwide
https://cybersecuritynews.com/solarwinds-nobelium-hacker-group/

Chinese APT Threat Actors Hacking Pulse Secure VPN Devices Remotely
https://gbhackers.com/chinese-apt-threat-actors-hacking-pulse-secure-vpn-devices-remotely/

NobleBaron New Poisoned Installers Could Be Used In Supply Chain Attacks
https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/

Your Amazon Devices to Automatically Share Your Wi-Fi With Neighbors
https://thehackernews.com/2021/05/your-amazon-devices-to-automatically.html

Report: Danish Secret Service Helped NSA Spy On European Politicians
https://thehackernews.com/2021/06/report-danish-secret-service-helped-nsa.html

JBS USA Cybersecurity Attack
https://www.globenewswire.com/news-release/2021/05/31/2239049/17532/en/Media-Statement-JBS-USA-Cybersecurity-Attack.html
https://nypost.com/2021/06/01/worlds-largest-meat-processor-jbs-foods-hit-by-cyberattack/
https://www.beefcentral.com/news/jbs-global-meat-processing-operations-paralysed-by-cyber-attack/

The Incredible Rise of North Korea’s Hacking Army
https://www.newyorker.com/magazine/2021/04/26/the-incredible-rise-of-north-koreas-hacking-army

Researchers Uncover Hacking Operations Targeting Government Entities in South Korea
https://thehackernews.com/2021/06/researchers-uncover-hacking-operations.html

US Seizes Domains Used by SolarWinds Hackers in Cyber Espionage Attacks
https://thehackernews.com/2021/06/us-seizes-domains-used-by-solarwinds.html

Chinese threat actors hacked NYC MTA using Pulse Secure zero-day
https://www.bleepingcomputer.com/news/security/chinese-threat-actors-hacked-nyc-mta-using-pulse-secure-zero-day/

Experts Uncover Yet Another Chinese Spying Campaign Aimed at Southeast Asia
https://thehackernews.com/2021/06/experts-uncover-yet-another-chinese.html

合庫銀徵才 最高起薪6.4萬元
https://money.udn.com/money/story/5613/5497925

資安防護管理人員(網路安全)
https://www.104.com.tw/job/6wvip?jobsource=jolist_a_relevance

資安管理資深專業人員-數位資安架構
https://www.104.com.tw/job/7ask3

資安管理資深專業人員-數位資安架構
https://www.104.com.tw/job/7ask3?jobsource=googlejobs

資安管理專業人員-數位資安工程
https://www.104.com.tw/job/7ask6

技術整合部：資安工程師 /資訊安全副理
https://www.104.com.tw/job/79h09?jobsource=job_same_B

資安制度管理人員
https://www.1111.com.tw/job/91457613/

資訊安全專案顧問
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=2374573&HIRE_ID=10457055

資安稽核專案經理
https://www.104.com.tw/job/7aq0e

資安工程師
https://www.104.com.tw/jb/104i/job/view?j=75hpb

【資安所】資安工程師
https://www.104.com.tw/job/7asj8

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
個人帳號被盜要不要緊？原來你的個資在暗網上都有價目表
https://m.eprice.com.tw/tech/talk/1141/5647389/1/

2021暗網個資價目表出爐！這帳號竟比信用卡資料更值錢
https://newtalk.tw/news/view/2021-05-31/581667

詐騙集團擱來啊！假賣家稱：帳戶遭駭客入侵　高雄女誤信險遭詐
https://www.ettoday.net/news/20210530/1994412.htm

佯稱駭客攻擊帳戶 湖內警方阻止女子被騙
https://www.chinatimes.com/realtimenews/20210530001459-260402?chdtv

疫情在家網購 婦遭詐騙集團盯上險失萬元
https://reurl.cc/rg8L5r

ATM轉帳金額輸入解除扣款代碼？ 詐騙新手法警一秒破解
https://udn.com/news/story/7320/5496204?from=udn-ch1_breaknews-1-0-news

她被騙到ATM輸「解除扣款程式碼」16250　警趕來掛斷歹徒電話
https://tw.appledaily.com/local/20210530/55U2P2QWUZDWNBQYVXNF2NEHNQ/

5月報稅季到了！留意2大詐騙手法 小心駭客入侵專家提3招自保
https://reurl.cc/EnzGDg

駭客入侵遠端鍵入代號能關帳？ 湖內警成功攔截詐騙
https://today.line.me/tw/v2/article/7KaD58

美軍核武機密因人員使用線上字卡App外洩
https://www.ithome.com.tw/news/144711

結合串流媒體與電話客服！專家警告：當心新型釣魚詐騙手法
https://newtalk.tw/news/view/2021-05-31/581666

一頁式購物詐騙爆量，以防疫類物資為名行詐財之實尤其猖獗
https://www.kocpc.com.tw/archives/386578

大考中心驚傳資料外洩，2千考生受影響
https://www.ithome.com.tw/news/144769

大考中心報名系統驚傳遭駭 2000筆考生資料遭遭不明人士瀏覽
https://reurl.cc/gW8KKR

新學測試考系統遭駭客入侵 大考中心:不影響指考
https://globalnewstv.com.tw/202106/154625/

教育學程報名系統疑個資外洩 台大：已修復補強
https://www.cna.com.tw/news/ahel/202106030339.aspx

防疫物資詐騙網站爆量！A你錢竊個資
https://reurl.cc/bXzQLM

疫情再起，趨勢科技兩周攔截高達 75 萬次一頁式詐騙網址
https://ccc.technews.tw/2021/05/31/trend-micro-4/

陽明校區疑似個資外洩通知
https://it.nycu.edu.tw/news/6808/

民進黨主任范綱皓、網紅Sabrina涉假訊息案 調查局：資安站偵辦中
https://www.chinatimes.com/realtimenews/20210602003906-260402?chdtv

今年首季錄145宗電郵騙案涉$4.8億 警方演習揭7成公司員工曾開釣魚電郵
https://hk.appledaily.com/local/20210601/W72RZS7NHZHIJH3UQGPSUOG44M/

首季145電郵騙案　駭客扮美國「副總裁」騙上海公司7600萬元
https://reurl.cc/gW8K5V

在家上班連wifi，卻讓客戶資料、公司機密外洩⋯為什麼？怎麼應對
https://www.businessweekly.com.tw/careers/blog/3006692

散布不實確診足跡引恐慌 調查局逮2網友送辦
https://udn.com/news/story/7320/5509694

Microsoft details new sophisticated spear-phishing attacks from NOBELIUM
https://securityaffairs.co/wordpress/118352/apt/spear-phishing-attacks-nobelium.html

Army of fake fans boosts China’s messaging on Twitter
https://apnews.com/article/asia-pacific-china-europe-middle-east-government-and-politics-62b13895aa6665ae4d887dcc8d196dfc

Data of 21 million users from 3 popular free mobile VPNs advertised for sale online
https://cybersecdn.com/index.php/2021/06/01/data-of-21-million-users-from-3-popular-free-mobile-vpns-advertised-for-sale-online/

Data leak makes Peloton’s Horrible, No-Good, Really Bad Day even worse
https://arstechnica.com/gadgets/2021/05/peloton-takes-3-months-to-fix-flaw-that-exposed-users-private-information/

E.研究報告
DarkSide 勒索病毒與美國輸油管攻擊事件(更新)
https://blog.trendmicro.com.tw/?p=68204

利用redis未授權訪問漏洞(windows版)
https://codingnote.cc/zh-tw/p/394403/

Fastjson 1.2.68 反序列化漏洞Commons IO 2.x 寫文件利用鏈挖掘分析
https://www.chainnews.com/articles/005686486820.htm

Google揭露新型態的Rowhammer記憶體漏洞技術：Half-Double可影響更遠的位元
https://www.ithome.com.tw/news/144723

0day安全學習筆記：MS06-040漏洞分析
https://bbs.pediy.com/thread-267893.htm

竊取信用卡卡號之釣魚信件分析報告
https://portal.cert.tanet.edu.tw/docs/pdf/202105310105545460955345255207.pdf

【IoT漏洞分析】FragAttack系列WiFi漏洞分析
https://forum.butian.net/share/154

內容農場給我下去！搜尋引擎的內容守門員：Panda 熊貓演算法
https://pansci.asia/archives/322173

BlackDragon
https://github.com/Cyber-Guy1/BlackDragon

Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat
https://unit42.paloaltonetworks.com/docker-honeypot/

Reverse Shell Generator by Ryan Montgomery
https://hakin9.org/reverse-shell-generator-by-ryan-montgomery/

Detecting CVE-2021-31166 – HTTP vulnerability
https://securityboulevard.com/2021/05/detecting-cve-2021-31166-http-vulnerability/

Vidar Stealer infrastructure
https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed

Supercharge Your Response to Security Incidents With AWS and FireEye Helix
https://www.fireeye.com/blog/products-and-services/2021/05/supercharge-response-to-incidents-with-aws-and-helix.html

Chinese Cyber Espionage Hackers Continue to Target Pulse Secure VPN Devices
https://thehackernews.com/2021/05/chinese-cyber-espionage-hackers.html

Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices
https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html

LINE_notify_collection
https://github.com/hazel-shen/LINE_notify_collection

Web Cache Poisoning: A Tale of chaining unkeyed inputs
https://infosecwriteups.com/web-cache-poisoning-a-tale-of-chaining-unkeyed-inputs-6e3cb026bd23

AutoPentest-DRL
https://github.com/crond-jaist/AutoPentest-DRL

Red Kube
https://github.com/lightspin-tech/red-kube

Hetty - An HTTP Toolkit For Security Research
https://hakin9.org/hetty-an-http-toolkit-for-security-research/

CheeseTools - Self-developed Tools For Lateral Movement/Code Execution
https://www.kitploit.com/2021/05/cheesetools-self-developed-tools-for.html

A Complete Malware Analysis Tutorials, Cheatsheet & Tools list for Security Professionals
https://gbhackers.com/malware-analysis-cheat-sheet-and-tools-list/

Kaiju - A Binary Analysis Framework Extension For The Ghidra Software Reverse Engineering Suite
https://www.kitploit.com/2021/05/kaiju-binary-analysis-framework.html

Open-source tool Yor automatically tags IaC resources for traceability and auditability
https://cybersecdn.com/index.php/2021/05/30/open-source-tool-yor-automatically-tags-iac-resources-for-traceability-and-auditability/

yor
https://github.com/bridgecrewio/yor/releases

Akamai Security Research: Financial Services Continues Getting Bombarded With Credential Stuffing And Web Application Attacks
https://www.akamai.com/us/en/about/news/press/2021-press/akamai-soti-security-research-phishing-for-finance.jsp

Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents
https://thehackernews.com/2021/05/researchers-demonstrate-2-new-hacks-to.html

Carbanak and FIN7 Attack Techniques
https://cybersecdn.com/index.php/2021/06/01/carbanak-and-fin7-attack-techniques/

Attackers Seek New Strategies to Improve Macros' Effectiveness
https://reurl.cc/Q97G2o

Top 10 Network Packet Analyzer Tools for Sysadmin & Security Analysts 2021
https://cybersecuritynews.com/network-packet-analyzer-tools/

Redline, Taurus and mini-Redline Infostealers delivered through Google PPC Ads
https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers

WebLogic RCE Leads to XMRig
https://thedfirreport.com/2021/06/03/weblogic-rce-leads-to-xmrig/

F.商業
Microchip推出首款用於加強FPGA設計的防護工具
https://reurl.cc/nonaAe

QNAP 推出新世代三頻 Mesh Wi-Fi SD-WAN 智能路由器
https://hk.xfastest.com/118367/qnap-mesh-wifi-sd-wan-qmiroplus-201w/

電信三雄 搶攻企業防疫商機
https://ctee.com.tw/news/tech/468094.html

增金鑰自動輪替與多因素認證，MOVEit強化日常資安防護
https://www.ithome.com.tw/review/144726

防疫期間企業遠距不中斷 數位通推雲端主機及桌面雲短租服務
https://money.udn.com/money/story/5640/5501672

5G 新興威脅讓智慧製造面臨資安難題
https://www.zerone.com.tw/Content/Product/543AFE3EF2724D4A

遠距商機爆發 銓鍇與精誠資訊策略合作 開拓雲端新格局
https://money.udn.com/money/story/5612/5501326

中華電信「hiBox 電子郵件簽章」因應遠距辦公為企業電子郵件 打造更安全的資安防護
https://reurl.cc/mLqERl

普萊德參加全球安全科技展，秀安防監控網路基礎建設設備和管理方案
https://fnc.ebc.net.tw/fncnews/stock/135369

Google助台全力防疫 分享遠距教學、居家工作多元指引
https://www.chinatimes.com/realtimenews/20210602003802-260412?chdtv

中小企業注意！遠傳攜手數聯資安推出「3S 遠距安全辦公方案」讓遠距工作不犧牲資安
https://www.ftvnews.com.tw/news/detail/2021602W0210

亞馬遜便道有資安疑慮 6/8在美啟動
https://reurl.cc/ZGQpMW

亞洲供應鏈重洗牌 是方電訊插旗東南亞推全新智慧交換連結服務
https://money.udn.com/money/story/5635/5503915

G.政府
唐鳳再出手 疫苗預約平台6月上線
https://reurl.cc/O0qR1A

刑事局資安實驗室 獲國際程式行為分析認證
https://www.cna.com.tw/news/asoc/202105310166.aspx

台灣之光！刑事局資安鑑識實驗室　全球第一通過ISO／IEC資安鑑識認證
https://www.ettoday.net/news/20210531/1995386.htm

刑事局資安鑑識實驗室全球首創：將惡意程式分析流程標準化並取得ISO國際認證
https://www.ithome.com.tw/news/144756

智慧移動與資安金融正夯 台盧森堡將辦經濟合作會議
https://www.taiwannews.com.tw/ch/news/4213623

【國防部成立75周年】國防組織完備 建構精銳勁旅
https://reurl.cc/dGVNK6

防疫大作戰 司法院公布「法院遠距視訊開庭操作手冊」
https://www.chinatimes.com/realtimenews/20210601006065-260402?chdtv

COMPUTEX 2021改全線上服務 王美花：8家指標性海外企業今年加碼投資台灣
https://www.taiwannews.com.tw/ch/news/4213984

領先科技部會！工研院非實驗人員全面居家上班
https://udn.com/news/story/7240/5507516

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車 相關資安
如何抵擋駭客攻擊，提升工控系統主動防禦力? (上篇)
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9255

如何抵擋駭客攻擊，提升工控系統主動防禦力? (下篇)
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9256

自動運転車セキュリティ入門 第１回：自動運転車セキュリティの概要
https://www.mbsd.jp/research/20210531/autonomous-car/

工業物聯網新危機 企業無法停機修補關鍵漏洞暴露被攻擊的成本
https://reurl.cc/dG57a2

入侵5G專網的破口，智慧製造面臨資安難題
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9260

聯網更有保護力 使用智慧家電不駭怕
https://reurl.cc/83yENy

德國萊因安全驗證 使用智慧家電不駭怕
https://ctee.com.tw/industrynews/technology/469142.html

所有車都是物聯網的時代來臨！瑞昱：軟體定義汽車，車用乙太網路是關鍵
https://www.bnext.com.tw/article/63146/realtek-computex-2021

「智慧製造不是革命，而是進化！」鴻海旗下富鴻網如何讓5G助攻智慧工廠
https://www.bnext.com.tw/article/63170/computex-2021-fhnet

Tesla 車內監控鏡頭有漏洞！駭客：邊開邊睡系統沒反應
https://auto.ltn.com.tw/news/17837/3

趨勢科技揭車聯網資安趨勢：當汽車成了行駛中的「超級電腦」，該如抵禦駭客攻擊
https://today.line.me/tw/v2/article/9jzxxg

A New Bug in Siemens PLCs Could Let Hackers Run Malicious Code Remotely
https://thehackernews.com/2021/05/a-new-bug-in-siemens-plcs-could-let.html

I.教育訓練
常考滲透測試面試問題
https://zhuanlan.zhihu.com/p/376107902

All about File upload XSS
https://infosecwriteups.com/all-about-file-upload-xss-c72c797aaba3

Cross Site Scripting -XSS
https://hackersonlineclub.com/cross-site-scripting-xss/

Windows 10 quietly got a built-in network sniffer, how to use
https://www.bleepingcomputer.com/news/microsoft/windows-10-quietly-got-a-built-in-network-sniffer-how-to-use/

J.人工智慧/AI/ML/人臉辨識
本週無合適議題。

6.近期資安活動及研討會
Golang Taipei Gathering #57 Webinar 6/1
https://www.meetup.com/golang-taipei-meetup/events/278400349/

從Python到TensorFlow線上讀書會-二部曲(14) -集群 6/1
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/274981394/

Taipei Creative Coders Meetup #9 6/2
https://www.meetup.com/tpecreativecoders/events/278466192/

TensorFlow Everywhere | From 0 to 1 6/10
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/277170902/

2021製造業資安論壇 6/10
https://docs.google.com/forms/d/e/1FAIpQLSeJEpc_ePmJGx2RO6hlSJQnmsFTzBT-2zkzjcnPHbdYS2UAhQ/viewform

行動應用APP安全檢測與實務(可抵內稽) 6/11
https://www.caa.org.tw/coursedetail-3515.html

Maximize the Output, or Optimize the Outcome 6/24
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003947/

【白帽駭客工坊】2021資安實務培訓課程 6/25
https://pttcareer.com/tech_job/M.1620115144.A.C05.html

Making websites run faster and environmentally friendly 6/25
https://www.meetup.com/taiwan-code-camp/events/278096767/

國家高速網路與計算中心 教育訓練 【資安進階課程】實體滲透與手法研究 6/29
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3950&from_course_list_url=homepage

Golang Taipei Gathering #58
https://www.meetup.com/golang-taipei-meetup/events/277604159/

Cyber Security Global Summit 21 6/29 ~ 6/30
https://cs.geekle.us/?utm_content=INFO_SEC_TIER2

元智資工夏令營-由programming邁入AI大數據與資安世界 7/15 ~ 7/17
https://cse-yzu.kktix.cc/events/yzcsapcs5

國立臺灣科技大學執行教育部「先進資通安全實務人才培育計畫」，將於110年7月26日至8月1日舉辦「110年新型態資安暑期課程(AIS3 2021)
http://cc.ncku.edu.tw/p/406-1002-220949,r804.php?Lang=zh-tw

學生計算機年會 SITCON 2021 9/4
https://sitcon.org/2021/

Cyber Defense Summit 2021 Oct. 4-7, 2021
https://summit.fireeye.com/