###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2023/5/8 ~ 2023/5/12

1.重大弱點漏洞/後門/Exploit/Zero Day
Zyxel 發布多個產品的安全公告
https://reurl.cc/a12Z19

SAP發布5月例行更新，修補BusinessObjects、3D Visual Enterprise License Manager重大漏洞
https://www.securityweek.com/sap-patches-critical-vulnerabilities-with-may-2023-security-updates/

Linux核心漏洞NetFilter恐被用於取得root權限
https://www.bleepingcomputer.com/news/security/new-linux-kernel-netfilter-flaw-gives-attackers-root-privileges/

Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Installs Compromised
https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html

Microsoft Warns of State-Sponsored Attacks Exploiting Critical PaperCut Vulnerability
https://thehackernews.com/2023/05/microsoft-warns-of-state-sponsored.html

Microsoft's May Patch Tuesday Fixes 38 Flaws, Including 2 Exploited Zero-Day Bugs
https://thehackernews.com/2023/05/microsofts-may-patch-tuesday-fixes-38.html

Experts Detail New Zero-Click Windows Vulnerability for NTLM Credential Theft
https://thehackernews.com/2023/05/experts-detail-new-zero-click-windows.html

New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks
https://thehackernews.com/2023/05/new-vulnerability-in-popular-wordpress.html

New Flaw in WordPress Plugin Used by Over a Million Sites Under Active Exploitation
https://thehackernews.com/2023/05/severe-security-flaw-exposes-over.html

Intel、AMD發布例行更新，公告超過100個漏洞的緩解措施
https://www.securityweek.com/chipmaker-patch-tuesday-intel-amd-address-over-100-vulnerabilities/

Adobe修補3D繪圖軟體漏洞
https://www.securityweek.com/adobe-patches-14-vulnerabilities-in-substance-3d-painter/

邊界閘道協定軟體FRRouting出現漏洞，恐被用於發動阻斷服務攻擊
https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html

OpenAI帳號驗證流程存在漏洞，透過相同電話號碼竟然「無限」次免費試用ChatGPT付費服務
https://checkmarx.com/blog/openai-allowed-unlimited-credit-on-new-accounts/

FortiADC、FortiOS、FortiProxy設備存在高風險漏洞
https://www.securityweek.com/fortinet-patches-high-severity-vulnerabilities-in-fortiadc-fortios/

微軟Azure旗下API管理服務存在漏洞，恐被用於SSRF、路徑穿越攻擊
https://ermetic.com/blog/azure/when-good-apis-go-bad-uncovering-3-azure-api-management-vulnerabilities/

阿里雲PostgreSQL資料庫出現重大漏洞
https://www.wiz.io/blog/brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r

電子商務平臺PrestaShop出現能讓後臺使用者刪除資料庫的漏洞
https://www.bleepingcomputer.com/news/security/prestashop-fixes-bug-that-lets-any-backend-user-delete-databases/

Google發布安卓5月例行更新，修補遭到商業間諜軟體利用的漏洞
https://source.android.com/docs/security/bulletin/2023-05-01

短影片社群平臺抖音存在漏洞，恐曝露使用者的行蹤
https://www.imperva.com/blog/imperva-red-team-discovers-vulnerability-in-tiktok-that-can-reveal-user-activity-and-information/

列印管理系統PapaerCut再度出現重大漏洞
https://securityaffairs.com/145752/hacking/papercut-new-exploit.html

2.銀行/金融/保險/證券/金融監理 新聞及資安
Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN
https://thehackernews.com/2023/05/hackers-targeting-italian-corporate.html

銀行資安專家看打詐防駭破口　「危機意識」最關鍵
https://finance.ettoday.net/news/2496087

千萬富翁變窮光蛋！2600萬存款吃完飯剩3000 投訴銀行遭回：正常消費
https://reurl.cc/qkQnMR

印度銀行Fullerton India傳出遭勒索軟體LockBit攻擊，外流600 GB內部資料
https://www.bankinfosecurity.com/lockbit-30-leaks-600-gbs-data-stolen-from-indian-lender-a-22010

新的網頁注入工具包DrIBAN鎖定義大利銀行用戶而來
https://www.cleafy.com/cleafy-labs/uncovering-driban-fraud-operations-chapter1

金融上雲零信任時代來臨 企業恐面臨３大資安阻礙
https://reurl.cc/6NrKjb

銀行自律上路 防堵供應鏈資安出包
https://reurl.cc/DmGqKE

3.信用卡/電子支付/行動支付/pay/支付系統/資安
搜集Apple Pay缺失 歐盟反壟可能動手開鍘
https://reurl.cc/KMN8lM

蘋果大力推動點擊支付，卻面臨新一輪歐盟審查
https://today.line.me/tw/v2/article/EXDzKz2

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
宣布Layer1公鏈Chiliz Chain正式上線主網！還記得Chiliz的破圈之路嗎
https://news.knowing.asia/news/e39cb3c8-86a2-435d-a7a4-875ffb0696d1

藝術家Kitboga建立虛假帳戶來誘騙駭客
https://news.cnyes.com/news/id/5174735?exp=a

Bitfinex Alpha：BRC-20和Ordinals的引入，最終將為Layer1區塊鏈帶來更多可能性
https://news.knowing.asia/news/c2ef7923-6f59-4c37-ba2c-b1bb3b16ffc6

駭客談判指南》加密資產被盜時該如何處理
https://www.blocktempo.com/what-to-do-when-encrypted-assets-are-stolen/

某駭客正以被遺棄的Meme代幣為攻擊目標獲利
https://news.cnyes.com/news/id/5176929

瞄準虛擬市場 台灣銘板、幣託簽「冷錢包」訂購合約
https://ec.ltn.com.tw/article/breakingnews/4299808

美國當局引渡通過SIM卡互換盜竊加密貨幣的英國公民
https://news.cnyes.com/news/id/5172454

美國與烏克蘭聯手，查封9個被勒索軟體駭客用於洗錢的加密貨幣交易所
https://www.bleepingcomputer.com/news/security/fbi-seizes-9-crypto-exchanges-used-to-launder-ransomware-payments/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
加密VPN不再安全！新勒索軟體能躲防毒和網路監控
https://reurl.cc/3Ov68R

Apple Mac 遭新款惡意軟件入侵　用戶個人文件及信用卡資訊恐被竊
https://www.hk01.com/article/894948?utm_source=01articlecopy&utm_medium=referral

Facebook 發現專門竊取平台帳號與資料的惡意軟體 NodeStealer
https://www.twcert.org.tw/tw/cp-104-7115-eff9b-1.html

新發現 Android 惡意軟體 Fleckpe 已於 Google Play 下載 62 萬次
https://www.twcert.org.tw/tw/cp-104-7113-6d626-1.html

FBI摧毀據稱是俄羅斯用來竊取北約盟國文件的惡意軟體
https://reurl.cc/EGEVKA

資安業者CyberArk提供勒索軟體解密工具White Phoenix，針對部分加密手法進行破解
https://www.cyberark.com/resources/threat-research-blog/white-phoenix-beating-intermittent-encryption

LockBit 3.0 BR - Fleury
https://otx.alienvault.com/pulse/6459138fb309030d05c34838

美國達拉斯市遭Royal勒索軟體攻擊，部分市府服務癱瘓
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10454

駭客透過瀏覽器畫面捏造Windows更新視窗，意圖散布竊資軟體Aurora
https://www.malwarebytes.com/blog/threat-intelligence/2023/05/fake-system-update-drops-new-highly-evasive-loader

美國宣布破壞惡意軟體Snake的基礎設施
https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-snake-malware-network-controlled

北韓駭客Kimsuky利用惡意軟體ReconShark跟蹤使用者
https://www.sentinelone.com/labs/kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/

規避防毒軟體出現新招式！勒索軟體Cactus將自己也「加密」
https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection

殭屍網路AndoryuBot鎖定Ruckus無線網路管理系統而來
https://www.fortinet.com/blog/threat-research/andoryubot-new-botnet-campaign-targets-ruckus-wireless-admin-remote-code-execution-vulnerability-cve-2023-25717

伊朗政府利用安卓惡意軟體BouldSpy監控少數民族
https://www.lookout.com/blog/iranian-spyware-bouldspy

為了讓加密檔案順利，勒索軟體Akira濫用Windows Restart Manager的API
https://www.bleepingcomputer.com/news/security/meet-akira-a-new-ransomware-operation-targeting-the-enterprise/

安卓惡意程式FluHorse鎖定臺灣、越南用戶的雙因素驗證碼、密碼而來
https://research.checkpoint.com/2023/eastern-asian-android-assault-fluhorse/

惡意軟體QBot透過OneNote文件與Windows說明檔案散布
https://blog.cyble.com/2023/04/21/qakbot-malware-continues-to-morph/

勒索軟體CrossLock繞過作業系統的事件追蹤機制
https://blog.cyble.com/2023/04/18/crosslock-ransomware-emerges-new-golang-based-malware-on-the-horizon/

駭客組織Blind Eagle透過Discord代管的PowerShell指令碼，散布木馬程式NjRAT
https://threatmon.io/apt-blind-eagles-malware-arsenal-technical-analysis/

俄國駭客組織Tomiris利用惡意軟體Turla混淆視聽
https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/

竊資軟體ViperSoftX鎖定密碼管理器程式而來
https://www.trendmicro.com/en_us/research/23/d/vipersoftx-updates-encryption-steals-data.html

Threat Assessment: Royal Ransomware
https://unit42.paloaltonetworks.com/royal-ransomware/

Managed XDR Investigation of Ducktail in Trend Micro Vision One
https://reurl.cc/OV95q3
https://reurl.cc/OV95X7

SideWinder Uses Server-side Polymorphism to Attack Pakistan Government Officials — and Is Now Targeting Turkey
https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-target-pakistan

AuKill EDR killer malware abuses Process Explorer driver
https://reurl.cc/GeW5dW

Sophisticated DarkWatchMan RAT Spreads Through Phishing Sites
https://blog.cyble.com/2023/05/05/sophisticated-darkwatchman-rat-spreads-through-phishing-sites/

Fake system update drops Aurora stealer via Invalid Printer loader
https://www.malwarebytes.com/blog/threat-intelligence/2023/05/fake-system-update-drops-new-highly-evasive-loader

Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020
https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger

10個勒索軟體家族鎖定VMware虛擬化平臺而來，利用Babuk原始碼打造相關作案工具
Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers
https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/

Babuk Source Code Sparks 9 Different Ransomware Strains Targeting VMware ESXi Systems
https://thehackernews.com/2023/05/babuk-source-code-sparks-9-new.html

New Android Malware 'FluHorse' Targeting East Asian Markets with Deceptive Tactics
https://thehackernews.com/2023/05/new-android-malware-fluhorse-targeting.html

CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine
https://thehackernews.com/2023/05/cert-ua-warns-of-smokeloader-and.html

New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets
https://thehackernews.com/2023/04/new-atomic-macos-stealer-can-steal-your.html

New Ransomware Strain 'CACTUS' Exploits VPN Flaws to Infiltrate Networks
https://thehackernews.com/2023/05/new-ransomware-strain-cactus-exploits.html

SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations
https://thehackernews.com/2023/05/sidecopy-using-action-rat-and-allakore.html

Andoryu Botnet Exploits Critical Ruckus Wireless Flaw for Widespread Attack
https://thehackernews.com/2023/05/andoryu-botnet-exploits-critical-ruckus.html

Bl00dy Ransomware Gang Strikes Education Sector with Critical PaperCut Vulnerability
https://thehackernews.com/2023/05/bl00dy-ransomware-gang-strikes.html

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Operation ChattyGoblin: Hackers Targeting Gambling Firms via Chat Apps
https://thehackernews.com/2023/05/operation-chattygoblin-hackers.html

Twitter Finally Rolling Out Encrypted Direct Messages — Starting with Verified Users
https://thehackernews.com/2023/05/twitter-finally-rolling-out-encrypted.html

實體SIM卡消失?蘋果iPhone15擬擴大導入 恐藏資安風險?專家這麼說
https://www.youtube.com/watch?v=Ya5vaOq5DcM

WhatsApp會偷聽？ 杜奕瑾分析現代人資安意識
https://news.ltn.com.tw/news/life/breakingnews/4296623

5G Castle 資安協作聯盟成立　產官學攜手打造5G資安服務生態系
https://www.storm.mg/localarticle/4789196

是否有人在追蹤你的 Android 手機？7 個跡象見端倪
https://www.kocpc.com.tw/archives/491213

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
GDDA提八大對策降低資安風險
https://ctee.com.tw/industrynews/technology/859456.html

關鍵資安：企業展現韌性是追求永續的必要布局
https://www.gvm.com.tw/article/102493

臺灣近四分之一企業2022年遭遇50次重大資安事故
https://www.ithome.com.tw/article/156844

資安業者Dragos證實遭遇資安事故，駭客企圖入侵其網路環境並進行勒索
https://www.dragos.com/blog/deconstructing-a-cybersecurity-event/

專門鎖定中文 Windows 用戶！運用雙重 DLL Sideloading 手法的 APT 駭客組織來襲
https://technews.tw/2023/05/12/hackers-start-using-double-dll-sideloading-to-evade-detection/

駭入多位重量級政商名流推特 英23歲男認罪
https://www.cna.com.tw/news/aopl/202305100170.aspx

英國政府承包商Capita遭黑客攻擊的損失額達2000萬英鎊
https://big5.sputniknews.cn/20230510/1050208004.html

背骨工程師出賣飛宏被抓包　查他筆電才知台達電被偷慘了
https://www.mirrormedia.mg/story/20230509inv002/

台達電飛宏爆重大間諜案　特斯拉充電樁機密流向中國
https://www.mirrormedia.mg/premium/20230509inv005

頂規防火牆擋不住龐大利益　內鬼師徒拷走極密資料高超手法曝光
https://www.mirrormedia.mg/story/20230509inv003/

中國重賞之下叛徒多　盤點台籍商業間諜超離譜行徑
https://www.mirrormedia.mg/story/20230509inv004/

美國前國土安全部長Janet Napolitano：我們無法消除資安威脅，但可減輕風險
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10461

微星MSI韌體金鑰遭洩露，上百款產品受影響
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10456

反間諜法擴張 中國觀察家籲台灣辦資安培訓
https://www.rti.org.tw/news/view/id/2167469

ASPI：中國滲透海外社群媒體 操弄全球輿論
https://www.rti.org.tw/news/view/id/2167399

深度專題｜「蜜獾行動」揭密（上）：一張螢幕截圖泄露中國隱密的輿論操作
https://www.rfa.org/cantonese/news/factcheck/factcheck-05112023084329.html

【香港法庭】男子涉網上發布煽惑他人殺法官及播毒言論　認三項煽惑罪判囚11個月
https://www.rfa.org/cantonese/news/htm/hkcourt/hk-court-05122023081146.html

富察在中國失聯超過50天　台文化界勸告不要進中港澳
https://www.rfa.org/cantonese/news/htm/tw-fu-05122023043428.html

不再「蛇」行 美調查局截斷俄國數位間諜行動
https://def.ltn.com.tw/article/breakingnews/4298198

烏克蘭政府單位遭駭侵者以假冒 Windows Update 指南發動攻擊
https://www.twcert.org.tw/tw/cp-104-7094-e0501-1.html

美國白宮花費1.4億成立國家人工智慧研究機構，減少人工智慧技術的潛在危害
https://www.techbang.com/posts/106051-white-house-ai

中國反制加拿大　要求加國駐上海總領事甄逸慧限期離境
https://news.tvbs.com.tw/world/2118355

Google在臺揭露烏克蘭戰爭背後的網路威脅態勢，有更多國家與個人也成目標，遠超傳統戰爭邊界
https://www.ithome.com.tw/news/156827

俄羅斯駭客Sandworm利用WinRAR解壓縮軟體、dd應用程式，對Windows及Linux電腦進行資料破壞攻擊
https://www.bleepingcomputer.com/news/security/russian-hackers-use-winrar-to-wipe-ukraine-state-agencys-data/

日本法務省所屬網站遭到癱瘓，起因是該國政府通過與難民有關法案的修正案惹議
https://www3.nhk.or.jp/news/html/20230509/k10014061071000.html

伊朗駭客傳出也針對列印管理系統PaperCut漏洞攻擊
https://twitter.com/MsftSecIntel/status/1654610012457648129

MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web
https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html

Sophos X-Ops 發現東南亞地區線上博弈玩家遭受進階型攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10447

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry
https://thehackernews.com/2023/05/dragon-breath-apt-group-using-double.html

N. Korean Kimsuky Hackers Using New Recon Tool ReconShark in Latest Cyberattacks
https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html

Mastermind Behind Twitter 2020 Hack Pleads Guilty and Faces up to 70 Years in Prison
https://thehackernews.com/2023/05/mastermind-behind-twitter-2020-hack.html

U.S. Government Neutralizes Russia's Most Sophisticated Snake Cyber Espionage Tool
https://thehackernews.com/2023/05/us-government-neutralizes-russias-most.html

美國扣押13個被用於提供DDoS服務的網域
https://www.justice.gov/usao-cdca/pr/federal-authorities-seize-13-internet-domains-associated-booter-websites-offered-ddos

U.S. Authorities Seize 13 Domains Offering Criminal DDoS-for-Hire Services
https://thehackernews.com/2023/05/us-authorities-seize-13-domains.html

New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe
https://thehackernews.com/2023/05/new-apt-group-red-stinger-targets.html

Spanish Police Takes Down Massive Cybercrime Ring, 40 Arrested
https://thehackernews.com/2023/05/spanish-police-takes-down-massive.html

資訊安全產品技術支援助理工程師【桃園】
https://www.104.com.tw/job/7xa17?jobsource=m104

資安工程師_12379
https://www.104.com.tw/job/7zq0n?jobsource=googlejobs

【資訊安全處/資安部 資安技術課】高級/資深工程師
https://www.104.com.tw/job/7j75u?jobsource=m104

網路資安工程師
https://www.104.com.tw/job/7zm7c?jobsource=googlejobs

資安科科主管 | F000007902
https://www.104.com.tw/job/7zl1h?jobsource=googlejobs

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
New phishing-as-a-service tool “Greatness” already seen in the wild
https://blog.talosintelligence.com/new-phishing-as-a-service-tool-greatness-already-seen-in-the-wild/
https://github.com/Cisco-Talos/IOCs/blob/main/2023/04/new-phishing-as-a-service-tool-greatness-already-seen-in-the-wild.txt

WD證實四月份資安事件確為勒索軟體組織駭入竊取客戶資料
https://netmag.tw/2023/05/10/wd-confirms-ransomware-organization-stole-customer

Western Digital Confirms Customer Data Stolen by Hackers in March Breach
https://thehackernews.com/2023/05/western-digital-confirms-customer-data.html

近半數主管懷疑員工可能洩露公司機密給 ChatGPT
https://finance.technews.tw/2023/05/12/almost-half-executive-suspect-data-risk/

詐騙盯上旅遊業 消費者小心個資被竊
https://www.1111.com.tw/news/jobns/151335

詐騙新手法增加！網路釣魚竊個資盯上「旅遊業」
https://today.line.me/tw/v2/article/RBywxyM

預防釣魚詐騙救星！ Whoscall「檢查連結」新功能登場
https://ahui3c.com/129366/whoscall0510

趨勢科技揭駭客四大釣餌 母親節不「瞎」拚
https://www.chinatimes.com/realtimenews/20230511002612-260410?chdtv

叫車資訊攏知! 男接「假小黃平台」詐騙解除扣款
https://www.youtube.com/watch?v=VFrVgbEEu4Y

黑客針對亞洲用家發出釣魚攻擊，無數 Chrome 用家伏已中
https://lihkg.com/thread/3386478/page/1

惡意造假訊息增添土耳其大選黑暗面 反對派指俄涉入
https://www.cna.com.tw/news/aopl/202305120244.aspx

西班牙警方破獲釣魚攻擊犯罪集團，共逮捕 40 人
https://www.twcert.org.tw/tw/cp-104-7119-7c11f-1.html

新出現的「Greatness」釣魚攻擊服務，簡化 Microsoft 365 釣魚攻擊流程
https://www.twcert.org.tw/tw/cp-104-7117-2e9ff-1.html

全球各地發生多起以假 QR Code 問卷、停車票卡竊取受害者資金事件
https://www.twcert.org.tw/tw/cp-104-7108-c6208-1.html

QR Code詐騙再現，新加坡民眾被騙走2萬美元
https://www.straitstimes.com/singapore/woman-who-scanned-qr-code-with-malware-lost-20k-to-bubble-tea-survey-scam-while-she-was-sleeping

個資外洩案 調局：FBI抓的是駭客論壇站長
https://udn.com/news/story/6656/7154165

Google將提供用戶搜尋可能流入暗網的個人資訊
https://blog.google/products/google-one/new-security-features-for-all-google-one-plans/

美國食品經銷商Sysco經歷網路攻擊，已造成資料外洩
https://www.bleepingcomputer.com/news/security/food-distribution-giant-sysco-warns-of-data-breach-after-cyberattack/

推特再傳資安事故，用戶私密推文曝光
https://www.bleepingcomputer.com/news/security/twitter-says-security-incident-exposed-private-circle-tweets/

E.研究報告/工具
Lack of Visibility: The Challenge of Protecting Websites from Third-Party Scripts
https://thehackernews.com/2023/05/lack-of-visibility-challenge-of.html

How to Set Up a Threat Hunting and Threat Intelligence Program
https://thehackernews.com/2023/05/how-to-set-up-threat-hunting-and-threat.html

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection
https://thehackernews.com/2023/05/researchers-uncover-new-exploit-for.html

Researchers Uncover SideWinder's Latest Server-Based Polymorphism Technique
https://thehackernews.com/2023/05/researchers-uncover-sidewinders-latest.html

Why Honeytokens Are the Future of Intrusion Detection
https://thehackernews.com/2023/05/why-honeytokens-are-future-of-intrusion.html

Product Security: Harnessing the Collective Experience and Collaborative Tools in DevSecOps
https://thehackernews.com/2023/05/strengthening-product-security.html

How Attack Surface Management Supports Continuous Threat Exposure Management
https://thehackernews.com/2023/05/how-attack-surface-management-supports.html

防範密碼與API金鑰洩漏，GitHub將推送保護功能免費提供給公開儲存庫
https://github.blog/2023-05-09-push-protection-is-generally-available-and-free-for-all-public-repositories/

GitHub Extends Push Protection to Prevent Accidental Leaks of Keys and Other Secrets
https://thehackernews.com/2023/05/github-extends-push-protection-to.html

Solving Your Teams Secure Collaboration Challenges
https://thehackernews.com/2023/05/solving-your-teams-secure-collaboration.html

資安界必知　五大駭客破解密碼手法全公開
https://www.technice.com.tw/cloudtech/infosecurity/52418/

以HTML5和WebAssembly實作JVM，CheerpJ 3.0讓瀏覽器順暢執行Java程式
https://www.ithome.com.tw/news/156843

F.商業
九成企業偏好採用單一雲端資安平台，簡化配置管理複雜度
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10449

零信任資安三大阻礙，應已「風險管理」取代合規思維
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10453

F5安全多雲網路方案簡化分散式應用部署的運作
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10446

Google Announces New Privacy, Safety, and Security Features Across Its Services
https://thehackernews.com/2023/05/google-announces-new-privacy-safety-and.html

Google推動「密碼金鑰」 邁向「無密碼」未來
https://www.ntdtv.com/b5/2023/05/11/a103709531.html

遠傳、淡江深化合作 三年培育上百資安人才
https://udn.com/news/story/7240/7161175

大宇資集團強攻印度市場再下一城　旗下安瑞宣布結盟偉康
https://finance.ettoday.net/news/2495750

資安大會 電信三雄展研發實力
https://ctee.com.tw/news/tech/859492.html

三甲科技首創「社交神盾」資安平台
https://money.udn.com/money/story/10860/7153612

臺灣資安大會開展 台灣大反詐戰警偵測偽冒網站
https://reurl.cc/xlnprZ

為強化容器安全，Google開源Bazel外掛程式
https://security.googleblog.com/2023/05/introducing-rulesoci.html

為防範用戶受騙，瀏覽器業者Mozilla買下AI服務評價驗證服務商Fakespot
https://blog.mozilla.org/en/mozilla/fakespot-joins-mozilla-firefox-shopping-announcement/

G.政府
推動區域資安聯防 台中數位局攜手彰投雲竹培訓資安人才
https://www.taichung.gov.tw/2353036/post

中台灣區域治理平台8縣市 推動區域資安保護網
https://reurl.cc/d761o8

政院月底檢討道安 成立「打詐辦公室」
https://anntw.com/articles/20230511-NPQj

公部門未禁用ChatGPT　唐鳳建議2大原則防個資外洩
https://www.upmedia.mg/news_info.php?Type=24&SerialNo=172426

賴清德接見美國前國土安全部長 聚焦網路安全
https://www.cna.com.tw/news/aipl/202305110321.aspx

藍委：美偵破台個資被駭案 我未聯繫
https://udn.com/news/story/6656/7154148

賴清德：資安人員要有守護國家的信念
https://newtalk.tw/news/view/2023-05-10/870472

賴清德：台灣資安具發展優勢 盼第一線抗網路攻擊
https://www.rti.org.tw/news/view/id/2167280

〈政來經去〉「資安國家隊」應盡速拿出具體績效
https://anntw.com/articles/20230510-qhPW

報稅季強化資安 財政部：24小時跨部會監控聯防
https://reurl.cc/pLO9jb

數位身分證恐洩個資 數發部：待獨立機關檢核
https://anntw.com/articles/20230511-dzqF

報稅期間資安防護 財政部七招因應
https://udn.com/news/story/121041/7157510

數位身分證重啟？ 唐鳳：關鍵在T-Road及獨立專責機關
https://www.rti.org.tw/news/view/id/2167398

蔡總統：各界攜手合作 建立資安國家隊
https://www.ydn.com.tw/news/newsInsidePage?chapterID=1585417&type=highlight

總統五度蒞臨臺灣資安大會致詞，強調「資安好、臺灣產業才會更好」
https://www.ithome.com.tw/news/156792

民團為數位身分證提告內政部 北高行判決「駁回」理由曝光
https://news.ltn.com.tw/news/society/breakingnews/4298130

海軍前士官長當駭客侵入自家系統 軍方：將加強教育
https://www.chinatimes.com/realtimenews/20230510002443-260402?chdtv

因政府開放電子病歷上雲，醫療產業連續2年加碼投資資安，2023增加4成
https://www.ithome.com.tw/article/156845

資安競賽「尋找資安女婕思」進入決賽，臺北科技大學、逢引大學、中央大學、大同高中拿下分組冠軍
https://www.nstc.gov.tw/folksonomy/detail/3e435b56-1ec0-4d57-8d48-45c45717d6df

臺灣高等檢察署查緝詐欺及資通犯罪督導中心揭牌，行政院長指示4大打詐面向
https://www.ey.gov.tw/Page/9277F759E41CCD91/10355997-9c41-4b4b-97f1-57110206a085

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
Colonial Pipeline事件兩年後: 關鍵基礎設施的資安仍任重道遠
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10455

智慧家電互通性檢測驗證服務暨電動車充電樁資安測試
https://etc.org.tw/%E6%96%B0%E8%81%9E%E4%B8%AD%E5%BF%83/%E6%AA%A2%E6%B8%AC%E9%A9%97%E8%AD%89%E5%B0%88%E5%8D%80/%E6%99%BA%E6%85%A7%E5%AE%B6%E9%9B%BB%E4%BA%92%E9%80%9A%E6%80%A7%E6%AA%A2%E6%B8%AC%E9%A9%97%E8%AD%89%E6%9C%8D%E5%8B%99%E6%9A%A8%E9%9B%BB%E5%8B%95%E8%BB%8A%E5%85%85%E9%9B%BB%E6%A8%81%E8%B3%87%E5%AE%89%E6%B8%AC%E8%A9%A6.aspx

寶寶監視器半夜出「怪聲」跟兒子聊天 父母嚇壞急追原因
https://udn.com/news/story/6810/7156560

Orqa無人機護目鏡傳出故障，起因是前合作廠商埋藏的「定時炸彈」
https://orqafpv.com/blog-details/bricking-incident-public-announcement

西門子、施耐德電機發布5月例行更新
https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-address-few-dozen-vulnerabilities/

西門子遠端終端裝置存在漏洞，若不修補恐影響能源供應設施運作
https://www.securityweek.com/critical-siemens-rtu-vulnerability-could-allow-hackers-to-destabilize-power-grid/

Inea工控遠端終端機設備存在重大漏洞
https://www.cisa.gov/news-events/ics-advisories/icsa-23-110-01

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

6.近期資安活動及研討會
TWCC-CLI 進階操作- AI/ML 自動流程 2023/5/12
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4035&from_course_list_url=course_index

【實作體驗營】一日駭客x網路弱點滲透 2023/5/13
https://www.accupass.com/event/2303030820005796452650

借助現代分析實現數位轉型 2023/5/15 ~ 2023/5/16
https://mktoevents.com/Microsoft+Event/394032/157-GQE-382?wt.mc_id=AID3058384_QSG_EML_640909&wt.mc_id=AID3058380_EML_8317669

「衛生福利部醫療領域資通系統資安防護基準」推廣說明會 2023/5/16
https://www.beclass.com/rid=274b10b64350aa626f12

Elastic Security－ 檢測、調查和應對多變的威脅 2023/5/17
https://www.accupass.com/event/2304190909578502986500

上市櫃資安法規要求在即 企業如何掌握法遵與因應策略 2023/5/19
https://www.accupass.com/event/2304270202566389789600

Taipei dbt Meetup #11 (in-person 👫 & online 👨‍�2023/5/24
https://www.meetup.com/taipei-dbt-meetup/events/292891149/

Elixir meetup �2023/5/24
https://www.meetup.com/elixirtw-taipei/events/293147308/

資安五四三 2023/5/25 （線上14:00 - 15:30）
https://csa.kktix.cc/events/202305-543

鏈三上雲：資安解析峰會 掌握Web 3資安動向，開啟鏈雲新模式 2023/5/25
https://www.accupass.com/event/2304120730519814020340

《區塊鏈初階課程》平日班 2023/5/25~2023/5/26
https://www.accupass.com/event/2304100300531686137286

3小時帶你了解AWS雲端服務與優勢 2023/5/26
https://www.uuu.com.tw/Public/content/edm/20230526_AWSDiscoveryDay_BC.htm

《區塊鏈初階課程》假日班 2023/5/27~2023/5/28
https://www.accupass.com/event/2304100341503819251900

大型語言模型時代下，建置解決方案該有的姿勢/知識 (Building solutions with LLMs) 2023/5/29
https://www.meetup.com/rladies-taipei/events/293170581/

5月台北例會_美國聯邦政府的供應鏈資安管理－以CMMC為例 (採線上舉辦) 2023/5/30
https://www.caa.org.tw/newsdetail-16263.html

台灣數位創新領航論壇 Taiwan Digital Innovation Navigation Forum 2023/5/30
https://www.accupass.com/event/2304240303341594373938

Azure AI 基礎知識 2023/5/31
https://mktoevents.com/Microsoft+Event/393899/157-GQE-382?wt.mc_id=AID3058385_QSG_EML_640902&wt.mc_id=AID3058380_EML_8317669

【Monosparta】②⓪②③ 第二梯次 軟體開發實戰訓練營➠線上說明會 2023/5/31 ~ 2023/6/28
https://trunk-studio.kktix.cc/events/monosparta-202307

資安分析新手村：掌握網路封包分析技術（線上課程） 2023/6/13
https://forms.gle/msePzws5GtcDunrc7

資安分析新手村：掌握網路封包分析技術（實體課程）2023/6/14
https://forms.gle/mtpZNPCpTVyv97Dr9

黑客視角：網站漏洞挖掘與防禦 ( 線上課程) 2023/6/27
https://forms.gle/JpThJxMgxZd3uNh39

黑客視角：網站漏洞挖掘與防禦 ( 實體課程) 2023/6/28
https://forms.gle/qQAqx8KZzzntSyLd9

COSCUP 2023 2023/07/29 ~ 2023/07/30
https://coscup.org/2023/zh-TW/landing

InfoSec Taiwan 2023 國際資安大會 2023/8/1 ~ 2023/8/3
https://csa.kktix.cc/events/infosectaiwan2023

DEF CON 32 2023/8/10 ~ 2023/8/13
https://defcon.org/index.html

HITCON CMT 2023 2023/08/18 ~ 2023/08/19
https://hitcon.org/2023/CMT/

PyCon TW 2023 2023/9/2 ~ 2023/9/3
https://tw.pycon.org/2023/zh-hant/registration/tickets

Hou.Sec.Con 2023/10/12 ~ 2023/10/13
https://web.cvent.com/event/76d46ccb-fe00-4fe5-ba46-e4a77c807f21/summary

(ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27
https://www.isc2.org/Congress-2023