資安事件新聞週報 2023/5/1 ~ 2023/5/5

###### tags: `資安事件新聞週報` # 資安事件新聞週報 2023/5/1 ~ 2023/5/5 1.重大弱點漏洞/後門/Exploit/Zero Day 服務定位協定SLP漏洞恐被用於DDoS流量放大攻擊 https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected https://thehackernews.com/2023/05/active-exploitation-of-tp-link-apache.html CISA Issues Advisory on Critical RCE Affecting ME RTU Remote Terminal Units https://thehackernews.com/2023/05/cisa-issues-advisory-on-critical-rce.html Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model https://thehackernews.com/2023/05/cisco-warns-of-vulnerability-in-popular.html Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html 密碼管理系統1Password服務出現異常，該公司表示並非資安漏洞造成 https://www.bleepingcomputer.com/news/security/1password-explains-scary-secret-key-and-password-change-alerts/ 飯店業注意！有研究人員指出Oracle物業管理系統一項漏洞的風險被嚴重低估，應儘速修補 https://www.darkreading.com/application-security/hotels-at-risk-from-bug-in-oracle-property-management-software 思科警告SPA112電話轉接器含RCE漏洞，呼籲用用戶汰換產品至ATA 190系列 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20SPA112%202-Port%20Phone%20Adapters%20Remote%20Command%20Execution%20Vulnerability&vs_k=1 思科伺服器管理工具存在零時差漏洞，恐被用於跨網站指令碼攻擊 https://www.bleepingcomputer.com/news/security/cisco-discloses-xss-zero-day-flaw-in-server-management-tool/ 新版Chrome瀏覽器修補15個安全漏洞 https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html?m=1 邊界閘道協定軟體FRRouting出現漏洞，恐被用於發動阻斷服務攻擊 https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html 開源資料視覺化工具Apache Superset存在RCE漏洞，至少有2千臺伺服器曝險 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/ Google Cloud平臺存在漏洞GhostToken，恐導致用戶帳號遭到挾持 https://taiwan.googleblog.com/2023/04/HowWeFoughtBadApps2022.html 針對Google Authenticator加入的同步功能可能存在資安風險，該公司承諾將採用端對端加密改善 https://www.ithome.com.tw/news/156617 仲琦科技 Hitron CODA-5310 - Using default credentials https://www.twcert.org.tw/tw/cp-132-7085-13321-1.html 2.銀行/金融/保險/證券/金融監理新聞及資安 FIN7 tradecraft seen in attacks against Veeam backup servers https://labs.withsecure.com/publications/fin7-target-veeam-servers https://github.com/WithSecureLabs/iocs/blob/master/FIN7VEEAM/iocs.csv Attention Online Shoppers: Don't Be Fooled by Their Sleek, Modern Looks — It's Magecart! https://thehackernews.com/2023/04/attention-online-shoppers-dont-be.html LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads https://thehackernews.com/2023/05/lobshot-stealthy-financial-trojan-and.html Hackers Targeting Italian Corporate Banking Clients with New Web-Inject Toolkit DrIBAN https://thehackernews.com/2023/05/hackers-targeting-italian-corporate.html ImB涉高利假債權吸金金管會：若違法最重可處七年以上、5億元以下罰金 https://turnnewsapp.com/livenews/finance/A95645002023050217524153 im.B借貸平台爆詐騙　不在金管會監管範圍 https://www.cardu.com.tw/news/detail.php?48749 張志堅自行研發關鍵技術打造證券業聯發科 https://money.udn.com/money/story/122331/7137902 京城銀攜南市調查處強化資安防護 https://ww2.money-link.com.tw/RealtimeNews/NewsContent.aspx?SN=5148076001&PU=0010 刑事局轉戰台新銀行資安長！1年來最大挑戰是什麼？企業資安該怎麼推 https://reurl.cc/EGAGKk 支付金融看好前兩大拆轉帳、轉贈點數與開設數位帳戶 https://udn.com/news/story/7239/7142864 3.信用卡/電子支付/行動支付/pay/支付系統/資安電子商務網站遭挾持，被植入付款表單，意圖竊取用戶信用卡資料 https://www.malwarebytes.com/blog/threat-intelligence/2023/04/kritec-art 資策會調查：行動支付常用度首破七成直追實體信用卡 https://money.udn.com/money/story/5613/7142872 台中e指通被嫌不好用議員促轉型「台中PAY」行動支付平台 https://news.ltn.com.tw/news/politics/breakingnews/4292418 鉅亨買基金攜手富達投信、台灣行動支付APP 攻新型態基金服務 https://wantrich.chinatimes.com/news/20230504901031-420401 北富銀即日起提供 Apple「iPhone卡緊收」服務收款快速方便 https://udn.com/news/story/7239/7142426 陸詐騙集團架釣魚網站在日盜走近3百萬組電子支付帳密 https://reurl.cc/kl6l03 4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安 How to mint NFTs programmatically (Zero Solidity knowledge needed) https://medium.com/@AaliyaAli_01/how-to-mint-nfts-programmatically-9dd23c3b5741 切勿點擊任何鑄幣連結！Yuga Labs新任CEO推特帳號被駭 https://news.knowing.asia/news/65e49b66-ddbc-4f37-a1cd-9aff9d24e19f YouTube 協助恢復試圖進行 XRP 加密詐騙的被駭頻道 https://reurl.cc/jlARKy Messari深度報告：Sui 技術優勢在哪？撐出 L1 公鏈新天地 https://www.blocktempo.com/messari-diving-into-sui/ Yearn：所有受到 Euler 攻擊影響的被盜資金均已收回並歸還給用戶 https://news.cnyes.com/news/id/5163325 跨鏈橋終極形態探究：如何解決流動性、確定性和安全性的三難問題 https://news.cnyes.com/news/id/5162892 一文搞懂加密貨幣！投身幣圈前，破解七大典型「謊言」與「迷思」 https://reurl.cc/n7KZk2 4 月份的加密騙局、不正當利用和駭客攻擊導致 1.03 億美元的損失 https://reurl.cc/zAVrm0 5.資安事件新聞 A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC 偽裝ChatGPT或類似AI工具的網路攻擊頻傳，Meta發現3月就有10個惡意軟體以此作為誘餌 https://engineering.fb.com/2023/05/03/security/malware-nodestealer-ducktail/ 惡意程式載入器AresLoader被用於散布多種攻擊工具 https://blog.cyble.com/2023/04/28/citrix-users-at-risk-aresloader-spreading-through-disguised-gitlab-repo/ Google切斷惡意軟體CryptBot的基礎設施 https://blog.google/technology/safety-security/continuing-our-work-to-hold-cybercriminal-ecosystems-accountable/ 勒索軟體攻擊美國達拉斯警方、法院網站 https://www.securityweek.com/ransomware-attack-affects-dallas-police-court-websites/ Meta發現今年3月以來，有10款惡意程式家族偽裝ChatGPT或類似的AI工具 https://engineering.fb.com/2023/05/03/security/malware-nodestealer-ducktail/ 小心！駭客冒充ChatGPT大量散播「病毒軟體」，Meta：正開發防禦策略 https://www.blocktempo.com/chatgpt-and-ai-the-newest-vector-for-malware-meta-security-team/ 駭客假造桌面版ChatGPT　透過Telegram傳送被盜數據 https://www.technice.com.tw/cloudtech/infosecurity/51238/ 北韓駭客APT37透過捷徑檔案散布木馬程式RokRAT https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link/ 為了增加得逞機率，勒索軟體Rapture植入前，祭出多種方法窺似受害者電腦 https://www.trendmicro.com/en_us/research/23/d/rapture-a-ransomware-family-with-similarities-to-paradise.html 英國中學Hardenhuish遭到勒索軟體攻擊 https://www.infosecurity-magazine.com/news/ransomware-disrupts-network/ 陸發報告控美中情局「網攻別國」　聲稱捕獲大批「木馬程式」 https://www.ettoday.net/news/20230504/2492133.htm 製造業淪為勒索軟體攻擊最大重點目標 https://www.eettaiwan.com/20230504nt21-the-2023-global-ransomware-report/ 5成企業去年遭勒索軟體攻擊製造業支付贖金最高 https://ec.ltn.com.tw/article/breakingnews/4291196 你的Mac裡有加密錢包嗎？小心被AMOS竊密程式盯上 https://netmag.tw/2023/05/03/new-macos-malicious-programs-steal-keychain-passwords-and-encrypted-currency-wallets Atomic Stealer | Threat Actor Spawns Second Variant of macOS Malware Sold on Telegram https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/ New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets https://thehackernews.com/2023/04/new-atomic-macos-stealer-can-steal-your.html BlackBit Ransomware: A Threat from the Shadows of LokiLocker https://blog.cyble.com/2023/05/03/blackbit-ransomware-a-threat-from-the-shadows-of-lokilocker/ New KEKW Malware Variant Identified in PyPI Package Distribution https://blog.cyble.com/2023/05/03/new-kekw-malware-variant-identified-in-pypi-package-distribution/ Raspberry Robin: A global USB malware campaign providing access to ransomware operators https://otx.alienvault.com/pulse/64525c79560a208895cba893 1877 Team: A Kurdish hacker group on the rise https://otx.alienvault.com/pulse/64524a56a61ad32b77d042d9 Tonto Team Using Anti-Malware Related Files for DLL Side-Loading https://asec.ahnlab.com/en/51746/ Tonto Team Uses Anti-Malware File to Launch Attacks on South Korean Institutions https://thehackernews.com/2023/04/tonto-team-uses-anti-malware-file-to.html ViperSoftX InfoStealer Adopts Sophisticated Techniques to Avoid Detection https://thehackernews.com/2023/04/vipersoftx-infostealer-adopts.html BouldSpy Android Spyware: Iranian Government's Alleged Tool for Spying on Minority Groups https://thehackernews.com/2023/05/bouldspy-android-spyware-iranian.html North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains https://thehackernews.com/2023/05/north-koreas-scarcruft-deploys-rokrat.html DNS惡意軟體工具包Decoy Dog鎖定組織的網路設備而來 https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/dog-hunt-finding-decoy-dog-toolkit-via-anomalous-dns-traffic/ New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks https://thehackernews.com/2023/05/new-decoy-dog-malware-toolkit-uncovered.html Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts https://thehackernews.com/2023/05/meta-takes-down-malware-campaign-that.html Chinese Hacker Group Earth Longzhi Resurfaces with Advanced Malware Tactics https://thehackernews.com/2023/05/chinese-hacker-group-earth-longzhi.html Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads https://thehackernews.com/2023/05/fleckpe-android-malware-sneaks-onto.html B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊 Google Blocks 1.43 Million Malicious Apps, Bans 173,000 Bad Accounts in 2022 https://thehackernews.com/2023/05/google-blocks-143-million-malicious.html Apple and Google Join Forces to Stop Unauthorized Location-Tracking Devices https://thehackernews.com/2023/05/apple-and-google-join-forces-to-stop.html Google帳號開始支援Passkey登入，讓用戶不用煩惱密碼管理，也比原本2SV更安全方便 https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html Google Introduces Passwordless Secure Sign-In with Passkeys for Google Accounts https://thehackernews.com/2023/05/google-introduces-passwordless-secure.html 11款訂閱木馬程式溜進Google Play，波及62萬個裝置 https://www.ithome.com.tw/news/156741 2022年Google封鎖逾17萬開發者帳號 https://security.googleblog.com/2023/04/how-we-fought-bad-apps-and-bad-actors.html 蘋果首度針對藍牙耳機發布安全更新 https://www.securityweek.com/apple-releases-first-ever-security-updates-for-beats-airpods-headphones/ 針對已遭利用的漏洞，蘋果首度發布快速修補Rapid Security Response更新 https://support.apple.com/en-us/HT201224 Apple首度以快速資安回應方式釋出iOS、iPadOS與macOS的安全修補更新 https://netmag.tw/2023/05/02/apple-uses-ios-and-macos-rapid-security-response-feature-for-the-first-time C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力金鼎科部分資料遭受駭客網路攻擊事件 https://reurl.cc/jlARqn 公司門禁磁扣「爽開家中大門」他傻眼！專家建議：避免使用這功能 https://fnc.ebc.net.tw/fncnews/house/160536 冷藏物流業者Americold傳出遭到網路攻擊 https://www.bleepingcomputer.com/news/security/cold-storage-giant-americold-outage-caused-by-network-breach/ 彰基一張檢核表，喚起全院資安意識！駭客「無差別攻擊」，智慧醫院變肥羊 https://www.bnext.com.tw/article/74678/cyber-security-cc0-hospital-ciso 影視平台「LiTV」片庫被刪險倒閉駭客超瞎理由曝光 https://today.line.me/tw/v2/article/YaW1WjB 蘋果、Google聯手打擊Airtag非法跟蹤行為 https://www.apple.com/newsroom/2023/05/apple-google-partner-on-an-industry-specification-to-address-unwanted-tracking/ 美歐聯手破獲暗網市集Monopoly Market，逮捕288名嫌犯 https://www.bleepingcomputer.com/news/security/police-operation-spector-arrests-288-dark-web-drug-vendors-and-buyers/ 聯合國網路罪犯條約傳出將於6月公布 https://therecord.media/first-draft-of-un-cybercrime-treaty-expected-in-june 美國FBI向國會報告資安防禦不對稱狀況，他們表示，網路探員每人至少要對付50個中國駭客 https://therecord.media/wray-fbi-cyber-budget-china-cyberthreats 研究人員挾持14個熱門Packagist套件，目的是為了求職 https://www.bleepingcomputer.com/news/security/researcher-hijacks-popular-packagist-php-packages-to-get-a-job/ 南韓能源組織的VMware桌面虛擬化平臺、Oracle Weblogic伺服器遭駭客組織8220鎖定，散布挖礦程式XMRig https://asec.ahnlab.com/en/51568/ 塔吉克政府高層、電信業者、公共服務基礎設施遭俄羅斯駭客攻擊，至少有499個系統遭設置後門，發起Paperbug網路間諜攻擊 https://www.prodaft.com/resource/detail/paperbug-nomadic-octopus-paperbug-campaign 德國IT服務業者Bitmarck遭到網路攻擊，關閉內部網路、客戶的系統 https://www.theregister.com/2023/05/01/bitmarck_data_breach/ 中國駭客組織Earth Longzhi利用新手法停用資安防護系統，鎖定臺灣、泰國、菲律賓而來 https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html 新加坡與法國聯手以人工智慧強化網路安全 https://www.zdnet.com/article/these-two-countries-are-teaming-up-to-develop-ai-for-cybersecurity/ 以色列主要新聞網站於獨立紀念日遭到Anonymous Sudan癱瘓 https://www.jpost.com/breaking-news/article-741298 郭台銘要派8萬個機器人上戰場學者：是中國上海造的嗎？萬一被解放軍駭了 https://reurl.cc/MReXx3 徐嶔煌諷：拿中國製造的機器人對付解放軍？郭台銘挨批「科幻國防」 https://www.ftvnews.com.tw/news/detail/2023502W0279 迎戰中國駭客! 日本自衛隊網路防衛隊人員年內將擴編2.5倍 https://newtalk.tw/news/view/2023-05-03/869385 中國駭客數比FBI多50倍呼籲美軍成立「網路部隊」聲浪漸增 https://reurl.cc/2WnW4v Sophos X-Ops 發現東南亞地區網路賭徒遭受進階型攻擊 https://n.yam.com/Article/20230504130468 大陸官方報告指控台灣2014年太陽花運動是美國主導 https://money.udn.com/money/story/5603/7141560?from=edn_subcatelist_cate 中國報告批美駭客帝國要以國產設備因應 https://money.udn.com/money/story/5603/7141968?from=edn_newestlist_cate_side 皇家駭客集團勒贖達拉斯市府網站停擺 https://www.worldjournal.com/wj/story/121469/7143800 美國政府提撥1.4億美元成立7個全新人工智慧研發中心，確保人工智慧技術不影響民眾安危 https://reurl.cc/WDnqeZ Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Compromised https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html Vietnamese Threat Actor Infects 500,000 Devices Using 'Malverposting' Tactics https://thehackernews.com/2023/05/vietnamese-threat-actor-infects-500000.html Operation SpecTor: $53.4 Million Seized, 288 Vendors Arrested in Dark Web Drug Bust https://thehackernews.com/2023/05/operation-spector-534-million-seized.html Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia https://thehackernews.com/2023/05/meta-uncovers-massive-social-media.html N. Korean Kimsuky Hackers Using New Recon Tool ReconShark in Latest Cyberattacks https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全 ChatGPT is Back in Italy After Addressing Data Privacy Concerns https://thehackernews.com/2023/04/chatgpt-is-back-in-italy-after.html 冒充Meta技術支援團隊的釣魚攻擊暴增，資安業者查獲3,200個臉書網頁、個人檔案以此行騙 https://www.group-ib.com/blog/meta-phishing-campaign/ 竊資軟體NodeStealer鎖定臉書、Gmail、Outlook帳密而來 https://engineering.fb.com/2023/05/03/security/malware-nodestealer-ducktail/ 美國明尼蘇達州學區資料外洩，傳出學生心理報告流出 https://www.nbcnews.com/tech/security/students-psychological-reports-abuse-allegations-leaked-ransomware-hac-rcna79414 兒童心理健康諮商業者Brightline證實檔案共用系統GoAnywhere遭零時差漏洞攻擊，78萬人資料洩露 https://www.bleepingcomputer.com/news/security/brightline-data-breach-impacts-783k-pediatric-mental-health-patients/ 資安業者揭露2023年第一季電子郵件夾帶惡意HTML附件的比例已接近5成 https://blog.barracuda.com/2023/05/03/threat-spotlight-malicious-html-attachments-doubles/ 2023年第一季解除分期付款詐騙高風險賣場公布，蝦皮購物居第一 https://www.facebook.com/165bear/posts/610576861113375?__cft__[0]=AZVB7hc_gbq5Iex0nQnt-FVU3oHjMeBXjBgnlBkNA6P0zNfbkqnjZ_n0C5aB1KzuM1LNYweIKJduUFdd0bkpL_b1w4dZHX_liYb_aNSe2dEYAGubDFirucO8-tAFcpnVd2AHINnqwD2Zw2jrPqrJa4PpWpgH7DOFsvU5KLt-HPTKJSpxditt4ETMhfepsBHAuVtbWq49ofSs7EjHIu5Q1IqF&__tn__=%2CO%2CP-y-R AI語音讓「綁架騙局」更可信，FBI指出可建立通關密語破解 https://edition.cnn.com/2023/04/29/us/ai-scam-calls-kidnapping-cec/index.html 電信業者T-Mobile證實今年第2次資料外洩，逾800人受害 https://www.bleepingcomputer.com/news/security/t-mobile-discloses-second-data-breach-since-the-start-of-2023/ 多家公司使用Salesforce服務卻被發現曝露敏感業務資料，原因出在組態設定錯誤 https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/ 以色列總理臉書帳號遭入侵，數萬民眾個資外洩 https://www.malwarebytes.com/blog/threat-intelligence/2023/04/kritec-art 假借Windows更新的名義，俄羅斯駭客APT28對烏克蘭政府機關發動網路釣魚攻擊，意圖收集目標機關的電腦資訊 https://cert.gov.ua/article/4492467 APT28 Targets Ukrainian Government Entities with Fake "Windows Update" Emails https://thehackernews.com/2023/05/apt28-targets-ukrainian-government.html 勒索軟體駭客BlackCat聲稱入侵硬碟製造商Western Digital，公布該公司的內部資料 https://www.bleepingcomputer.com/news/security/hackers-leak-images-to-taunt-western-digitals-cyberattack-response/ 別再用vip！趕快換掉台灣人最常用的「10組爛密碼」 https://3c.ltn.com.tw/news/53107 醫院個資外洩恐影響國安監委申請調查 https://www.cna.com.tw/news/aipl/202305040039.aspx 打詐民宿隊！反詐號角響起！宜蘭兩千家民宿業者誓師響應 https://www.watchmedia01.com/cnews-20230504203507.html 小心誘騙點擊再盜取個資！沃爾瑪等9大品牌最常被駭客冒用 https://ec.ltn.com.tw/article/breakingnews/4291020 刑事局公布112年首季高風險賣場　蝦皮購物回應：平台無個資外洩 https://www.setn.com/News.aspx?NewsID=1288776 E.研究報告/工具 Why Your Detection-First Security Approach Isn't Working https://thehackernews.com/2023/04/why-your-detection-first-security.html Wanted Dead or Alive: Real-Time Protection Against Lateral Movement https://thehackernews.com/2023/05/wanted-dead-or-alive-real-time.html Why Telecoms Struggle with SaaS Security https://thehackernews.com/2023/05/why-telecoms-struggle-with-saas-security.html Researchers Uncover New BGP Flaws in Popular Internet Routing Protocol Software https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html Why the Things You Don't Know about the Dark Web May Be Your Biggest Cybersecurity Threat https://thehackernews.com/2023/05/why-things-you-dont-know-about-dark-web.html Lack of Visibility: The Challenge of Protecting Websites from Third-Party Scripts https://thehackernews.com/2023/05/lack-of-visibility-challenge-of.html 有駭客組織以雙重DLL測載方式試圖逃避資安檢測 https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ NIST CSF 2.0草案出爐，增加「治理」核心構面 https://www.nist.gov/system/files/documents/2023/04/24/NIST%20Cybersecurity%20Framework%202.0%20Core%20Discussion%20Draft%204-2023%20final.pdf 研究人員展示挾持歐洲太空總署衛星的手法 https://www.thalesgroup.com/en/worldwide/security/press_release/thales-seizes-control-esa-demonstration-satellite-first F.商業資安法規再升級國內製造業準備好了嗎？安碁資訊給資安長的三大建議 https://esg.gvm.com.tw/article/26888 資安風暴是危機也是商機？一文看懂資安服務產業 https://reurl.cc/vkMmR1 網創獲AWS進階合作夥伴認證提供客戶全方位雲端、資安趨勢服務 https://money.udn.com/money/story/5640/7137612 G.政府個資外洩修法擬罰鍰上限改至1千萬立委認為難奏效 https://news.pts.org.tw/article/635034 企業外洩個資罰則再加重　最高1500萬元 https://www.ctwant.com/article/254348 台灣首座「量子加密通訊網路」來了！竊聽馬上被發現，還能怎麼加密資訊 https://www.bnext.com.tw/article/75109/nstc-quantum-internet H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療相關資安 CISA Warns of Critical Flaws in Illumina's DNA Sequencing Instruments https://thehackernews.com/2023/04/cisa-warns-of-critical-flaws-in.html 美國針對Illumina的DNA測試系統重大漏洞提出警告 https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to.html Hackers Exploiting 5-year-old Unpatched Vulnerability in TBK DVR Devices https://thehackernews.com/2023/05/hackers-exploiting-5-year-old-unpatched.html 駭客運用5年前的TBK Vision視訊監控畫面側錄設備漏洞發動攻擊 https://www.fortiguard.com/outbreak-alert/tbk-dvr-attack 駭客正利用TBK DVR設備5年前已知未修補漏洞取得設備管理權限 https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/ Netgear網路管理系統漏洞恐被用於提升權限、洩露帳密資料 https://flashpoint.io/resources/research/fp-2023-01-netgear-prosafe-network-management-system/ OSU研究駭客可利用智慧電錶破壞電力網路穩定 https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=10098782&tag=1 兆勤防火牆設備出現重大漏洞，若不修補恐被用於執行OS命令 https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls 勒索軟件癱瘓美國油管運輸！從OT資安事件看工控聯網的隱憂 https://makerpro.cc/2023/05/viewing-hidden-dangers-of-industrial-control-networking-from-ot-information-security-incidents/ I.教育訓練 iPAS資訊安全工程師中級筆記 https://hackmd.io/@Not/iPASInformationSecuritySpecialist iPas資安工程師證照考前研習 https://reurl.cc/GEbA3p Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！ https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/ 全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口 https://reurl.cc/m39MDj CISSP資安認證的8大領域 https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html CISSP考試心得 https://reurl.cc/KbY83j CISSP考試心得 – Benson https://reurl.cc/GbWvxd 目標導向-20天光速考過CISSP https://reurl.cc/2Zq6zn CISSP證照考試實戰心得第一章：初期準備工作 https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat CISSP證照考試實戰心得第二章：規律且有紀律的讀書策略 https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies CISSP證照考試實戰心得第三章：終極一戰 https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle Quick CISSP Infographic for IPSec https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec CSSLP Certification - Security models in F# https://github.com/vbocan/csslp Certified Secure Software Lifecycle Professional in bullet points https://github.com/joeyhage/csslp-notes CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得 https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/ EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022 https://reurl.cc/1oyEM8 CEH v11 考試心得與準備方式 https://blog.sean.taipei/2022/01/ceh CEH https://github.com/a3cipher/CEH CodeRed by EC-Council https://github.com/codered-by-ec-council 深度解析 CPENT 考試心得、以及與 OSCP 的比較 https://reurl.cc/41eL8v EC-Council CPENT v1 滲透測試認證 – 內容及心得分享 https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review [備考心得]CompTIA Security+ (SY0–601) 上篇 https://reurl.cc/M053DK [備考心得]CompTIA Security+ (SY0–601) 下篇 https://reurl.cc/M053Gv comptia-security-plus https://github.com/ajfuto/comptia-security-plus security-plus https://github.com/fjavierm/security-plus CompTIA Security+ Certification Practice Test Questions https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette 不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書） https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html Learn NIST Inside Out With 21 Hours of Training @ 86% OFF https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html 駭客與國家: 網路攻擊與地緣政治新常態 The hacker and the state: cyber attacks and the new normal of geopolitic https://reurl.cc/D3nKKj Practical Network Penetration Tester (PNPT) Certification Review https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df WUSON常用的基本詞彙 https://choson.lifenet.com.tw/?p=1958 6.近期資安活動及研討會營業秘密保護與資訊安全管理 2023/5/6 https://www.accupass.com/event/2304241603381258796798 人工智慧之民事侵權責任探究 2023/5/6 https://www.accupass.com/event/2304241735321819706360 TEDxNYCULive 2023：Possibility 可能性 2023/5/7 https://www.accupass.com/event/2304180415231057647711 社團法人台灣駭客協會 112 年度第一次會員聚會 2023/5/9 https://hitcon.kktix.cc/events/hit-banquet-112 2023 CYBERSEC 資安大會 Jamf Apple 資安館 2023/5/9 ~ 2023/5/11 https://jamf.kktix.cc/events/cybersec2023jamf Microsoft Azure 虛擬培訓日：基礎知識 2023/5/9 ~ 2023/5/10 https://mktoevents.com/Microsoft+Event/394403/157-GQE-382?wt.mc_id=AID3058380_QSG_EML_640883&wt.mc_id=AID3058380_EML_8317669 台灣網路講堂「建構多元異質的數位韌性」座談會 2023/5/10 https://www.twsig.tw/20230510/ Hack The Capitol 6.0 2023/5/10 ~ 2023/5/11 https://www.icsvillage.com/hack-the-capitol-2023 黑暗網站憑據如何導致軟體供應鏈攻擊 2023/5/11 https://lp.cyberark.com/how-dark-web-credentials-lead-to-a-software-supply-chain-attack-tc-registrationlp.html?utm_campaign=identity_security Airflow Taiwan User Meetup #4 2023/5/11 https://www.meetup.com/taipei-py/events/292991559/ TWCC-CLI 進階操作- AI/ML 自動流程 2023/5/12 https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4035&from_course_list_url=course_index 【實作體驗營】一日駭客x網路弱點滲透 2023/5/13 https://www.accupass.com/event/2303030820005796452650 借助現代分析實現數位轉型 2023/5/15 ~ 2023/5/16 https://mktoevents.com/Microsoft+Event/394032/157-GQE-382?wt.mc_id=AID3058384_QSG_EML_640909&wt.mc_id=AID3058380_EML_8317669 「衛生福利部醫療領域資通系統資安防護基準」推廣說明會 2023/5/16 https://www.beclass.com/rid=274b10b64350aa626f12 Elastic Security－檢測、調查和應對多變的威脅 2023/5/17 https://www.accupass.com/event/2304190909578502986500 上市櫃資安法規要求在即企業如何掌握法遵與因應策略 2023/5/19 https://www.accupass.com/event/2304270202566389789600 Taipei dbt Meetup #11 (in-person 👫 & online 👨‍�2023/5/24 https://www.meetup.com/taipei-dbt-meetup/events/292891149/ Elixir meetup �2023/5/24 https://www.meetup.com/elixirtw-taipei/events/293147308/ 資安五四三 2023/5/25 （線上14:00 - 15:30） https://csa.kktix.cc/events/202305-543 鏈三上雲：資安解析峰會掌握Web 3資安動向，開啟鏈雲新模式 2023/5/25 https://www.accupass.com/event/2304120730519814020340 《區塊鏈初階課程》平日班 2023/5/25~2023/5/26 https://www.accupass.com/event/2304100300531686137286 3小時帶你了解AWS雲端服務與優勢 2023/5/26 https://www.uuu.com.tw/Public/content/edm/20230526_AWSDiscoveryDay_BC.htm 《區塊鏈初階課程》假日班 2023/5/27~2023/5/28 https://www.accupass.com/event/2304100341503819251900 大型語言模型時代下，建置解決方案該有的姿勢/知識 (Building solutions with LLMs) 2023/5/29 https://www.meetup.com/rladies-taipei/events/293170581/ 5月台北例會_美國聯邦政府的供應鏈資安管理－以CMMC為例 (採線上舉辦) 2023/5/30 https://www.caa.org.tw/newsdetail-16263.html 台灣數位創新領航論壇 Taiwan Digital Innovation Navigation Forum 2023/5/30 https://www.accupass.com/event/2304240303341594373938 Azure AI 基礎知識 2023/5/31 https://mktoevents.com/Microsoft+Event/393899/157-GQE-382?wt.mc_id=AID3058385_QSG_EML_640902&wt.mc_id=AID3058380_EML_8317669 【Monosparta】②⓪②③ 第二梯次軟體開發實戰訓練營➠線上說明會 2023/5/31 ~ 2023/6/28 https://trunk-studio.kktix.cc/events/monosparta-202307 資安分析新手村：掌握網路封包分析技術（線上課程） 2023/6/13 https://forms.gle/msePzws5GtcDunrc7 資安分析新手村：掌握網路封包分析技術（實體課程）2023/6/14 https://forms.gle/mtpZNPCpTVyv97Dr9 黑客視角：網站漏洞挖掘與防禦 ( 線上課程) 2023/6/27 https://forms.gle/JpThJxMgxZd3uNh39 黑客視角：網站漏洞挖掘與防禦 ( 實體課程) 2023/6/28 https://forms.gle/qQAqx8KZzzntSyLd9 COSCUP 2023 2023/07/29 ~ 2023/07/30 https://coscup.org/2023/zh-TW/landing InfoSec Taiwan 2023 國際資安大會 2023/8/1 ~ 2023/8/3 https://csa.kktix.cc/events/infosectaiwan2023 DEF CON 32 2023/8/10 ~ 2023/8/13 https://defcon.org/index.html HITCON CMT 2023 2023/08/18 ~ 2023/08/19 https://hitcon.org/2023/CMT/ PyCon TW 2023 2023/9/2 ~ 2023/9/3 https://tw.pycon.org/2023/zh-hant/registration/tickets Hou.Sec.Con 2023/10/12 ~ 2023/10/13 https://web.cvent.com/event/76d46ccb-fe00-4fe5-ba46-e4a77c807f21/summary (ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27 https://www.isc2.org/Congress-2023