###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2022/10/17 ~ 2022/10/21

1.重大弱點漏洞/後門/Exploit/Zero Day
Fortinet防火牆、網頁安全閘道、網路設備管理系統的重大漏洞CVE-2022-40684已出現攻擊行動
https://www.bleepingcomputer.com/news/security/fortinet-urges-admins-to-patch-bug-with-public-exploit-immediately/

Fortinet修補重大漏洞已有攻擊行動，1.7萬臺設備曝險，臺灣653臺全球第三
https://www.ithome.com.tw/tech/153719

Fortinet說明優先向特定用戶通報重大漏洞CVE-2022-40684的原因
https://www.fortinet.com/blog/psirt-blogs/update-regarding-cve-2022-40684

Researchers Detail Windows Zero-Day Vulnerability Patched Last Month
https://thehackernews.com/2022/10/researchers-reveal-detail-for-windows.html

0patch釋出非官方的Windows MOTW漏洞修補程式
https://times.hinet.net/news/24201213

微軟針對TLS交握錯誤發布額外修補程式
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-tls-handshake-failures-in-out-of-band-updates/

上千臺Zimbra郵件伺服器遭到重大漏洞CVE-2022-41352攻擊
https://www.bleepingcomputer.com/news/security/almost-900-servers-hacked-using-zimbra-zero-day-flaw/

Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite
https://thehackernews.com/2022/10/zimbra-releases-patch-for-actively.html

Critical RCE Vulnerability Discovered in Popular Cobalt Strike Hacking Software
https://thehackernews.com/2022/10/critical-rce-vulnerability-discovered.html

出現影響程度直逼Log4Shell的漏洞！Apache修補Commons Text重大漏洞CVE-2022-42889
https://www.darkreading.com/application-security/researchers-keep-a-wary-eye-on-critical-new-vulnerability-in-apache-commons-text

Apache近日發布更新以解決多個產品的安全性弱點
https://nvd.nist.gov/vuln/detail/CVE-2022-42889#vulnCurrentDescriptionTitle

apache airflow CVE-2022-41672
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41672

apache commons_jxpath CVE-2022-41852
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41852

cisco ios_xe CVE-2022-20847 CVE-2022-20848 CVE-2022-20856 CVE-2022-20919 CVE-2022-20851
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20847
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20848
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20856
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20919
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20851

cisco sd-wan_vbond_orchestrator CVE-2022-20818 CVE-2022-20775 CVE-2022-20850
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20818
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20775
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-20850

cloudflare goflow CVE-2022-2529
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-2529

ibm qradar_security_information_and_event_manager CVE-2022-22480
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22480

ibm websphere_automation_for_ibm_cloud_pak_for_watson_aiops
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-22493

Oracle Critical Patch Update for October 2022
https://reurl.cc/le3ZzY

WordPress推出6.0.3版，修補16個漏洞
https://www.wordfence.com/blog/2022/10/patch-now-the-wordpress-6-0-3-security-update-contains-important-fixes/

滲透測試工具Cobalt Strike出現重大RCE漏洞，起因是修補不全造成
https://securityintelligence.com/posts/analysis-rce-vulnerability-cobalt-strike/

Hackers Started Exploiting Critical "Text4Shell" Apache Commons Text Vulnerability
https://thehackernews.com/2022/10/hackers-started-exploiting-critical.html

全景軟體 RAVA憑證驗證系統網站 - SQL Injection
https://www.twcert.org.tw/tw/cp-132-6617-109b0-1.html

2.銀行/金融/保險/證券/支付系統/金融監理 新聞及資安
消失的存款？帳戶6.7萬遭「駭客盜領」 客服稱自動儲值她崩潰：根本沒用過
https://www.chinatimes.com/realtimenews/20221019003373-260405?chdtv

財金公司F-ISAC 躍金融業防駭中樞
https://wantrich.chinatimes.com/news/20221021900399-420501

金融科技轉型與創新 重量級企業曝關鍵發展
https://www-ch.scu.edu.tw/october/news/18687

政大攜手華碩集團、富邦金控　推動資安人才培育
https://www.nccu.edu.tw/p/406-1000-12651,r17.php?Lang=zh-tw

百年彰銀面臨各種資安威脅，設資安長兼顧企業營運安全
https://www.ithome.com.tw/people/153627

More Fintech More Different！2022台北金融科技展
https://reurl.cc/V1y88Q

金融資安行動方案推動2年，金管會提出4大防護要點，並透露下個推動重點聚焦零信任與身分驗證框架
https://www.ithome.com.tw/news/153223

全國金控數位長大調查： 不上雲，如何談資安與國安？ 數位金融關鍵下一步
https://www.businesstoday.com.tw/article/category/183017/post/202210120028/

新光銀流通卡站上百萬張 積極朝數位支付生態圈拓展
https://reurl.cc/YXZ8VD

新光銀「數位轉型」邁步！總座李正國：數位帳戶存款目標百億元
https://finance.technews.tw/2022/10/21/digital-account-deposit/

ATM跨行服務系統 財金公司周末凌晨演練
https://wantrich.chinatimes.com/news/20221021900479-420501

3.電子支付/行動支付/pay/資安
Vulnerabilities in Online Payment Systems
https://medium.com/@claudio_moranb/vulnerabilities-in-online-payment-systems-edd2d3c06905

全盈強調顧客體驗 以inside打團戰
https://reurl.cc/0XYEZ9

後疫情時代電子支付百百種　中華電信多元付款一機搞定
https://www.ettoday.net/news/20221011/2346493.htm

電子支付車資反遭控坐霸王車 真相大白小黃運將慘了
https://udn.com/news/story/7320/6671524

愛金卡成就生態圈 自我配速前進
https://reurl.cc/EROG1k

持續優化電票與電支資料整合，一卡通靠掌握會員樣貌深化體驗
https://www.ithome.com.tw/people/153209

查賄標準核定 含行動支付
https://reurl.cc/9pgV7O

翻轉公股形象！台灣Pay黏住年輕人 贏家密碼大公開
https://www.chinatimes.com/realtimenews/20221016000010-260410?chdtv

無接觸付款開創新市場 行動裝置完成生活大小事
https://money.udn.com/money/story/5635/6698240

iPhone用戶看過來 2招快速完成LINE Pay支付
https://www.sogi.com.tw/articles/line_pay/6257532

支付、壽險、證券、銀行、投信各有亮點！金融服務再進化 贏家密碼大公開
https://udn.com/news/story/6852/6683883

HAPPY GO Pay行動支付 捐贈發票e起來 儲存、捐贈發票遠百禮券等你來抽
https://www.etax.nat.gov.tw/etwmain/announcement/news/rPV2e1r

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
Why Crypto Winter is No Excuse to Let Your Cyber Defenses Falter
https://thehackernews.com/2022/10/why-crypto-winter-is-no-excuse-to-let.html

Mastercard針對銀行推加密貨幣交易服務
https://www.ithome.com.tw/news/153683

朝鮮駭客攻擊日本多家交易所
https://news.cnyes.com/news/id/4980215

日本警察廳警告：多家加密貨幣交易所遭北韓「拉撒路」攻擊，疑駭走百億日元
https://www.blocktempo.com/japan-police-warn-north-korea-lazarus-attack-crypto-asset-company/

LiveArtX財庫錢包遭駭、197個NFT被盜！地板價跌80%；官方承諾100%負責
https://www.blocktempo.com/liveartx-releases-hack-incident-update/

LiveArtX被盜事件更新：197枚被盜NFT已銷毀，未和駭客談判並已報警
https://news.cnyes.com/news/id/4980802

在「加密寒冬」中破冰前行：Uniswap 完成 1.65 億美元融資
https://blockcast.it/2022/10/17/crypto-winter-hasnt-driven-away-vcs-uniswap-raises-165m-in-new-funding/

DAO現身 顛覆性區塊鏈正悄悄地在發生
https://view.ctee.com.tw/technology/45293.html

DAO Maker社區：團隊疑似通過操縱治理投票篡改承諾的賠償流程
https://news.cnyes.com/news/id/4980530

加密駭客最愛的跨鏈橋真的不能碰嗎？一文解釋不同跨鏈橋分類與比較：過去、現在與未來
https://abmedia.io/20221017-cross-chain-bridge-explained

幣安亞太情報長談犯罪應對　以冷錢包保護虛擬資產
https://www.digitimes.com.tw/iot/article.asp?id=0000647414_YRK3CP0P2OSSFM3VZLU0B

綠色區塊鏈Rubix宣佈首創舉辦虛擬黑客松競賽
https://www.businesswire.com/news/home/20221013005877/zh-HK/

EP.101 區塊鏈駭客週，熊市就是最補的時節：BNB Chain、Mango
https://player.soundon.fm/p/fdc9f2f8-73b0-4094-a16e-b01d78f4c3e2/episodes/bb1393eb-d179-4f79-81e5-0873579dae76

Chainalysis研究總監：網橋安全性是「未解決的技術挑戰」
https://reurl.cc/Qb8WKp

Mango駭客案》社群提賠償方案，將根據遭駭前一小時快照進行補償
https://www.blocktempo.com/mango-new-proposal-token-compensation-based-on-a-napshot-of-balances-one-hour-befor-the-attack/

BitKeep Swap遭駭客攻擊損失達100萬美元，官方承諾賠償用戶損失
https://news.cnyes.com/news/id/4980981

加密貨幣投資新手必看！一文破解加密貨幣七大迷思
https://www.businesstoday.com.tw/article/category/80402/post/202210180026/

DeFi借貸協議Moola Market遭駭客攻擊，損失840萬美元
https://news.cnyes.com/news/id/4981606

Alameda 領投 3,700 萬鎂的交易機器人服務「3Commas」，為何受加密交易者青睞
https://www.blocktempo.com/3commas-crypto-trading-bot-service-favored-by-traders/

以太坊鬧鐘服務遭駭 26 萬鎂，合約漏洞竟超過 4 年後才被發現
https://www.blocktempo.com/ethereum-alarm-clock-service-was-hackerd-for-260-thousand/

推特用戶利用發文警告跨鏈橋漏洞，拯救 BitAnt 免於駭客攻擊
https://www.marscryptonews.com/bitbtc1020/

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
勒索軟體Magniber利用JavaScript、.NET程式語言，並結合多款Windows公用工具發動寄生攻擊
https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

竊密軟體Ducktail透過PHP指令碼入侵Windows電腦，偷取臉書帳號
https://www.zscaler.com/blogs/security-research/new-php-variant-ducktail-infostealer-targeting-facebook-business-accounts

烏克蘭、波蘭物流業者遭到勒索軟體Prestige鎖定
https://www.microsoft.com/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/

英國NHS急救專線代管業者Advanced公布調查結果，證實遭到勒索軟體LockBit攻擊
https://www.theregister.com/2022/10/14/nhs_software_hosting_provider_advanced_ransomware_lockbit/

荷蘭警方利用比特幣交易空窗期，取得155個勒索軟體Deadbolt解密金鑰
https://www.bleepingcomputer.com/news/security/police-tricks-deadbolt-ransomware-out-of-155-decryption-keys/

勒索軟體Ransom Cartel疑駭客組織REvil東山再起
https://unit42.paloaltonetworks.com/ransom-cartel-ransomware/

惡意軟體Ursnif要求受害者文件輸入驗證碼來降低警覺
https://www.mandiant.com/resources/blog/rm3-ldr4-ursnif-banking-fraud

線上轉檔網站也有假的！有人以提供免費轉檔服務散布竊密程式RedLine Stealer
https://blog.cyble.com/2022/10/14/online-file-converter-phishing-page-spreads-redline-stealer/

駭客組織OldGremlin鎖定俄羅斯Linux主機，發動勒索軟體攻擊
https://www.group-ib.com/media-center/press-releases/oldgremlin-2022/

上櫃公司大拓日本子公司遭勒索軟體攻擊
https://www.ithome.com.tw/news/153728

伊朗民眾遭到安卓FurBall間諜軟體鎖定
https://www.welivesecurity.com/2022/10/20/domestic-kitten-campaign-spying-iranian-citizens-furball-malware/

16款點擊惡意App被下載超過2千萬次
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-malicious-clicker-found-in-apps-installed-by-20m-users/

中國駭客APT41利用惡意軟體Spyder Loader埋伏香港政府超過一年
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/spyder-loader-cuckoobees-hong-kong

中國駭客DiceyF鎖定東南亞的網路賭場部署惡意框架
https://securelist.com/diceyf-deploys-gameplayerframework-in-online-casino-development-studio/107723/

研究人員發現幾乎不可能偵測的PowerShell後門程式
https://www.safebreach.com/resources/blog/safebreach-labs-researchers-uncover-new-fully-undetectable-powershell-backdoor/

英國保險業者Kingfisher遭勒索軟體LockBit攻擊，泄洩1.4 TB資料
https://cybernews.com/news/hackers-stole-data-from-kingfisher-insurance/

德國媒體集團遭勒索軟體攻擊，報紙與電子報都停擺
https://www.ithome.com.tw/news/153713

日本科技公司大宮化成遭勒索軟體LockBit攻擊
https://securityaffairs.co/wordpress/137243/cyber-crime/oomiya-lockbit-3-0-ransomware.html

印度製藥廠Ipca Laboratories、Aarti Drugs遭勒索軟體攻擊
https://ciso.economictimes.indiatimes.com/news/after-ipca-laboratories-pharma-major-aarti-drugs-hit-by-ransomware-attack-data-leaked-on-dark-web/94913796

澳洲保險業者Medibank證實遭到勒索軟體攻擊
https://www.bleepingcomputer.com/news/security/australian-insurance-firm-medibank-confirms-ransomware-attack/

勒索軟體Venus鎖定遠端桌面連線服務入侵Windows電腦
https://www.bleepingcomputer.com/news/security/venus-ransomware-targets-publicly-exposed-remote-desktop-services/

駭客兜售UEFI惡意軟體BlackLotus
https://www.bleepingcomputer.com/news/security/malware-dev-claims-to-sell-new-blacklotus-windows-uefi-bootkit/

目標式勒索攻擊: 製造業榜首
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10122

新發現 PHP 資訊竊取惡意軟體，針對 Facebook 帳號發動釣魚攻擊
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10125

New PHP Version of Ducktail Malware Hijacking Facebook Business Accounts
https://thehackernews.com/2022/10/new-php-version-of-ducktail-malware.html

Black Basta Ransomware Hackers Infiltrate Networks via Qakbot to Deploy Brute Ratel C4
https://thehackernews.com/2022/10/black-basta-ransomware-hackers.html

New Prestige Ransomware Targeting Polish and Ukrainian Organizations
https://thehackernews.com/2022/10/new-prestige-ransomware-targeting.html

Сryptocurrency and Ransomware — The Ultimate Friendship
https://thehackernews.com/2022/10/ryptocurrency-and-ransomware-ultimate.html

Chinese 'Spyder Loader' Malware Spotted Targeting Organizations in Hong Kong
https://thehackernews.com/2022/10/chinese-spyder-loader-malware-spotted.html

Chinese Hackers Targeting Online Casinos with GamePlayerFramework Malware
https://thehackernews.com/2022/10/chinese-hackers-targeting-online.html

Experts Warn of Stealthy PowerShell Backdoor Disguising as Windows Update
https://thehackernews.com/2022/10/experts-warn-of-stealthy-powershell.html

sczriptzzbn inject pushes malware for NetSupport RAT
https://isc.sans.edu/diary/rss/29170

Ukrainian Military-Themed Excel File Delivers Multi-Stage Cobalt Strike Loader
https://otx.alienvault.com/pulse/63500a9e91356686ec60813b

New “Prestige” ransomware impacts organizations in Ukraine and Poland
https://otx.alienvault.com/pulse/634e8b4943741c14c4db6e12

Hackers Using New Version of FurBall Android Malware to Spy on Iranian Citizens
https://thehackernews.com/2022/10/hackers-using-new-version-of-furball.html

These 16 Clicker Malware Infected Android Apps Were Downloaded Over 20 Million Times
https://thehackernews.com/2022/10/these-16-clicker-malware-infected.html

New Ursnif Variant Likely Shifting Focus to Ransomware and Data Theft
https://thehackernews.com/2022/10/latest-ursnif-variant-shifts-focus-from.html

GuLoader Malware Disguised as a Word File Being Distributed in Korea
https://asec.ahnlab.com/en/40283/

OldGremlin Ransomware Targeted Over a Dozen Russian Entities in Multi-Million Scheme
https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
My iPad Dilemma is Settled
https://techuisite.com/my-ipad-dilemma-is-settled-e652826ed971

macOS 13 Ventura、iPadOS 16將在10月24日釋出
https://www.ithome.com.tw/news/153714

Verizon警告預付卡用戶手機門號挾持攻擊，至少有250個用戶受到影響
https://www.bleepingcomputer.com/news/security/verizon-notifies-prepaid-customers-their-accounts-were-breached/

南韓網路巨擘Kakao數據中心火災癱瘓系統　總統府撂重話: 「恐成國家安全致命問題」
https://www.taiwannews.com.tw/ch/news/4688341

韓國通訊龍頭Kakao週末大斷線 用戶叫苦連天引南韓總統關切
https://news.pts.org.tw/article/604891

Kakao癱瘓後不到一天時間 北韓疑試圖進行網路駭客攻擊
https://times.hinet.net/news/24202826

南韓版的LINE「Kakao」資料庫起火！通訊軟體故障引起民生癱瘓
https://n.yam.com/Article/20221020133721

一組電池引蝴蝶效應 韓國檢討資安弱點防國安危機
https://www.cna.com.tw/news/aopl/202210170225.aspx

安全研究人員發現iOS 16會繞過VPN傳送個人隱私敏感資訊 蘋果表示流量經過加密不準備修正
https://reurl.cc/7p6j8d

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
資安不只是 IT 的責任！老闆沒有這 3 個作為，別怪員工上駭客的當
https://www.managertoday.com.tw/columns/view/65873?

我代表隊國際資安賽摘銀！選手：世界看見台灣投入
https://ec.ltn.com.tw/article/breakingnews/4094428

台灣資安主管聯盟凝聚力量 推動公私協力、共創資安聯防
https://www.tca.org.tw/tca_news1.php?n=1872

知名廣告封鎖列表EasyList遭大量印度劣質瀏覽器存取導致服務異常
https://www.ithome.com.tw/news/153724

西半山男子電腦疑被駭客入侵　銀行戶口內40萬被轉走
https://www.hk01.com/article/827214?utm_source=01articlecopy&utm_medium=referral

駭客組織 Lapsus$ Uber：網絡安全事件幕後黑手
https://www.technice.com.tw/cloudtech/infosecurity/19349/

巴西警方逮捕疑似駭客組織Lapsus$成員
https://www.bleepingcomputer.com/news/security/brazil-arrests-suspect-believed-to-be-a-lapsus-gang-member/

伊恩颶風災情慘重，美國政府救濟金發放被駭客盯上，駭客透過即時通訊討論如何冒領的內容曝光
https://cofense.com/blog/scammers-are-targeting-hurricane-relief-funds-through-fema

美國商業媒體Fast Company透露更多資安事故的調查結果
https://www.bleepingcomputer.com/news/security/fast-company-says-executive-board-member-info-was-not-stolen-in-attack/

印度大型發電廠Tata Power證實遭到網路攻擊
https://techcrunch.com/2022/10/14/india-power-company-tata-power-cyber-attack/

美國政府提供紅隊分析工具RedEye
https://github.com/cisagov/RedEye/

CISA開源紅隊分析工具RedEye
https://www.ithome.com.tw/news/153681

揭密美國！史諾登歸化俄籍評價兩極
https://today.line.me/tw/v2/article/YanppVj

烏克蘭物流業遭駭客攻擊 微軟：與俄團隊非常相似
https://hkx.eu/economic/635593.html?amp=1

FBI警告：中共駭客或在美期中選舉前攻擊
https://reurl.cc/Qb8WyO

談印太網路威脅 美國土安全部長點名中、俄等國
https://www.cna.com.tw/news/aopl/202210190242.aspx

全球 1/3 資安新創都來自以色列！網路安全強國是如何煉成的
https://buzzorange.com/techorange/2022/10/21/cybersecurity-in-israel/

防中國大陸滲透 澳洲資助9.3億元供索羅門警力
https://money.udn.com/money/story/5599/6703776

中國宣揚網路主權概念可能造成的衝擊
https://indsr.org.tw/focus?typeid=18&uid=11&pid=202

Indian Energy Company Tata Power's IT Infrastructure Hit By Cyber Attack
https://thehackernews.com/2022/10/indian-energy-company-tata-powers-it.html

New Chinese Cyberespionage Group Targeting IT Service Providers and Telcos
https://thehackernews.com/2022/10/new-chinese-cyberespionage-group.html

Brazilian Police Arrest Suspected Member of Lapsus$ Hacking Group
https://thehackernews.com/2022/10/brazilian-police-arrest-suspected.html

資安工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=50293&HIRE_ID=11521669

MIS 程式設計師
https://www.104.com.tw/job/7meew

資安經理/副理 (跨國金控)
https://www.linkedin.com/jobs/view/%E8%B3%87%E5%AE%89%E7%B6%93%E7%90%86-%E5%89%AF%E7%90%86-%E8%B7%A8%E5%9C%8B%E9%87%91%E6%8E%A7-at-michael-page-3317635835/?originalSubdomain=tw

國立高雄師範大學 圖書資訊處 徵聘資安技術專員1名
https://www.nstc.gov.tw/folksonomy/detail/9d416077-bbfe-4901-b1cf-304fbfe617d1?l=ch

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
請加強防範偽冒技服中心之社交工程郵件
https://www.nccst.nat.gov.tw/NewInfoDetail?lang=zh&seq=1607

駭客公布竊自哥倫比亞的大量資料，曝露澳洲臥底警探身分
https://www.ithome.com.tw/news/153661

受哥倫比亞資安事故牽連！澳洲警察調查跨園販毒集團的相關機密曝光，恐導致正在進行的專案受阻
https://www.smh.com.au/national/secret-agents-targeting-drug-cartels-in-australia-exposed-in-data-hack-20221004-p5bmzg.html

針對電商業者資料外洩事件頻傳，刑事警察局擬升級「網安專案」，外洩個資的電商、負責維護的ERP業者恐面臨刑案調查
https://tw.news.yahoo.com/%E5%81%B7%E9%9B%9E%E9%9B%BB%E5%95%86%E5%B0%8F%E5%BF%83%E4%BA%861-%E5%88%91%E4%BA%8B%E5%B1%80%E6%8E%A8%E5%8B%95-%E7%B6%B2%E5%AE%89%E5%B0%88%E6%A1%882-0-%E5%A4%96%E6%B4%A9%E5%80%8B%E8%B3%87%E9%9B%BB%E5%95%86%E5%B0%87%E8%A2%AB%E5%88%91%E6%A1%88%E8%AA%BF%E6%9F%A5-073031512.html

又是網站廣告成效追蹤器肇事！美國醫療照護系統Advocate Aurora Health外洩300萬病人資料
https://healthitsecurity.com/news/3m-advocate-aurora-health-patients-face-phi-exposure-tied-to-tracking-pixels

美國CISA力挺FIDO無密碼身分認證機制，成新世代多因素認證標準
https://www.ithome.com.tw/news/153766

微軟伺服器配置錯誤導致大規模外洩！逾6.5萬家企業資料因此曝險
https://msrc-blog.microsoft.com/2022/10/19/investigation-regarding-misconfigured-microsoft-storage-location-2/

臺北市政府推出熊好券2.0，冒牌網站隨之出現
https://news.pts.org.tw/article/605266

法國網路酒商iDealwine遭到網路攻擊，客戶資料恐外洩
https://www.idealwine.info/update-to-idealwine-customers/

需要就學貸款的美國學生遭網路釣魚攻擊鎖定
http://www.ic3.gov/Media/Y2022/PSA221018

Microsoft 365的訊息加密功能可能會洩漏結構性資訊
https://labs.withsecure.com/advisories/microsoft-office-365-message-encryption-insecure-mode-of-operation

澳洲電商平臺MyDeal資料外洩，220萬客戶受到影響
https://www.bleepingcomputer.com/news/security/mydeal-data-breach-impacts-22m-users-stolen-data-for-sale-online/

全國馬拉松路跑網站傳遭害，眾點資訊公司發布防詐騙簡訊
https://www.watchmedia01.com/anews-20221014020630.html

對抗電信詐騙　從保護個資開始
https://forum.ettoday.net/news/2360478?redirect=1

KnowBe4網路釣魚測試結果揭示向商業相關郵件轉變的趨勢
http://www.businesswirechina.com/hk/news/51886.html

澳洲醫療保險公司Medibank遭網路攻擊 駭客威脅曝光1000名澳洲名人個資
https://reurl.cc/nOWZWD

澳洲星國控股電信公司資料庫遭網路攻擊，近千萬筆客戶個資外流，引發澳洲輿論討論及星國總理關注
https://www.trade.gov.tw/Pages/Detail.aspx?nodeID=45&pid=751510

Microsoft Confirms Server Misconfiguration Led to 65,000+ Companies' Data Leak
https://thehackernews.com/2022/10/microsoft-confirms-server.html

網傳圖卡擷取LINE社群流傳「急徵30位！線上操作員...」訊息，稱是「都說網軍治國還不信 你說這是什麼工作」
https://tfc-taiwan.org.tw/articles/8326

E.研究報告/工具
GitHub Copilot建議結果包含受保護程式碼，訓練資料來源合法性爭議再起
https://www.ithome.com.tw/news/153682

從零信任建構政府數位韌性
https://fc.bnext.com.tw/articles/view/2497?

什麼是VPN，為什麼需要它？絕不只搭配 Netflix 跨境追劇而已！加碼推薦 5 款「VPN 軟體」，更安全的網路使用方式
https://www.gq.com.tw/gadget/article/vpn

狂收釣魚網址？連台積電都曾中毒停機，你該做的「零信任」4件事
https://money.udn.com/money/story/5612/6697149

什麼是 電子郵件數位簽章 ？郵件簽章如何防止 email 詐騙
http://www.digitalwall.com/scripts/displaypr.asp?UID=86840

結合FAIR與NIST資安框架分析資安風險：以金融業為例
https://ndltd.ncl.edu.tw/cgi-bin/gs32/gsweb.cgi/login?o=dnclcdr&s=id=%22110NCU05015079%22.&searchmode=basic

How To Build a Career as a Freelance Cybersecurity Analyst — From Scratch
https://thehackernews.com/2022/10/how-to-build-career-as-freelance.html

Researchers Say Microsoft Office 365 Uses Broken Email Encryption to Secure Messages
https://thehackernews.com/2022/10/researchers-claim-microsoft-office-365.html

Researchers Detail Azure SFX Flaw That Could've Allowed Attackers to Gain Admin Access
https://thehackernews.com/2022/10/researchers-detail-azure-sfx-flaw-that.html

A Quick Guide for Small Cybersecurity Teams Looking to Invest in Cyber Insurance
https://thehackernews.com/2022/10/a-quick-guide-for-small-cybersecurity.html

Finding P1 Vulnerabilities: A Step by Step Guide
https://medium.com/the-gray-area/finding-p1-vulnerabilities-a-step-by-step-guide-b88521195204

JavaScript concepts that every developer should know
https://mukeshprajapati0251.medium.com/javascript-concepts-that-every-developer-should-know-2fa6543c9c60

Passive Income in Cyber Security — How to guide
https://taimurcloud123.medium.com/passive-income-in-cyber-security-how-to-guide-e437fb9a8f34

Passive Income in Cyber Security — Part 2
https://taimurcloud123.medium.com/passive-income-in-cyber-security-part-2-f7066504a47b

10 SQL Queries You Should Keep In Mind
https://pythonians.medium.com/10-sql-queries-you-should-keep-in-mind-33502328515

You should know these Linux commands to improve your terminal game
https://devangtomar.medium.com/you-should-know-these-linux-commands-to-improve-your-terminal-game-%EF%B8%8F-85aa58aa6996

Not All Sandboxes Are for Children: How to Secure Your SaaS Sandbox
https://thehackernews.com/2022/10/not-all-sandboxes-are-for-children-how.html

Fuzzing for Bug Bounty Hunting
https://maheshbasnet.medium.com/how-fuzzing-can-boost-you-bug-bounty-career-49e499900aa9

Linux/Ubuntu Commands To Speed Up Your Daily Work
https://levelup.gitconnected.com/linux-ubuntu-commands-to-speed-up-your-daily-work-32f0d2517e8b

Python Script That Kept Me Online All Day
https://python.plainenglish.io/python-script-that-kept-me-online-all-day-2957c62ec44d

A Quick Look at the "Strengthening America's Cybersecurity" Initiative
https://thehackernews.com/2022/10/a-quick-look-at-strengthening-americas.html

F.商業
Windows Subsystem for Android將支援Android 13
https://www.ithome.com.tw/news/153759

Oracle推出MySQL湖邊小屋服務HeatWave Lakehouse
https://www.ithome.com.tw/news/153729

Google Cloud發佈Software Delivery Shield強化軟體供應鏈安全
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10126

Google Launches GUAC Open Source Project to Secure Software Supply Chain
https://thehackernews.com/2022/10/google-launches-guac-open-source.html

「駭客知道怎麼逼你付錢！」Google Cloud協助企業防護資安，完善數位韌性
https://www.storm.mg/article/4572278?page=1

遠傳攜手獨角獸Databricks，深化大數據平台布局
https://www.ttv.com.tw/finance/view/1020221714582E0380FDCF4448639F2EBC769F5BD0BB1A74/587

G.政府
行政院將修正禁用中國資通產品條例，例外使用需經資安長同意
https://www.ithome.com.tw/news/153700

公部門委外數位電子看板 將納規範
https://udn.com/news/story/7314/6696965

唐鳳借將 調查局「王牌中的王牌」周士楨任數位部資通安全署主秘
https://reurl.cc/LM9X9y

唐鳳與童振源對談 向僑胞介紹數位發展部
https://www.rti.org.tw/news/view/id/2147847

外交部力推與先進國家資安合作
https://news.ltn.com.tw/news/politics/paper/1546436

桃園交通服務不打烊 資安防護再升級
https://reurl.cc/bE17Xr

防範公務機密外洩 政風處辦資訊系統使用稽核
https://www.kmdn.gov.tw/1117/1271/1272/548207

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
European Police Arrest a Gang That Hacked Wireless Key Fobs to Steal Cars
https://thehackernews.com/2022/10/european-police-arrest-gang-that-hacked.html

asus rt-ax56u_firmware CVE-2021-40556
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2021-40556

axiosys bento4 CVE-2022-41428 CVE-2022-41429 CVE-2022-41430
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41428
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41429
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2022-41430

美國針對研華、日立能源工控系統發布資安通告
https://www.cisa.gov/uscert/ncas/current-activity/2022/10/18/cisa-releases-two-industrial-control-systems-advisories

法國、拉脫維亞、西班牙警方逮捕31名偷車賊，涉及竄改汽車診斷系統繞過無錀匙啟動機制
https://www.bleepingcomputer.com/news/security/police-dismantles-criminal-ring-that-hacked-keyless-cars/

駭客爆特斯拉電動車疑似內建作弊程式！Euro NCAP 最新調查報告出爐
https://reurl.cc/bE1G8y

美國政府計畫比照能源之星計畫模式，將於2023年針對消費級物聯網裝置提供安全標章認證
https://reurl.cc/RXavn9

工控製造業資安:淺談 IEC62443 工業自動化及控制系統網通安全標準
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10123

I.教育訓練
iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

我國網路資安狂被駭 監委申請自動調查
https://www.chinatimes.com/realtimenews/20220810003152-260407?chdtv

6.近期資安活動及研討會
資安情蒐暨資安政策趨勢研討會—以半導體供應鏈為核心 2022/10/25
https://stli.iii.org.tw/news-event.aspx?no=16&d=1177

【Monosparta】②⓪②③ 第一梯次 軟體開發實戰訓練營➠線上說明會 2022/10/26
https://trunk-studio.kktix.cc/events/monosparta-202301

CODE BLUE 2022 @TOKYO 2022/10/27 ~ 2022/10/28
https://codeblue.jp/2022/en/

金融產業跨域資安人力高峰論壇 2022/10/28
https://isipevent.kktix.cc/events/f2ce8bcc

資訊安全與人工智慧實作 2022/10/28
https://www.cisanet.org.tw/Course/Detail/2867

資訊安全發展趨勢| 數位社會與資訊安全 - 董監事系列認證課程 2022/11/5
https://www.accupass.com/event/2208120843261385349231

行動應用APP 安全檢測（APK/IPA）2022-11-18 09:00 ~ 2022-11-18 12:00
https://www.cisanet.org.tw/Course/Detail/2865

ICS 2022 WORKSHOP PROGRAM -「Ubiquitous Cybersecurity and Forensics」 2022/12/15 ~ 2022/12/17
https://ics2022.esam.io/

TANET 2022 WORKSHOP PROGRAM -「第二屆數位鑑識、醫療私密與網駭安全」 2022/12/15 ~ 2022/12/17
https://tanet2022.esam.io/