###### tags: `資安事件新聞週報`
# 資安事件新聞週報 2024/12/23 ~ 2024/12/27

1.重大弱點漏洞/後門/Exploit/Zero Day
Sophos 近日發布更新以解決 Firewall 的安全性弱點
https://www.ithome.com.tw/news/166622
https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
https://nvd.nist.gov/vuln/detail/CVE-2024-12727
https://nvd.nist.gov/vuln/detail/CVE-2024-12728
https://nvd.nist.gov/vuln/detail/CVE-2024-12729

Sophos修補兩項防火牆重大漏洞，若不處理就有可能遭到SQL注入攻擊、曝露系統特權管理員帳號
https://www.ithome.com.tw/news/166622

Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation
https://thehackernews.com/2024/12/sophos-fixes-3-critical-firewall-flaws.html

Palo Alto Networks防火牆存在阻斷服務漏洞，傳出已有攻擊行動
https://www.ithome.com.tw/news/166717

Palo Alto Releases Patch for PAN-OS DoS Flaw — Update Immediately
https://thehackernews.com/2024/12/palo-alto-releases-patch-for-pan-os-dos.html

Fortinet FortiClient
https://nvd.nist.gov/vuln/detail/CVE-2020-15934

Fortinet 發布FortiManager的安全公告
https://www.cisa.gov/news-events/alerts/2024/12/20/fortinet-releases-security-updates-fortimanager
https://www.fortiguard.com/psirt/FG-IR-24-425

Fortinet FortiManager
https://nvd.nist.gov/vuln/detail/CVE-2024-48889
https://nvd.nist.gov/vuln/detail/CVE-2021-32589

Fortinet FortiWAN
https://nvd.nist.gov/vuln/detail/CVE-2021-26102
https://nvd.nist.gov/vuln/detail/CVE-2021-26115

Fortinet無線網路管理系統FortiWLM存在重大漏洞，若不處理攻擊者有機會接管設備
https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortiwlm-bug-giving-hackers-admin-privileges/

Fortinet FortiWLM
https://nvd.nist.gov/vuln/detail/CVE-2023-34990

Microsoft Excel
https://nvd.nist.gov/vuln/detail/CVE-2024-43106

Acrobat Reader DC
https://nvd.nist.gov/vuln/detail/CVE-2022-44512
https://nvd.nist.gov/vuln/detail/CVE-2022-44513
https://nvd.nist.gov/vuln/detail/CVE-2022-44514
https://nvd.nist.gov/vuln/detail/CVE-2022-44518
https://nvd.nist.gov/vuln/detail/CVE-2022-44520

Apache Tomcat
https://nvd.nist.gov/vuln/detail/CVE-2024-50379

Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks
https://thehackernews.com/2024/12/apache-tomcat-vulnerability-cve-2024.html

Apache 已發布安全性更新來解決 Struts 2 的弱點
https://struts.apache.org/core-developers/file-upload-interceptor
https://cwiki.apache.org/confluence/display/WW/S2-067
https://isc.sans.edu/diary/31520
https://www.ithome.com.tw/news/166558

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization
https://thehackernews.com/2024/12/apache-mina-cve-2024-52046-cvss-100.html

Apache修補開源CDN軟體Traffic Control重大層級SQL注入漏洞
https://www.ithome.com.tw/news/166697

Apache基金會修補網頁伺服器元件Tomcat遠端程式碼執行漏洞
https://www.ithome.com.tw/news/166667

Chunghwa Telecom tbm-client
https://nvd.nist.gov/vuln/detail/CVE-2024-12643
https://nvd.nist.gov/vuln/detail/CVE-2024-12644
https://nvd.nist.gov/vuln/detail/CVE-2024-12646

Chunghwa Telecom TenderDocTransfer
https://nvd.nist.gov/vuln/detail/CVE-2024-12641
https://nvd.nist.gov/vuln/detail/CVE-2024-12642

IBM Security QRadar Log Management AQL Plugin contains multiple vulnerabilities (CVE-2024-45296, CVE-2024-8986, CVE-2024-21489)
https://www.ibm.com/support/pages/node/7179757

IBM商業智慧分析套件Cognos Analytics存在重大漏洞，有可能導致敏感資訊曝光、系統當機
https://securityonline.info/cve-2024-51466-cvss-9-0-critical-vulnerability-found-in-ibm-cognos-analytics/

Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now
https://thehackernews.com/2024/12/critical-sql-injection-vulnerability-in.html

CISA Adds Acclaim USAHERDS Vulnerability to KEV Catalog Amid Active Exploitation
https://thehackernews.com/2024/12/cisa-adds-acclaim-usaherds.html

CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List
https://thehackernews.com/2024/12/cisa-adds-critical-flaw-in-beyondtrust.html

Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools
https://thehackernews.com/2024/12/hackers-exploiting-critical-fortinet.html

Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia
https://thehackernews.com/2024/12/cloud-atlas-deploys-vbcloud-malware.html

FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks
https://thehackernews.com/2024/12/ficora-and-kaiten-botnets-exploit-old-d.html

中國一家網路設備廠商的雲端集中管理平臺存在重大漏洞，攻擊者有機會用來控制列管設備
https://www.ithome.com.tw/news/166718

Java網路應用程式框架Apache MINA存在風險滿分的重大漏洞
https://securityonline.info/cve-2024-52046-cvss-10-critical-apache-mina-flaw-could-allow-remote-code-execution/

XML檔案解析程式庫libxml2存在重大漏洞，恐被用於XML外部實體攻擊
https://securityonline.info/cve-2024-40896-cvss-9-1-critical-xxe-vulnerability-discovered-in-libxml2/

程式碼管理系統Gogs存在重大漏洞，若不處理攻擊者有機會執行任意命令、竊取代管的程式碼
https://www.ithome.com.tw/news/166703

檔案傳輸系統CrushFTP存在重大漏洞，攻擊者能藉此重設密碼控制用戶帳號
https://securityonline.info/cve-2024-53552-cvss-9-8-crushftp-flaw-exposes-users-to-account-takeover/

控管Unix與Linux系統的開源套件Webmin有重大漏洞，一般帳號可趁機偷用root權限執行惡意命令
https://www.ithome.com.tw/news/166669

WordPress外掛WPLMS、VibeBP存在7項重大漏洞
https://patchstack.com/articles/multiple-critical-vulnerabilities-patched-in-wplms-and-vibebp-plugins/

MinIO修補物件儲存平臺弱點，包括允許任意使用者獲得完全管理權限的重大漏洞
https://www.ithome.com.tw/news/166613

2.銀行/金融/保險/證券/金融監理 新聞及資安
DORA 新法規上路！歐盟金融機構須加強網路韌性
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=11479

銀行金融檢查 防制詐騙與資安成重點
https://udn.com/news/story/7239/8436847

金融 AI 應用的潛在風險 建立治理與問責機制
https://reurl.cc/6jjngy

精進客戶金融體驗　中信銀行接軌國際　取得ISO10002、ISO10004雙驗證
https://finance.ettoday.net/news/2881376

日本三菱UFJ銀行網路銀行無法登入 疑似遭網攻
https://news.pchome.com.tw/finance/cna/20241226/index-17352184936963118003.html#google_vignette

三菱日聯銀行網銀系統故障 或因遭受攻擊
https://tchina.kyodonews.net/news/2024/12/9ca3d807c8c2--.html#google_vignette

金融監管總局擬加強銀行業金融機構高管人員任職資格管理
http://big5.news.cn/gate/big5/www.xinhuanet.com/fortune/20241227/6be12d5d56dd4eb1b42ef17a83571877/c.html

證交所攜手財金公司 力推金融區塊鏈有價證券借貸銀行保證
https://reurl.cc/Q55Kdq

3.信用卡/電子支付/行動支付/pay/支付系統/資安
行動支付新兵報到！Ocard 攜手 Pi 拍錢包推出 Ocard Pay
https://finance.technews.tw/2024/12/25/ocard/

HIVEX攜手四大電支 嗶進日本
https://www.chinatimes.com/newspapers/20241223000426-260208?chdtv

台灣人卡費年破4.2兆！人均擁4張⋯Visa揭台灣3大良機：電支為何不是對手
https://reurl.cc/V00bXA

香港八達通網絡新增PayMe付款 提升的士支付便利性
https://www.epochtimes.com/b5/24/12/23/n14396603.htm

4.加密貨幣/數位貨幣/挖礦/區塊鍊/智能合約/WEB3 資安
North Korean Hackers Pull Off $308M Bitcoin Heist from Crypto Firm DMM Bitcoin
https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html

本週五「史上最大規模」140億美元比特幣期權到期，小心市場劇烈波動
https://www.blocktempo.com/bitcoin-faces-a-critical-period/

美擴大301調查 衝擊加密貨幣
https://www.ctee.com.tw/news/20241227700082-439901

國際支付准用比特幣！俄財長宣布「挖礦合法化」：抵抗西方制裁
https://news.tvbs.com.tw/world/2730149

無懼西方制裁！俄羅斯使用比特幣規避審查
https://reurl.cc/966mrO

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Trojan.Win64.MALXMR.AA（又名 KASPERSKY）木馬病毒
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win64.malxmr.aa

後門程式OtterCookie鎖定軟體開發人員而來，北韓駭客假借徵才名義散布
https://www.bleepingcomputer.com/news/security/new-ottercookie-malware-used-to-backdoor-devs-in-fake-job-offers/

後門程式LittleLamb、WoolTea鎖定Palo Alto Networks防火牆而來
https://securityonline.info/cve-2024-9474-exploited-littlelamb-wooltea-backdoor-discovered-in-palo-alto-devices/%20https://northwave-cybersecurity.com/hubfs/LITTLELAMB%20WOOLTEA%20technical%20writeup%20Schrijver%20and%20Oudenaarden.pdf

勒索軟體LockBit開發者傳出在以色列被捕
https://www.ithome.com.tw/news/166701

以Python打造的竊資軟體NodeStealer針對臉書廣告管理員而來
https://securityonline.info/nodestealer-infostealer-new-python-based-variant-targets-facebook-ads-manager/

勒索軟體LockBit開發者傳出在以色列被捕
https://www.darkreading.com/cyberattacks-data-breaches/lockbit-ransomware-developer-arrested-israel

網釣工具包WikiKit鎖定汽車、製造、醫療而來，佯稱是受害者所屬企業來發動攻擊
https://securityonline.info/wikikit-phishing-kit-targets-major-industries-with-evasive-techniques/

Python惡意套件Zebo與Cometlogger被用於供應鏈攻擊，竊取帳密資料
https://www.ithome.com.tw/news/166653

跨平臺勒索軟體NotLockBit鎖定Windows、macOS電腦而來
https://securityonline.info/notlockbit-new-cross-platform-ransomware-threatens-windows-and-macos/

殭屍網路Mirai變種Hail Cock鎖定Digiever網路視訊監視設備而來，利用RCE漏洞入侵受害設備
https://www.ithome.com.tw/news/166652

羅馬尼亞駭客組織Diicot鎖定Linux主機而來，企圖散布挖礦軟體
https://www.ithome.com.tw/news/166626

Juniper針對Session Smart Router提出警告，駭客利用預設帳密散布殭屍網路病毒Mirai
https://www.ithome.com.tw/news/166594

駭客UAC-0125濫用Cloudflare Workers散布惡意程式，目的是攻佔烏克蘭軍隊個人電腦
https://www.ithome.com.tw/news/166625

Cyberattack: UAC-0125 using the theme "Army+" (CERT-UA#12559)
https://cert.gov.ua/article/6281701

Recent Cases of Watering Hole Attacks, Part 1
https://blogs.jpcert.or.jp/en/2024/12/watering_hole_attack_part1.html

為了讓變種威脅更能掩人耳目，伊朗駭客Charming Kitten改用C++重寫既有的惡意程式
https://www.ithome.com.tw/news/166721

伊朗駭客Charming Kitten以C++改寫惡意程式，對亞洲企業組織發動攻擊
https://thehackernews.com/2024/12/irans-charming-kitten-deploys-bellacpp.html

Iran's Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware
https://thehackernews.com/2024/12/irans-charming-kitten-deploys-bellacpp.html

Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts
https://thehackernews.com/2024/12/researchers-uncover-pypi-packages.html

LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages
https://thehackernews.com/2024/12/lockbit-developer-rostislav-panev.html

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware
https://thehackernews.com/2024/12/lazarus-group-spotted-targeting-nuclear.html

Rspack旗下NPM套件遭到供應鏈攻擊，開發人員電腦恐被植入挖礦軟體
https://www.ithome.com.tw/news/166665

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack
https://thehackernews.com/2024/12/rspack-npm-packages-compromised-with.html

B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
U.S. Judge Rules Against NSO Group in WhatsApp Pegasus Spyware Case
https://thehackernews.com/2024/12/us-judge-rules-against-nso-group-in.html

針對5年前間諜軟體供應商NSO Group被控利用WhatsApp零時差漏洞入侵逾1,400臺行動裝置，美國法院判決WhatsApp勝訴
https://www.ithome.com.tw/news/166670

間諜軟體供應商NSO Group利用WhatsApp零時差漏洞入侵逾1,400臺行動裝置
https://www.bleepingcomputer.com/news/security/us-court-finds-spyware-maker-nso-liable-for-whatsapp-hacks/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件 / 資安人力
AI模型對資安訓練陽奉陰違，策略性掩蓋偏好迎合訓練者
https://www.ithome.com.tw/news/166616

日本航空傳出對外網路停擺，部分機場班機出現延誤，當地媒體指出是遭遇網路攻擊
https://www.ithome.com.tw/news/166698

半導體材料供應商合晶美國子公司Helitek遭網路攻擊
https://mops.twse.com.tw/mops/web/ajax_t05sr01_1?firstin=true&stp=1&step=1&SEQ_NO=3&SPOKE_TIME=184557&SPOKE_DATE=20241226&COMPANY_ID=6182

核能工程師遭北韓駭客Lazarus鎖定，面臨惡意軟體CookiePlus攻擊
https://thehackernews.com/2024/12/lazarus-group-spotted-targeting-nuclear.html

資安業者TeamT5解析2024年中國APT攻擊態樣與假訊息潮流
https://www.ithome.com.tw/news/166623

中國駭客鎖定電信業發動大規模攻擊，CISA呼籲高風險用戶應改用支援E2EE的加密通訊軟體因應
https://www.ithome.com.tw/news/166655

俄羅斯駭客APT29架設RDP代理伺服器從事中間人攻擊，竊取帳密並部署惡意軟體
https://www.bleepingcomputer.com/news/security/russian-hackers-use-rdp-proxies-to-steal-data-in-mitm-attacks/

Ruijie Networks' Cloud Platform Flaws Could've Exposed 50,000 Devices to Remote Attacks
https://thehackernews.com/2024/12/ruijie-networks-cloud-platform-flaws.html

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞/網路霸凌/帳號安全
思科10月傳出資料遭竊事故還沒結束？12月有駭客聲稱他們握有4.5 TB規模的資料
https://www.ithome.com.tw/news/166719

KYC客戶識別受到挑戰，資安業者警告駭客於暗網系統性彙整能用於通過驗證的資料
https://www.infosecurity-magazine.com/news/major-biometric-data-farming/

OpenAI違反GDPR，義大利政府判罰1,500萬歐元
https://www.ithome.com.tw/news/166702

萬豪國際及其子公司喜達屋因近年大規模資料外洩事故遭起訴，美國政府下令要求改善資安
https://www.ithome.com.tw/news/166663

鎖定M365帳號的網釣平臺FlowerStorm崛起，疑似Rockstar 2FA捲土重來
https://www.ithome.com.tw/news/166651

英國AI開發平臺Builder.ai資料庫配置不當，曝露300萬筆記錄資料
https://www.websiteplanet.com/news/builderai-breach-report/

【錯誤】網傳「詐騙集團會假冒快遞員送包裹，當民眾掃碼簽收後，銀行存款就會被盜領一空」
https://reurl.cc/Egg57g

Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service
https://thehackernews.com/2024/12/rockstar2fa-collapse-fuels-expansion-of.html

Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts
https://thehackernews.com/2024/12/brazilian-hacker-charged-for-extorting.html

Italy Fines OpenAI €15 Million for ChatGPT GDPR Data Privacy Violations
https://thehackernews.com/2024/12/italy-fines-openai-15-million-for.html

E.研究報告/工具
認識威脅情資與威脅格局的運用方式
https://teamt5.org/tw/posts/whitepaper-tw-understanding-threat-intelligence-and-the-threat-landscape-with-team-t5/

當 APT 威脅埋伏於環境中，該如何有效處置
https://teamt5.org/tw/posts/ir-use-case-how-to-respond-to-advanced-persistent-threat-apt/

實戰威脅狩獵所面臨的挑戰
https://teamt5.org/tw/posts/challenges-of-threat-hunting/

Linux 攻擊場域：常見惡意手法
https://teamt5.org/tw/posts/linux-attack-method-analysis-on-common-malicious-attack-methods/

研究人員揭露針對DNSSEC防護措施而來的阻斷服務攻擊KeyTrap
https://www.darkreading.com/cloud-security/dnssec-denial-of-service-attacks-show-fragility

Windows應用程式控制機制WDAC可被利用，研究人員展示停止EDR系統運作
https://securityonline.info/weaponizing-windows-defender-new-attack-bypasses-edr/

AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case
https://thehackernews.com/2024/12/ai-could-generate-10000-malware.html

F.商業
TeamT5 再度獲得國際肯定，Frost & Sullivan 頒發臺灣最佳威脅情資公司
https://reurl.cc/WAAmY9

Top 10 Cybersecurity Trends to Expect in 2025
https://thehackernews.com/2024/12/top-10-cybersecurity-trends-to-expect.html

台北市電腦商業同業公會頒發2024資安精品獎，6項產品及服務獲獎
https://www.tca.org.tw/tca_news1.php?n=2257

G.政府
數發部：台灣AI發展將聚焦微調國際大型模型及開發特定領域應用
https://www.sinotrade.com.tw/richclub/news/676e7aa431c1ba247abf7915

數發部首次參與美國網路風暴演練 深化資安聯防
https://www.rti.org.tw/news/view/id/2231792

持續強化基建韌性　落實資安即國安 法規推高防禦力　打消駭客意圖
https://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/09AF0F9742704E30A1A7CB9F32F14A36#google_vignette

臺東大學攜手資安院　深耕資安領域　共創更安全未來
https://www.1111.com.tw/news/jobns/158946

台積電、資安院簽MOU 提升半導體產業供應鏈資安韌性
https://news.cnyes.com/news/id/5810519

資安院與台積電簽署資通安全合作備忘錄　攜手實現資安共好
https://www.knews.com.tw/news/5665367847FC9B98D8BA409B7BFAE39A#google_vignette

H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車/人工智慧/AI/ML/人臉辨識/醫療 相關資安
西門子UMC元件存在重大漏洞，攻擊者有機會遠端執行任意程式碼
https://securityonline.info/cve-2024-49775-cvss-9-8-critical-vulnerability-in-siemens-umc-exposes-systems-to-remote-exploitation/

Rockwell能源控制監視器PowerMonitor存在重大漏洞，攻擊者有機會取得工控環境的存取權限
https://www.securityweek.com/rockwell-powermonitor-vulnerabilities-allow-remote-hacking-of-industrial-systems/

鎖定物聯網裝置的惡意軟體BadBox攻擊升溫，19萬臺安卓裝置遭綁架、組成殭屍網路
https://www.ithome.com.tw/news/166649

I.教育訓練
資安事件發生必要知道的復原程序，降低傷害
https://www.ithome.com.tw/pr/163614

iPAS資訊安全工程師中級筆記
https://hackmd.io/@Not/iPASInformationSecuritySpecialist

iPas資安工程師證照考前研習
https://reurl.cc/GEbA3p

iPAS◆資訊安全規劃實務◆中級測驗題庫彙編(123題)
https://reurl.cc/orlD1g

GCP Associate Cloud Engineer (ACE) 學習心得、教材資源與筆記分享 — 學習天然高可用與零信任設計
https://medium.com/blacksecurity/gcp-associate-cloud-engineer-78f736aee7ad

Coursera 盤點 7 項雲端資安認證，高薪跳板都在這了！
https://buzzorange.com/techorange/2022/07/12/cloud-security-certificates/

一般人也能拿到國際資安認證！CSCU安全電腦使用者認證課程
https://www.ithome.com.tw/pr/160954

全球網絡安全勞動力失衡 (ISC)2免費課程及考試填補人才缺口
https://reurl.cc/m39MDj

CISSP資安認證的8大領域
https://2formosa.blogspot.com/2022/12/CISSP-topic-domains.html

CISSP考試心得
https://reurl.cc/KbY83j

CISSP考試心得 – Benson
https://reurl.cc/GbWvxd

目標導向-20天光速考過CISSP
https://reurl.cc/2Zq6zn

CISSP證照考試實戰心得 第一章：初期準備工作
https://netmag.tw/2022/06/17/the-cissp-has-learned-the-first-chapter-in-actual-combat

CISSP證照考試實戰心得 第二章：規律且有紀律的讀書策略
https://netmag.tw/2022/07/01/the-cissp-is-in-the-field-of-combat-chapter-two-regular-and-disciplined-reading-strategies

CISSP證照考試實戰心得 第三章：終極一戰
https://netmag.tw/2022/07/12/the-cissp-has-learned-a-third-chapter-in-actual-combat-experience-the-ultimate-battle

Quick CISSP Infographic for IPSec
https://www.studynotesandtheory.com/single-post/quick-cissp-infographic-for-ipsec

CSSLP Certification - Security models in F#
https://github.com/vbocan/csslp

Certified Secure Software Lifecycle Professional in bullet points
https://github.com/joeyhage/csslp-notes

CPSA(CREST Practitioner Security Analyst) 資安分析師考試心得
https://tech-blog.cymetrics.io/posts/huli/crest-cpsa-prepare/

EC-Council CEH v11 考試心得、改版資訊以及準備方向 2021、2022
https://reurl.cc/1oyEM8

CEH v11 考試心得與準備方式
https://blog.sean.taipei/2022/01/ceh

CEH
https://github.com/a3cipher/CEH

CodeRed by EC-Council
https://github.com/codered-by-ec-council

EC-Council CEH Practical / Master 準備心得 — 讓理論與實作相輔相成的學習
https://medium.com/blacksecurity/ceh-practical-master-3e80cac180a2

EC-Council CEHP考試準備心得
https://hackmd.io/@9dCJrgb6QHGd8dRfgHO0zg/r14xNn1po

My ceh practical notes
https://github.com/dhabaleshwar/CEHPractical/blob/main/Everything%20You%20Need.md

CEHP課程筆記
https://hackmd.io/@nfu-johnny/B1Ju_BMPR

ECSA v10 考試心得與讀書資料分享/ ECSA v10 Review and Study Materials
https://medium.com/blacksecurity/ecsa-v10-1ec76c0eb7d4

EC-Council ECSA資安分析專家 v10 考試心得分享
https://javaxtalk.blogspot.com/2019/05/ec-council-ecsa-v10.html

20180817 EC-Council ECSA v10 PASS
https://www.ptt.cc/bbs/License/M.1534571704.A.5BA.html

關於EC-Council CPENT和LPT Master滲透測試證照準備方式及心得分享
https://medium.com/@ChadSecurity/%E9%97%9C%E6%96%BCec-council-cpent%E5%92%8Clpt-master%E6%BB%B2%E9%80%8F%E6%B8%AC%E8%A9%A6%E8%AD%89%E7%85%A7%E6%BA%96%E5%82%99%E6%96%B9%E5%BC%8F%E5%8F%8A%E5%BF%83%E5%BE%97%E5%88%86%E4%BA%AB-efb63de00a8d

深度解析 CPENT 考試心得、以及與 OSCP 的比較
https://reurl.cc/41eL8v

EC-Council CPENT v1 滲透測試認證 – 內容及心得分享
https://hackercat.org/pentesting/ec-council-cpent-v1-experience-review

CPENT 從暴力到破解
https://hackmd.io/@3WAsoRFgSlyy7pm10p60kg/ByO0zs295

Ec-Council CPENT心得 - 資安菜鳥從CEH到LPT Master
https://4hsienyang.medium.com/cpent-lpt-master-ccaebf2dbc7f

CPENT考試心得分享：一次拿到 LPT 滲透測試大師認證
https://ucom.uuu.com.tw/web/Testimony/Article/4404

kaizensecurity/CPENT
https://github.com/kaizensecurity/CPENT/tree/master

CPENT : Pentesting like NO OTHERS !
https://www.linkedin.com/pulse/cpent-pentesting-like-others-belly-rachdianto/

Journey of My CPENT Exam
https://medium.com/techiepedia/journey-of-my-cpent-exam-3a5d7ee6d917

[備考心得]CompTIA Security+ (SY0–601) 上篇
https://reurl.cc/M053DK

[備考心得]CompTIA Security+ (SY0–601) 下篇
https://reurl.cc/M053Gv

comptia-security-plus
https://github.com/ajfuto/comptia-security-plus

security-plus
https://github.com/fjavierm/security-plus

CompTIA Security+ Certification Practice Test Questions
https://www.examcompass.com/comptia/security-plus-certification/free-security-plus-practice-tests#google_vignette

不只是工程師才要懂的 App 資訊安全：取得資安檢測合格證書血淚史（iT邦幫忙鐵人賽系列書）
https://news.pchome.com.tw/living/books/20220202/index-64375841669874292009.html

App防駭學，資安防護實戰課程全面提升安全觀念
https://www.ithome.com.tw/pr/161505

OSEP (Evasion Techniques and Breaching Defenses (PEN-300) 心得分享
https://hackmd.io/@henry-ko/HyQ56e8eF

OSEP (Evasion Techniques and Breaching Defenses (PEN-300)
http://github.com/In3x0rabl3/OSEP

OSCP（Offensive Security Certified Professional）
https://github.com/0x584A/oscp-notes/tree/master

ISACA Certified Information Systems Auditor® (CISA) 國際電腦稽核師認證準備歷程心得、申請流程分享- 2023年
https://reurl.cc/aVLoX9

Learn NIST Inside Out With 21 Hours of Training @ 86% OFF
https://thehackernews.com/2022/06/learn-nist-inside-out-with-21-hours-of.html

駭客與國家: 網路攻擊與地緣政治新常態
The hacker and the state: cyber attacks and the new normal of geopolitic
https://reurl.cc/D3nKKj

Practical Network Penetration Tester (PNPT) Certification Review
https://tmc222.medium.com/practical-network-penetration-tester-pnpt-certification-review-4280e4e164df

WUSON常用的基本詞彙
https://choson.lifenet.com.tw/?p=1958

證照仍是學習資安基本功的主要管道，有專家打造「資安證照地圖」
https://www.ithome.com.tw/news/156754

用證照證明自己實力之餘，更應將證照視為督促學習的最大動力
https://www.ithome.com.tw/news/156756

打破證照誤解與迷思，資安專家帶你釐清資安證照的意義
https://www.ithome.com.tw/news/156755

Accelerate Your Career with the Global Leader in Cyber Security Training
https://www.sans.org/mlp/promo-partnership-hacker-news/

【成大資安社社課】資安禁術 - 逆向工程地獄試煉
https://www.youtube.com/watch?v=4Yc3-9CjG6U

透過實務演練，教你建立實作標準的安全SOP流程
https://www.ithome.com.tw/pr/163514

6.近期資安活動及研討會
“全球金牌敏捷课程” - CSM认证（周末班）2024/12/28
https://www.meetup.com/shanghai-agile-scrum-user-group/events/304806511/

Focus and Take Action - Entrepreneurs and Digital Nomads 2024/12/29
https://www.meetup.com/taipei-accountability-group/events/rjcdptygcqbmc/

SecondLook Discussions 2024/12/29
https://www.meetup.com/secondlook-bangkok/events/pbfdptygcqbmc/

Algorithms Study Group! 2024/12/31
https://www.meetup.com/codeseoul/events/vgfcptygcqbpc/