---
# System prepended metadata

title: 資安事件新聞週報 2022/10/10  ~  2022/10/14
tags: [資安事件新聞週報]

---

###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2022/10/10  ~  2022/10/14

1.重大弱點漏洞/後門/Exploit/Zero Day
Hackers Exploiting Unpatched RCE Flaw in Zimbra Collaboration Suite
https://thehackernews.com/2022/10/hackers-exploiting-unpatched-rce-flaw.html

Zimbra修補已出現攻擊行動的RCE漏洞
https://www.rapid7.com/blog/post/2022/10/06/exploitation-of-unpatched-zero-day-remote-code-execution-vulnerability-in-zimbra-collaboration-suite-cve-2022-41352/

電子郵件系統Zimbra尚未修補的RCE漏洞已出現攻擊行動
https://www.rapid7.com/blog/post/2022/10/06/exploitation-of-unpatched-zero-day-remote-code-execution-vulnerability-in-zimbra-collaboration-suite-cve-2022-41352/

微軟發佈10月份安全性公告
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/11/microsoft-releases-october-2022-security-updates

針對7月被揭露的勒索軟體LockBit攻擊事故，駭客疑似利用新的零時差漏洞入侵Exchange，但有資安專家認為攻擊者利用的漏洞是ProxyNotShell
https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-lockbit-ransomware/

微軟發布10月份例行更新，但眾所關注的ProxyNotShell修補並未一起釋出
https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2022-patch-tuesday-fixes-zero-day-used-in-attacks-84-flaws/

Microsoft Issues Improved Mitigations for Unpatched Exchange Server Vulnerabilities
https://thehackernews.com/2022/10/microsoft-issues-improved-mitigations.html

Microsoft Patch Tuesday Fixes New Windows Zero-Day; No Patch for Exchange Server Bugs
https://thehackernews.com/2022/10/microsoft-patch-tuesday-fixes-new.html

針對Fortinet CVE-2022-40684漏洞的PoC已經出現
https://thehackernews.com/2022/10/poc-exploit-released-for-critical.html

Fortinet修補防火牆、網頁安全閘道RCE漏洞，但先私下通知部分用戶
https://www.ithome.com.tw/news/153533

Fortinet 警告管理員立即修補關鍵的身份驗證繞過錯誤
https://www.bleepingcomputer.com/news/security/fortinet-warns-admins-to-patch-critical-auth-bypass-bug-immediately/

Fortinet Warns of New Auth Bypass Flaw Affecting FortiGate and FortiProxy
https://thehackernews.com/2022/10/fortinet-warns-of-new-auth-bypass-flaw.html

Fortinet Warns of Active Exploitation of Newly Discovered Critical Auth Bypass Bug
https://thehackernews.com/2022/10/fortinet-warns-of-active-exploitation.html

PoC Exploit Released for Critical Fortinet Auth Bypass Bug Under Active Attacks
https://thehackernews.com/2022/10/poc-exploit-released-for-critical.html

沙箱元件vm2存在重大漏洞Sandbreak，可被用於RCE攻擊
https://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067

Researchers Detail Critical RCE Flaw Reported in Popular vm2 JavaScript Sandbox
https://thehackernews.com/2022/10/researchers-detail-critical-rce-flaw.html

Cisco 近日發布更新以解決多個產品的安全性弱點
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/06/cisco-releases-security-updates-multiple-products

資安廠商踢爆VMware vCenter Server漏洞拖了快1年仍修不好，最新推出的vSphere 8仍無法倖免
https://www.bleepingcomputer.com/news/security/vmware-vcenter-server-bug-disclosed-last-year-still-not-patched/

SAP發布10月份例行修補公告，緩解兩個CVSS風險評分達9.6分的漏洞
https://www.securityweek.com/sap-patches-critical-vulnerabilities-commerce-manufacturing-execution-products

Aruba針對SD-WAN系統修補3個網頁管理介面的重大漏洞
https://www.bleepingcomputer.com/news/security/aruba-fixes-critical-rce-and-auth-bypass-flaws-in-edgeconnect/

Google發布電腦版Chrome 106.0.5249.119，修補6個高風險漏洞
https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html

2.銀行/金融/保險/證券/支付系統/金融監理 新聞及資安
金融科技駭客事件再添新案例  受災戶集中在歐洲
https://www.technice.com.tw/cloudtech/infosecurity/19808/

銀行當機出包 30分鐘內要通報金管會
https://www.chinatimes.com/realtimenews/20221012003639-260410?chdtv

AI透過拍攝手機、ATM表面的熱成像照片，20秒內就可以破解你的密碼，成功率高達86%
https://www.techbang.com/posts/100740-heat-password-crack

中國銀保監會出手 新設小額網貸全面叫停
https://www.worldjournal.com/wj/story/121347/6683223

加速數位轉型，第一金證成立數位發展事業群
http://www.investor.com.tw/onlineNews/NewsContent.asp?articleNo=14202210130027

玉山安永科技論壇 聚焦企業資安應變管理與布局關鍵
https://reurl.cc/zN30be

集保結算所股務4e服務 攜手共創數位新未來
https://news.cnyes.com/news/id/4978389

駭客組織LofyGang鎖定開發者發動供應鏈攻擊，目標為信用卡資料
https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over-a-year/

LofyGang Distributed ~200 Malicious NPM Packages to Steal Credit Card Data
https://thehackernews.com/2022/10/lofygang-distributed-200-malicious-npm.html

澳洲Medibank保險公司遭網路攻擊，調查未經授權存取事件並關閉多項服務
https://www.itnews.com.au/news/medibank-takes-systems-offline-after-cyber-incident-586417?utm_source=feed&utm_medium=rss&utm_campaign=iTnews+Technology+feed

當心駭客利用網釣結合語音手法誘騙受害者安裝Android金融木馬的新趨勢，已有義大利網路銀行被鎖定
https://www.threatfabric.com/blogs/toad-fraud.html

3.電子支付/行動支付/pay/資安
行動支付為何無法取代現金？和電子支付差在哪？「1關鍵」讓台灣人愛用現金
https://reurl.cc/m38ax1

後疫情時代電子支付百百種　中華電信多元付款一機搞定
https://www.ettoday.net/news/20221011/2346493.htm

台中捷運行動支付招標 便利搭車再升級
https://reurl.cc/dWNRaV

新北幣遭批花五千萬沒效 資訊中心：首創整合行動支付
https://udn.com/news/story/7323/6667470

港媒：PayPal停社民連帳戶 指風險過高
https://udn.com/news/story/7331/6683296

8月全支付會員衝47萬 推升電支破1850萬人
https://reurl.cc/ERxkQ0

AlipayHK新接入韓國、新加坡　覆蓋12萬韓國商戶
https://reurl.cc/m38ak9

電子支付車資反遭控坐霸王車 真相大白小黃運將慘了
https://udn.com/news/story/7320/6671524

黑龍江男子偷換藥房電子支付收款碼騙財 店長：很氣憤
https://reurl.cc/5pjebv

電子支付大戰 誰會勝出
https://reurl.cc/60oWbb

僵屍電子支付帳號來襲
https://talk.ltn.com.tw/article/paper/1543558

狂閃退！ 「超級悠遊卡」上線一天 加值「出槌」
https://reurl.cc/zN30Qy

SuperCard超級悠遊卡開賣！一次可刷1萬元、用手機也能加值，怎麼做
https://www.bnext.com.tw/article/71985/easycard-nfc-supercard-2022

Google Pixel 7 系列臉部解鎖安全度不足！將不支援電子支付認證
https://reurl.cc/3YgGkl

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Hackers Steal $100 Million Cryptocurrency from Binance Bridge
https://thehackernews.com/2022/10/hackers-steal-100-million.html

No KYC Crypto Exchanges — Buy Crypto without KYC
https://medium.com/coinmonks/no-kyc-crypto-exchanges-buy-crypto-without-kyc-3b2eda2b5397

自己投90%贊成！Mango駭客提案用金庫7000萬鎂償還壞帳，通過即歸還部分贓款
https://www.surviews.com/post/5676.html

十天6起安全事故，損失金額超8億美元，鏈上安全何時解決
https://news.cnyes.com/news/id/4977353

Coinbase 最新紀錄片《Coin: A Founder’s Story》值得一看嗎
https://blockcast.it/2022/10/12/coin-a-founders-story-why-its-worth-watching/

科普｜比特幣私鑰有多安全？網上販賣「暴力猜測器」萬年才能解
https://reurl.cc/QbrzrM

Chainalysis示警，加密貨幣遭駭客竊取規模今年恐創紀錄新高
https://reurl.cc/W16l59

Transit Finance發布竊盜案100%退款方案，駭客已歸還83%贓款
https://www.blocktempo.com/updates-about-transit-finance-attack/

加密貨幣遭駭客竊取規模今年勢創紀錄 現已累計被竊超過30億美元
https://reurl.cc/W16lpL

今年以來加密貨幣已被盜逾30億美元 全年規模料創紀錄新高
https://news.cnyes.com/news/id/4978101

FTX 遭受 Gas 竊取攻擊，駭客零成本鑄造 XEN 代幣 1.7 萬次
https://www.owlting.com/news/articles/186802

2022加密貨幣攻擊已損23億鎂！immunefi：駭客偏愛BNB Chain、以太坊
https://www.blocktempo.com/immunefi-published-crypto-losses-q3-2022-report/

Mango 被盜 1 億美元：一場利用閃電貸和 DAO 治理的雙重攻擊
https://blockcast.it/2022/10/13/solana-defi-protocol-mango-markets-loses-117m-in-hack/

攻擊分析｜Mango 遭吸乾 1.16 億全步驟拆解，攻擊預言機漏洞再做空
https://www.surviews.com/post/5685.html

資安行不行？今年幣圈被盜近千億
https://ec.ltn.com.tw/article/breakingnews/4088156

鏈習生幣圈日報 2022.10.13｜十分鐘掌握全球區塊鏈及加密貨幣新聞
https://reurl.cc/9pe2dx

幣安跨鏈橋遭駭，被盜走1億美元資產
https://www.ithome.com.tw/news/153528

報告：加密投資者更願意在CEX上持有資產
https://news.cnyes.com/news/id/4978608

無聊猿NFT釣魚案｜警方靠加密偵探 ZachXBT 推特研究，逮到5名嫌犯
https://www.blocktempo.com/french-police-use-zachxbt-s-research-to-arrest-five-nft-scammer/

ETHW 生態發展現狀：社群熱度攀升、入場資金較少
https://blockcast.it/2022/10/14/ethpows-latest-development/

比特幣ATM負責人被抓！台北頂好 西門町的 BTM 被詐騙集團當洗錢水房
https://www.blocktempo.com/first-btm-money-laundering-case-in-taiwan/

一名15歲加密貨幣駭客同意向受害者支付2200萬美元賠償
https://news.cnyes.com/news/id/4979646?exp=a

數位人民幣8月底累計交易逾千億人民幣，人行將鞏固法償性地位
https://reurl.cc/kExmpL

澳門完成討論貨幣發行制度草案，擬將數字貨幣納入法定貨幣
https://news.cnyes.com/news/id/4979591

歐洲人也能用比特幣買麥當勞了！一文掌握加密貨幣發展：薩爾瓦多後來怎麼了
https://reurl.cc/qN7ypy

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
新惡意軟體Maggie已感染超過 250 台微軟 SQL 伺服器
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10116

可繞過1000多個EDR產品！勒索軟體BlackByte使用「自帶驅動程式」技術
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10115

七成以上台灣企業供應鏈曾遭勒索病毒襲擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10112

四份一曾遭勒索程式襲擊的醫療機構被迫全面停運
https://times.hinet.net/mobile/news/24189913

Akamai 2022 年上半年亞太及日本區勒索軟體報告
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10107

微軟Cyber Signals研究：勒索軟體經濟快速崛起 演變為新商業模式
https://www.techbang.com/posts/99312-microsoft-cyber-signals-research-the-rapid-rise-of-the

以色列組織遭到駭客組織Polonium鎖定，被植入多種後門程式
https://www.welivesecurity.com/2022/10/11/polonium-targets-israel-creepy-malware/

駭客以推送NFT錢包Phantom更新為由散布惡意軟體
https://www.bleepingcomputer.com/news/security/fake-solana-phantom-security-updates-push-crypto-stealing-malware/

假的勒索軟體透過色情圖片散布，且可能會抹除受害電腦硬碟資料
https://blog.cyble.com/2022/10/06/fake-ransomware-infection-under-widespread/

勒索軟體Black Basta透過滲透測試工具Brute Ratel C4入侵受害組織
https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html

語音網釣攻擊結合安卓惡意軟體，鎖定義大利銀行用戶而來
https://www.threatfabric.com/blogs/toad-fraud.html

目標式勒索攻擊：製造業榜首
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/763DAC733AC54415A0438FB5DC1ADC28

Cryptojacking campaign detected in the wild
https://www.bitdefender.com/files/News/CaseStudies/study/424/Bitdefender-PR-Whitepaper-SLOneDriveCyberJack-creat6318-en-EN.pdf

Deep Analysis of Snake Keylogger
https://x-junior.github.io/malware%20analysis/2022/06/24/Snakekeylogger.html

BlackByte Ransomware Abuses Vulnerable Windows Driver to Disable Security Solutions
https://thehackernews.com/2022/10/blackbyte-ransomware-abuses-vulnerable.html

Researchers Detail Malicious Tools Used by Cyber Espionage Group Earth Aughisky
https://thehackernews.com/2022/10/researchers-detail-malicious-tools-used.html

出現鎖定Mac、Linux與Windows的全新中文C2攻擊框架
https://blog.talosintelligence.com/2022/10/alchimist-offensive-framework.html

New Chinese Malware Attack Framework Targets Windows, macOS, and Linux Systems
https://thehackernews.com/2022/10/new-chinese-malware-attack-framework.html

Modified WhatsApp App Caught Infecting Android Devices with Malware
https://thehackernews.com/2022/10/modified-whatsapp-app-caught-infecting.html

New Report Uncovers Emotet's Delivery and Evasion Techniques Used in Recent Attacks
https://thehackernews.com/2022/10/new-report-uncovers-emotets-delivery.html

Mirai Botnet Hits Wynncraft Minecraft Server with 2.5 Tbps DDoS Attack
https://thehackernews.com/2022/10/mirai-botnet-hits-wynncraft-minecraft.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
400個手機App竊取百萬用戶臉書帳號資料
https://about.fb.com/news/2022/10/protecting-people-from-malicious-account-compromise-apps/

Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials
https://thehackernews.com/2022/10/facebook-detects-400-android-and-ios.html

iPhone 共享相簿邀請廣告要如何封鎖？4招防止廣告詐騙教學
https://mrmad.com.tw/iphone-shared-album-invitation-anti-blocking

臉書全網哀號！名律師曝追蹤數「被砍80萬」 專家曝原因
https://www.chinatimes.com/realtimenews/20221012004118-263301?chdtv

研究指 iOS 16 多數蘋果原廠應用會繞過 VPN，連 Android 系統也這樣
https://today.line.me/tw/v2/article/2Deqwk8

Google修補42個Android漏洞，其中3個為涉及高通無線模組的重大漏洞
https://www.malwarebytes.com/blog/news/2022/10/vulnerabilities-in-google-android-could-allow-for-arbitrary-code-execution

Android與Chrome今年將支援Passkey功能，無密碼時代近了
https://www.ithome.com.tw/news/153615

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
全球資安威脅 童子賢：台灣無法置身事外
https://ec.ltn.com.tw/article/breakingnews/4086908

美禁高階晶片輸中 童子賢：兩大經濟體碰撞須小心面對
https://news.cnyes.com/news/id/4977232

資安需求已擴大，面對人才供給的挑戰，培育方向要更寬廣，不只重實務還要考量各種資安人才的養成
https://www.ithome.com.tw/news/153614

實現人盡其才，如何用才很重要
https://www.ithome.com.tw/news/153619

資安你我有責，不只是資安人才的事
https://times.hinet.net/news/24193850

TB級DDoS攻擊頻繁，臺灣第三季遭受攻擊流量增加20倍，網路媒體與網路產業最嚴重
https://blog.cloudflare.com/cloudflare-ddos-threat-report-2022-q3/

私有NPM套件被用於計時攻擊
https://blog.aquasec.com/private-packages-disclosed-via-timing-attack-on-npm

New Timing Attack Against NPM Registry API Could Expose Private Packages
https://thehackernews.com/2022/10/new-timing-attack-against-npm-registry.html

黑客假扮IT部門 狂發MFA驗證令員工跪低
https://www.wepro180.com/1014_mfa/

美擬全面禁售華為、中興等中企新設備
https://reurl.cc/ZbKD4a

英媒：中共執迷「控制」 有驚人「治台計劃」
https://www.soundofhope.org/post/661524?lang=b5

逾10座美國機場的網站傳出遭俄羅斯駭客Killnet癱瘓
https://www.ithome.com.tw/news/153546

遭親俄駭客網攻 美機場服務當機
https://reurl.cc/AOVoo3

為採購烏克蘭自產無人機　基金會募款7小時破1.8億
https://www.ctwant.com/video/5133

無懼中共威脅 烏克蘭議員預計10月底訪台
https://www.soundofhope.org/post/661503?lang=b5

烏克蘭資安長Victor Zhora：如何面對真實戰爭+資訊戰的混合攻擊局面
https://netmag.tw/2022/10/12/ukrainian-minister-victor-zhora-and-radware-talk-about-a-growing-cyber-attack-on-the-country

Budworm Hackers Resurface with New Espionage Attacks Aimed at U.S. Organization
https://thehackernews.com/2022/10/budworm-hackers-resurface-with-new.html

英特爾證實Alder Lake處理器的BIOS原始碼外洩，但宣稱資料供漏洞懸賞所用
https://www.tomshardware.com/news/intel-confirms-6gb-alder-lake-bios-source-code-leak-new-details-emerge

Intel Confirms Leak of Alder Lake BIOS Source Code
https://thehackernews.com/2022/10/intel-confirms-leak-of-alder-lake-bios.html

New PHP Version of Ducktail Malware Hijacking Facebook Business Accounts
https://thehackernews.com/2022/10/new-php-version-of-ducktail-malware.html

國際業務專案管理師 
https://www.104.com.tw/job/7sd52

資安文字客服專員
https://reurl.cc/0XALjk

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
Hackers Can Use 'App Mode' in Chromium Browsers' for Stealth Phishing Attacks
https://thehackernews.com/2022/10/hackers-can-use-app-mode-in-chromium.html

Researchers Warn of New Phishing-as-a-Service Being Used by Cyber Criminals
https://thehackernews.com/2022/10/researchers-warn-of-new-phishing-as.html

64,000 Additional Patients Impacted by Omnicell Data Breach - What is Your Data Breach Action Plan
https://thehackernews.com/2022/10/64000-additional-patients-impacted-by.html

BazarCall Call Back Phishing Attacks Constantly Evolving Its Social Engineering Tactics
https://thehackernews.com/2022/10/bazarcall-callback-phishing-attacks.html

孫維德觀點：民間網友已成為打擊網路詐騙的重大力量
https://www.storm.mg/article/4550477?page=1

參選人可以花錢買新聞？「置入性行銷」也是種假訊息？陳炳宏：只要用錢砸，新聞就出現了
https://tfc-taiwan.org.tw/articles/8305

汽車大廠Toyota不慎把車輛管理系統的金鑰公開在GitHub上，恐外洩近30萬用戶資料
https://global.toyota/jp/newsroom/corporate/38095972.html

威剛傳出資料外洩，但該公司表示駭客掌握的是一年前事故的資料
https://www.bleepingcomputer.com/news/security/adata-denies-ransomhouse-cyberattack-says-leaked-data-from-2021-breach/

遊戲業者2K客服系統遭駭，玩家個資流入地下論壇
https://www.bleepingcomputer.com/news/security/2k-games-warns-users-their-stolen-data-is-now-up-for-sale-online/

澳洲IT服務業者Dialog遭駭，客戶及員工資料恐外洩
https://www.ithome.com.tw/news/153567

刑事警察局公告高風險賣場，生活市集入榜五周，近兩周最嚴重
https://www.facebook.com/165bear/posts/472618001575929

新的Caffeine網釣攻擊工具訂閱服務更加明目張膽，駭客架設公開網站供買家下單
https://www.mandiant.com/resources/blog/caffeine-phishing-service-platform

鎖定美國小型企業的COVID-19補助網釣攻擊升溫，駭客濫用Google表單騙取受害者資料
https://www.inky.com/en/blog/fresh-phish-small-business-covid-19-grants-designed-for-disaster

又出現新的網釣攻擊套件租賃服務Caffeine，開放註冊的特性將讓攻擊門檻更低
https://www.mandiant.com/resources/blog/caffeine-phishing-service-platform

媽祖盃全國馬拉松路跑遭駭　官方緊急網站加密並呼籲別受騙
https://www.watchmedia01.com/fnews-20221014020630.html

北港媽祖盃馬拉松報名網站遭駭　官方即時簡訊呼籲防詐
https://n.yam.com/Article/20221013164070

喻虹淵慘遭友詐3447萬 手機號碼也被盜 急喊：還我清白
https://www.chinatimes.com/amp/realtimenews/20221013005688-260404

防疫紓困訊息詐騙多 電子支付疑洩個資
https://reurl.cc/bEQMNo

E.研究報告/工具
找駭客？Let's Go! Day08 日本女性資安社群 CTF4GIRLS
https://ithelp.ithome.com.tw/articles/10297165

[複習] 資安定義、工程及網路
https://ithelp.ithome.com.tw/articles/10307532

The essentials of GRC and cybersecurity — How they empower each other
https://thehackernews.com/2022/10/the-essentials-of-grc-and-cybersecurity.html

The Latest Funding News and What it Means for Cyber Security in 2023
https://thehackernews.com/2022/10/the-latest-funding-news-and-what-it.html

Does the OWASP Top 10 Still Matter
https://thehackernews.com/2022/10/does-owasp-top-10-still-matter.html

Lazarus Group Uses the DLL Side-Loading Technique (mi.dll)
https://asec.ahnlab.com/en/39828/

How To Attack Admin Panels Successfully
https://infosecwriteups.com/how-to-attack-admin-panels-successfully-72c90eeb818c

How to Make Money with Web Scraping Using Python
https://medium.com/geekculture/how-to-make-money-with-web-scraping-using-python-b09546e0e08d

Passive Income in Cyber Security — How to guide
https://taimurcloud123.medium.com/passive-income-in-cyber-security-how-to-guide-e437fb9a8f34

Passive Income in Cyber Security — Part 2
https://taimurcloud123.medium.com/passive-income-in-cyber-security-part-2-f7066504a47b

Exploratory Data Analysis of Hotel booking demand — A Case Study
https://medium.com/@itssouravshrivas/exploratory-data-analysis-of-hotel-booking-demand-a-case-study-4a27bff589ca

Difference between BOM and DOM in JavaScript
https://medium.com/geekculture/difference-between-bom-and-dom-in-javascript-5c8317c5c1d2

Principles of Writing Automated Tests
https://adequatica.medium.com/principles-of-writing-automated-tests-a2b72218264c

Backend Basics: RESTful API (API, REST, Methods, JSON, Examples)
https://medium.com/altogic/backend-basics-restful-api-api-rest-methods-json-examples-429744ba0831

The Only Guide You’ll Need for CyberChess — plus How To Get Free Heroes & Skills
https://medium.com/binaryx-gamefi/cyberchess-beginners-guide-and-tutorial-with-limited-140-gift-code-from-binaryx-fdeeb052392a

How I Found Multiple SQL Injections in 5 Minutes in Bug Bounty
https://infosecwriteups.com/how-i-found-multiple-sql-injections-in-5-minutes-in-bug-bounty-40155964c498

How I Build my own CI/CD Pipeline for Python Apps
https://medium.com/codex/how-i-build-my-own-ci-cd-pipeline-for-python-apps-98bb1cd5d13c

EXPLOITING OS COMMAND INJECTION VULNERABILITIES
https://infosecwriteups.com/exploiting-os-command-injection-vulnerabilities-14195c9a410b

How To Build a Career as a Freelance Cybersecurity Analyst — From Scratch
https://thehackernews.com/2022/10/how-to-build-career-as-freelance.html

F.商業
VMware 助關貿網路打造 T-Cloud 關貿雲服務
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10108

研華攜手慧景通過VPC資安認證
https://reurl.cc/eOR1rQ

微軟 Ignite 大會：推出多種工具、產品和服務 協助客戶提高效率和生產力
https://news.microsoft.com/zh-tw/microsoft-ignite/

叡揚 分享資安、雲端、智能解決方案
https://wantrich.chinatimes.com/news/20221014900122-420101

Google針對軟體供應鏈推出安全解決方案Software Delivery Shield
https://www.ithome.com.tw/news/153589

Samsung 和 Google 將合力簡化初次設定 Matter 家居產品的流程
https://chinese.engadget.com/samsung-announces-expanded-partnership-with-google-to-support-matter-devices-110008848.html

G.政府
防公共電子看板遭駭 唐鳳：視同連線公務網路管理
https://udn.com/news/story/7240/6681472

公共場域電子看板將納管 唐鳳曝最新進度
https://ctee.com.tw/livenews/aj/ctee/a11608002022101215461977

數位部資安署 月薪6萬 僅來2人
https://reurl.cc/AOVxqd

資安攻防怎麼做？唐鳳：紅藍須並重結合成「紫隊」
https://udn.com/news/story/7238/6681424

政府約聘人員薪資 立委促定期檢討
https://www.epochtimes.com/b5/22/10/12/n13843964.htm

馬斯克要「台灣變特區」　邱國正：國軍目前絕不再買特斯拉
https://www.ettoday.net/news/20221012/2356762.htm

資安恐外洩？國軍現有7輛特斯拉「停在這」　何志偉：真的不安全
https://www.ctwant.com/article/212802

不再買特斯拉！國防部：資安考量不開啟攝影與自動導航
https://www.nownews.com/news/5950649

航太、造船、資安...開箱國防自主千億商機 國內軍工產業供應鏈樣貌曝光！
https://www.wealth.com.tw/articles/47d9e603-1099-4908-80ee-bfb22b01a589

新北市體現領導者的數位轉型「AI智慧之城」啟動數位治理新動能
https://city.gvm.com.tw/article/95194

資策會秀5項AI技術研發 提升道安、預測製造業設備損耗
https://ec.ltn.com.tw/article/breakingnews/4088214

中製資通設備佯裝MIT 政院：持續加強資安韌性防護
https://reurl.cc/RX5Abz

TWISA組團赴日本CEATEC展 資安輸出受肯定
https://money.udn.com/money/story/10860/6687194

臺大資管系教授、前NCC委員孫雅麗：企業建置5G專網不可忽視資通安全，5項安全議題要注意
https://www.ithome.com.tw/news/153631

傳上校持機密設施圖遭調查局帶走 國防部：配合偵辦
https://reurl.cc/Qbr0YO

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
Critical Bug in Siemens SIMATIC PLCs Could Let Attackers Steal Cryptographic Keys
https://thehackernews.com/2022/10/critical-bug-in-siemens-simatic-plcs.html

國家級的網攻！針對半導體製造業的勒索軟體攻擊將持續並產生重大影響
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10110

TXOne Networks與NEC台灣合作提供零售業POS系統資安防護
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10106

SEMI E187設備資安標準導入指南出爐
https://www.eettaiwan.com/20221013nt22-semi-e187/

建構半導體供應鏈安全網 SEMI發布E187設備資安標準
https://www.chinatimes.com/newspapers/20221013000193-260204?chdtv

SEMI晶圓設備資安標準指南出爐 提升半導體供應鏈安全
https://times.hinet.net/news/24191275

IKEA智慧照明系統漏洞恐導致組態遭到重設、使用者失去調整亮度的能力
https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting/

西門子工控系統的全域私鑰恐遭利用，PLC設備資料可能被竄改
https://claroty.com/team82/research/the-race-to-native-code-execution-in-plcs-using-rce-to-uncover-siemens-simatic-s7-1200-1500-hardcoded-cryptographic-keys

CISA發布25項ICS產品安全警告，涵蓋西門子、Hitachi等多項漏洞
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/13/cisa-releases-twenty-five-industrial-control-systems-advisories

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

我國網路資安狂被駭 監委申請自動調查
https://www.chinatimes.com/realtimenews/20220810003152-260407?chdtv

6.近期資安活動及研討會
MOPCON 2022  2022/10/15 ~ 2022/10/16
https://mopcon.org/

金融資安案例研習 2022/10/17
https://www.sitca.org.tw/OPF/B0000/PPT049_2022_01.asp

Kubernetes Summit 2022 2022/10/18 ~ 2022/10/19
https://k8s.ithome.com.tw/

Taipei dbt Meetup #7 (in-person 👫 & online 👨‍💻) 2022/10/19
https://www.meetup.com/taipei-dbt-meetup/events/288207892/

國家高速網路與計算中心 教育訓練 「大數據程式開發平台(VM版本)」建置與開發實務課程 2022/10/21
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4009&from_course_list_url=course_index

CISCO 資安講堂 2022/10/21
https://www.accupass.com/event/2209281120037267603420

資安情蒐暨資安政策趨勢研討會—以半導體供應鏈為核心 2022/10/25
https://stli.iii.org.tw/news-event.aspx?no=16&d=1177

【Monosparta】②⓪②③ 第一梯次 軟體開發實戰訓練營➠線上說明會 2022/10/26
https://trunk-studio.kktix.cc/events/monosparta-202301

CODE BLUE 2022 @TOKYO  2022/10/27 ~ 2022/10/28
https://codeblue.jp/2022/en/

金融產業跨域資安人力高峰論壇 2022/10/28
https://isipevent.kktix.cc/events/f2ce8bcc

資訊安全與人工智慧實作 2022/10/28
https://www.cisanet.org.tw/Course/Detail/2867

資訊安全發展趨勢| 數位社會與資訊安全 - 董監事系列認證課程 2022/11/5
https://www.accupass.com/event/2208120843261385349231

行動應用APP 安全檢測（APK/IPA）2022-11-18 09:00 ~ 2022-11-18 12:00
https://www.cisanet.org.tw/Course/Detail/2865

ICS 2022 WORKSHOP PROGRAM -「Ubiquitous Cybersecurity and Forensics」 2022/12/15 ~ 2022/12/17
https://ics2022.esam.io/

TANET 2022 WORKSHOP PROGRAM -「第二屆數位鑑識、醫療私密與網駭安全」 2022/12/15 ~ 2022/12/17
https://tanet2022.esam.io/