###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2022/10/24 ~ 2022/10/28

1.重大弱點漏洞/後門/Exploit/Zero Day
Cisco 近日發布更新以解決Identity Services Engine的安全性弱點
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/21/cisco-releases-security-update-cisco-identity-services-engine

Hackers Actively Exploiting Cisco AnyConnect and GIGABYTE Drivers Vulnerabilities
https://thehackernews.com/2022/10/hackers-actively-exploiting-cisco.html

思科兩年前修補的AnyConnect漏洞被用於實際攻擊行動
https://www.ithome.com.tw/news/153829

臺灣資安人員揭露微軟Exchange漏洞ProxyRelay細節
https://blog.orange.tw/2022/10/proxyrelay-a-new-attack-surface-on-ms-exchange-part-4.html

MoTW零時差漏洞可讓惡意JavaScript指令碼繞過Windows內建的安全檢查機制
https://www.bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings/

VMware修補Cloud Foundation重大RCE漏洞
https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-cloud-foundation-remote-code-execution-bug/

VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform
https://thehackernews.com/2022/10/vmware-releases-patch-for-critical-rce.html

Hackers Started Exploiting Critical "Text4Shell" Apache Commons Text Vulnerability
https://thehackernews.com/2022/10/hackers-started-exploiting-critical.html

22-Year-Old Vulnerability Reported in Widely Used SQLite Database Library
https://thehackernews.com/2022/10/22-year-old-vulnerability-reported-in.html

Acer Altos W2000h-W570h F4 CVE-2022-41415
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41415

apache dubbo hessian-lite 3.2.12及之前版本 CVE-2022-39198
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-39198

asusswitch CVE-2022-36438
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-36438

avira_security CVE-2022-3368
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-3368

f5 big-ip_access_policy_manager
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41624

f5 big-ip_advanced_firewall_manager
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41806

f5 big-ip_application_security_manager
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41691
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41617

f5 big-ip_local_traffic_manager
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41787

f5 nginx_plus
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41743

fortinet fortios
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-29055

fortinet fortiswitchmanager
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-40684

fortinet fortitester
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-33872
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-33873
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-33874
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-35846
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-35844

juniper junos
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22246
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22251
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22201
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22218
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22223
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22228
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22231
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22232
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22235
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22236

junos_os_evolved
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22239
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22192
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22211
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22247
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22248

junos paragon_active_assurance_control_center
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22229

mozilla network_security_services
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-3479

Google發布Chrome 107，修補14個漏洞
https://www.securityweek.com/google-pays-out-over-50000-vulnerabilities-patched-chrome-107

Google Issues Urgent Chrome Update to Patch Actively Exploited Zero-Day Vulnerability
https://thehackernews.com/2022/10/google-issues-urgent-chrome-update-to.html

oracle access_manager
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-39412

oracle bi_publisher
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21590

oracle database
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21596

oracle database_-_sharding
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21603

oracle e-business_suite
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21587

oracle enterprise_data_quality
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21613
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21612
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21614
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21615

oracle enterprise_manager_base_platform
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21623

oracle graalvm
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21634

oracle http_server
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21593

oracle mysql
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-21600

oracle peoplesoft_enterprise_common_components
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-39406

Samba 產品存在多個安全性弱點
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/26/samba-releases-security-updates

資料庫程式庫SQLite修補存在達22年的高風險漏洞
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/

開源加密程式庫OpenSSL預告修補重大漏洞
https://www.securityweek.com/openssl-patch-first-critical-vulnerability-2016

Adobe家庭安全套件存在重大漏洞，攻擊者可掌控視訊鏡頭或遠端停用
https://blog.talosintelligence.com/vuln-spotlight-abode/

2.銀行/金融/保險/證券/支付系統/金融監理 新聞及資安
金融資安行動方案重要措施及成效
https://reurl.cc/GXklo3

資安防護 金融業應加強演練
https://ec.ltn.com.tw/article/paper/1547989

合庫銀行攜手偉康科技 打造便民金融FIDO 開拓創新金融新版圖
https://www.winnews.com.tw/97208/

金融科技展登場 黃天牧：要服務更多底端民眾
https://www.ttv.com.tw/finance/view/?i=102022281332F0F9343DF8304F7F82C118476994E81C5B2E&from=587

安聯人壽攜手遠東商銀 推出全台業界第一全Web介面
https://www.chinatimes.com/realtimenews/20221028003205-260410?chdtv

FinTech要看到「金字塔底端」！　金管會：否則只是創造更多有錢人
https://finance.ettoday.net/news/2367974

手機門號轉帳怎麼用？30 家銀行開通整理，轉帳再送萬元現金
https://reurl.cc/LX1ZeL

中華郵政數位金融服務 再升級
https://wantrich.chinatimes.com/news/20221027900177-420501

北富銀智能防詐再升級、無紙化節費破億
https://reurl.cc/Wq4VWL

聯卡中心董座換人 劉燈城11月退休 張雲鵬接任
https://reurl.cc/Z1nzMM

3.電子支付/行動支付/pay/資安
第三方支付業者涉洗錢 調查局約談4人送辦
https://taronews.tw/2022/10/27/869776/

首宗第三方支付涉洗錢70億 不法獲利3億 27人被訴
https://ec.ltn.com.tw/article/breakingnews/4103316

「全盈+PAY」跨機構轉帳年底上線，銀行、電支帳戶皆能一鍵轉帳
https://technews.tw/2022/10/27/pluspay-2022-10-27/

全支付會員數「200萬」達標！　下一步挑戰電支買基金
https://finance.ettoday.net/news/2364167#ixzz7j1IbITeR

玉山銀攜全盈支付創新生態圈商業模式 獲台北金融科技共創典範獎
https://udn.com/news/story/7239/6722736

電支武林高手輩出！零售業跨入支付大戰，虧錢也要拚龍頭
https://technews.tw/2022/10/01/retail-enters-payment-wars/

「朋友拒電子支付還不自備零錢」他怨去結帳的人超衰 兩派論戰吵翻天
https://reurl.cc/ymylK2

金融科技展婆婆媽媽必逛區！好好證券攜手全支付大撒全支付點數
https://www.chinatimes.com/realtimenews/20221028003890-260410?chdtv

一卡通擘劃數據賦能 推動數位轉型及服務優化
https://reurl.cc/Wq4Vb9

電子支付攻生活繳費 磁吸用戶
https://ctee.com.tw/wealth/729015.html

支付龍頭Visa創新轉型走什麼策略? 專訪Visa大中華區總裁于雪莉
https://www.bnext.com.tw/article/72309/visa202210

街口支付新總經理范庭甄升任 擬深化金融業合作
https://today.line.me/tw/v2/article/RBnGBNz

連手機都懶得拿 英國男子花1.2萬在手背植入行動支付晶片
https://reurl.cc/EXKaW0

LINE Pay拓展新場景 Audi新車下訂也可用行動支付
https://udn.com/news/story/7239/6659096

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Critical Flaw Reported in Move Virtual Machine Powering the Aptos Blockchain Network
https://thehackernews.com/2022/10/critical-flaw-reported-in-move-virtual.html

加密駭客在2022年的三個季度內盜取了超過25億美元
https://news.cnyes.com/news/id/4989040

BitMEX 創辦人：香港成為加密朝聖地，預示牛市回歸
https://blockcast.it/2022/10/27/for-some-reason-hong-kong-wants-crypto-back/

慎防釣魚！加密偵探ZachXBT：”Monkey Drainer” 已竊盜100萬鎂ETH、含1 BAYC
https://www.blocktempo.com/monkey-drainer-scammer-sole-700-eth/

BitKeep：目前已完成99%的賠付工作，駭客72小時內未歸還資金將訴諸法律
https://news.cnyes.com/news/id/4989838

安全團隊：TrustSwap項目遭受駭客攻擊，影響金額至少約779萬美元
https://news.cnyes.com/news/id/4990207

派盾：多鏈錢包UvToken遭遇攻擊，駭客獲利約150萬美元
https://amp-news.cnyes.com/news/id/4989836

報告：2022年Q3區塊鏈領域主要攻擊事件超37起，總損失約4億504萬美元
https://news.cnyes.com/news/id/4990825

Beosin：EthTeamFinance項目遭受到了漏洞攻擊事件簡析
https://news.cnyes.com/news/id/4990322

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Venus Ransomware 針對公開暴露的遠端桌面服務
https://www.bleepingcomputer.com/news/security/venus-ransomware-targets-publicly-exposed-remote-desktop-services/

新勒索軟體Royal透過客服電話入侵電腦
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10135

含有漏洞的技嘉驅動程式遭到利用，駭客發動勒索軟體攻擊
https://www.ithome.com.tw/news/153827

巴基斯坦組織遭駭客SideWinder鎖定，利用WarHawk後門程式發動攻擊
https://www.zscaler.com/blogs/security-research/warhawk-new-backdoor-arsenal-sidewinder-apt-group-0

近5千個GitHub儲存庫被用於存放假的概念性驗證攻擊程式，成散布惡意軟體溫床
https://arxiv.org/abs/2210.08374

殭屍網路病毒Emotet透過自解RAR壓縮檔散布
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/archive-sidestepping-self-unlocking-password-protected-rar/

又有駭客使用外洩的勒索軟體LockBit產生器犯案！研究人員揭露勒索軟體TommyLeaks、SchoolBoys
https://www.bleepingcomputer.com/news/security/tommyleaks-and-schoolboys-two-sides-of-the-same-ransomware-gang/

惡意Chrome擴充套件Dormant Colors挾持瀏覽器，載入惡意指令碼
https://guardiosecurity.medium.com/dormant-colors-live-campaign-with-over-1m-data-stealing-extensions-installed-9a9a459b5849

烏克蘭政府機關遭勒索軟體Cuba鎖定
https://www.bleepingcomputer.com/news/security/cuba-ransomware-affiliate-targets-ukrainian-govt-agencies/

英國汽車經銷商Pendragon遭勒索軟體LockBit攻擊
https://www.bleepingcomputer.com/news/security/pendragon-car-dealer-refuses-60-million-lockbit-ransomware-demand/

LV勒索軟體利用ProxyShell漏洞入侵約旦組織
https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html

美國學校遭到駭客組織Vice Society鎖定，被植入多種勒索軟體
https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/

為防範自帶驅動程式攻擊，微軟修正Windows驅動程式黑名單同步問題
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/

駭客佯稱提供知名應用程式，引誘Windows、Android使用者下載，目的是散布多種惡意軟體
https://blog.cyble.com/2022/10/18/ermac-android-malware-increasingly-active/

澳洲臨床實驗室ACL遭勒索軟體攻擊，12.8萬人資料外洩
https://www.bleepingcomputer.com/news/security/australian-clinical-labs-says-patient-data-stolen-in-ransomware-attack/

LV Ransomware Exploits ProxyShell in Attack on a Jordan-based Company
https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html

Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware

Unattributed RomCom Threat Actor Spoofing Popular Apps Now Hits Ukrainian Militaries
https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries

Broken Dreams and Piggy Banks: Pig Butchering Crypto Fraud Growing Online
https://www.proofpoint.com/us/blog/threat-insight/broken-dreams-and-piggy-banks-pig-butchering-crypto-fraud-growing-online

#StopRansomware: Daixin Team
https://www.cisa.gov/uscert/ncas/alerts/aa22-294a

Ransomware: Open Source to the Rescue
https://thehackernews.com/2022/10/ransomware-open-source-to-rescue.html

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/

Vice Society Hackers Are Behind Several Ransomware Attacks Against Education Sector
https://thehackernews.com/2022/10/vice-society-hackers-are-behind-several.html

Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop Malware
https://thehackernews.com/2022/10/emotet-botnet-distributing-self.html

Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware
https://thehackernews.com/2022/10/multiple-campaigns-exploit-vmware.html

Hive Ransomware Hackers Begin Leaking Data Stolen from Tata Power Energy Company
https://thehackernews.com/2022/10/hive-ransomware-hackers-begin-leaking.html

SideWinder APT Using New WarHawk Backdoor to Target Entities in Pakistan
https://thehackernews.com/2022/10/sidewinder-apt-using-new-warhawk.html

CISA Warns of Daixin Team Hackers Targeting Health Organizations With Ransomware
https://thehackernews.com/2022/10/cisa-warns-of-daixin-team-hackers.html

Why Ransomware in Education on the Rise and What That Means for 2023
https://thehackernews.com/2022/10/why-ransomware-in-education-on-rise-and.html

Surtr ransomware is being distributed in Korea
https://asec.ahnlab.com/ko/40925/

Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers
https://reurl.cc/284vyX

Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cranefly-new-tools-technique-geppei-danfuan

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
Apple iOS and macOS Flaw Could've Let Apps Eavesdrop on Your Conversations with Siri
https://thehackernews.com/2022/10/apple-ios-and-macos-flaw-couldve-let.html

蘋果修補已被用於攻擊的iOS零時差漏洞CVE-2022-42827
https://www.bleepingcomputer.com/news/apple/apple-fixes-new-zero-day-used-in-attacks-against-iphones-ipads/

16款廣告點擊惡意App被下載超過2千萬次
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-malicious-clicker-found-in-apps-installed-by-20m-users/

蘋果系統更新日！macOS Ventura、iOS 16.1 修補上百項漏洞
https://reurl.cc/EXKDqK

快更新！46款iPhone、iPad藏漏洞 駭客恐入侵
https://reurl.cc/rZlnxy

蘋果發布macOS Ventura 13大改版，修補112個漏洞
https://www.securityweek.com/apple-patches-over-100-vulnerabilities-release-macos-ventura-13

為避免使用者送修手機資料外流，三星推出「維修模式」
https://news.samsung.com/global/samsung-releases-maintenance-mode-a-new-feature-to-hide-your-personal-information-from-prying-eyes

一個通訊軟體失火，讓整個南韓癱瘓4天！Kakao之亂是什麼？對韓國人有多重要
https://www.bnext.com.tw/article/72212/kakao-service-disruption

These Dropper Apps On Play Store Targeting Over 200 Banking and Cryptocurrency Wallets
https://thehackernews.com/2022/10/these-dropper-apps-on-play-store.html

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
Uber被駭客入侵後進而調查網路安全事件
https://blog.twnic.tw/2022/10/27/24691/

《紐約郵報》網站和Twitter賬戶被黑
https://reurl.cc/EXKanA

《紐約郵報》網頁被駭？原來是內部員工所為
https://www.epochtimes.com/b5/22/10/28/n13854395.htm

程式碼代管服務GitHub、Heroku、Buddy遭到濫用，被用於挖礦
https://sysdig.com/blog/massive-cryptomining-operation-github-actions/

Kiss-a-Dog攻擊行動鎖定存在漏洞的Docker與K8s而來
https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/

生物辨識將成元宇宙資安罩門，恐衍生各種犯罪行為
https://technews.tw/2022/10/27/metaverse-security/

生物辨識登入技術可能存在資安風險
https://www.moneydj.com/kmdj/news/newsviewer.aspx?a=2ae0aa1b-0af6-493d-91f9-c16b36d2681c

英國網路安全委員會推出試點計畫，培養國家資安專家
https://www.infosecurity-magazine.com/news/uk-cyber-security-council-1/

親中駭客Dragonbridge企圖透過假訊息操縱美國政局，並竄改新聞聲稱駭客組織APT41受美國政府指使發動攻擊
https://www.mandiant.com/resources/blog/prc-dragonbridge-influence-elections

伊朗審查網路鎮壓抗議 美對監獄官等人祭新制裁
https://newtalk.tw/news/view/2022-10-27/838298

報復以色列援烏 俄駭客網攻以國會網站
https://news.ltn.com.tw/news/world/breakingnews/4103569

研究人員：與中國有關聯的網絡水軍試圖在美國中期選舉前煽動分裂
https://reurl.cc/x1DkZ4

New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes Instances
https://thehackernews.com/2022/10/new-cryptojacking-campaign-targeting.html

Implementing Defense in Depth to Prevent and Mitigate Cyber Attacks
https://thehackernews.com/2022/10/implementing-defense-in-depth-to.html

Raspberry Robin Operators Selling Cybercriminals Access to Thousands of Endpoints
https://thehackernews.com/2022/10/raspberry-robin-operators-selling.html

資安管理師
https://www.104.com.tw/job/7c0oh?jobsource=m_job_same_b

高級資安分析師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=111046&HIRE_ID=11544889

資安助理諮詢人員
https://www.104.com.tw/job/7svap

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
戶政系統遭駭》民眾戶籍網上賣 鎖定宜蘭20萬筆 林姿妙個資全曝光
https://www.peoplenews.tw/articles/5f8b568f47

戶政系統遭駭》民眾戶籍網上賣 鎖定宜蘭20萬筆 林姿妙個資全曝光
https://reurl.cc/YdlQaX

台灣戶政資料遭駭！資料集中於宜蘭地區
https://www.inside.com.tw/article/29471-ris-hacked

2千3百萬臺灣民眾個資疑似流入駭客論壇兜售
https://www.peoplenews.tw/articles/5f8b568f47

Australian Health Insurer Medibank Suffers Breach Exposing 3.9 Million Customers' Data
https://thehackernews.com/2022/10/australian-health-insurer-medibank.html

澳洲 Medibank 資訊洩露事件升級，駭客公佈大量客戶資訊，升級勒索要求
https://vitomag.com/tech/uijrce.html

澳洲保險業者Medibank遭網攻，本週證實駭客已存取大部分客戶個資
https://www.bleepingcomputer.com/news/security/medibank-now-says-hackers-accessed-all-its-customers-personal-data/

澳1/3國民電信個資外洩 最大醫保又遇駭
https://news.ltn.com.tw/news/world/paper/1548096

印度大型電力公司Tata Power遭到網路攻擊，勒索軟體Hive宣稱是他們所為並洩露竊得資料
https://www.bleepingcomputer.com/news/security/hive-claims-ransomware-attack-on-tata-power-begins-leaking-data/

立委曝抖音外交部假帳號認知戰 吳釗燮：報警處理
https://www.epochtimes.com/b5/22/10/26/n13853378.htm

外交部進軍抖音？　吳釗燮：是假的、中國認知作戰伎倆
https://www.upmedia.mg/news_info.php?Type=24&SerialNo=157383

TikTok出現冒用部徽假帳號 外交部：嚴重混淆視聽 已請警政署調查
https://today.line.me/tw/v2/article/60jOxyv

第三季高風險賣場名單出爐，旋轉拍賣、鞋全家福、生活市集入榜
https://www.facebook.com/165bear/posts/pfbid02hmKviDfLjRJcoCjGnBZAm6ceiNgBYmPBAvoXxgB9ZWEzqMquEE7Sc6Sb8BMVG9sSl

美國CISA力挺無密碼身分認證機制FIDO
https://www.ithome.com.tw/news/153767

票券服務系統業者See Tickets證實存在2年半的資料外洩事件
https://www.bleepingcomputer.com/news/security/see-tickets-discloses-25-years-long-credit-card-theft-breach/

POS惡意軟體MajikPOS竊得16.7萬筆交易記錄
https://blog.group-ib.com/majikpos_treasurehunter_malware

DHL是今年第3季駭客最愛冒用的品牌
https://blog.checkpoint.com/2022/10/24/online-shoppers-beware-scammers-most-likely-to-impersonate-dhl/

商業媒體Fast Company遭駭客入侵的徵結點，竟是弱密碼pizza123
https://www.bleepingcomputer.com/news/security/how-the-pizza123-password-could-take-down-an-organization/

資安業者數聯資安遭到冒用，駭客假借資安審查的名義發動網釣攻擊
https://www.facebook.com/groups/rayforum/posts/5543651542381625/

國際旅遊組織遭到鎖定，駭客假借LinkedIn的名義發動網釣攻擊，並繞過Google Workspace郵件防護機制
https://www.armorblox.com/blog/linkedin-email-attack/

為改善假帳號氾濫的情況，LinkedIn祭出多項安全措施
https://blog.linkedin.com/2022/october/25/new-linkedin-profile-features-help-verify-identity--detect-and-r

美國新聞媒體紐約郵報證實遭駭，網站與推特帳號發布攻擊政治人物的標題
https://www.bleepingcomputer.com/news/security/new-york-post-hacked-with-offensive-headlines-targeting-politicians/

雲端通訊業者Twilio針對7月遭駭事件公布新的調查結果，駭客曾在6月底先發動語音網釣攻擊
https://www.bleepingcomputer.com/news/security/twilio-discloses-another-hack-from-june-blames-voice-phishing/

建築師偽冒簽名騙裝修許可 新北市府官僚不查還要民眾提告再說
https://times.hinet.net/news/24220855

資安小貼士：暗網出售網上二手交易平台外洩資料 用戶緊記提防釣魚攻擊
https://www.techritual.com/2022/10/28/340067/

E.研究報告/工具
保障醫療行業資訊安全，7個重點要關注
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10137

專訪：韌體大廠AMI翻轉企業治理架構，用 CISO管 CIO
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10129

新版ISO 27001:2022在10月25日正式出爐
https://www.iso.org/standard/82875.html

新版ISO 27001出爐 KPMG：標準不跟進 資安恐被搗蛋
https://udn.com/news/story/7240/6719038

網安攻防系列專題─水坑攻擊Watering hole
https://www.asfalisint.com/post/cybersecurity-series-watering-hole

委外評估應納供應鏈資安風險
https://view.ctee.com.tw/business/45787.html

居家上班都在摸魚？老闆對員工進行資安監控合法嗎？勞動律師解析
https://www.businesstoday.com.tw/article/category/183034/post/202210270046/

李維斌：將資安內化成組織文化的四種方法
https://www.ithome.com.tw/news/153857

Researchers Uncover Stealthy Techniques Used by Cranefly Espionage Hackers
https://thehackernews.com/2022/10/researchers-uncover-stealthy-techniques.html

The Four Phases of a Mobile Application Attack
https://www.guardsquare.com/blog/four-phases-of-a-mobile-application-attack?utm_medium=newsletter

A Quick Look at the "Strengthening America's Cybersecurity" Initiative
https://thehackernews.com/2022/10/a-quick-look-at-strengthening-americas.html

Free Dark Web Monitoring Stamps The $17 Million Credentials Markets
https://insecureweb.com/free-dark-web-monitoring-stamps-the-17-million-credentials-markets/

Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog
https://thehackernews.com/2022/10/researchers-detail-windows-event-log.html

How the Software Supply Chain Security is Threatened by Hackers
https://thehackernews.com/2022/10/how-software-supply-chain-security-is.html

Data Science Test: Price Elasticity in Python
https://medium.com/@Linguin1/data-science-test-ecommerce-price-elasticity-in-python-c3c07324e8f1

A Python library that makes it simple to forecast time series
https://levelup.gitconnected.com/a-python-library-that-makes-it-simple-to-forecast-time-series-6a403da71542

Interactive Webmap using Python
https://sbhadra019.medium.com/interactive-webmap-using-python-8b11ba2f5f0f

About Detection Engineering
https://cyb3rops.medium.com/about-detection-engineering-44d39e0755f0

JavaScript is not hard!! you are just not learning it the right way!!
https://medium.com/@wisdomjohnikoi/javascript-is-not-hard-you-are-just-not-learning-it-the-right-way-81a2b50e89fb

Data Scientist Job Salaries Analysis
https://medium.com/@nikhilpurao1998/data-scientist-job-salaries-analysis-f153717e2dbf

Why HTTP based Microservices is a BAD idea
https://shanira.medium.com/why-http-based-microservices-is-a-bad-idea-1175b0f54920

SQL Windows Functions Explained like you are 5!
https://hipiyushjain.medium.com/sql-windows-functions-explained-like-you-are-5-af6f034fa7d7

Python Script to Steal Credit Card And Browser-Saved Passwords
https://medium.com/@abwahab5095/python-script-to-steal-credit-card-and-browser-saved-passwords-ac6c9e99ed5f

How I Earned €150 in 2 Minutes | HTML injection in email
https://medium.com/@whitehatcyber404/how-i-earned-150-in-2-minutes-html-injection-in-email-3f26f27d3822

10 SQL Queries You Should Keep In Mind
https://pythonians.medium.com/10-sql-queries-you-should-keep-in-mind-33502328515

F.商業
為強化軟體供應鏈安全，Google啟動 GUAC 專案
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10138

Fortinet推出FortiMDR全中文化服務，台灣在地專業資安技術團隊親自監控調查
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10132

Red Hat 合作夥伴網擎資訊提供 CentOS 停止支援後解方
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10130

70%以上網攻始於端點設備！大世科整合端點安全防護讓混合工作模式下更安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10139

臺科大與Palo Alto Networks合作，透過防火牆設備實作練習培育相關資安人才
https://www.cna.com.tw/amp/news/ahel/202210250332.aspx

美國投顧公司Vista Equity Partners投入46億美元，買下資安教育訓練業者KnowBe4
https://investors.knowbe4.com/news-releases/news-release-details/knowbe4-be-acquired-vista-equity-partners-46-billion/

數位轉型引發「網路資安債」，CyberArk：身分安全管理不容忽視
https://technews.tw/2022/10/28/cyberark-identity/

立高科技有限公司成為Cymulate香港區代理 為本地市場提供自動化攻擊模擬及資安防禦能力驗證
https://money.udn.com/money/story/12987/6716423

45%企業剛開始身分安全治理！SailPoint 提企業身分安全計畫成熟度評估
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10142

緯謙獲數位轉型楷模獎 SaaS雲平台助企業加速轉型
https://www.sinotrade.com.tw/richclub/news/635a48951989be9be4942aca

沈柏延當選ASOCIO主席 助軟體、資服業拓展國際
https://wantrich.chinatimes.com/news/20221028900042-420301

G.政府
中共軍事威脅 顧立雄：台半導體生態系不可取代
https://ctee.com.tw/livenews/jj/ctee/A06668002022102620143942

為提升防疫URL的識別度，中央疫情指揮中心宣布採用數發部的短網址服務
https://www.cdc.gov.tw/Bulletin/Detail/oGThi1auOiVDKcRYQ1KhnQ?typeid=9

中國駭客潛在侵襲威脅 數位部資安人才卻爆爭議
https://reurl.cc/YdlQMn

數位部用人唯親 恐坐實養網軍惡名
https://reurl.cc/eW5Zvx

質疑用人狹隘搞小圈圈 立委批數發部人事任用有缺失
https://newtalk.tw/news/view/2022-10-27/838309

媒體與數位平台議價•唐鳳：調查產業損失試算彌補金　擬1個月內促成雙方對話
https://www.taiwannews.com.tw/ch/news/4699419

中鋼強化資安防護 與法務部調查局簽合作備忘錄
https://money.udn.com/money/story/5612/6722323?from=edn_newest_index

低軌衛星執照最快11月開放申請 中資不得涉入
https://news.pts.org.tw/article/606520

中國大疆無人機陷國安疑慮 吳政忠：須建立晶片資安檢測
https://www.epochtimes.com/b5/22/10/26/n13853259.htm

唐鳳：台灣首要任務打造可信任供應鏈助民主陣營
https://wantrich.chinatimes.com/news/20221027900877-420501

唐鳳盼台打造可信賴供應鏈 助民主夥伴迎戰網攻
https://ec.ltn.com.tw/article/breakingnews/4103839

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
D-Link DIR878
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-43184
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-20017

tp-link ax10_firmware
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41541

Learn any ML topic : 4-layered inverted onion approach
https://medium.com/@mukesh.kr/learn-any-ml-topic-4-layered-inverted-onion-approach-e49c06d387fc

Moxa EDR-G9010 結合 IPS 與 MXsecurity，打造OT 專用資安平台
https://www.informationsecurity.com.tw/article/article_detail_2021.aspx?aid=10127

軟體定義汽車帶來全新挑戰　先談資安才有大商機
https://reurl.cc/6LgkOd

晶片短缺，豐田只給一把智慧鑰匙！Toyota、Lexus受影響車款一次看
https://www.bnext.com.tw/article/72288/toyota-oct-range-nov-

縮短時間/降低難度　LoRa認證模組力助終端開發
https://www.2cm.com.tw/2cm/zh-tw/tech/5296BF2CD4B3497C99AB4B0539C73030?type=

第一線匯聚SASE與SD-WAN戰力 打造堅韌的雲端資安防線
https://www.digitimes.com.tw/iot/article.asp?id=0000647668_LZC5M1JF7HC1UP7JCLMGM

O-RAN實作研究，臺科大資工系教授鄭欣明：要小心3個資安威脅
https://times.hinet.net/mobile/news/24220885

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

我國網路資安狂被駭 監委申請自動調查
https://www.chinatimes.com/realtimenews/20220810003152-260407?chdtv

6.近期資安活動及研討會
資訊安全發展趨勢| 數位社會與資訊安全 - 董監事系列認證課程 2022/11/5
https://www.accupass.com/event/2208120843261385349231

TWCERT/CC 2022 台灣資安通報年會 2022/11/15
https://twcert.informationsecurity.com.tw/2022_annual_meeting.htm

微軟 DevDays Asia 2022 亞太技術年會 2022/11/15 ~ 2022/11/17
https://news.microsoft.com/zh-tw/devdays-asia-2022/

行動應用APP 安全檢測（APK/IPA）2022-11-18 09:00 ~ 2022-11-18 12:00
https://www.cisanet.org.tw/Course/Detail/2865

ICS 2022 WORKSHOP PROGRAM -「Ubiquitous Cybersecurity and Forensics」 2022/12/15 ~ 2022/12/17
https://ics2022.esam.io/

TANET 2022 WORKSHOP PROGRAM -「第二屆數位鑑識、醫療私密與網駭安全」 2022/12/15 ~ 2022/12/17
https://tanet2022.esam.io/