###### tags: `資安事件新聞週報` # 資安事件新聞週報 2024/11/25 ~ 2024/11/29 1.重大弱點漏洞/後門/Exploit/Zero Day 網路流量監控系統Zabbix存在重大層級漏洞，恐被用於SQL注入、RCE攻擊 https://www.bleepingcomputer.com/news/security/new-nachovpn-attack-uses-rogue-vpn-servers-to-install-malicious-updates/ 網路流量監控系統LibreNMS存在重大漏洞，攻擊者有機會執行作業系統層級命令 https://securityonline.info/librenms-vulnerability-cve-2024-51092-mitigating-the-risk-of-server-compromise/ 美國證實Array Networks旗下SSL VPN系統重大漏洞已出現攻擊行動 https://www.ithome.com.tw/news/166225 Array Networks、Fortinet SSL VPN漏洞被用於散布後門程式，臺灣、日本有企業受害 https://www.ithome.com.tw/news/166218 Palo Alto Networks、SonicWall旗下SSL VPN系統存在新型態漏洞NachoVPN，攻擊者有機會為用戶端安裝惡意更新 https://www.bleepingcomputer.com/news/security/new-nachovpn-attack-uses-rogue-vpn-servers-to-install-malicious-updates/ Intruder Launches Intel: A Free Vulnerability Intelligence Platform For Staying Ahead of the Latest Threats https://thehackernews.com/2024/11/intruder-launches-intel-free.html 俄羅斯駭客RomCom利用Firefox、Windows零時差漏洞發動攻擊 https://www.ithome.com.tw/news/166215 RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyberattacks https://thehackernews.com/2024/11/romcom-exploits-zero-day-firefox-and.html CISA Urges Agencies to Patch Critical "Array Networks" Flaw Amid Active Attacks https://thehackernews.com/2024/11/cisa-urges-agencies-to-patch-critical.html WordPress網站防護外掛存在重大漏洞，逾20萬網站曝險 https://www.securityweek.com/critical-vulnerabilities-found-in-anti-spam-plugin-used-by-200000-wordpress-sites/ WordPress寄信外掛FluentSMTP存在重大漏洞，恐導致網站遭挾持 https://securityonline.info/cve-2024-9511-cvss-9-8-critical-flaw-in-fluentsmtp-plugin-exposes-over-300000-wordpress-sites-to-potential-takeover/ Critical WordPress Anti-Spam Plugin Flaws Expose 200,000+ Sites to Remote Attacks https://thehackernews.com/2024/11/critical-wordpress-anti-spam-plugin.html PHP修補重大層級的記憶體越界寫入漏洞 https://www.ithome.com.tw/news/166230 PHP修補重大層級的記憶體越界存取、緩衝區過度讀取漏洞 https://securityonline.info/php-patches-multi-flaws-including-cve-2024-8932-cvss-9-8-urges-immediate-update/ 檔案共享伺服器ProjectSend存在重大漏洞，已被用於實際攻擊行動 https://www.ithome.com.tw/news/166258 Critical Flaw in ProjectSend Under Active Exploitation Against Public-Facing Servers https://thehackernews.com/2024/11/critical-flaw-in-projectsend-under.html Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks https://thehackernews.com/2024/11/microsoft-fixes-ai-cloud-and-erp.html 2.銀行/金融/保險/證券/金融監理 新聞及資安 2024金融白皮書 打詐護資安 https://www.ctee.com.tw/news/20241126700076-439901 金融建言白皮書 打詐護資安 https://www.cdns.com.tw/articles/1125242 全球人壽攜手奧義智慧，提升資安永續，落實社會責任實現 https://www.cio.com.tw/global-life-join-together-to-smart-promote-security-and-implement-social-responsibility/ 3.信用卡/電子支付/行動支付/pay/支付系統/資安 特店APP、第三方身分驗證 明年上路 https://news.housefun.com.tw/news/article/133533445793.html A3A PayTech Limited 利用 AWS 雲端技術革新支付領域 https://today.line.me/hk/v2/article/2DnZgz6 引狼入室！馬籍女員工偷換店內「收款條碼」 2個月盜走109萬 https://reurl.cc/p9xvRe PayMe銀聯虛擬卡懶人包！開通方法、如何付款/綁到銀聯雲閃付、限時優惠著數一覽 https://reurl.cc/5D2dN6 4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安 5銀行欲試辦虛幣保管業務 2025年可望見首案 https://www.rti.org.tw/news/view/id/2229579 金管會推動「虛擬資產保管業務」試辦！明年元旦起受理申請、 5 家銀行有意願 https://blockcast.it/2024/11/29/taiwan-to-launch-crypto-custody-pilot-for-local-banks-in-2025/ 台灣洗防新規11/30上路，未登記不得提供虛擬資產服務 https://www.blocktempo.com/taiwans-new-aml-law-effective-nov-30-exchanges-and-crypto-traders-must-register/ 加密貨幣課稅新政應如何實施？立委黃珊珊強調「先管理、再課稅」 https://reurl.cc/ZZjVd6 北韓駭客冒充創投、HR、IT 人員，竊取數價值十億美元的加密貨幣 https://technews.tw/2024/11/29/north-korean-hackers/ 加密新希望？川普團隊考慮將加密貨幣監管權交給 CFTC https://abmedia.io/cftc-may-lead-digital-asset-regulation 1000倍山寨幣季即將來臨—聖誕行情最佳加密貨幣選擇 https://m.cnyes.com/news/id/5794228 10萬美元是個坎！比特幣近期暴漲是一種虛假的安全感 https://hk.investing.com/news/economic-indicators/article-721064 香港計劃擴大稅收豁免範圍，避險基金、超級富豪投資加密幣獲利擬免稅 https://blockcast.it/2024/11/28/hong-kong-proposes-tax-free-crypto-profits-for-hedge-funds-private-equity-and-wealthy-investors/ 5.資安事件新聞 A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC 中國及越南遭到CleverSoar惡意部署工具鎖定，攻擊者意圖散布Winos 4.0、Nidhogg https://www.ithome.com.tw/news/166273 中國駭客組織鎖定 Linux 系統，部署新型後門程式 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11406 惡意程式GodLoader迴避偵測出現新手法，駭客濫用遊戲引擎感染1.7萬臺電腦 https://www.ithome.com.tw/news/166280 趨勢科技揭露Salt Typhoon攻擊電信業者的惡意程式GhostSpider https://www.ithome.com.tw/news/166197 出現命名意圖與兩大AI平臺混淆的可疑開發套件，目的是散播竊資軟體JarkaStealer https://www.ithome.com.tw/news/166188 北韓駭客Lazarus鎖定macOS用戶，意圖散布木馬程式RustyAttr https://securityonline.info/lazarus-group-exploits-xattr-with-rustyattr-to-evade-detection/ 俄羅斯駭客鎖定歐洲、亞洲，散布惡意軟體HatVibe、CherrySpy https://thehackernews.com/2024/11/russian-hackers-deploy-hatvibe-and.html 南亞駭客組織APT-K-47以伊斯蘭教朝聖活動為誘餌，散布惡意軟體Asyncshell https://thehackernews.com/2024/11/apt-k-47-uses-hajj-themed-lures-to.html 對抗資安人員駭客出奇招，惡意軟體Raspberry Robin在測試環境會部署誘餌擾亂調查 https://www.zscaler.com/blogs/security-research/unraveling-raspberry-robin-s-layers-analyzing-obfuscation-techniques-and 越南駭客透過企業臉書帳號散布竊資軟體VietCredCare、DuckTail https://www.group-ib.com/blog/tracing-the-path-of-vietcredcare-and-ducktail/ 研究人員揭露名為Bootkitty的惡意UEFI Bootkit，專門鎖定Linux主機而來 https://www.ithome.com.tw/news/166255 軟體供應鏈Blue Yonder遭勒索軟體攻擊，波及星巴克等業者 https://www.ithome.com.tw/news/166196 兆勤證實防火牆漏洞遭到勒索軟體利用的情況 https://www.ithome.com.tw/news/166220 防毒軟體Avast的驅動程式元件遭到濫用，駭客企圖停用受害電腦防護機制 https://www.ithome.com.tw/news/166200 竊資軟體NodeStealer透過臉書廣告散布，利用Windows公用程式竊取瀏覽器資料 https://thehackernews.com/2024/11/nodestealer-malware-targets-facebook-ad.html 以色列企業組織遭伊朗駭客鎖定，被散布惡意軟體WezRat https://thehackernews.com/2024/11/iranian-hackers-deploy-wezrat-malware.html 北韓駭客鎖定開發人員而來，藉由NPM套件散布惡意程式BeaverTail、InvisibleFerret https://securityonline.info/cyber-espionage-campaign-north-korean-actors-deploy-beavertail-and-invisibleferret/ 哈馬斯駭客Wirte鎖定以色列企業組織，散布資料破壞軟體SameCoin https://thehackernews.com/2024/11/hamas-affiliated-wirte-employs-samecoin.html Researchers Uncover Malware Using BYOVD to Bypass Antivirus Protections https://thehackernews.com/2024/11/researchers-uncover-malware-using-byovd.html North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn https://thehackernews.com/2024/11/north-korean-hackers-steal-10m-with-ai.html APT-K-47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware https://thehackernews.com/2024/11/apt-k-47-uses-hajj-themed-lures-to.html Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia https://thehackernews.com/2024/11/russian-hackers-deploy-hatvibe-and.html Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries https://thehackernews.com/2024/11/chinese-hackers-use-ghostspider-malware.html Researchers Discover "Bootkitty" – First UEFI Bootkit Targeting Linux Kernels https://thehackernews.com/2024/11/researchers-discover-bootkitty-first.html 駭客組織APT-C-60鎖定StatCounter、Bitbucket伺服器，意圖散布惡意軟體SpyGlace https://thehackernews.com/2024/11/apt-c-60-exploits-wps-office.html 日本遭APT-C-60網釣攻擊，濫用StatCounter、Bitbucket並意圖散布SpyGlace後門 https://www.ithome.com.tw/news/166278 APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign https://thehackernews.com/2024/11/apt-c-60-exploits-wps-office.html Matrix Botnet Exploits IoT Devices in Widespread DDoS Botnet Campaign https://thehackernews.com/2024/11/matrix-botnet-exploits-iot-devices-in.html XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner https://thehackernews.com/2024/11/xmlrpc-npm-library-turns-malicious.html Cybercriminals Exploit Popular Game Engine Godot to Distribute Cross-Platform Malware https://thehackernews.com/2024/11/cybercriminals-exploit-popular-game.html B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊 中國駭客組織利用 SIGTRAN、GSM 協定入侵南亞、非洲電信網路 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11400 Google's New Restore Credentials Tool Simplifies App Login After Android Migration https://thehackernews.com/2024/11/googles-new-restore-credentials-tool.html PyPI Python Library "aiocpa" Found Exfiltrating Crypto Keys via Telegram Bot https://thehackernews.com/2024/11/pypi-python-library-aiocpa-found.html 針對遭遇中國駭客Salt Typhoon入侵的事故，T-Mobile公布最新調查結果 https://www.bleepingcomputer.com/news/security/chinese-hackers-breached-t-mobiles-routers-to-scope-out-network/ U.S. Telecom Giant T-Mobile Detects Network Intrusion Attempts from Wireline Provider https://thehackernews.com/2024/11/us-telecom-giant-t-mobile-detects.html C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力 北韓駭客半年內竊取逾1千萬美元加密貨幣、針對衛星與軍事系統從事網釣攻擊 https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/ 俄羅斯駭客APT28發動Nearest Neighbor攻擊，目的是收集烏克蘭情報 https://www.ithome.com.tw/news/166183 中國駭客Earth Kasha發起LodeInfo攻擊，將範圍從日本延伸到臺灣、印度 https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html U.S. Citizen Sentenced for Spying on Behalf of China's Intelligence Agency https://thehackernews.com/2024/11/us-citizen-sentenced-for-spying-on.html 國際執法單位與非洲刑警組織聯手，逮捕上千名參與網路犯罪的嫌犯 https://www.ithome.com.tw/news/166222 INTERPOL Busts African Cybercrime: 1,006 Arrests, 134,089 Malicious Networks Dismantled https://thehackernews.com/2024/11/interpol-busts-african-cybercrime-1006.html Microsoft, Meta, and DOJ Disrupt Global Cybercrime and Fraudulent Networks https://thehackernews.com/2024/11/microsoft-meta-and-doj-disrupt-global.html Google Exposes GLASSBRIDGE: A Pro-China Influence Network of Fake News Sites https://thehackernews.com/2024/11/google-exposes-glassbridge-pro-china.html 圖博新聞媒體、大學網站遭中國駭客TAG-112攻擊，用網站漏洞與紅隊測試工具進行滲透 https://www.ithome.com.tw/news/166202 China-Linked TAG-112 Targets Tibetan Media with Cobalt Strike Espionage Campaign https://thehackernews.com/2024/11/china-linked-tag-112-targets-tibetan.html Latest Multi-Stage Attack Scenarios with Real-World Examples https://thehackernews.com/2024/11/latest-multi-stage-attack-scenarios.html D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全 因不滿成為OpenAI宣傳影片生成器Sora的工具，受邀測試的藝術家洩露存取權限 https://www.ithome.com.tw/news/166221 中國駭客Earth Kasha從事網釣攻擊，意圖對日本企業散布後門程式Anel https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html 逾四分之三黑色星期五垃圾信涉及詐騙 https://www.infosecurity-magazine.com/news/black-friday-spam-emails-scams/ 中國Storm-2077架設影響力網路GlassBridge，意圖對美國政府機關、非政府組織散布假新聞 https://thehackernews.com/2024/11/google-exposes-glassbridge-pro-china.html Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks https://thehackernews.com/2024/11/phishing-as-service-rockstar-2fa.html E.研究報告/工具 MITRE 2024 年最危險軟體弱點排名：跨站腳本攻擊（XSS）居首位 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11407 「零信任博士」的實踐觀察，揭示零信任挑戰與應用未來 https://www.ithome.com.tw/news/166187 Flying Under the Radar - Security Evasion Techniques https://thehackernews.com/2024/11/flying-under-radar-security-evasion.html Cybersecurity Blind Spots in IaC and PaC Tools Expose Cloud Platforms to New Attacks https://thehackernews.com/2024/11/cybersecurity-flaws-in-iac-and-pac.html Unlocking Google Workspace Security: Are You Doing Enough to Protect Your Data https://thehackernews.com/2024/11/the-importance-of%20having-a-google-workspace-backup-solution.html Defensible Security Architecture and Engineering: Designing and Building Defenses for the Future https://thehackernews.com/expert-insights/2024/11/defensible-security-architecture-and.html The Future of Serverless Security in 2025: From Logs to Runtime Protection https://thehackernews.com/2024/11/the-future-of-serverless-security-in.html F.商業 微軟推出首款加強資料安全的自製晶片 Azure Integrated HSM https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11403 Akamai 將微分段技術擴展至 Amazon Web Services https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11401 2024上市櫃高科技製造業資安論壇：AI資安技術 x ESG資安治理 實踐數位韌性 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11396 AWS與Rust基金會攜手，驗證Rust標準函式庫的安全性 https://www.ithome.com.tw/news/166158 展望2025國際治理趨勢，BSI揭露董事會「義務」成新主軸 https://www.ithome.com.tw/news/166133 資安新創Wiz買下雲端安全業者Dazz https://www.ithome.com.tw/news/166164 G.政府 資安院攜手產業提升資安韌性，跨域協作聯防成就資安共好 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11405 行政院推打詐策略行動綱領2.0，提高產業防詐監管力度、AI科技防詐是關鍵 https://www.ithome.com.tw/news/166264 重塑對企業資安聯防的溝通模式，TWCERT/CC將逐步從傳統事件通報提升到關鍵情資共享 https://www.ithome.com.tw/news/166249 北捷AI客服遭網友測試發現可代寫程式碼，北捷緊急斷開Azure Open AI回應功能 https://www.ithome.com.tw/news/166191 影城放《國有器官》接恐嚇郵件 國安局：中共對台長臂管轄 https://news.pts.org.tw/article/726123 H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安 Over Two Dozen Flaws Identified in Advantech Industrial Wi-Fi Access Points – Patch ASAP https://thehackernews.com/2024/11/over-two-dozen-flaws-identified-in.html 已終止維護的D-Link數據機存在重大漏洞，近6萬臺設備曝險 https://www.ithome.com.tw/news/166245 威聯通修補路由器OS與NAS加值軟體重大漏洞 https://www.ithome.com.tw/news/166195 I.教育訓練 資安事件發生必要知道的復原程序，降低傷害 https://www.ithome.com.tw/pr/163614 iPAS資訊安全工程師中級筆記 https://hackmd.io/@Not/iPASInformationSecuritySpecialist iPas資安工程師證照考前研習 https://reurl.cc/GEbA3p iPAS◆資訊安全規劃實務◆中級測驗題庫彙編(123題) https://reurl.cc/orlD1g GCP Associate Cloud Engineer (ACE) 學習心得、教材資源與筆記分享 — 學習天然高可用與零信任設計 https://medium.com/blacksecurity/gcp-associate-cloud-engineer-78f736aee7ad Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！ https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/ 一般人也能拿到國際資安認證！CSCU安全電腦使用者認證課程 https://www.ithome.com.tw/pr/160954 全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口 https://reurl.cc/m39MDj CISSP資安認證的8大領域 https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html CISSP考試心得 https://reurl.cc/KbY83j CISSP考試心得 – Benson https://reurl.cc/GbWvxd 目標導向-20天光速考過CISSP https://reurl.cc/2Zq6zn CISSP證照考試實戰心得 第一章：初期準備工作 https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略 https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies CISSP證照考試實戰心得 第三章：終極一戰 https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle Quick CISSP Infographic for IPSec https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec CSSLP Certification - Security models in F# https://github.com/vbocan/csslp Certified Secure Software Lifecycle Professional in bullet points https://github.com/joeyhage/csslp-notes CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得 https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/ EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022 https://reurl.cc/1oyEM8 CEH v11 考試心得與準備方式 https://blog.sean.taipei/2022/01/ceh CEH https://github.com/a3cipher/CEH CodeRed by EC-Council https://github.com/codered-by-ec-council EC-Council CEH Practical / Master 準備心得 — 讓理論與實作相輔相成的學習 https://medium.com/blacksecurity/ceh-practical-master-3e80cac180a2 EC-Council CEHP考試準備心得 https://hackmd.io/@9dCJrgb6QHGd8dRfgHO0zg/r14xNn1po My ceh practical notes https://github.com/dhabaleshwar/CEHPractical/blob/main/Everything%20You%20Need.md CEHP課程筆記 https://hackmd.io/@nfu-johnny/B1Ju_BMPR ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4 EC-Council ECSA資安分析專家 v10 考試心得分享 https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html 20180817 EC-Council ECSA v10 PASS https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html 關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享 https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d 深度解析 CPENT 考試心得、以及與 OSCP 的比較 https://reurl.cc/41eL8v EC-Council CPENT v1 滲透測試認證 – 內容及心得分享 https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review CPENT 從暴力到破解 https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295 Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證 https://ucom.uuu.com.tw/web/Testimony/Article/4404 kaizensecurity/CPENT https://github.com/kaizensecurity/CPENT/tree/master CPENT : Pentesting like NO OTHERS ! https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/ Journey of My CPENT Exam https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917 [備考心得]CompTIA Security+ (SY0–601) 上篇 https://reurl.cc/M053DK [備考心得]CompTIA Security+ (SY0–601) 下篇 https://reurl.cc/M053Gv comptia-security-plus https://github.com/ajfuto/comptia-security-plus security-plus https://github.com/fjavierm/security-plus CompTIA Security+ Certification Practice Test Questions https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette 不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書） https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html App防駭學，資安防護實戰課程全面提升安全觀念 https://www.ithome.com.tw/pr/161505 OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享 https://hackmd.io/@henry-ko/HyQ56e8eF OSEP (Evasion Techniques and Breaching Defenses (PEN-300) http://github.com/In3x0rabl3/OSEP OSCP（Offensive Security Certified Professional） https://github.com/0x584A/oscp-notes/tree/master ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年 https://reurl.cc/aVLoX9 Learn NIST Inside Out With 21 Hours of Training @ 86% OFF https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html 駭客與國家: 網路攻擊與地緣政治新常態 The hacker and the state: cyber attacks and the new normal of geopolitic https://reurl.cc/D3nKKj Practical Network Penetration Tester (PNPT) Certification Review https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df WUSON常用的基本詞彙 https://choson.lifenet.com.tw/?p=1958 證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」 https://www.ithome.com.tw/news/156754 用證照證明自己實力之餘，更應將證照視為督促學習的最大動力 https://www.ithome.com.tw/news/156756 打破證照誤解與迷思，資安專家帶你釐清資安證照的意義 https://www.ithome.com.tw/news/156755 Accelerate Your Career with the Global Leader in Cyber Security Training https://www.sans.org/mlp/promo-partnership-hacker-news/ 【成大資安社社課】資安禁術 - 逆向工程地獄試煉 https://www.youtube.com/watch?v=4Yc3-9CjG6U 透過實務演練，教你建立實作標準的安全SOP流程 https://www.ithome.com.tw/pr/163514 6.近期資安活動及研討會 Threat Analyst Summit 2024 威脅分析師高峰會 2024/12/11 ~ 2024/12/12 https://teamt5tw.kktix.cc/events/tas2024 金融反詐 X AI深偽：資安實務專題講座（中部場）2024/12/16 https://isipevent.kktix.cc/events/m165isip Free Startup Fundraising Office Hours Expert AMA with Angel Investor Scott Fox! 2024/12/25 https://www.meetup.com/taipei-startups-investors-masterminds-network/events/bmzxltygcqbhc/