###### tags: `資安事件新聞週報` # 資安事件新聞週報 2023/9/18 ~ 2023/9/22 1.重大弱點漏洞/後門/Exploit/Zero Day Fortinet 發布多個產品的安全公告 https://www.cisa.gov/news-events/alerts/2023/09/15/fortinet-releases-security-updates-multiple-products Fortinet修補防火牆作業系統、上網安全閘道、WAF的高風險漏洞 https://www.securityweek.com/fortinet-patches-high-severity-vulnerabilities-in-fortios-fortiproxy-fortiweb-products/ Fortinet修補防火牆作業系統、上網安全閘道、WAF的高風險漏洞 https://www.securityweek.com/fortinet-patches-high-severity-vulnerabilities-in-fortios-fortiproxy-fortiweb-products/ 1.2萬臺Juniper網路安全設備曝露於無需身分驗證的RCE漏洞 https://vulncheck.com/blog/juniper-cve-2023-36845 Nearly 12,000 Juniper Firewalls Found Vulnerable to Recently Disclosed RCE Vulnerability https://thehackernews.com/2023/09/over-12000-juniper-firewalls-found.html 趨勢科技修補端點防護產品已被用於攻擊行動的零時差漏洞 https://www.bleepingcomputer.com/news/security/trend-micro-fixes-endpoint-protection-zero-day-used-in-attacks/ https://success.trendmicro.com/dcx/s/solution/000294994 https://www.jpcert.or.jp/english/at/2023/at230021.html 趨勢科技 Deep Discovery Inspector 6.x 和 CVE-2023-3823/3824 安全性通告 https://www.cve.org/CVERecord?id=CVE-2023-3823 https://www.cve.org/CVERecord?id=CVE-2023-3824 Trend Micro Releases Urgent Fix for Actively Exploited Critical Security Vulnerability https://thehackernews.com/2023/09/trend-micro-releases-urgent-fix-for.html Microsoft 推出 2023 年 9 月 Patch Tuesday 每月例行更新修補包 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10694 微軟Patch Tuesday修補兩個零時差弱點 https://www.twcert.org.tw/tw/cp-104-7374-2742e-1.html Microsoft Uncovers Flaws in ncurses Library Affecting Linux and macOS Systems https://thehackernews.com/2023/09/microsoft-uncovers-flaws-in-ncurses.html Beware: Fake Exploit for WinRAR Vulnerability on GitHub Infects Users with Venom RAT https://thehackernews.com/2023/09/beware-fake-exploit-for-winrar.html WinRAR 中存在允許執行任意程式碼的弱點 https://www.twncert.org.tw/Security_Alerts_Detail?lang=en&seq=1253 Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities https://www.ibm.com/support/pages/node/7032220?myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E GitLab發布更新，修補執行任意自動化工作流程的漏洞 https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/ GitLab Releases Urgent Security Patches for Critical Vulnerability https://thehackernews.com/2023/09/gitlab-releases-urgent-security-patches.html 網路監控軟體Nagios XI存在高風險漏洞，恐導致資訊洩漏或權限提升 https://outpost24.com/blog/nagios-xi-vulnerabilities/ Critical Security Flaws Exposed in Nagios XI Network Monitoring Software https://thehackernews.com/2023/09/critical-security-flaws-exposed-in.html High-Severity Flaws Uncovered in Atlassian Products and ISC BIND Server https://thehackernews.com/2023/09/high-severity-flaws-uncovered-in.html Atlassian修補旗下Jira、Confluence、Bitbucket、Bamboo漏洞 https://www.securityweek.com/atlassian-security-updates-patch-high-severity-vulnerabilities/ 開源物件儲存服務MinIO漏洞被用於攻擊，駭客意圖破壞企業網路環境 https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services N-able遠端管理工具存在高風險漏洞，恐被用於刪除端點電腦檔案 https://www.mandiant.com/resources/blog/arbitrary-file-deletion-vulnerabilities 程式庫ncurses存在高風險漏洞，影響執行Linux、FreeBSD、macOS作業系統的電腦 https://www.microsoft.com/en-us/security/blog/2023/09/14/uncursing-the-ncurses-memory-corruption-vulnerabilities-found-in-library/ 2.銀行/金融/保險/證券/金融監理 新聞及資安 Akamai: 美國金融機構遭遇史上最大規模DDoS攻擊 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10690 中華開發金控採用CyberArk平台確保多雲環境下系統存取權限及顧客資料的保全 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10687 駭客組織USDoD聲稱竊得信用評估業者環聯資料，環聯表示並未遭到入侵 https://www.bleepingcomputer.com/news/security/transunion-denies-it-was-hacked-links-leaked-data-to-3rd-party/ https://newsroom.transunion.com/transunion-statement-regarding-some-limited-online-activity-alleging-that-data-obtain-from-multiple-entities-including-transunion-will-be-released-read-full-statement/ 泰國數位金融平臺CardX傳出資料外洩 https://www.cardx.co.th/news/details/personal-data-protection 富士達保經落實資安及個資保護 取得雙項國際資訊安全認證 https://money.udn.com/money/story/5636/7449935 公股銀：網路攻擊量年增一倍 https://reurl.cc/A07Y38 符合金融法規的電子帳單系統建置 https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000673789_0C384V0P7SOL8GL0MB3SQ 3.信用卡/電子支付/行動支付/pay/支付系統/資安 網站信用卡側錄攻擊Silent Skimmer鎖定亞太、拉丁美洲及北美 https://blogs.blackberry.com/en/2023/09/silent-skimmer-online-payment-scraping-campaign-shifts-targets-from-apac-to-nala 這樣怎麼繳？停車場遭怨手機支付卻沒訊號 https://reurl.cc/z6ZE5k 長榮航機上行動支付服務上線 國內首見 https://news.cnyes.com/news/id/5320592 台灣支付生態巨變！後疫情時代這類支付成主流 為6成民眾首選 https://udn.com/news/story/7239/7453382 元大銀行QR Code升級 行動支付綁定與額度隨時掌握 https://udn.com/news/story/7239/7408153 4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安 North Korea's Lazarus Group Suspected in $31 Million CoinEx Heist https://thehackernews.com/2023/09/north-koreas-lazarus-group-suspected-in.html 北韓駭客Lazarus從加密貨幣交易所CoinEx竊得3,100萬美元 https://thehackernews.com/2023/09/north-koreas-lazarus-group-suspected-in.html 台灣首部「加密貨幣專法」提案出爐！立委江永昌提虛擬資產監管12面向 https://www.blocktempo.com/taiwan-first-virtual-assets-law-proposal-released/ 比特幣在美聯儲鷹派態度對利率的影響下出現波動，交易量持續處於多年低位，而流動性相對穩定 https://hk.investing.com/news/stock-market-news/article-384391 欲起草「加密貨幣政策框架」！一分鐘回顧美國共和黨總統候選人Vivek Ramaswamy如何支持加密貨幣發展 https://reurl.cc/GKxOGv 臺灣立例擁抱加密貨幣與香港競爭　比特幣價格向上更多人持有可爆升的BTCBSC https://news.cnyes.com/news/id/5330910 加密貨幣公司尋找美國以外增長機會，香港等地加大開放力度 https://reurl.cc/V4DlmA 交易量新低、波動性下降！數據解讀：加密貨幣市場的嚴峻現狀 https://blockcast.it/2023/09/19/bitcoins-rise-masks-a-grim-outlook-for-crypto-markets/ JPEX案｜森美連續兩日缺席　多間加密貨幣兌換店被查封 https://hk.on.cc/hk/bkn/cnt/entertainment/20230919/bkn-20230919162402356-0919_00862_001.html 5.資安事件新聞 A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC 台中、彰化肉品市場遭勒索攻擊，營運停擺 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10695 Ransom.Win32.NOESCAPE.THFOEBC 勒索病毒 https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.noescape.thfoebc 旅館集團美高梅在遭遇勒索軟體攻擊的10天後恢復正常 https://www.securityweek.com/mgm-resorts-computers-back-up-after-10-days-as-analysts-eye-effects-of-casino-cyberattacks/ 駭客組織Gold Melody向勒索軟體駭客兜售存取組織的管道 https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker 中文使用者遭到鎖定，駭客向其散布木馬ValleyRAT、Sainbox RAT、Purple Fox https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape 惡意軟體VenomRAT假借WinRAR漏洞概念性驗證程式散布 https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-venomrat/ 亞塞拜然共和國遭到Rust惡意軟體攻擊 https://www.deepinstinct.com/blog/operation-rusty-flag-a-malicious-campaign-against-azerbaijanian-targets 中東電信業者遭駭客組織ShroudedSnooper鎖定，假借提供端點防護系統元件散布惡意程式 https://blog.talosintelligence.com/introducing-shrouded-snooper/ 美國針對勒索軟體Snatch的攻擊行動提出警告 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a 駭客透過惡意Python套件culturestreak散布挖礦程式 https://checkmarx.com/blog/attacker-unleashes-stealthy-crypto-mining-via-malicious-python-package/ 殭屍網路P2PInfect攻擊爆增600倍 http://www.cadosecurity.com/cado-security-labs-researchers-witness-a-600x-increase-in-p2pinfect-traffic/ 駭客使用Python打造竊資軟體NodeStealer，鎖定北美與南歐盜取企業臉書帳號 https://www.netskope.com/blog/new-python-nodestealer-goes-beyond-facebook-credentials-now-stealing-all-browser-cookies-and-login-credentials 勒索軟體LockBit透過多種遠端管理工具散布 https://www.esentire.com/blog/russia-linked-lockbit-ransomware-gang-attacks-an-msp-and-two-manufacturers-using-the-targets-rmm-tools-to-infect-downstream-customers-and-employees-with-ransomware 中國駭客Earth Lusca鎖定政府機關散布Linux惡意程式SprySOCKS http://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html 勒索軟體NoEscape聲稱攻擊美加邊境水務組織 https://www.theregister.com/2023/09/15/ijc_noescape_ransomware/ 惡意軟體Bumblebee濫用WebDAV資料夾進行散布 https://intel471.com/blog/bumblebee-loader-resurfaces-in-new-campaign 駭客組織Scattered Spider擴大攻擊範圍，發動勒索軟體攻擊迫使受害組織付錢 https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware 斯里蘭卡政府電子郵件系統遭勒索軟體攻擊，備份資料也無法倖免 https://cert.gov.lk/?p=3362 勒索軟體駭客BlackCat鎖定Azure Storage儲存桶下手 https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azure-storage-with-sphynx-encryptor/ 卡車車隊管理服務Orbcomm遭勒索軟體攻擊，司機改用紙本記錄工作狀態 https://www.bleepingcomputer.com/news/security/orbcomm-ransomware-attack-causes-trucking-fleet-management-outage/ 勒索軟體NoEscape聲稱攻擊美加邊境水務組織 https://www.theregister.com/2023/09/15/ijc_noescape_ransomware/ 駭客組織Scattered Spider擴大攻擊範圍，發動勒索軟體攻擊迫使受害組織付錢 https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware 駭客使用Python打造竊資軟體NodeStealer，鎖定北美與南歐盜取企業臉書帳號 https://www.netskope.com/blog/new-python-nodestealer-goes-beyond-facebook-credentials-now-stealing-all-browser-cookies-and-login-credentials Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets | Microsoft Security Blog https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/ RedLine/Vidar Abuses EV Certificates, Shifts to Ransomware https://www.trendmicro.com/en_us/research/23/i/redline-vidar-first-abuses-ev-certificates.html https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/i/redline-vidar-first-abuses-ev-certificates-then-shifts-to-ransomware-/IOCs-RedLineVidar-Abuses-EV%20Certificates-Shifts-to-Ransomware.txt PSA: Ongoing Webex malvertising campaign drops BatLoader https://www.malwarebytes.com/blog/threat-intelligence/2023/09/ongoing-webex-malvertising-drops-batloader New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials https://www.netskope.com/blog/new-python-nodestealer-goes-beyond-facebook-credentials-now-stealing-all-browser-cookies-and-login-credentials New MidgeDropper Variant https://www.fortinet.com/blog/threat-research/new-midgedropper-variant 巴基斯坦駭客APT36假借提供YouTube應用程式攻擊安卓手機 https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/ A peek into APT36’s updated arsenal https://www.zscaler.com/blogs/security-research/peek-apt36-s-updated-arsenal Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-venomrat/ New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants https://blog.talosintelligence.com/introducing-shrouded-snooper/ Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/ The Curious Case of “Monti” Ransomware: A Real-World Doppelganger https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger NodeStealer Malware Now Targets Facebook Business Accounts on Multiple Browsers https://thehackernews.com/2023/09/nodestealer-malware-now-targets.html Financially Motivated UNC3944 Threat Actor Shifts Focus to Ransomware Attacks https://thehackernews.com/2023/09/financially-motivated-unc3944-threat.html Inside the Code of a New XWorm Variant https://thehackernews.com/2023/09/inside-code-of-new-xworm-variant.html Earth Lusca's New SprySOCKS Linux Backdoor Targets Government Entities https://thehackernews.com/2023/09/earth-luscas-new-sprysocks-linux.html Transparent Tribe Uses Fake YouTube Android Apps to Spread CapraRAT Malware https://thehackernews.com/2023/09/transparent-tribe-uses-fake-youtube.html Fresh Wave of Malicious npm Packages Threaten Kubernetes Configs and SSH Keys https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html ShroudedSnooper's HTTPSnoop Backdoor Targets Middle East Telecom Companies https://thehackernews.com/2023/09/shroudedsnoopers-httpsnoop-backdoor.html Cyber Group 'Gold Melody' Selling Compromised Access to Ransomware Attackers https://thehackernews.com/2023/09/cyber-group-gold-melody-selling.html Ukrainian Hacker Suspected to be Behind "Free Download Manager" Malware Attack https://thehackernews.com/2023/09/ukrainian-hacker-suspected-to-be-behind.html Researchers Raise Red Flag on P2PInfect Malware with 600x Activity Surge https://thehackernews.com/2023/09/researchers-raise-red-flag-on-p2pinfect.html B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊 因應量子電腦時代的安全威脅，加密通訊軟體Signal採用新加密協定PQXDH https://www.ithome.com.tw/news/158852 Signal Messenger Introduces PQXDH Quantum-Resistant Encryption https://thehackernews.com/2023/09/signal-messenger-introduces-pqxdh.html The Rise of the Malicious App https://thehackernews.com/2023/09/the-rise-of-malicious-app.html 蘋果發布iOS 17.0.1、macOS Ventura 13.6，修補3個已被用於攻擊行動的零時差漏洞 https://www.bleepingcomputer.com/news/apple/apple-emergency-updates-fix-3-new-zero-days-exploited-in-attacks/ Apple Rushes to Patch 3 New Zero-Day Flaws: iOS, macOS, Safari, and More Vulnerable https://thehackernews.com/2023/09/apple-rushes-to-patch-3-new-zero-day.html C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力 國際刑事法院證實遭到網路攻擊 https://www.bleepingcomputer.com/news/security/hackers-breached-international-criminal-courts-systems-last-week/ 面對人數多50倍的中國駭客威脅，FBI局長呼籲公私聯防，善用AI對抗網路威脅 https://www.ithome.com.tw/news/158829 OpenAI成立紅隊演練網路，招募各界專家改善大型語言模型安全 https://www.ithome.com.tw/news/158834 家庭清潔用品公司高樂氏遭到網路攻擊導致營運受到衝擊 https://www.theregister.com/2023/09/19/the_clorox_company_admits_cyber/ https://d18rn0p25nwr6d.cloudfront.net/CIK-0000021076/ae1fd2f2-142b-4a99-bed8-e7bfeb8a2bb7.pdf https://www.sec.gov/ix?doc=/Archives/edgar/data/21076/000120677423000969/clx4231381-8k.htm 挖礦攻擊行動Ambersquid鎖定不尋常的AWS服務下手 https://sysdig.com/blog/ambersquid/ 俄羅斯駭客NoName057(16)疑發動DDoS攻擊，癱瘓加拿大機場旅客通關作業 https://www.lapresse.ca/actualites/national/2023-09-19/agence-des-services-frontaliers/la-panne-dans-les-aeroports-provenait-bien-d-une-attaque-informatique.php https://securityaffairs.com/151149/hacking/noname-ddos-attack-canadian-airports.html New AMBERSQUID Cryptojacking Operation Targets Uncommon AWS Services https://thehackernews.com/2023/09/new-ambersquid-cryptojacking-operation.html Mysterious 'Sandman' Threat Actor Targets Telecom Providers Across Three Continents https://thehackernews.com/2023/09/mysterious-sandman-threat-actor-targets.html China Accuses U.S. of Decade-Long Cyber Espionage Campaign Against Huawei Servers https://thehackernews.com/2023/09/china-accuses-us-of-decade-long-cyber.html 伊朗駭客APT33發起密碼潑灑攻擊，並濫用開源資安框架偵察Azure AD環境 https://aka.ms/peach-sandstorm Iranian Nation-State Actors Employ Password Spray Attacks Targeting Multiple Sectors https://thehackernews.com/2023/09/iranian-nation-state-actors-employ.html Iranian Nation-State Actor OilRig Targets Israeli Organizations https://thehackernews.com/2023/09/iranian-nation-state-actor-oilrig.html D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全 Cybercriminals Combine Phishing and EV Certificates to Deliver Ransomware Payloads https://thehackernews.com/2023/09/cybercriminals-combine-phishing-and-ev.html Retool Falls Victim to SMS-Based Phishing Attack Affecting 27 Cloud Clients https://thehackernews.com/2023/09/retool-falls-victim-to-sms-based.html TikTok Faces Massive €345 Million Fine Over Child Data Violations in E.U. https://thehackernews.com/2023/09/tiktok-faces-massive-345-million-fine.html 微軟外洩38 TB資料，起因是Azure儲存桶未設防 https://www.bleepingcomputer.com/news/microsoft/microsoft-leaks-38tb-of-private-data-via-unsecured-azure-storage/ https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/ Microsoft AI Researchers Accidentally Expose 38 Terabytes of Confidential Data https://thehackernews.com/2023/09/microsoft-ai-researchers-accidentally.html Sophisticated Phishing Campaign Targeting Chinese Users with ValleyRAT and Gh0st RAT https://thehackernews.com/2023/09/sophisticated-phishing-campaign_20.html 資安業者指控Google Authenticator雙因素驗證碼雲端同步機制恐削弱安全性 https://retool.com/blog/mfa-isnt-mfa/ E.研究報告/工具 The Interdependence between Automated Threat Intelligence Collection and Humans https://thehackernews.com/2023/09/the-interdependence-between-automated.html Cybersecurity Law A graduate degree for working professionals https://www.law.umaryland.edu/academics/ms-in-law-program/landing-pages/cybersecurity-hacker-news/ The Convergence of AI + Cybersecurity https://abnormalsecurity.com/convergence?utm_source=hackernews&_m=3n.009a.3152.kl0ao0dcsu.251q Do You Really Trust Your Web Application Supply Chain https://thehackernews.com/2023/09/do-you-really-trust-your-web.html Finnish Authorities Dismantle Notorious PIILOPUOTI Dark Web Drug Marketplace https://thehackernews.com/2023/09/finnish-authorities-dismantle-notorious.html How to Interpret the 2023 MITRE ATT&CK Evaluation Results https://thehackernews.com/2023/09/how-to-interpret-2023-mitre-att.html F.商業 Google Agrees to $93 Million Settlement in California's Location-Privacy Lawsuit https://thehackernews.com/2023/09/google-agrees-to-93-million-settlement.html AI引領反欺詐革命！HiTRUST獲發明專利，金融電商皆受益 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10696 先竊取，後解密！Openfind 部署後量子加密技術，強化郵件安全 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10688 思科以280億美元買下大數據資安業者Splunk https://www.ithome.com.tw/news/158878 https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2023/m09/cisco-to-acquire-splunk-to-help-make-organizations-more-secure-and-resilient-in-an-ai-powered-world.html https://www.splunk.com/en_us/newsroom/press-releases/2023/cisco-to-acquire-splunk-to-help-make-organizations-more-secure-and-resilient-in-an-ai-powered-world.html https://www.ithome.com.tw/news/149369 資安業者CrowdStrike買下ASPM新創Bionic https://www.crowdstrike.com/press-releases/crowdstrike-to-acquire-bionic-to-extend-cloud-security-leadership/ https://www.securityweek.com/crowdstrike-to-acquire-bionic/ 為強化列印系統安全，微軟將在Windows更新逐步淘汰第三方印表機驅動程式 https://learn.microsoft.com/en-us/windows-hardware/drivers/print/end-of-servicing-plan-for-third-party-printer-drivers-on-windows Google承諾將為Chromebook提供長達10年的安全更新 https://blog.google/outreach-initiatives/education/automatic-update-extension-chromebook/ G.政府 美國NIST院長回訪數位部進行深度資安交流 https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=10698 政府資服採購作業指引9月公布，開始明定標案需獨立編列資安預算 https://www.ithome.com.tw/news/158882 數位部舉行縣市資訊主管聯席會 提升資安韌性 https://reurl.cc/A07Y6Z 400億政府資訊服務採購變革關鍵，新版資服採購作業指引出爐 https://www.ithome.com.tw/news/158881 防堵敏感資訊被駭 政府採購契約納入資安要求 https://www.rti.org.tw/news/view/id/2179341 資安法將送政院 修法聚焦三重點 https://www.chinatimes.com/newspapers/20230904000100-260202?chdtv H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安 DDoS 2.0: IoT Sparks New DDoS Alert https://thehackernews.com/2023/09/ddos-20-iot-sparks-new-ddos-alert.html 歐姆龍修補PLC、工程軟體的漏洞 https://www.securityweek.com/omron-patches-plc-engineering-software-flaws-discovered-during-ics-malware-analysis/ 網路電話Atos Unify存在漏洞，恐讓駭客在系統設置後門 https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-missing-authentication-atos-unify-openscape/ I.教育訓練 iPAS資訊安全工程師中級筆記 https://hackmd.io/@Not/iPASInformationSecuritySpecialist iPas資安工程師證照考前研習 https://reurl.cc/GEbA3p Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！ https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/ 全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口 https://reurl.cc/m39MDj CISSP資安認證的8大領域 https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html CISSP考試心得 https://reurl.cc/KbY83j CISSP考試心得 – Benson https://reurl.cc/GbWvxd 目標導向-20天光速考過CISSP https://reurl.cc/2Zq6zn CISSP證照考試實戰心得 第一章：初期準備工作 https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略 https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies CISSP證照考試實戰心得 第三章：終極一戰 https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle Quick CISSP Infographic for IPSec https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec CSSLP Certification - Security models in F# https://github.com/vbocan/csslp Certified Secure Software Lifecycle Professional in bullet points https://github.com/joeyhage/csslp-notes CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得 https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/ EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022 https://reurl.cc/1oyEM8 CEH v11 考試心得與準備方式 https://blog.sean.taipei/2022/01/ceh CEH https://github.com/a3cipher/CEH CodeRed by EC-Council https://github.com/codered-by-ec-council EC-Council CEH Practical / Master 準備心得 — 讓理論與實作相輔相成的學習 https://medium.com/blacksecurity/ceh-practical-master-3e80cac180a2 EC-Council CEHP考試準備心得 https://hackmd.io/@9dCJrgb6QHGd8dRfgHO0zg/r14xNn1po ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4 EC-Council ECSA資安分析專家 v10 考試心得分享 https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html 20180817 EC-Council ECSA v10 PASS https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html 關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享 https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d 深度解析 CPENT 考試心得、以及與 OSCP 的比較 https://reurl.cc/41eL8v EC-Council CPENT v1 滲透測試認證 – 內容及心得分享 https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review CPENT 從暴力到破解 https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295 Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證 https://ucom.uuu.com.tw/web/Testimony/Article/4404 kaizensecurity/CPENT https://github.com/kaizensecurity/CPENT/tree/master CPENT : Pentesting like NO OTHERS ! https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/ Journey of My CPENT Exam https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917 [備考心得]CompTIA Security+ (SY0–601) 上篇 https://reurl.cc/M053DK [備考心得]CompTIA Security+ (SY0–601) 下篇 https://reurl.cc/M053Gv comptia-security-plus https://github.com/ajfuto/comptia-security-plus security-plus https://github.com/fjavierm/security-plus CompTIA Security+ Certification Practice Test Questions https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette 不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書） https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享 https://hackmd.io/@henry-ko/HyQ56e8eF OSCP（Offensive Security Certified Professional） https://github.com/0x584A/oscp-notes/tree/master ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年 https://reurl.cc/aVLoX9 Learn NIST Inside Out With 21 Hours of Training @ 86% OFF https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html 駭客與國家: 網路攻擊與地緣政治新常態 The hacker and the state: cyber attacks and the new normal of geopolitic https://reurl.cc/D3nKKj Practical Network Penetration Tester (PNPT) Certification Review https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df WUSON常用的基本詞彙 https://choson.lifenet.com.tw/?p=1958 證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」 https://www.ithome.com.tw/news/156754 用證照證明自己實力之餘，更應將證照視為督促學習的最大動力 https://www.ithome.com.tw/news/156756 打破證照誤解與迷思，資安專家帶你釐清資安證照的意義 https://www.ithome.com.tw/news/156755 Accelerate Your Career with the Global Leader in Cyber Security Training https://www.sans.org/mlp/promo-partnership-hacker-news/ 6.近期資安活動及研討會 從 MLOps 到 LLMOps 的混合雲實踐 2023/9/25 https://www.meetup.com/rladies-taipei/events/295452194/ 四個月考過CCNA，成為網路工程師 2023/9/27 https://www.accupass.com/event/2308280820492735100520 【ACSI安碁資訊】上雲後的下一步——如何逐步建構雲端防護 2023/9/28 https://www.accupass.com/event/2307270328312367680900 Hou.Sec.Con 2023/10/12 ~ 2023/10/13 https://web.cvent.com/event/76d46ccb-fe00-4fe5-ba46-e4a77c807f21/summary Taipei DevOps User Group Launch Event 2023/10/13 https://www.meetup.com/taipei-devops-user-group/events/295716641/ 國家高速網路與計算中心 平行計算程式設計基礎課程 2023/10/17 https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=4033&from_course_list_url=homepage OCF 培訓活動: 如何建立安全的網路架構 II 2023/10/21 https://ocftw.kktix.cc/events/ocftot2023 (ISC)2 SECURITY CONGRESS LEAD WITH CONFINDENCE 2023/10/25 ~ 2023/10/27 https://www.isc2.org/Congress-2023 Web應用滲透測試 2023/11/9 ~ 2023/11/10 https://www.chtti.cht.com.tw/general/course_info.jsp?activity_id=631 【亞洲最具指標供應鏈高峰會】Supply Chain Summit 2023 2023/11/14 ~ 2023/11/15 https://www.accupass.com/event/2307070154211343470512 【Monosparta】②⓪②④ 第一梯次 軟體開發實戰訓練營➠線上說明會 2024/1/17 https://trunk-studio.kktix.cc/events/monosparta-202401