---
# System prepended metadata

title: 資安事件新聞週報  2019/10/21  ~  2019/10/25
tags: [資安事件新聞週報]

---

###### tags: `資安事件新聞週報`
# 資安事件新聞週報  2019/10/21  ~  2019/10/25

1.重大弱點漏洞/後門/Exploit/Zero Day
SRLabs發現智能揚聲器新漏洞或變身監聽用戶的間諜設備
https://www.cnbeta.com/articles/tech/901805.htm

Google、Amazon智能喇叭偷錄密碼
http://bit.ly/2P77wue

Symantec antivirus crashes something again. This time Chrome 78 browsers
https://www.zdnet.com/article/symantec-antivirus-crashes-something-again-this-time-chrome-78-browsers/#ftag=RSSbaffb68

Apache Traffic Server 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10079

Docker Hub現支援TOTP雙因素驗證
https://www.ithome.com.tw/news/133748

PHP遠程代碼執行漏洞預警（CVE-2019-11043）
https://www.huaweicloud.com/notice/2018/20191024155807348.html

PHP 遠程代碼執行漏洞（CVE-2019-11043）[附exploit]
http://vulsee.com/archives/vulsee_2019/1023_9128.html

Fortinet FortiOS 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15703

NETGEAR JNR1010訪問控制錯誤漏洞
https://kb.netgear.com/30177/JNR1010-Firmware-Version-1-0-0-32

Oracle Java SE 安全漏洞(CVE-2019-11068)
http://www.dukulong.com/article/CVE-2019-11068.html

Weblogic反序列化遠程代碼執行漏洞預警通告
https://cloud.tencent.com/developer/article/1526492

Red Hat JBoss Data Virtualization 多個漏洞
https://www.auscert.org.au/bulletins/ESB-2019.3899/

Linux核心含有可造成系統當機或遭駭客掌控的陳年漏洞
https://www.ithome.com.tw/news/133724

Linux 有嚴重漏洞，可導致使用 Wi-Fi 的附近設備當機
https://technews.tw/2019/10/21/unpatched-linux-bug-may-open-devices-to-serious-attacks-over-wi-fi/

Trend Micro Anti-Threat Toolkit (ATTK) 1.62.0.1218 Remote Code Execution
https://packetstormsecurity.com/files/154916/TREND-MICRO-ANTI-THREAT-TOOLKIT-ATTK-REMOTE-CODE-EXECUTION.txt

Cisco 多個產品發布多個安全更新
https://www.us-cert.gov/ncas/current-activity/2019/10/17/cisco-releases-security-updates

Cisco Identity Services Engine存儲型跨站腳本漏洞
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-ise-store-xss

CVE-2019-12643：CISCO IOS XE身份驗證繞過漏洞
https://nosec.org/home/detail/3070.html

Cisco REST API中的認證繞過漏洞，讓黑客遠程控制Cisco路由器
http://www.51testing.com/html/04/n-4462904.html

思科 Firepower Management Center 遠端執行任意程式碼漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-fmc-rce

BIND 多個漏洞
https://www.us-cert.gov/ncas/current-activity/2019/10/17/isc-releases-security-advisories-bind

VMware VeloCloud Orchestrator 信息洩露漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5533

Windows 10 更新小幫手暗藏漏洞，Microsoft 建議用戶盡快安裝更新
http://bit.ly/2VXpaSn

微軟推送新補丁：修復Intel四代酷睿安全漏洞
http://news.mydrivers.com/1/652/652468.htm

快遞櫃人臉辨識漏洞 照片可解鎖
https://www.ydn.com.tw/News/356800

ECPay Logistics for WooCommerce <= 1.2.181030 - Unauthenticated Reflected XSS
https://wpvulndb.com/vulnerabilities/9869

CVE-2019-16928: Exploiting an Exim Vulnerability via EHLO Strings
https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-16928-exploiting-an-exim-vulnerability-via-ehlo-strings/

Short October Patch Tuesday Includes Remote Desktop Client, Browser, and Authentication Patches
http://bit.ly/2PaHaaB

Belkin Wemo Switch
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2019-17532

D-Link 路由器遠端執行程式碼漏洞
https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html

DIR-859 A3-1.06 and DIR-850 A1.13 devices
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2019-17508

D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2019-17506

DIR-880L 1.08B04 and DIR-895 L/R 1.13b03
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14948

D-Link DIR-846 devices
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2019-17510

D-Link DIR-846
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2019-17509

Sophos Cyberoam firewall appliance with CyberoamOS
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2019-17059

RHEL 7和CentOS 7獲得重要Linux內核安全更新：推薦盡快安裝
https://www.cnbeta.com/articles/tech/902755.htm

Chrome is crashing on windows 10 1903 with your latest version. 78.0.3904.70
https://support.google.com/chrome/thread/17501990?hl=en

Firefox, Chrome Bugs Allow Arbitrary Code-Execution
https://threatpost.com/critical-firefox-bugs-arbitrary-code-execution/149455/

FusionPBX跨站脚本漏洞
https://github.com/fusionpbx/fusionpbx/commit/c48a160af53352ad1a43518b7d0faab16b8dfbcc

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
Open Banking上路作半套？TSP業者要合縱聯盟
https://www.chinatimes.com/realtimenews/20191018005473-260410?chdtv

財金資訊公司帶頭打造Open API平臺，下階段關鍵挑戰是身分認證
https://www.ithome.com.tw/news/133693

政大國際產學聯盟營運長王儷玲：臺灣開放銀行能走得更穩健，未來可逐步擴大到Open Finance
https://www.ithome.com.tw/news/133694

金融個資存取如何更安全？開放銀行將引進OAuth 2委任授權架構
https://www.ithome.com.tw/news/133707

國銀提報衝擊容忍度4小時...被打槍
https://money.udn.com/money/story/5613/4116077

銀行系統出包 拚2小時修復
https://money.udn.com/money/story/5613/4116074

銀行系統出包 金管會要求2小時補漏
https://udn.com/news/story/7239/4115794?from=udn-ch1_breaknews-1-cate6-news

提款機貼「不要插壞了」…男小心插還故障　再看字條昏倒
https://news.tvbs.com.tw/fun/1219501

厄利垂亞網路普及率只1％　領錢看瞴ATM管制比北韓嚴格
https://www.ettoday.net/news/20191017/1559140.htm

領不到錢！週四多地ATM傳當機　網驚呼：台灣被入侵
https://www.setn.com/News.aspx?NewsID=620161

銀行數位化風險不容忽視　穆迪示警：恐引發系統性風險
https://tw.finance.appledaily.com/realtime/20191021/1652086/

APX新技術改變傳統金流 可有效防制洗錢遏止資安問題
http://bit.ly/2W41WtR

金融業系統頻頻出包 金管會八大措施強化控管
https://ec.ltn.com.tw/article/breakingnews/2954302

國泰投信否認遭駭客勒索未遂、電腦當機
https://udn.com/news/story/7253/4119687

國泰投信電腦中毒當機關閉網路 已恢復正常
https://udn.com/news/story/7239/4119618

傳遭駭客勒索未遂大當機 國泰投信否認
https://money.udn.com/money/story/5607/4119618

傳遭駭客勒索？國泰投信：絕無此事
https://www.chinatimes.com/realtimenews/20191022004560-260410?chdtv

國泰投信官網癱瘓　國泰投信：關閉內網防止同仁中毒電腦影響系統
https://www.ettoday.net/news/20191022/1563026.htm

遭駭客勒索大當機？國泰投信澄清：明天可正常基金申贖
https://news.cnyes.com/news/id/4399329

中國銀行：將暫時關閉三星部分手機指紋登陸銀行功能
https://news.sina.com.tw/article/20191022/33036810.html

純網銀資料放海外？顧立雄：核心資料留在家裡面
https://www.chinatimes.com/realtimenews/20191022004036-260410?chdtv

資安、轉型並重 保險業因應全新挑戰
https://www.chinatimes.com/realtimenews/20191022004939-260410?chdtv

Visa完成對Rambus支付業務組合的收購
https://times.hinet.net/news/22617064

數千個網路商店被注入 Magecart信用卡盜卡程式,今年第三起類似事件!
https://blog.trendmicro.com.tw/?p=62262

Thieves Using JCB to Scoop out ATM Machine Has Reminded Netizens of the Viral Meme
https://www.news18.com/news/buzz/thieves-using-jcb-to-scoop-out-atm-machine-has-reminded-netizens-of-the-viral-meme-2347025.html

Banks deny compensation when hackers steal customers' money
https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982

Cyberhackers targeting banking systems, municipalities for bigger payouts, US Secret Service says
https://www.ksat.com/news/cyber-hackers-targeting-banking-systems-municipalities-for-bigger-payouts-us-secret-service-says

Payment Security Software Market Solid Analyzed Segmentation, Demand, Recent Share Estimation and Growth Prospects by Regions to 2017 – 2025
https://statsflash.com/payment-security-software-market-solid-analyzed-segmentation-demand-recent-share-estimation-and-growth-prospects-by-regions-to-2017-2025/54679/

FIN6 Compromised E-commerce Platform via Magecart to Inject Credit Card Skimmers Into Thousands of Online Shops
http://bit.ly/2MEQWPl

Browser-based attacks, our customers, and us
https://www.zdnet.com/article/browser-based-attacks-our-customers-and-us/#ftag=RSSbaffb68

Magecart group linked to Dridex banking Trojan, Carbanak
https://www.zdnet.com/article/magecart-group-linked-to-dridex-banking-trojan-carbanak/#ftag=RSSbaffb68

The forgotten domain: Exploring a link between Magecart Group 5 and the Carbanak APT
https://blog.malwarebytes.com/threat-analysis/2019/10/the-forgotten-domain-exploring-a-link-between-magecart-group-5-and-the-carbanak-apt/

PSD2 Authentication Deadline Extended: Here's What's Next
https://www.bankinfosecurity.com/psd2-authentication-deadline-extended-heres-whats-next-a-13284

FBI Issues Payment Card Skimming Warning
https://www.bankinfosecurity.com/fbi-issues-payment-card-skimming-warning-a-13292

Banks must ditch SMS one-time passcodes – and fast
https://www.globalbankingandfinance.com/banks-must-ditch-sms-one-time-passcodes-and-fast/

Banks deny compensation when hackers steal customers’ money
http://mednewsledger.info/banks-deny-compensation-when-hackers-steal-customers-money-cbc-news/149/

3.電子支付/電子票證/行動支付/ pay/新聞及資安
為台灣Pay市占喊冤 林國良：交易額增3倍
http://bit.ly/2OZ6joO

微信支付寶雙雙叫停，指紋支付現重大漏洞
https://ek21.com/news/tech/153478/

京東金融賬戶被盜刷15萬？用戶：支付環節有安全漏洞
https://finance.sina.com.cn/money/bank/bank_hydt/2019-10-25/doc-iicezzrr4888043.shtml

4.虛擬貨幣/區塊鍊相關新聞及資安
專家傳真－台灣發展證券型代幣市場的生態剖析
http://bit.ly/2N8qm1g

Maxonrow 揮軍俄羅斯區塊鏈產業圈 擔任KuCoin 見面會重量級開場嘉賓
http://bit.ly/2MyK7jN

Blockchain helps enterprises' digital ecosystems in Asia-Pacific
https://www.zdnet.com/article/blockchain-helps-enterprises-digital-ecosystems-in-asia-pacific/#ftag=RSSbaffb68

Zcash (ZEC) Warns Users Against a Malicious Copy Of The Native ZecWallet In GitHub
https://bitcoinexchangeguide.com/zcash-zec-warns-users-against-a-malicious-copy-of-the-native-zecwallet-in-github/

Malicious Fraudulent Version Of ZecWallet Found By Community
https://cryptodaily.co.uk/2019/10/malicious-fraudulent-version-found-community

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式
Emsisoft發布美國今年前三季勒索軟體調查結果
https://www.nccst.nat.gov.tw/NewsRSSDetail?lang=zh&RSSType=news&seq=16308

攻擊手法再翻新！駭客用音訊檔「WAV」散布惡意程式
https://cnews.com.tw/140191018a03/

黑科技！用「聲音」部署惡意挖礦程式，駭客透過 .WAV 音檔入侵挖門羅幣 XMR
https://www.blocktempo.com/hackers-use-malicious-code-in-wav-audio-files-to-mine-cryptocurrencies/

新型ATM惡意軟體Dtrack
http://bit.ly/31w8Ysw

可解鎖上百種Stop勒索軟體變種的金鑰來了
https://www.ithome.com.tw/news/133726

假冒的Tor Browser到暗網偷竊比特幣
https://ithome.com.tw/news/133731

電腦病毒你知多少？不可輕忽的資安議題，你意想不到的病毒演進史
https://www.issdu.com.tw/news_detail.php?id=95&type=security

微軟聯合PC業者防止韌體惡意程式
https://www.ithome.com.tw/news/133745

美國發現最新惡意軟體 系中共黑客所爲
https://www.bldaily.com/us-news/p-435242.html

即使漏洞修補了兩年, WannaCry 仍是 使用EternalBlue 漏洞攻擊手法中最多的
https://blog.trendmicro.com.tw/?p=62316

Phorpiex Botnet Sending Out Millions of Sextortion Emails Using Hacked Computers
https://thehackernews.com/2019/10/phorpiex-botnet-sextortion-emails.html

Malicious Tor Browser Fleeces Darknet Users of Bitcoins
https://www.bankinfosecurity.com/malicious-tor-browser-fleeces-darknet-users-bitcoins-a-13272

Fake Tor Browser steals Bitcoin from Dark Web users
https://www.zdnet.com/article/malicious-tor-browser-steals-bitcoin-from-dark-web-users/#ftag=RSSbaffb68

Fleecing the onion: Darknet shoppers swindled out of bitcoins via trojanized Tor Browser
https://www.welivesecurity.com/2019/10/18/fleecing-onion-trojanized-tor-browser/

Sodinokibi Ransomware Gang Appears to Be Making a Killing
https://www.bankinfosecurity.com/sodinokibi-ransomware-gang-appears-to-be-making-killing-a-13269

Telangana third most hit by Dtrack spying malware
http://www.newindianexpress.com/states/telangana/2019/oct/21/telangana-third-most-hit-by-dtrack-spying-malware-2050610.html

This Malware is Hiding C&C Server IPs in the Blockchain
https://www.cbronline.com/news/redaman-blockchain

Top Malware em Setembro de 2019
https://www.techenet.com/2019/10/check-point-top-malware-mais-procurados-em-setembro/

2019 Healthcare Threat Report: Protecting Patients, Providers and Payers
https://www.proofpoint.com/sites/default/files/gtd-pfpt-us-tr-2019-healthcare-threat-report.pdf

New Crypto-Jacking Malware ‘Graboid' Infects Thousands of Computers to Mine Monero (XMR)
https://bitcoinexchangeguide.com/new-crypto-jacking-malware-graboid-infects-thousands-of-computers-to-mine-monero-xmr/

TA505 debuts Get2 downloader and SDBbot RAT in new phishing campaigns
https://www.scmagazine.com/home/security-news/phishing/ta505-debuts-get2-downloader-and-sdbbot-rat-in-new-phishing-campaigns/

Malware That Forces ATMs To Give All Their Money Is Gaining Popularity, Here's How It Works
https://www.indiatimes.com/technology/news/malware-that-forces-atms-to-give-all-their-money-is-gaining-popularity-here-s-how-it-works-377975.html

Malware jackpot serang jaringan mesin ATM di seluruh dunia
https://beritagar.id/artikel/berita/malware-jackpot-serang-jaringan-mesin-atm-di-seluruh-dunia

Researchers find stealthy MSSQL server backdoor developed by Chinese cyberspies
https://www.zdnet.com/article/researchers-find-stealthy-mssql-server-backdoor-developed-by-chinese-cyberspies/

Winnti Group’s skip‑2.0: A Microsoft SQL Server backdoor
https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/

Phishing alert: This fake email about a bank payment delivers trojan malware
https://www.zdnet.com/article/phishing-alert-this-fake-email-about-a-bank-payment-delivers-trojan-malware/

New Variant of Remcos RAT Observed In the Wild
https://www.fortinet.com/blog/threat-research/new-variant-of-remcos-rat-observed-in-the-wild.html

New Variant of Gustuff Android Banking Trojan Emerges
https://www.securityweek.com/new-variant-gustuff-android-banking-trojan-emerges

Gustuff return, new features for victims
https://blog.talosintelligence.com/2019/10/gustuffv2.html

Ransomware: The nightmare before Cyber Monday
https://www.zdnet.com/article/ransomware-the-nightmare-before-cyber-monday/#ftag=RSSbaffb68

Major German manufacturer still down a week after getting hit by ransomware
https://www.zdnet.com/article/major-german-manufacturer-still-down-a-week-after-getting-hit-by-ransomware/#ftag=RSSbaffb68

ATTK of the Pwns: Trend Micro's antivirus tools 'will run malware – if its filename is cmd.exe'
https://www.theregister.co.uk/2019/10/21/flaw_trend_micro/

Discord Turned Into an Info-Stealing Backdoor by New Malware
https://www.bleepingcomputer.com/news/security/discord-turned-into-an-info-stealing-backdoor-by-new-malware/

Report: Billtrust Recovering From Ransomware Attack
https://www.bankinfosecurity.com/report-billtrust-recovering-from-ransomware-attack-a-13289

Swedish police cleared to deploy spyware against crime suspects
https://www.zdnet.com/article/swedish-police-cleared-to-deploy-spyware-against-crime-suspects/#ftag=RSSbaffb68

ACSC warns of Windows malware Emotet spreading in Australia
https://www.itwire.com/security/acsc-warns-of-windows-malware-emotet-spreading-in-australia.html

Chubb finds ‘alarming’ rise in ransomware attacks
https://www.canadianunderwriter.ca/insurance/chubb-finds-alarming-rise-in-ransomware-attacks-1004169886/

Μια σύντομη ματιά στο Citadel Banking Trojan
https://www.secnews.gr/201778/mia-syntomi-matia-sto-citadel-banking-trojan/

Telangana third most hit by Dtrack spying malware
http://www.newindianexpress.com/states/telangana/2019/oct/21/telangana-third-most-hit-by-dtrack-spying-malware-2050610.html

UPDATED GUSTUFF ANDROID TROJAN CHANGES TACTICS
https://duo.com/decipher/updated-gustuff-android-trojan-changes-tactics

This easy-to-use information-stealing trojan malware is quickly gaining popularity among cyber criminals
https://www.zdnet.com/article/this-easy-to-use-information-stealing-trojan-malware-is-quickly-gaining-popularity-among-cyber-criminals/

Unpacking Malware Series - Maze Ransomware
https://poxyran.github.io/poxyblog/hide/pages/22-10-2019-unpacking-malware-series-maze-ransomware.html

B.行動安全 / iPhone / Android /穿戴裝置 /App
蘋果針對 Safari 安全瀏覽功能發表聲明
https://www.twcert.org.tw/tw/cp-104-3011-6428e-1.html

加州男子控告 AT&T 與駭客合作，透過 SIM 卡調換竊其多個交易所帳戶 5,500 萬資產
https://www.blocktempo.com/att-sued-sim-swap-loss-1-8-million/

中國製UC瀏覽器再傳含有中間人攻擊風險
https://ithome.com.tw/news/133712

「抖音」疑配合中國審查　美國會議員要求國安調查
https://tw.news.appledaily.com/international/realtime/20191025/1653840/

美國抖音下載破1億1000萬　「淪中國情報平台」參議員要求嚴審！
https://www.ettoday.net/news/20191025/1564920.htm

梅賽德斯·賓士APP在美爆安全漏洞 可看其他車主信息
https://news.sina.com.tw/article/20191021/33029440.html

香港工程師致力挖掘各App隱藏功能　吸引臉書、IG高管爭相追蹤
https://www.ettoday.net/news/20191023/1563397.htm

數位版毛語錄？「學習強國」App，暴露中共嚴重的亡國感
https://opinion.udn.com/opinion/story/120611/4121556

臉書又全球大當機 貼文消失、使用異常
http://bit.ly/2BFZRLB

棄守第二大手機市場？傳因「臉部辨識」技術未許可 Google Pixel 4將不在印度販售
https://news.sina.com.tw/article/20191018/32995848.html

Pixel 4 臉部解鎖存重大漏洞：閉著眼也能解鎖
https://www.techbang.com/posts/73599-pixel-4-face-unlock-has-a-major-vulnerability-close-your-eyes-to-unlock-it

三星 Galaxy S10 指紋辨識出包，貼上保護膜任何指紋都能解鎖
https://technews.tw/2019/10/18/samsung-galaxy-s10-under-screen-fingerprint-recognition-bug/

三星旗艦機S10出包 指紋辨識被輕易解鎖...官方認了
http://bit.ly/2pBMzN5

三星S10指紋辨識破功 任何人都能解
https://www.chinatimes.com/realtimenews/20191018002483-260412?chdtv

指紋辨識出包！三星下周更新軟體 要用戶先移除保護貼
https://udn.com/news/story/6811/4114209?from=udn-ch1_breaknews-1-cate5-news

三星指紋辨識現漏洞 台廠供應鏈受牽連
http://bit.ly/2N2eiyB

Galaxy S10 出現指紋辨識異常 三星：將盡速發布修補軟體
https://fnc.ebc.net.tw/FncNews/else/103179

三星Galaxy S10指紋辨識爆漏洞 多家銀行暫停指紋登入功能
https://newtalk.tw/news/view/2019-10-23/315627

三星承認指紋漏洞，支付寶微信等關閉S10等機型指紋支付
https://kknews.cc/tech/e6z8m8r.html

三星手機指紋重大漏洞遭多國停用 安全事故頻出釋放危險信號
https://kknews.cc/digital/gpzp2q8.html

S10、Note 10都傳出超聲波指紋辨識有漏洞 全球多家銀行都暫停支援指紋登入
http://bit.ly/2PfEOaG

修復指紋辨識漏洞！三星急釋出Galaxy S10軟體更新
http://bit.ly/32K4MXv

Samsung to patch S10 fingerprint sensor bug next week
https://www.zdnet.com/article/samsung-to-patch-s10-fingerprint-sensor-bug-next-week/#ftag=RSSbaffb68

Google Play上的假美肌應用程式「Yellow Camera」,會攔截簡訊驗證碼,觸發 WAP 代扣繳費功能
https://blog.trendmicro.com.tw/?p=62312

三星Galaxy S10國行版推送更新：修復指紋漏洞 
http://www.sohu.com/a/349341594_114760

惡意美顏相機App，偷讀簡訊認證碼讓你賠大錢
https://www.techbang.com/posts/73698-malicious-beauty-camera-app-sneaking-through-the-newsletter-authentication-code-lets-you-lose-money

FTC出手禁售3款跟蹤程式
https://www.ithome.com.tw/news/133770

FTC Brings First Case Against Developers of “Stalking” Apps
https://www.ftc.gov/news-events/press-releases/2019/10/ftc-brings-first-case-against-developers-stalking-apps

Chrome for Android Enables Site Isolation Security Feature for All Sites with Login
https://thehackernews.com/2019/10/chrome-site-isolation-android.html

Huge rise in rogue banking apps driving fraud attacks
https://www.computerweekly.com/news/252472525/Huge-rise-in-rogue-banking-apps-driving-fraud-attacks

Fake mobile app fraud tripled in first half of 2019, finds RSA Security
https://www.techcentral.ie/fake-mobile-app-fraud-tripled-in-first-half-of-2019-finds-rsa-security/

Chrome for Android Enables Site Isolation Security Feature for All Sites with Login
https://thehackernews.com/2019/10/chrome-site-isolation-android.html

Fake Photo Beautification Apps on Google Play can Read SMS Verification Code to Trigger Wireless Application Protocol (WAP)/Carrier Billing
http://bit.ly/2JfCpJ9

Google to roll out update 'in the coming' months to fix Pixel 4 Face Unlock bypass
https://www.zdnet.com/article/google-to-roll-out-update-in-the-coming-months-to-fix-pixel-4-face-unlock-bypass/#ftag=RSSbaffb68

42 Adware Apps with 8 Million Downloads Traced Back to Vietnamese Student
https://thehackernews.com/2019/10/42-adware-apps-with-8-million-downloads.html

Vietnamese student behind Android adware strain that infected millions
https://www.zdnet.com/article/vietnamese-student-behind-android-adware-strain-that-infected-millions/#ftag=RSSbaffb68

Mobile Anti Malware Market Share, Application Scope, Growth Rate, Top Players, Production, Sales and Next 5 Years Forecast Analysis
http://bit.ly/31Ln0GI

Mobile under attack with malicious intent
https://www.itweb.co.za/content/WnpNgq2AdBnMVrGd

C.事件 / 駭客 / DDOS / APT / 雲端/暗網/徵才 / 國際資安事件
中華資安國際提出「常見 5 種資安漏洞」，守護企業須建立「紅藍紫隊」思維
https://www.inside.com.tw/feature/atd-2019/17875-2019ATD03-CHTsecurity

Facebook 員工需透過香港駭客了解公司內部計劃
https://unwire.pro/2019/10/21/facebook-employees-turn-to-hong-kong-hacker-for-info/news/

林宗男、吳瑞北、李忠憲、孫宏民、范俊逸／建設智慧國家 有賴資安磐石
https://talk.ltn.com.tw/article/paper/1326235

DEVCORE 紅隊的進化，與下一步
https://devco.re/blog/2019/10/24/evolution-of-DEVCORE-red-team-and-the-next/

AWS數據中心裝蜜罐 每分鐘被攻擊13次印證高風險
http://bit.ly/33UTlfQ

侵犯隱私? 台大醫院爆監控電腦
https://m.ltn.com.tw/news/life/paper/1327147

他不認為自己是駭客 自稱「密碼恐怖份子」
http://bit.ly/3615q54

駭客鎖定聯合國人道援助組織 誘騙員工洩露個資
https://www.cna.com.tw/news/aopl/201910250107.aspx

鎖定UN人道援助員工攻擊 資安業者揭大規模駭客活動
http://bit.ly/2JlY9mz

有關惡意 IP 對企業 Office 365 帳號進行暴力破解攻擊
https://www.tc.edu.tw/news/show/id/143817

日本星巴克會員網站遭駭 信用卡儲值服務暫時喊停
https://fnc.ebc.net.tw/FncNews/else/103918

My Starbucks不正ログイン防止のため、パスワードを変更してください
https://www.starbucks.co.jp/notice/20203207.php

淘寶台灣捲土重來立委控英商掩護中資新漏洞
http://www.epochtimes.com/gb/19/10/24/n11608964.htm

中國製監控系統遍布　被禁設備移除難度高　
https://tw.news.appledaily.com/international/realtime/20191020/1651382/

更換華監控系統有難度 美政府部門仍使用被禁設備
https://hk.news.appledaily.com/international/realtime/article/20191020/60173943

路透：部分美企對華為5G技術感興趣 正進行初期討論
https://fnc.ebc.net.tw/FncNews/headline/103280

遠端操控軟體TeamViewer遭爆駭客入侵 結果事實讓人傻眼了
http://bit.ly/2W35T1Z

6個月嬰兒都不放過！全球最大宗兒童色情暗網遭破獲 用「比特幣」付費下載25萬支性虐影片
http://bit.ly/2W674hm

暗網與比特幣　助業者設全球最大兒童色情網
https://news.tvbs.com.tw/world/1219582

四方支付團伙落網：利用電商平台漏洞轉移非法資金
https://news.sina.com.tw/article/20191024/33063888.html

中譯語通集數據 成中共網控打手
http://bit.ly/2W8Me0V

澳前情報官被控犯保密法 妻被疑為中共間諜
http://www.epochtimes.com/b5/19/10/24/n11608504.htm

美官員：中共加強網攻美通信技術供應鏈
http://www.epochtimes.com/b5/19/10/20/n11601178.htm

美國人的錢如何通過華爾街流向中共
https://www.ntdtv.com/b5/2019/10/23/a102691983.html

德國政府掛保證：Firefox是最安全的瀏覽器
https://ithome.com.tw/news/133716

「香港解密」曝示威者個資台人也入列 台灣基進籲政府反制
http://bit.ly/2W7hT2u

利用中文來監控的駭客團伙Rocke改變犯罪策略
https://read01.com/5neoxBB.html

中共政治局委員、中宣部部長黃坤明在烏鎮互聯網大會上批「網絡霸凌」言論 遭網民潮水般抨擊
http://www.epochtimes.com/b5/19/10/21/n11602804.htm

中共升級網攻手段 攻破蘋果手機 監控海外僑民
https://www.ntdtv.com/b5/2019/10/22/a102691472.html

中國國家級駭客再升級 專攻少數族群及其海外親友手機
https://www.rti.org.tw/news/view/id/2038908

中國駭客攻擊發生劇變 外媒：針對少數民族、僑民
https://news.ltn.com.tw/news/world/breakingnews/2954868

紐時：中國國家主席習近平重組解放軍 中國駭客監控蔓延全球
http://bit.ly/2qFzTFG

2019年中國網絡安全行業市場現狀及發展前景分析三因素共振驅動市場規模將超900億
http://finance.eastmoney.com/a/201910241270819442.html

支付寶36萬招找茬程序員“年薪”無上限
http://finance.eastmoney.com/a/201910241270807142.html

Google地圖疑鑽法律漏洞　南韓4成軍事設施曝光
https://hk.on.cc/hk/bkn/cnt/aeanews/20191021/bkn-20191021200046743-1021_00912_001.html

Fb封鎖俄羅斯、伊朗4用戶網路　疑企圖干擾美總統大選
https://www.chinatimes.com/realtimenews/20191022004345-260408?chdtv

駭客入侵Avast以危害CCleaner，捷克情報機構指中國駭客最為可疑
https://www.ithome.com.tw/news/133747

敘利亞政府監控人民網路 駭客攔截警告網友
http://bit.ly/2Nl6HLZ

美國聯邦調查局FBI警告中小企業與政府組織要小心線上盜錄
https://www.ithome.com.tw/news/133805

美軍採購中國製無人機 國防部澄清：只供練靶用
https://hk.news.appledaily.com/international/realtime/article/20191025/60192426

英美安全報告：俄政府駭客利用伊朗駭客網絡駭攻20國
https://www.soundofhope.org/b5/2019/10/22/n3276558.html

俄駭客控制伊朗網路設備1年半 冒名攻擊逾20國
http://bit.ly/32DagDn

資用伊朗駭客團隊犯案 俄國黑吃黑
https://udn.com/news/story/6809/4117441

俄羅斯駭客駭進伊朗駭客的攻擊架構與工具，借刀殺人
https://www.ithome.com.tw/news/133744

俄駭客冒名伊朗網攻 20國受害
https://www.ydn.com.tw/News/357392

俄國駭客入侵伊朗網路設備 冒名攻擊其他國家1年半
https://news.pchome.com.tw/science/cnews/20191022/index-57173805502394227005.html

Russian APT Turla targets 35 countries on the back of Iranian infrastructure
https://www.zdnet.com/article/russian-apt-turla-targets-35-countries-on-the-back-of-iranian-infrastructure/#ftag=RSSbaffb68

Cybercrime Tool Prices Continue to Rise on Darknet Sites
https://www.bankinfosecurity.asia/cybercrime-tool-prices-continue-to-rise-on-darknet-sites-a-13265

A Look at the Pricing of Cybercrime Goods, Services
https://www.flashpoint-intel.com/blog/a-look-at-the-pricing-of-cybercrime-goods-services/

Russia-Linked Cyber Espionage Group APT29 Remains Active
https://www.bankinfosecurity.com/russia-linked-cyber-espionage-group-apt29-remains-active-a-13270

Feds Shut Down Largest Dark Web Child Abuse Site; South Korean Admin Arrested
https://thehackernews.com/2019/10/dark-web-child-abuse.html

US stopped using floppy disks to manage nuclear weapons arsenal
https://www.zdnet.com/article/us-stopped-using-floppy-disks-to-manage-nuclear-weapons-arsenal/#ftag=RSSbaffb68

Multifactor authentication issue hitting North American Azure, Office 365 users
https://www.zdnet.com/article/multifactor-authentication-issue-hitting-north-american-azure-office-365-users/#ftag=RSSbaffb68

Avast target of cyber-security attack, company and Czech counterintelligence say
https://news.yahoo.com/avast-target-cyber-security-attack-141226927.html

Avast says hackers breached internal network through compromised VPN profile
https://www.zdnet.com/article/avast-says-hackers-breached-internal-network-through-compromised-vpn-profile/#ftag=RSSbaffb68

Avast fights off cyber-espionage attempt, Abiss
https://blog.avast.com/ccleaner-fights-off-cyberespionage-attempt-abiss

Avast: Stolen VPN Credentials Led to CCleaner Attack Redux
https://www.bankinfosecurity.com/avast-stolen-vpn-credentials-led-to-ccleaner-attack-redux-a-13283

Feds Shut Down Largest Dark Web Child Abuse Site; South Korean Admin Arrested
https://thehackernews.com/2019/10/dark-web-child-abuse.html

NordVPN、TorGuard與VikingVPN三大VPN業者的金鑰外流
https://www.ithome.com.tw/news/133751

NordVPN 承認伺服器有安全漏洞，讓攻擊者得以攔截用戶流量
https://www.techbang.com/posts/73673-nordvpn-server-breach-vpn-traffic-exposed-encryption

NordVPN admits to 'isolated' server breach in Finland
https://engt.co/32E9INN

NordVPN reveals breach at datacenter provider
https://www.welivesecurity.com/2019/10/22/nordvpn-breach-datacenter-provider/

Why the NordVPN network is safe after a third-party provider breach
https://nordvpn.com/zh-tw/blog/official-response-datacenter-breach/

Bezos DDoS'd: Amazon Web Services' DNS systems knackered by hours-long cyber-attack
https://www.theregister.co.uk/2019/10/22/aws_dns_ddos/

CPDoS：一種新的Web緩存污染攻擊
https://www.anquanke.com/post/id/189507

黑客利用緩存中毒攻擊將目標鎖定CDN保護網站
https://www.freebuf.com/news/217870.html

New Cache Poisoning Attack Lets Attackers Target CDN Protected Sites
https://thehackernews.com/2019/10/cdn-cache-poisoning-dos-attack.html

CPDoS attack can poison CDNs to deliver error pages instead of legitimate sites
https://www.zdnet.com/article/cpdos-attack-can-poison-cdns-to-deliver-error-pages-instead-of-legitimate-sites/#ftag=RSSbaffb68

FBI: Russian Hacker Indicted In Pittsburgh Wanted For Allegedly Running Worldwide Conspiracy
https://pittsburgh.cbslocal.com/2019/10/24/fbi-russian-hacker-indicted-in-pittsburgh-wanted-for-allegedly-running-worldwide-conspiracy/

Your Cache Has Fallen: Cache-Poisoned Denial-of-Service Attack
https://cpdos.org/paper/Your_Cache_Has_Fallen__Cache_Poisoned_Denial_of_Service_Attack__Preprint_.pdf

Transparent Tribe – APT Targeting India
https://labs.k7computing.com/?p=17380

Brazilian government seeks data governance head
https://www.zdnet.com/article/brazilian-government-seeks-data-governance-head/#ftag=RSSbaffb68

Czech authorities dismantle alleged Russian cyber-espionage network
https://www.zdnet.com/article/czech-authorities-dismantle-alleged-russian-cyber-espionage-network/#ftag=RSSbaffb68

Chinese national sentenced for trying to smuggle military tech from US to China
https://www.zdnet.com/article/chinese-national-sentenced-for-trying-to-smuggle-military-tech-from-us-to-china/#ftag=RSSbaffb68

NCSC Investigated 658 Serious Cybersecurity Incidents
https://www.bankinfosecurity.com/ncsc-investigated-658-serious-cybersecurity-incidents-a-13286

A DDoS gang is extorting businesses posing as Russian government hackers
https://www.zdnet.com/article/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers/#ftag=RSSbaffb68

滲透測試工程師
https://m.104.com.tw/job/3f823?jobsource=m104

資安滲透測試專家(Q13)
https://m.104.com.tw/job/4chjb?jobsource=m104

資訊安全工程師(滲透測試)_T2
https://m.104.com.tw/job/51ik0?jobsource=m104

高級安全工程師--滲透測試
https://m.104.com.tw/job/6a198?jobsource=m104

【資安所】網駭科技研析中心-資安滲透檢測工程師
https://m.104.com.tw/job/6k11l?jobsource=m104

資安檢測工程師
https://m.104.com.tw/job/64myq?jobsource=m104

系統資安工程師
https://m.104.com.tw/job/6hr7s?jobsource=m104

網路資安工程師
https://m.104.com.tw/job/59nw1?jobsource=m104

資安服務工程師
https://m.104.com.tw/job/3biy7?jobsource=m104

資安事件調查員
https://m.104.com.tw/job/6j3cl?jobsource=m104

數位鑑識工程師 _T2
https://m.104.com.tw/job/6ptmc?jobsource=m104

數位鑑識與舞弊偵防顧問
https://m.104.com.tw/job/2wf7t?jobsource=m104

Incident Response Engineer
https://m.104.com.tw/job/6q9n9?jobsource=m104

【IT】資安系統工程師 - 1900454
https://m.104.com.tw/job/6qs9w?jobsource=m104

資安技術人員
https://m.104.com.tw/job/63m1f?jobsource=m104

[軟體系統]高級資安系統應用工程師(台南)
https://www.104.com.tw/job/6rpmd

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
錢櫃個資外洩？詐騙集團竟知身分證、消費日
http://bit.ly/32wsyGl

錢櫃回應了！客人「個資外洩」狂接詐騙電話　身分證、消費日全曝光
https://www.ettoday.net/news/20191020/1560888.htm

知名訂房網疑資料外洩 會員慘遭詐
https://penghudaily.blogspot.com/2019/10/blog-post_153.html

電信中盤商騙移工個資 辦人頭門號供詐騙集團
http://bit.ly/2BuDKYi

Mercedes-Benz App 出現問題令車主資料外洩
https://unwire.hk/2019/10/20/mercedes-benz-app-glitch/fun-tech/

西青警方連續破獲24起新型電信網絡詐騙案
http://life.eastmoney.com/a/201910181264643554.html

駭客入侵！大咖女星裸照慘遭外流　粉心疼籲「拒點拒分享」
https://www.setn.com/News.aspx?NewsID=620965

Alexa與Google Home第三方應用程式可用語音釣魚竊取用戶密碼
https://ithome.com.tw/news/133727

蔡依林門票傳黃牛詐財 女粉匯1萬2買特區一場空
https://udn.com/news/story/7320/4102849?from=udn-ch1_breaknews-1-0-news

男子用美團代購機票被騙3460元 南航否認系統漏洞
https://news.sina.com.tw/article/20191021/33017716.html

用LINE的QR Code詐騙？別點不明連結！學著保護帳號
https://www.mygopen.com/2019/10/line-qr-code.html

超危險詐騙！點個連結別人就可以登入你的 LINE 帳號
https://applealmond.com/posts/60838

前1天簽約！Beauty88遭控惡倒　欠3百人6千萬
https://news.tvbs.com.tw/life/1220906

捷運置物櫃變"藏金閣" 詐19人得手1500萬
https://www.ttv.com.tw/news/view/10810210032200N/579

香港銀保監會通報騙保案件 各保險公司啟動全面自查整改
https://news.sina.com.tw/article/20191023/33047482.html

護兒少個資隱私 小心數位足跡被蒐
https://udn.com/news/story/7314/4120957

聲援反送中卻遭香港網站鎖定！台灣人個資全都曝
http://bit.ly/32JpnLP

【2019/10/24 1:00】PayPalを騙る詐欺メールに関する注意喚起
https://www.cc.uec.ac.jp/blogs/news/2019/10/20191024paypalphishing.html

Fraud attacks see huge rise in 2019
https://www.itproportal.com/news/fraud-attacks-see-huge-rise-in-2019/

Banking scams becoming more sophisticated
https://www.iol.co.za/personal-finance/my-money/banking/banking-scams-becoming-more-sophisticated-35279484

Stripe Users Targeted in Phishing Attack That Steals Banking Info
https://www.bleepingcomputer.com/news/security/stripe-users-targeted-in-phishing-attack-that-steals-banking-info/

Delhi: Ex-head constable held for ATM card fraud
http://timesofindia.indiatimes.com/articleshow/71639868.cms

Open database leaked 179GB in customer, US government, and military records
https://www.zdnet.com/article/autoclerk-database-leaked-customer-government-and-military-personal-records/#ftag=RSSbaffb68

Report: Travel Reservations Platform Leaks US Government Personnel Data
https://www.vpnmentor.com/blog/us-travel-military-leak/

Veterans' Data at Risk on Shared Network Storage Devices
https://www.bankinfosecurity.com/veterans-data-at-risk-on-shared-network-storage-devices-a-13281

Unsecure Database Exposed US Military Personnel Data: Report
https://www.bankinfosecurity.com/unsecure-database-exposed-us-military-personnel-data-report-a-13280

How to Avoid the Top Three Causes of Data Breaches in 2019
https://thehackernews.com/2019/10/data-breach-protection.html

Europe Data Exfiltration Market Industry Analysis and Market Forecast (2017-2024)
https://statsflash.com/europe-data-exfiltration-market-industry-analysis-and-market-forecast-2017-2024/183239/

New report offers insights into phishing scammers' go-to tricks
https://www.healthcareitnews.com/news/new-report-offers-insights-phishing-scammers-go-tricks

Three Charged in $11 Million BEC Scam
https://www.bankinfosecurity.com/three-charged-in-11-million-bec-scam-a-13290

Tres detenidos por estafar más de diez millones de euros a empresas extranjeras
http://www.guardiacivil.es/es/prensa/noticias/7146.html

E.研究報告
Sim卡及移動端核彈漏洞密集爆發：近期網絡戰頂級數字武器解析 
http://www.sohu.com/a/348031102_354899

存在多年的Linux 漏洞被發現：可通過WiFi 攻擊目標計算機
https://linux.cn/article-11479-1.html?utm_source=rss&utm_medium=rss

境外APT組織“響尾蛇”再次對我國發起攻擊事件報告
http://it.rising.com.cn/dongtai/19655.html

Who is the superuser? CVE-2019-14287 sudo漏洞分析
https://zhuanlan.zhihu.com/p/87345893

X-Forwarded-For注入漏洞過程記錄
https://www.cnblogs.com/soldierback/p/11707035.html

Microsoft office 公式編輯器 Matrix record 棧溢出漏洞分析
https://www.chainnews.com/zh-hant/articles/473375998581.htm

Asruex 後門變種通過 Office 和 Adobe 漏洞感染 word 和 PDF 文檔
https://www.chainnews.com/zh-hant/articles/611710583547.htm

Libra的Move IR編譯器漏洞詳解
https://www.coingogo.com/news/37737

使用Ghidra 分析phpStudy 後門
https://paper.seebug.org/

Web安全Day9 - 文件下載漏洞實戰攻防
https://xz.aliyun.com/t/6590

Windows下防禦利用——SEH深入分析
https://www.anquanke.com/post/id/189093

CVE-2019-11043 / PHP-FPM在Nginx特定配置下遠程代碼執行
https://qiita.com/shimizukawasaki/items/aaac680c921a9cf1b156

在CTF比賽中發現的PHP遠程代碼執行0day漏洞
https://nosec.org/home/detail/3083.html

《XSS攻擊-XSS漏洞原理》課程文檔講解
https://zhuanlan.zhihu.com/p/87733231

對金融網站漏洞檢測的過程分享
https://www.admin5.com/article/20191024/930296.shtml

滲透測試對Java架構網站漏洞檢測方法
https://www.admin5.com/article/20191024/930295.shtml

WhatsApp UAF 漏洞分析（CVE-2019-11932）
https://paper.seebug.org/1061/

Fragscapy：通過協議Fuzz的方法探測IDS/防火牆檢測規則的漏洞
https://www.4hou.com/tools/20657.html

Tiny PE Creating the smallest possible PE executable
https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm

Spring Security OAuth 2.3 Open Redirection（CVE-2019–3778 ）分析復現篇
https://www.freebuf.com/vuls/216582.html

TWCERT/CC-2019年10月份資安情資電子報
https://www.twcert.org.tw/tw/cp-106-3023-5e111-1.html

順著鍵鼠找到你？黑客利用羅技漏洞趁虛而入
https://zhuanlan.kanxue.com/article-9636.htm

Operation Ghost: The Dukes aren’t back – they never left
https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/

Shikata Ga Nai Encoder Still Going Strong
https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html

SkiPfisH Web security scanner
https://artofexploit.com/2019/10/12/skipfish-web-security-scanner/

FOCA - Tool To Find Metadata And Hidden Information In The Documents
https://www.nahidhasantechnology.com/2019/10/foca-tool-to-find-metadata-and-hidden.html

brutemap-dev/brutemap
https://github.com/brutemap-dev/brutemap

cisco/mercury
https://github.com/cisco/mercury

leebaird/discover
https://github.com/leebaird/discover

vstinner/python-security
https://github.com/vstinner/python-security

Prepare for a New Cyber Cold War in 2020, Warns Check Point
https://www.globenewswire.com/news-release/2019/10/24/1935000/0/en/Prepare-for-a-New-Cyber-Cold-War-in-2020-Warns-Check-Point.html

PowerShellRunBox: Analysing PowerShell threats using PowerShell debugging
https://blog.apnic.net/2019/10/23/powershellrunbox-analyzing-powershell-threats-using-powershell-debugging/

A Deep-Dive Analysis of the NukeSped RATs
https://feedproxy.google.com/~r/fortinet/blog/threat-research/~3/QqmLFUy4jXo/deep-analysis-nukesped-rat.html

A Deep-Dive Analysis of the NukeSped RATs
https://www.fortinet.com/blog/threat-research/deep-analysis-nukesped-rat.html

Finding Vulnerabilities in Closed Source Windows Software by Applying Fuzzing
https://www.apriorit.com/dev-blog/640-qa-fuzzing-for-closed-source-windows-software

HITCON CTF Quals 2019 - Path of Exploitation
https://david942j.blogspot.com/2019/10/official-write-up-hitcon-ctf-quals-2019.html

benoitsevens/applying-ttd-to-malware-analysis
https://github.com/benoitsevens/applying-ttd-to-malware-analysis

ByePg: Defeating Patchguard Using Exception-Hooking
https://blog.can.ac/2019/10/19/byepg-defeating-patchguard-using-exception-hooking/

The SWAX Benchmark: Attacking Biometric Systems with Wax Figures
https://arxiv.org/abs/1910.09642

Possible New BadPatch Campaign Uses Multi-Component Python Compiled Malware
https://www.fortinet.com/blog/threat-research/badpatch-campaign-uses-python-malware.html

Red Team Tactics: Active Directory Recon using ADSI and Reflective DLLs
https://outflank.nl/blog/2019/10/20/red-team-tactics-active-directory-recon-using-adsi-and-reflective-dlls/

Obfuscating Java bytecode with LLVM and Epona
https://blog.quarkslab.com/obfuscating-java-bytecode-with-llvm-and-epona.html

F.商業
Windows 7 終止支援倒數 88 天　微軟推出電腦分析服務、協助有效部署 Windows 10 版本更新
https://gnn.gamer.com.tw/detail.php?sn=187315

Google改善Chrome 77的網站隔離機制，首度進駐Android版
https://ithome.com.tw/news/133710

免疫幽靈入侵 - Google Chrome 加入網站分離功能加強保安防禦
https://hk.xfastest.com/37296/google-chrome-safety-update/

資安漏洞恐釀每年百億損失！中華資安國際：數位轉型須具備資安管理意識
https://www.thenewslens.com/feature/atd-2019/126292

互聯安睿：擁有iPAS 非名校出身也能是資安紅人
https://www.cheers.com.tw/article/article.action?id=5095469&eturec=1

叡揚資通安全稽核系統協助機關建立資安病歷
http://n.yam.com/Article/20191021823606

趨勢科技併購Cloud Conformity　強化雲端資安領先地位
https://tw.appledaily.com/new/realtime/20191022/1652343/

微軟有新方式來防止駭客從韌體入侵
https://chinese.engadget.com/2019/10/22/microsoft-secured-core-pc/

東捷資訊服務強化智能、平台及IoT服務 深耕六大商機
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=13&id=571062

A Comprehensive Guide On How to Protect Your Websites From Hackers
https://thehackernews.com/2019/10/website-security-guide.html

Microsoft to Reward Hackers for Finding Bugs in Open Source Election Software
https://thehackernews.com/2019/10/election-software-hacking.html

Cynet's Vulnerability Assessment Enables Organizations to Dramatically Reduce their Risk Exposure
https://thehackernews.com/2019/10/cynet-vulnerability-assessment.html

G.政府
新北警成立全國首支科偵小隊 科技建警偵防並重
https://udn.com/news/story/7320/4111697

資通黑名單不公布？蘇貞昌：做通體檢視 非針對中國產品
http://www.epochtimes.com/b5/19/10/18/n11597062.htm

資通黑名單 蘇揆盼做通體檢視
http://bit.ly/2J7vUbg

資訊戰開打 藍委提「美台資安聯防」蘇揆：全力支持
http://www.epochtimes.com/b5/19/10/18/n11596307.htm

調查局抓到了！2大陸假訊息欲影響我國選情
https://udn.com/news/story/7321/4117009

調查局查獲大陸人士散布蔡總統賣台假訊息
https://www.cna.com.tw/news/asoc/201910210172.aspx

造謠英文賣台？調查局查獲中國央廣記者惡意傳遞假消息
https://newtalk.tw/news/view/2019-10-21/314850

造謠蔡英文賣台給日本訊息 竟是中國央廣記者惡意散布
https://news.ltn.com.tw/news/politics/breakingnews/2952901

「蔡英文是中共地下黨員」是假新聞還是「真段子」
http://bit.ly/31AkV0l

iPAS人才認證，為iPASS一卡通資安人才做後盾
https://web.cheers.com.tw/issue/2019/emba/article/school4.php

快速偵測網路攻擊 企業資安防衛利器 [成果新知]
https://www.moea.gov.tw/MNS/doit/bulletin/Bulletin.aspx?kind=4&html=1&menu_id=13553&bull_id=6332

許毓仁暴怒...問資安拒讓顧立雄答詢　怒嗆蘇貞昌「閉嘴！」
https://www.ettoday.net/news/20191022/1562477.htm

北市府網路連2天當機 王世堅質疑沒有防火牆
https://news.ltn.com.tw/news/Taipei/breakingnews/2953830

首善之都台北市府網路2天內當機2次　資訊局：設備老舊
https://tw.appledaily.com/new/realtime/20191022/1652389/

駭客又入侵? 北市府各局處網路全癱瘓 各局處公文系統全停擺 資訊局緊急追查
https://www.ttv.com.tw/news/view/10810220012600N/568

網路系統異常 北市府：與駭客攻擊無關
https://www.cna.com.tw/news/aloc/201910220187.aspx

駭客入侵北市府？王世堅酸柯不要被害妄想症
https://www.chinatimes.com/realtimenews/20191022003000-260407?chdtv

智慧城市？北市府網路當機半天　因設備舊
https://news.tvbs.com.tw/politics/1221483

電腦兩天兩次大當機 北市府:非駭客攻擊
https://www.cdns.com.tw/articles/39161

中共統戰變種「準戰爭」立委學者推兩法案聯防
http://bit.ly/2W7ujYs

2018政府機關資安通報現況大公開，6起3級事件最嚴重
https://www.ithome.com.tw/news/133776

手機綁定自然人憑證 申辦政府服務線上搞定
http://bit.ly/2ohuKTs

自然人憑證綁定手機 免插卡就能網路報稅
http://bit.ly/2qFCRdk

工研院：無密碼身分辨識結合終端，為台製造業新商機
https://www.moneydj.com/KMDJ/News/NewsViewer.aspx?a=1e3a8fbc-ea61-4306-aa21-127a0fbcf629

訂定「教育機構資安審議會設置要點」，並自即日生效
https://edu.law.moe.gov.tw/NewsContent.aspx?id=95839

空軍前參謀長遭吸收發展共諜組織 輕判6個月
https://news.ltn.com.tw/news/society/breakingnews/2956660

行政院技術服務中心108年第3季資通安全技術報告
https://download.nccst.nat.gov.tw/attachfilenew/108_Q3_Cyber%20Security%20Technology%20Report.pdf

H.ICS/SCADA 工控系統
工廠已成駭客最愛目標，建立完整資安組織與 SOP 是台廠當務之急
https://buzzorange.com/techorange/2019/10/23/2019-aiot-techorange/

Outdated OSs Still Present in Many Industrial Organizations: Report
https://www.securityweek.com/outdated-oss-still-present-many-industrial-organizations-report

I.教育訓練
ASP.net mvc面試49題
http://bit.ly/2MBnHy6

slavaim/mac-notes
https://github.com/slavaim/mac-notes

RootUp/PHDays9
https://github.com/RootUp/PHDays9

LinuxForensic
https://github.com/ashemery/LinuxForensics/blob/master/OSDFCon19-Final.pdf

J.物聯網/IOT/人工智慧/車聯網/光聯網/深度學習/機器學習/無人機/人臉辨識
日本連鎖酒店HIS Group稱黑客可能通過室內機器人偷窺客人
https://www.cnbeta.com/articles/tech/902535.htm

機器人供客房服務　可能遭駭變偷拍工具
https://news.tvbs.com.tw/world/1220138

IoT 技術中心斥資上億 德國萊因用物聯三箭打造連網用戶安全體驗
https://times.hinet.net/topic/22619421

Singapore expands test site for autonomous vehicles
https://www.zdnet.com/article/singapore-expands-test-site-for-autonomous-vehicles/#ftag=RSSbaffb68

6.近期資安活動及研討會
 交通大學亥客書院-A015:進階網頁滲透測試 10/26
 https://hackercollege.nctu.edu.tw/?p=1090

 International Conference on Networks & Communications (NETWORKS) 10/26 ~ 10/27
 https://infosec-conferences.com/events-in-2019/networks/

 亞洲‧矽谷學院108年免費認證考試 10/27
 https://college.asvda.org.tw/

 Nspa實作課程「惡意巨集文件與惡意程式下載器」 10/27
 https://www.facebook.com/events/459141201342125/

 International Conference on Emerging Security Information, Systems and Technologies (SECURWARE) 10/27 ~ 10/31
 https://infosec-conferences.com/events-in-2019/securware/

 SANS Amsterdam October  10/28
 https://infosec-conferences.com/events-in-2019/sans-amsterdam-october/

 行動應用App基本資安認證制度推廣說明會 10/28
 https://www.tca.org.tw/exhibit_info1.php?n=1154

 工業自動化資安管理與實務 10/29 ~ 10/30
 https://www.ivendor.com.tw/website/featured_detial/91

 資安檢核核心技術及進階技術研討會 10月28日至10月30日
 http://bit.ly/2TN2UtD

 Foundations in Digital Forensics with EnCase® (DF120) (原CF1) 10/28 ~ 10/31
 https://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=39

 International Workshop on Reliability and Security Data Analysis (RSDA)  10/28 ~ 10/31
 https://infosec-conferences.com/events-in-2019/rsda/

 International Symposium on Software Reliability Engineering (ISSRE)  10/28 ~ 11/1
 https://infosec-conferences.com/events-in-2019/issre/

 Securing New Ground 10/29 ~ 10/30
 https://infosec-conferences.com/events-in-2019/securing-new-ground/

 CEBIT Australia  10/29 ~ 10/31
 https://infosec-conferences.com/events-in-2019/cebit-australia/

 SSCP資訊安全專業人員認證　課程說明會  10/30
 https://www.accupass.com/event/1910180803231516519793

 Nspa實作課程「加密勒索攻擊」 10/31
 https://www.facebook.com/events/391437314853475/

 OWASP AppSec Day Melbourne  11/1
 https://infosec-conferences.com/events-in-2019/owasp-appsec-day-melbourne/

 Hackfest 2019  11/1 ~ 11/3
 https://infosec-conferences.com/events-in-2019/hackfest-2019/

 行政院資安學院 物聯網資安培訓課程 11/3 ~ 11/30
 https://www.accupass.com/event/1810080517061259295030

  Elite East Coast CISO Summit 11/3~11/5
 https://infosec-conferences.com/events-in-2019/elite-east-coast-ciso-summit/

 Red Hat Forum Taipei 2019  11/5
 https://www.facebook.com/events/1390202967799392/

 資安人才培育成果發表暨就業媒合會 11/5
 https://ievents.iii.org.tw/eventS.aspx?t=0&id=733

 Cyber Security Summit: Boston  11/6
 https://infosec-conferences.com/events-in-2019/cyber-security-summit-boston/

 駭客攻防暨數位鑑識系列一(第1期) 11/7
 https://service.tabf.org.tw/Training/CourseDetail.aspx?PID=384540

 網路攻擊鏈( Cyber Kill Chain)各階段實作 (6hr)  11/7
 http://www.tabf.org.tw/Training/CourseDetail.aspx?PID=384540

 Cybersecurity Framework 擴大資安視野 Seminar CYBERSEC 101 研討會  11/8
 https://signupcybersec101.ithome.com.tw/

 BSides Charleston 11/9
 https://infosec-conferences.com/events-in-2019/bsides-charleston/

 Kotlin/Everywhere GDG Taoyuan - 運用 Ktor 建置一個以 Kotlin 打造的後端服務  11/9
 https://www.meetup.com/GDGTaoyuan/events/264776152/

 OpenInfra Day Taiwan 11/12
 http://openinfra.digitimes.com.tw/

 108年政府組態基準(GCB)實作研習 11/12 ~ 11/22
 https://register.nccst.nat.gov.tw/Active/registerDetail.do?activeId=1285&activeType=course

 CLEAR Cyber Leaders Conference 11/12 ~ 11/13
 https://infosec-conferences.com/events-in-2019/clear-cyber-leaders-conference/

 108年資安法律案例分享說明會 11/13
 https://register.nccst.nat.gov.tw/Active/registerDetail.do?activeId=1286&activeType=conf

 Windows檔案系統及檔案還原 (6hr)  11/14
 http://www.tabf.org.tw/Training/CourseDetail.aspx?PID=384541

 Digital Internet Summit 11/14
 https://infosec-conferences.com/events-in-2019/digital-internet-summit/

 INTERFACE – Nebraska 11/14
 https://infosec-conferences.com/events-in-2019/interface-nebraska/

 SecureWV – Hack3rCon  11/15 ~ 11/17
 https://infosec-conferences.com/events-in-2019/securewv-hack3rcon/

 交通大學亥客書院-P006:高階網頁滲透測試 11/16
 https://hackercollege.nctu.edu.tw/?p=1092

 FS-ISAC Fall Summit 11/17 ~ 11/20
 https://infosec-conferences.com/events-in-2019/fs-isac-fall-summit/

 Microsoft IoT in Action 11/20
 https://www.iotinactionevents.com/event/taipei

 LINE將於11月舉辦LINE DEVELOPER DAY 2019  11/20 ~ 11/21
 https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=14&id=0000570636_HL57CPQM2H1ZHE71YVI2W

 Infosecurity ISACA North America Expo and Conference 11/20 ~ 11/21
 https://infosec-conferences.com/events-in-2019/isaca-north-america-expo-conference/

 檔案特徵值比對與關鍵字搜尋 (2hr) Open Source數位鑑識工具實務操作 (5hr) 11/21
 http://www.tabf.org.tw/Training/CourseDetail.aspx?PID=384542

 2019 BSI 國際資安標準管理年會  11/22
 https://www.accupass.com/event/1910070533451342891420

 Trend Micro CTF 2019 // Raimund Genes Cup  FINAL / NOVEMBER 23–24, 2019 
 https://www.trendmicro.com/en_us/campaigns/capture-the-flag.html

 資安檢核核心技術及進階技術研討會11月26日至11月28日
 http://bit.ly/2TN2UtD

 人資人員必修的職安法規定 11/26
 https://www.accupass.com/event/1909121441141977826554

 模擬案例鑑識分析實務 (6hr)  11/28
 http://www.tabf.org.tw/Training/CourseDetail.aspx?PID=384543

 Cybersecurity Framework 擴大資安視野 Seminar CYBERSEC 101 研討會  11/29
 https://signupcybersec101.ithome.com.tw/

 交通大學亥客書院-B015:惡意程式檢測 11/30
 https://hackercollege.nctu.edu.tw/?p=1098

 亞洲‧矽谷學院108年免費認證考試 11/30
 https://college.asvda.org.tw/

 Digital Summit Dallas  12/4
 https://infosec-conferences.com/events-in-2019/digital-summit-dallas/

 Kansas City Cyber Security Conference 12/5
 https://infosec-conferences.com/events-in-2019/kc-cyber-security-conference/

 CyberMaryland Conference 12/5 ~ 12/6
 https://infosec-conferences.com/events-in-2019/cybermaryland-conference/

 FutureCon Nashville Cyber Security Conference 12/11
 https://infosec-conferences.com/events-in-2019/futurecon-nashville/

 Utility Cyber Security Forum December 12/11
 https://infosec-conferences.com/events-in-2019/utility-cyber-security-forum-dec/

 交通大學亥客書院-A018:企業網域控管－Active Directory攻擊與防禦  12/14
 https://hackercollege.nctu.edu.tw/?p=1094

 Japan Security Analyst Conference
 https://jsac.jpcert.or.jp/