1.重大弱點漏洞/後門/Exploit/Zero Day
Juniper 產品 Junos OS 系列中的J-Web存在安全性弱點
https://reurl.cc/lD4jQ9

Adobe 已發布安全更新，以解決 ColdFusion 的弱點
https://reurl.cc/AALej3

Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability
https://thehackernews.com/2023/07/adobe-rolls-out-new-patches-for.html

Adobe針對ColdFusion漏洞CVE-2023-29298再度修補
https://www.bleepingcomputer.com/news/security/adobe-fixes-patch-bypass-for-exploited-coldfusion-cve-2023-29298-flaw/

Oracle Critical Patch Update for July 2023
https://reurl.cc/4ov7YY
https://www.securityweek.com/oracle-releases-508-new-security-patches-with-july-2023-cpu/

Citrix 發布 NetScaler ADC 和網關的安全更新
https://reurl.cc/r54j34

Citrix修補應用程式交付控制器、SSL VPN系統的零時差漏洞
https://www.bleepingcomputer.com/news/security/new-critical-citrix-adc-and-gateway-flaw-exploited-as-zero-day/

Citrix NetScaler ADC and Gateway Devices Under Attack: CISA Urges Immediate Action
https://thehackernews.com/2023/07/citrix-netscaler-adc-and-gateway.html

Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway
https://thehackernews.com/2023/07/zero-day-attacks-exploited-critical.html

Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens
https://thehackernews.com/2023/07/microsoft-bug-allowed-hackers-to-breach.html

AMI基板管理控制器MegaRAC出現重大漏洞，恐導致伺服器服務中斷
https://eclypsium.com/research/bmcc-lights-out-forever/

Critical Flaws in AMI MegaRAC BMC Software Expose Servers to Remote Attacks
https://thehackernews.com/2023/07/critical-flaws-in-ami-megarac-bmc.html

Apache視訊會議解決方案OpenMeetings存在漏洞，恐被攻擊者執行惡意程式碼
https://www.sonarsource.com/blog/a-twist-in-the-code-openmeetings-vulnerabilities-through-unexpected-application-state/

Apache OpenMeetings Web Conferencing Tool Exposed to Critical Vulnerabilities
https://thehackernews.com/2023/07/apache-openmeetings-web-conferencing.html

Linux使用者留意！Ghostscript發現嚴重遠端程式碼執行漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10571

缺陷追蹤管理系統Jira的外掛程式路徑穿越漏洞被用於攻擊行動
https://www.securityweek.com/two-jira-plugin-vulnerabilities-in-attacker-crosshairs/

Google發布Chrome 115，修補20個漏洞
https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html

郵件伺服器系統Zimbra出現零時差漏洞，此漏洞已被用於攻擊行動
https://www.bleepingcomputer.com/news/security/zimbra-urges-admins-to-manually-fix-zero-day-exploited-in-attacks/

思科SD-WAN vManage網路管理系統存在REST API漏洞
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-unauthapi-sphCLYPA

Citrix修補Ubuntu版VPN用戶端重大漏洞
https://https//support.citrix.com/article/CTX564169/citrix-secure-access-client-for-ubuntu-security-bulletin-for-cve202324492

CISA將Windows、Netwrix Auditor漏洞列入已遭利用名單
https://www.cisa.gov/news-events/alerts/2023/07/11/cisa-adds-five-known-vulnerabilities-catalog

竊資軟體假借Linux漏洞概念性驗證程式散布
https://www.bleepingcomputer.com/news/security/fake-linux-vulnerability-exploit-drops-data-stealing-malware/

Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
https://www.exploit-db.com/exploits/51589

Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
https://www.exploit-db.com/exploits/51574

Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.
https://www.exploit-db.com/exploits/51609

Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure
https://www.exploit-db.com/exploits/51571

Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
https://www.exploit-db.com/exploits/51575

2.銀行/金融/保險/證券/金融監理 新聞及資安
駭客組織FIN8透過後門程式Sardoinc部署勒索軟體BlackCat
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor

FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware Attacks
https://thehackernews.com/2023/07/fin8-group-using-modified-sardonic.html

元大金供應商大會，聚焦資安管理議題
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10570

證交所舉辦「證券商資通安全會議」，共包括三大議題
https://m.esunsec.com.tw/news/instant-detail.aspx?id=%7B30BCB7B0-9595-4B09-B1CF-2D0450516A35%7D

證交所：券商資安零容忍
https://reurl.cc/DALQWR

政大籌設資安研究中心，以金融資安為主軸
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10579

金管會正式公布開放銀行第三階段最新進度，最快明年初開放上路
https://www.ithome.com.tw/news/157843

開放銀行第3階段要來了！35項交易服務　最快明年上路
https://finance.ettoday.net/news/2542744

「開放銀行」最快明年初可上路 金管會將把關資安
https://udn.com/news/story/7239/7308759

3.信用卡/電子支付/行動支付/pay/支付系統/資安
WordPress電子商城付款外掛WooCommerce Payments漏洞出現攻擊行動
https://www.wordfence.com/blog/2023/07/massive-targeted-exploit-campaign-against-woocommerce-payments-underway/

Cybercriminals Exploiting WooCommerce Payments Plugin Flaw to Hijack Websites
https://thehackernews.com/2023/07/cybercriminals-exploiting-woocommerce.html

防詐破口…警示情報 電支、銀行卡關
https://udn.com/news/story/7239/7303422

電支成防詐破口 業者稱警示帳戶銀行端溝通受限
https://news.pts.org.tw/article/646510

電支防詐再強化 月底前需登錄金融機構聯防電子化平台
https://money.udn.com/money/story/5613/7300037

微信支付可綁定國際信用卡 在中國大陸消費
https://reurl.cc/GALykA

中國｜螞蟻集團：支付寶完成對境外用戶使用移動支付的服務支持
https://reurl.cc/eD7l5L

尼日利亞電子支付發達　惟最新研究揭示「陰暗面」
https://www.hk01.com/article/915695?utm_source=01articlecopy&utm_medium=referral

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
比特幣價格攀3個月高點 背後有股神秘推力
https://ctee.com.tw/news/global/902660.html

鏈上數據顯示：美國政府又賣掉 8,200 枚比特幣
https://blockcast.it/2023/07/21/mica-daily-0721/

XRP創紀錄！瑞波幣交易量「首度超越」比特幣(BTC)
https://www.blocktempo.com/xrp-market-share-of-volume-surpasses-bitcoin-for-the-first-time/

前Elliptic加密顧問：比特幣不再是犯罪分子的首選資產
https://news.cnyes.com/news/id/5259503?exp=a

Fantom：已緊急凍結6000萬枚USDC、FTM下挫10%
https://www.blocktempo.com/fantom-said-60-million-usdc-has-been-frozen-urgently/

借貸協議Geist Finance因Multichain漏洞將永久關閉
https://news.cnyes.com/news/id/5252769

安全公司：上周發生的15起安全事件造成約550萬美元的損失
https://news.cnyes.com/news/id/5252995

數據：從1月到2023年6月，加密行業造成約4.794億美元的損失
https://news.cnyes.com/news/id/5254594

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Ransom.Win32.NOKO.YPDFA 勒索病毒
https://reurl.cc/ZWq5eW

新種無檔案惡意軟體 PyLoose，藏身記憶體內挖掘加密貨幣且難以偵測
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10574

殭屍網路Dark.IoT鎖定兆勤防火牆、VPN設備的重大漏洞而來
https://www.fortinet.com/blog/threat-research/ddos-botnets-target-zyxel-vulnerability-cve-2023-28771

勒索軟體Mallox鎖定微軟SQL Server而來
https://unit42.paloaltonetworks.com/mallox-ransomware

化妝品業者雅詩蘭黛傳出遭BlackCat、Clop勒索軟體攻擊
https://therecord.media/blackcat-clop-claim-cyberattack-on-estee-lauder

駭客組織TeamTNT發起殭屍網路Silentbob攻擊行動
https://blog.aquasec.com/teamtnt-reemerged-with-new-aggressive-cloud-campaign

新版LokiBot惡意軟體正透過Windows Office文件檔案傳播
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10575

巴基斯坦組織遭到惡意軟體ShadowPad攻擊
https://www.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-pakistani-government-delivers-shad.html

盜版瑪利歐電影暗藏惡意軟體，駭客意圖竊取用戶瀏覽器的密碼及信用卡資料
https://blog.avast.com/mario-movie-malware

勒索軟體SophosEncrypt假冒資安業者Sophos發動攻擊
https://www.bleepingcomputer.com/news/security/cybersecurity-firm-sophos-impersonated-by-new-sophosencrypt-ransomware/

勒索軟體NoEscape一個月有10個組織受害，疑為Avaddon東山再起
https://www.bleepingcomputer.com/news/security/fake-linux-vulnerability-exploit-drops-data-stealing-malware/

UEFI惡意程式BlackLotus傳出原始碼外洩
https://www.bleepingcomputer.com/news/security/source-code-for-blacklotus-windows-uefi-malware-leaked-on-github/

專訪：以魔法打敗魔法？Thales 用加密技術揪出勒索軟體
https://netmag.tw/2023/07/18/interview-defeating-magic-with-magicthales-uses-encryption-technology-to-uncover-ransomware

惡意軟體Sogu、Snowydrive透過USB裝置散布
https://www.mandiant.com/resources/blog/infected-usb-steal-secrets

Malicious USB Drives Targetinging Global Targets with SOGU and SNOWYDRIVE Malware
https://thehackernews.com/2023/07/malicious-usb-drives-targetinging.html

Cybercriminals Exploit Microsoft Word Vulnerabilities to Deploy LokiBot Malware
https://thehackernews.com/2023/07/cybercriminals-exploit-microsoft-word.html

Local Governments Targeted for Ransomware – How to Prevent Falling Victim
https://thehackernews.com/2023/07/local-governments-targeted-for.html

DDoS Botnets Hijacking Zyxel Devices to Launch Devastating Attacks
https://thehackernews.com/2023/07/ddos-botnets-hijacking-zyxel-devices-to.html

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks
https://thehackernews.com/2023/07/mallox-ransomware-exploits-weak-ms-sql.html

Pakistani Entities Targeted in Sophisticated Attack Deploying ShadowPad Malware
https://thehackernews.com/2023/07/pakistani-entities-targeted-in.html

俄羅斯駭客Turla鎖定國防產業的Exchange伺服器，並將其當作C2伺服器
https://www.bleepingcomputer.com/news/security/microsoft-hackers-turn-exchange-servers-into-malware-control-centers/

Turla's New DeliveryCheck Backdoor Breaches Ukrainian Defense Sector
https://thehackernews.com/2023/07/turlas-new-deliverycheck-backdoor.html

蠕蟲程式P2PInfect鎖定Redis伺服器而來
https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/

New P2PInfect Worm Targeting Redis Servers on Linux and Windows Systems
https://thehackernews.com/2023/07/new-p2pinfect-worm-targeting-redis.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
駭客濫用WebAPK誘騙安卓用戶安裝惡意程式
https://thehackernews.com/2023/07/hackers-exploit-webapk-to-deceive.html
https://twitter.com/getriffsec/status/1676663509617131520
https://www.linkedin.com/pulse/using-webapk-technology-phishing-attacks-csirt-knf/

Hackers Exploit WebAPK to Deceive Android Users into Installing Malicious Apps
https://thehackernews.com/2023/07/hackers-exploit-webapk-to-deceive.html

CISA and NSA Issue New Guidance to Strengthen 5G Network Slicing Against Threats
https://thehackernews.com/2023/07/cisa-and-nsa-issue-new-guidance-to.html

冒牌Threads社交App竟登上歐洲蘋果App Store第一
https://www.hackread.com/fake-threads-app-apple-store-europe/

安卓手機比iPhone容易被駭？Google新規要揪App害群之馬
https://3c.ltn.com.tw/news/54156

豪車科技升級綁手機 專家憂資安漏洞洩個資
https://news.ebc.net.tw/news/society/373900

「穿絲襪等我」！公部門群組傳色色訊息　稱「病毒入侵」遭網吐槽
https://ctinews.com/news/items/gOnLZgyjak

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
元老級駭客Kevin Mitnick過世，享年59歲
https://www.ithome.com.tw/news/157889
https://www.dignitymemorial.com/obituaries/las-vegas-nv/kevin-mitnick-11371668
https://twitter.com/kminx/status/1682027234796924928
https://www.nytimes.com/2023/07/20/technology/kevin-mitnick-dead-hacker.html

資安專才遭科技業挖走 他點出這些關鍵原因
https://udn.com/news/story/7240/7305741

台南警官為跳槽科技大廠提早退休　具「資安專長」年薪飆破300萬
https://today.line.me/tw/v2/article/DRyx8PB

Google 美國遇集體訴訟，以用戶數據訓練 AI 但未獲授權
https://technews.tw/2023/07/17/google-hit-with-lawsuit-alleging-it-stole-data-from-millions-of-users-to-train-its-ai-tools/

社群網站建置工具Lemmy遭到零時差漏洞攻擊
https://www.securityweek.com/hackers-target-reddit-alternative-lemmy-via-zero-day-vulnerability/

一字之差！逾10萬原應寄至美國軍方的電子郵件，恐因網域名稱錯誤而傳至敵對的馬利共和國
https://www.ft.com/content/ab62af67-ed2a-42d0-87eb-c762ac163cf0

挪威資源回收業者Tomra遭到網路攻擊，關閉內部系統
https://www.securityweek.com/recycling-giant-tomra-takes-systems-offline-following-cyberattack/

攻擊行動DangerousPassword鎖定開發人員而來，Windows、macOS、Linux用戶都是目標
https://blogs.jpcert.or.jp/en/2023/07/dangerouspassword_dev.html

俄羅斯駭客透過波蘭大使館電子郵件攻擊西方駐烏外交使團
https://big5.ftchinese.com/interactive/115735?exclusive

中國駭客入侵美國務院電郵 CNN：提早獲知布林肯訪中前想法
https://reurl.cc/65Y3pO

美國政府機構之電子郵件系統遭中國支持的網路攻擊組織滲透
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10568

美國CISA發布保護雲端環境安全的工具
https://www.cisa.gov/resources-tools/resources/free-tools-cloud-environments

美國公布國家網路安全戰略實施計畫
https://www.whitehouse.gov/wp-content/uploads/2023/07/National-Cybersecurity-Strategy-Implementation-Plan-WH.gov_.pdf

JumpCloud供應鏈攻擊疑為北韓駭客所為
https://thehackernews.com/2023/07/north-korean-state-sponsored-hackers.html
https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/
https://www.reuters.com/technology/n-korea-hackers-breached-us-it-company-bid-steal-crypto-sources-2023-07-20/
https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/

North Korean State-Sponsored Hackers Suspected in JumpCloud Supply Chain Attack
https://thehackernews.com/2023/07/north-korean-state-sponsored-hackers.html

中國駭客APT41鎖定行動裝置散布間諜軟體WyrmSpy、DragonEgg
https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41

Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware
https://thehackernews.com/2023/07/chinese-apt41-hackers-target-mobile.html

U.S. Government Blacklists Cytrox and Intellexa Spyware Vendors for Cyber Espionage
https://thehackernews.com/2023/07/us-government-blacklists-cytrox-and.html

Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats
https://thehackernews.com/2023/07/microsoft-expands-cloud-logging-to.html

資訊安全分析師 Security Analyst
https://www.104.com.tw/job/6t00v?jobsource=jolist_b_relevance

資訊安全分析師 (大數據平台 Splunk 應用 )
https://www.104.com.tw/job/6iubm?jobsource=jolist_b_relevance

資訊安全分析師【台北】
https://www.104.com.tw/job/7iidg?jobsource=jolist_b_relevance

資訊安全分析師(初/中/高)級 Security Analyst (T1/T2/T3)
https://www.104.com.tw/job/79u7l?jobsource=jolist_b_relevance

儲備資訊安全分析師【宇數科技-高雄】_三個月專業培訓(無經驗可)
https://www.104.com.tw/job/6p7ra?jobsource=jolist_b_relevance

〔資訊〕資安分析師
https://www.104.com.tw/job/7vsy8?jobsource=jolist_b_relevance

AD10507 資安分析師
https://www.104.com.tw/job/7fipf?jobsource=jolist_b_relevance

端點資安防護分析師
https://www.104.com.tw/job/7qdy3?jobsource=jolist_b_relevance

Anti-Virus Research Scientist/Engineer 電腦病毒分析師 - Taipei (Req: 11699)_歡迎應屆畢業生應徵
https://www.104.com.tw/job/477n9?jobsource=jolist_b_relevance

【資安所】網路資安分析師
https://www.104.com.tw/job/80oat?jobsource=jolist_b_relevance

資安威脅獵捕分析師(Threat Hunting) - 台北(中芯)
https://www.104.com.tw/job/79xe2?jobsource=jolist_b_relevance

網路資安效能分析師-台北
https://www.104.com.tw/job/7ug37?jobsource=jolist_b_relevance

【開發金控】資安分析師 (經理/協理)
https://www.104.com.tw/job/7pgvw?jobsource=jolist_b_relevance

資安鑑識分析師(台南)
https://www.104.com.tw/job/7pacw?jobsource=jolist_b_relevance

資訊安全威脅獵捕分析師/研究員
https://www.104.com.tw/job/7eim4?jobsource=jolist_b_relevance

【TeamT5網路威脅情資分析師團隊實習生招募計畫】
https://www.104.com.tw/job/74n0t?jobsource=jolist_b_relevance

JNR360-威脅策略分析師
https://www.104.com.tw/job/817u0?jobsource=jolist_b_relevance

【台中】Information Security Analyst 資安事件分析師
https://www.104.com.tw/job/7jlnm?jobsource=jolist_b_relevance

資安威脅及事件分析師-M212
https://www.104.com.tw/job/7wi9q?jobsource=jolist_b_relevance

資安鑑識分析師
https://www.104.com.tw/job/5xtj0?jobsource=jolist_b_relevance

網路安全分析師 / 資訊安全工程師
https://www.104.com.tw/job/7h6sb?jobsource=jolist_b_relevance

L2 Security Analyst / L2 安全分析師 (台北)
https://www.104.com.tw/job/7x7l8?jobsource=jolist_b_relevance

資安分析師/資安工程師
https://www.104.com.tw/job/7o70a?jobsource=jolist_b_relevance

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
假資訊太多，美政府要調查ChatGPT的模型訓練及資料蒐集、安全方法
https://www.ithome.com.tw/news/157818

Let's Encrypt將於2024年終止跨簽章支援
https://www.ithome.com.tw/news/157725

個資論斤秤兩賣，台灣談資安恐淪為笑話
https://www.storm.mg/article/4830210

CERT-UA Uncovers Gamaredon's Rapid Data Exfiltration Tactics Following Initial Compromise
https://thehackernews.com/2023/07/cert-ua-uncovers-gamaredons-rapid-data.html

惡意軟體分析平臺VirusTotal驚傳資料外洩，逾5千用戶個資受影響
https://www.spiegel.de/netzwelt/web/virustotal-datenleck-offenbart-kunden-der-google-sicherheitsplattform-a-abc16326-ddff-4a11-b149-d96be7f3bdbd

VirusTotal Data Leak Exposes Some Registered Customers' Details
https://thehackernews.com/2023/07/virustotal-data-leak-exposes-some.html

Owner of BreachForums Pleads Guilty to Cybercrime and Child Pornography Charges
https://thehackernews.com/2023/07/owner-of-breachforums-pleads-guilty-to.html

JumpCloud Blames 'Sophisticated Nation-State' Actor for Security Breach
https://thehackernews.com/2023/07/jumpcloud-blames-sophisticated-nation.html

CI/CD代管服務Google Cloud Build存在漏洞Bad.Build，恐讓攻擊者用來提升權限
https://www.bleepingcomputer.com/news/security/google-cloud-build-bug-lets-hackers-launch-supply-chain-attacks/
https://orca.security/resources/blog/bad-build-google-cloud-build-potential-supply-chain-attack-vulnerability/
https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/

Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation
https://thehackernews.com/2023/07/badbuild-flaw-in-google-cloud-build.html

竊資軟體BundleBot假借提供Google的AI機器人的名義散布，目的是挾持臉書帳號
https://research.checkpoint.com/2023/byos-bundle-your-own-stealer/

研究人員揭露濫用ZIP頂級網域的網釣攻擊行動
https://www.fortinet.com/blog/industry-trends/threat-actors-add-zip-domains-to-phishing-arsenals

台電針對以電費帳單為幌子的釣魚郵件攻擊提出警告
https://www.taipower.com.tw/tc/news_info.aspx?id=6594&chk=177ddec6-3ea0-4839-8dc7-ceb107080249&mid=5563

冒牌廣告管理程式、瀏覽器延伸套件鎖定臉書用戶而來
https://www.malwarebytes.com/blog/threat-intelligence/2023/07/criminals-target-businesses-with-malicious-extension-for-metas-ads-manager-and-accidentally-leak-stolen-accounts

俄羅斯駭客Gamaredon入侵受害電腦1小時內外洩資料
https://cert.gov.ua/article/5160737

針對AWS的雲端帳密盜竊攻擊Silentbob蔓延，駭客也開發Azure、GCP攻擊工具
https://www.darkreading.com/cloud/aws-cloud-credential-stealing-campaign-spreads-azure-google
https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/

駭客打造AI犯罪工具WormGPT發動商業郵件詐騙攻擊
https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks/

WormGPT: New AI Tool Allows Cybercriminals to Launch Sophisticated Cyber Attacks
https://thehackernews.com/2023/07/wormgpt-new-ai-tool-allows.html

防詐騙！中華「偽裝來電」先警示　台灣大「隱碼」個資不外洩
https://www.nownews.com/news/6200235

當心！駭客正濫用 Glitch 平台散佈釣魚郵件，試圖騙取 Microsoft 365 帳號
https://www.techbang.com/posts/107899-hackers-abused-the-glitch-platform-to-distribute-phishing

E.研究報告/工具
8.5%的Docker映像檔含有私鑰、API密鑰或其他敏感資訊
https://arxiv.org/pdf/2307.03958.pdf

數位韌性這樣做：五大構面與實例
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&cat=60&id=0000668887_E1T7O7B59FYAQL66S1FNO

電商客服的挑戰及ChatGPT應用的風險
https://view.ctee.com.tw/business/51069.html

瑞星捕获疑似朝鲜黑客组织针对韩国发起的APT攻击
https://www.aqniu.com/vendor/98028.html

关闭WIN10/WIN11的自动更新
http://blog.nsfocus.net/win10-win11/

These 6 Questions Will Help You Choose the Best Attack Surface Management Platform
https://thehackernews.com/2023/07/these-6-questions-will-help-you-choose.html

Go Beyond the Headlines for Deeper Dives into the Cybercriminal Underground
https://thehackernews.com/2023/07/go-beyond-headlines-for-deeper-dives.html

How to Manage Your Attack Surface
https://thehackernews.com/2023/07/how-to-manage-your-attack-surface.html

Exploring the Dark Side: OSINT Tools and Techniques for Unmasking Dark Web Operations
https://thehackernews.com/2023/07/exploring-dark-side-osint-tools-and.html

A Few More Reasons Why RDP is Insecure (Surprise!)
https://thehackernews.com/2023/07/a-few-more-reasons-why-rdp-is-insecure.html

F.商業
VMware與AMD、三星和RISC-V Keystone共同推廣機密運算提升工作負載安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10563

104資訊科技攜手蓋亞資訊建構資安戰情雷達系統 提升應變及防護能力
https://www.techbang.com/posts/107878-104-improve-resilience-and-protection

微軟發佈 Microsoft Entra 新身份識別資安解決方案 強化零信任架構
https://news.microsoft.com/zh-tw/microsoft-entraid-zerotrust/

工控安全防護刻不容緩，Fortinet攜生態系夥伴揭製造業最佳資安解方
https://www.techbang.com/posts/107779-industrial-control-security-protection-is-urgent-fortinet-and

Fortinet 共築資安聯防體系
https://www.chinatimes.com/newspapers/20230717000291-260210?chdtv

資安防護網再晉級！Netron網創資訊如何助攻人資系統領導品牌MAYO，擄獲《財富》500 強客戶的心
https://www.cw.com.tw/article/5126447

G.政府
高雄長庚紀念醫院與法務部調查局合作資安聯防
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10572

數位部揭露2022年政府資安情勢，資安事件達765件，近5年新高
https://ec.ltn.com.tw/article/paper/1594609

為因應可能會出現的網路攻擊，國防部將動員民間資安人才參與漢光演習
https://www.cna.com.tw/news/aipl/202307110164.aspx

漢光演習下週登場 顧立雄揭目標：讓中共無法越過台海
https://news.ltn.com.tw/news/politics/breakingnews/4370948

為防範駭客假冒政府名義行騙，政府設置專屬簡訊平臺，預估9月底建置完成
https://udn.com/news/story/7240/7293336

總統訪美遭駭客猛攻　數位發展部長唐鳳曝4字訣護國
https://www.ftvnews.com.tw/news/detail/2023717W0078

台灣申請加入CPTPP密件遭外洩？路透：國安局證實正在徹查
https://udn.com/news/story/7238/7316456

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
惡意軟體AVrecon感染逾7萬臺路由器
https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/

Honeywell Experion DCS分散式控制系統發現9個安全漏洞
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10576

即時通訊框架QuickBlox存在漏洞，恐曝露數百萬使用者資料
https://www.hackread.com/exploitable-flaws-quickblox-expose-user-records/
https://research.checkpoint.com/2023/major-security-flaws-in-popular-quickblox-chat-and-video-framework-expose-sensitive-data-of-millions/
https://claroty.com/team82/research/major-security-flaws-in-popular-quickblox-chat-and-video-framework-expose-sensitive-data-of-millions

Critical Security Flaws Uncovered in Honeywell Experion DCS and QuickBlox Services
https://thehackernews.com/2023/07/critical-security-flaws-uncovered-in.html

為強化物聯網裝置安全，美國打算推出資安信任標章
https://www.fcc.gov/cybersecurity-certification-mark
https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/18/biden-harris-administration-announces-cybersecurity-labeling-program-for-smart-devices-to-protect-american-consumers/
https://www.fcc.gov/document/rosenworcel-announces-cybersecurity-labeling-program-smart-devices

GE人機介面與SCADA產品Cimplicity存在漏洞，恐被攻擊者用於執行任意程式碼
https://www.securityweek.com/recently-patched-ge-cimplicity-vulnerabilities-reminiscent-of-russian-ics-attacks/

FIRST揭露CVSS風險評分4.0，首度針對工業控制系統與物聯網裝置提供額外評估指標
https://www.first.org/newsroom/releases/20230713

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials
https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4

EC-Council ECSA資安分析專家 v10 考試心得分享
https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html

20180817 EC-Council ECSA v10 PASS
https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html

關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享
https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

CPENT 從暴力到破解
https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295

Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master
https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f

CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證
https://ucom.uuu.com.tw/web/Testimony/Article/4404

kaizensecurity/CPENT
https://github.com/kaizensecurity/CPENT/tree/master

CPENT : Pentesting like NO OTHERS !
https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/

Journey of My CPENT Exam
https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享
https://hackmd.io/@henry-ko/HyQ56e8eF

ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年
https://reurl.cc/aVLoX9

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」
https://www.ithome.com.tw/news/156754

用證照證明自己實力之餘，更應將證照視為督促學習的最大動力
https://www.ithome.com.tw/news/156756

打破證照誤解與迷思，資安專家帶你釐清資安證照的意義
https://www.ithome.com.tw/news/156755

Accelerate Your Career with the Global Leader in Cyber Security Training
https://www.sans.org/mlp/promo-partnership-hacker-news/

6.近期資安活動及研討會
Taipei dbt Meetup #13 (in-person 👫 & online 👨‍💻)2023/7/26
https://www.meetup.com/taipei-dbt-meetup/events/294298229/

2023政府資安發展論壇-零信任 打造韌性國家 2023/7/27
https://www.informationsecurity.com.tw/seminar/2023_Infosec-gov/

AI引爆電商革命 數據驅動變現力 2023/7/27
https://www.accupass.com/event/2305190535222139620296

大數據分析進階班 2023/7/27 ~ 2023/7/28
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=600

【舒虎教育】《區塊鏈初階課程》平日班 2023/7/27 ~ 2023/7/28
https://www.accupass.com/event/2305280843071623542481

資安風險論壇 - 上市櫃公司資安治理與零信任架構 2023/7/28
https://www.leeandli.com/TW/NewslettersDetail/7118.htm

緯育TibaMe「 第二屆IT人才求職趣」大型人才招募活動 2023/7/29
https://tibametibame.kktix.cc/events/goodjob729even

【舒虎教育】《區塊鏈初階課程》假日班 2023/7/29 ~ 2023/7/30
https://www.accupass.com/event/2305280843202058678448

COSCUP 2023 2023/07/29 ~ 2023/07/30
https://coscup.org/2023/zh-TW/landing

112 年度政大區網中心研討會 2023/7/31
https://tp2rc.tanet.edu.tw/seminar

入門 AI 開源的生態系平台 Hugging Face 2023/7/31
https://www.meetup.com/rladies-taipei/events/294283382/

InfoSec Taiwan 2023 國際資安大會 2023/8/1 ~ 2023/8/3
https://csa.kktix.cc/events/infosectaiwan2023

大數據分析進階班 2023/8/10 ~ 2023/8/11
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=611

DEF CON 32 2023/8/10 ~ 2023/8/13
https://defcon.org/index.html

AIoT應用實作研習班 2023/8/16 ~ 2023/8/17
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=601

HITCON CMT 2023 2023/08/18 ~ 2023/08/19
https://hitcon.org/2023/CMT/

大數據分析進階班 (台中) 2023/8/21 ~ 2023/8/22
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=612

AIoT應用實作研習班 (台中) 2023/8/23 ~ 2023/8/24
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=604

5G+AIOT機器人智慧生活應用科學營 2023/8/23 ~ 2023/8/25
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=625

【資安課程】數位鑑識工具與實務課程｜ACW SOUTH數位產業署沙崙資安服務基地 2023/8/31
https://ievents.iii.org.tw/EventS.aspx?t=0&id=2170

2023中部製造業資安論壇 2023/9/1
https://www.informationsecurity.com.tw/seminar/2023_TCM/register.aspx

PyCon TW 2023 2023/9/2 ~ 2023/9/3
https://tw.pycon.org/2023/zh-hant/registration/tickets

Web應用滲透測試 2023/9/7 ~ 2023/9/8
https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=631

Hou.Sec.Con 2023/10/12 ~ 2023/10/13
https://web.cvent.com/event/76d46ccb-fe00-4fe5-ba46-e4a77c807f21/summary

(ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27
https://www.isc2.org/Congress-2023