資安新聞及事件週報 2018/12/17 ~ 2018/12/21

資安新聞及事件週報  2018/12/17  ~  2018/12/21

1.重大弱點漏洞

Bash 驚現年度最大安全漏洞
http://www.twoeggz.com/news/12570883.html

QEMU 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16872

VMware vRealize Operations 權限許可和訪問控制漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6978

慎防滑鼠鍵盤應用程式Logitech Options，暗開Windows後門
https://bit.ly/2EoPUok

羅技Options被曝注入攻擊漏洞，官方修復
http://www.sohu.com/a/282218580_114760

Logitech app security flaw allowed keystroke injection attacks
https://www.zdnet.com/article/logitech-app-security-flaw-allowed-keystroke-injection-attacks/#ftag=RSSbaffb68

華碩與技嘉的驅動程式遭爆含有權限擴張漏洞
https://ithome.com.tw/news/127777

SECUREAUTH LABS 證實 ASUS、GIGABYTE 於應用程式中存在安全漏洞
https://news.xfastest.com/others/56219/secureauth-labs-asus-gigabyte-privilege-vulnerabilities/

D-Link DVA-5592 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17777

Adobe's Year-End Update Patches 87 Flaws in Acrobat Software
https://bit.ly/2Gy0Cf0

50天53個漏洞：Adobe Reader 模糊測試結果驚人
https://www.aqniu.com/news-views/41988.html

IBM Event Streams 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1833

Webroot BrightCloud SDK 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4015

Artifex Software Ghostscript 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19134

公開軟件漏洞　如向黑客教路
https://hk.news.appledaily.com/international/daily/article/20181216/20569793

電子設備芯片新的高危漏洞被發現 或造成重大後果
https://pttnews.cc/80a6243e38

libexif 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20030

SQLite爆重大漏洞! 數百萬App和IoT裝置資料安全拉警報
https://www.ithome.com.tw/news/127707

SQLite “Magellan” RCE漏洞影響數十億個應用程序，包括所有基於Chromium的瀏覽器
https://www.linuxidc.com/Linux/2018-12/155888.htm

SQLite爆重大漏洞! 數百萬app和IoT裝置資料安全拉警報
https://bit.ly/2Bpxa4Y

SQLite被曝存在漏洞，所有Chromium 瀏覽器受影響
https://nearathon.com/tuijian/37317

SQLite漏洞將使數以百萬計的應用程序受到黑客攻擊
https://bbs.pediy.com/thread-248430.htm

SQLite bug impacts thousands of apps, including all Chromium-based browsers
https://www.zdnet.com/article/sqlite-bug-impacts-thousands-of-apps-including-all-chromium-based-browsers/#ftag=RSSbaffb68

Critical SQLite Flaw Leaves Millions of Apps Vulnerable to Hackers
https://thehackernews.com/2018/12/sqlite-vulnerability.html

Chromium系列瀏覽器 SQLite 數據庫引擎存在漏洞可被遠程攻擊
https://www.landiannews.com/archives/53875.html

Magellan: Remote Code Execution Vulnerability in SQLite Disclosed
https://www.tenable.com/blog/magellan-remote-code-execution-vulnerability-in-sqlite-disclosed

Google Chrome Serviceworker信息洩露漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6099

Google Chrome DevTools代碼執行漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6101

Google Go 路徑遍歷漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16874

Chrome 72釋出Beta版，增加公開類別域、使用者觸發查詢API
https://www.ithome.com.tw/news/127773?fbclid=IwAR2Msg_nJWjlx5MtZabri4CNK3Bmbrl1LcKBvBhWvlZt7qgdwz6ZMTGLoCo

Google working on blocking Back button hijacking in Chrome
https://www.zdnet.com/article/google-working-on-blocking-back-button-hijacking-in-chrome/

安全加倍！亞馬遜修復智能家居13處漏洞
https://kknews.cc/tech/g384pe9.html

Responsive FileManager 9.13.4 XSS / File Manipulation / Traversal - CXSecurity.com
https://cxsecurity.com/issue/WLB-2018120148

Realtek rtl81xx SDK遠程代碼執行漏洞(CVE-2014-8361)
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8361

Symantec™ IT Management Suite 8.5 powered by Altiris™ technology  實施自動漏洞補救
https://symc.ly/2rBaRVk

Windows 10 更新又出事，這次輪到音效驅動程式受影響
https://technews.tw/2018/12/16/windows-10-version-1809-cumulative-update-kb4471332-breaking-down-audio/

微軟IE零時差弱點通知（CVE-2018-8653）
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653

微軟12月份月度安全漏洞預警
https://bbs.huaweicloud.com/forum/thread-13318-1-1.html

微軟 Internet Explorer 執行任意程式碼漏洞
https://kb.cert.org/vuls/id/573168/

微軟緊急修補IE的遠端攻擊漏洞，Google證實有駭客已用於目標式攻擊
https://www.ithome.com.tw/news/127787

微軟緊急修補JSsript引擎，抑制IE 0-day在野攻擊
https://www.twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=5070

微軟發布針對IE補丁：防止攻擊者利用漏洞破壞內存
https://iview.sina.com.tw/post/17985002

多款Apple產品NetworkExtension邏輯缺陷漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4369

ARM Trusted Firmware信息洩露漏洞
https://github.com/ARM-software/arm-trusted-firmware/pull/1127

Microsoft Windows rundll32.exe code execution
https://packetstormsecurity.com/files/150772

Microsoft Issues Emergency Patch For Under-Attack IE Zero Day
https://bit.ly/2CtiUtD

UltraISO 9.7.1.3519 Output FileName Denial Of Service - CXSecurity.com
https://www.anquanke.com/vul/id/1439678

phpMyAdmin 4.8.0~4.8.3 Transformation 任意文件包含/遠程代碼執行漏洞(需登錄/PMASA-2018-6/CVE-2018-19968)
https://bit.ly/2rCZoVh

【升級PHP7與強化網站防護成焦點】不論是否升級至新版環境，PHP 5網站都不能坐以待斃
https://bit.ly/2UMdBws

Bug fix #2 in Firefox Focus for iOS
https://bit.ly/2PDYAsJ

Thousands of Jenkins servers will let anonymous users become admins
https://www.zdnet.com/article/thousands-of-jenkins-servers-will-let-anonymous-users-become-admins/#ftag=RSSbaffb68

Insider awarded $10,000 bounty for reporting enterprise software piracy
https://www.zdnet.com/article/insider-awarded-10000-bounty-for-reporting-enterprise-software-piracy/#ftag=RSSbaffb68

Thousands of Jenkins servers will let anonymous users become admins
https://zd.net/2S8RAGp

Microsoft's new Windows 10 19H1 test build paves the way for new Sandbox feature
https://www.zdnet.com/article/microsofts-new-windows-10-19h1-test-build-paves-the-way-for-new-sandbox-feature/#ftag=RSSbaffb68

IRS Linux move delayed by lingering Oracle Solaris systems
https://www.zdnet.com/article/irs-linux-move-delayed-by-lingering-oracle-solaris-systems/#ftag=RSSbaffb68

哪裡可以找到SPECTRE和MELTDOWN安全漏洞更新
https://bit.ly/2SYq6Dl

2.銀行/金融/保險/證券/電子支付/行動支付/支付系統/虛擬貨幣/區塊鍊 新聞及資安
探討區塊鏈貨幣Bitcoin的技術與風險
https://bit.ly/2Eyda3R

「什麼是比特幣？」是2018年Google最常被問到的問題
https://bit.ly/2EvrdGC

EOSMax和BetDice遭受回滾交易漏洞攻擊，損失較大
http://www.01caijing.com/article/33042.htm

關貿(6183)攜多家銀行打造供應鏈金融生態區塊鏈，有望提升放貸比例
https://bit.ly/2GuwfWs

加密貨幣監管再升級 日本金融廳發布最新監管草案
https://bit.ly/2rKy3R7

2018 台北區塊鏈產官學高峰會，近百位海內外重量級人士與會
https://technews.tw/2018/12/19/2018-blockchain-summit/

開發 DApp 就是開發全世界，微軟區塊鏈開發大賽英、台、美團隊抱回國際大獎
https://buzzorange.com/techorange/2018/12/19/blockchain-competition-2/

LINE首度揭露LINK區塊鏈生態系將主攻4國市場，包括臺灣
https://www.ithome.com.tw/news/127775

〈區塊鏈大應用〉臉書招募區塊鏈開發人員 可望在未來推出加密貨幣
https://fnc.ebc.net.tw/FncNews/else/63380

當潮水退去，區塊鏈到底為我們帶來了什麼
http://news.knowing.asia/news/0bb8198d-bf18-4e5b-b6a1-a8c227b5c826

This Brazilian Bank Is Using Ethereum to Issue a Stablecoin
https://bit.ly/2S9PNRF

《區塊鏈智能合約安全審計白皮書(2018年)》發佈
https://www.finet.hk/Newscenter/news_content/5c1717f5bde0b347a45eecd1

CSPay接受加密貨幣充值 冀普及應用
https://www2.hkej.com/instantnews/hongkong/article/2018134

Fastwin遭黑客攻擊事件暴露新型漏洞， EOSIO官方已更新修復
http://www.bitecoin.com/online/2018/12/34033.html

Timothy C. May離開了，當年的「密碼龐克」孕育了如今的比特幣
http://news.knowing.asia/news/29f15235-1998-48ae-ae35-8618ae0cba4f

Blockchain, artificial intelligence top LinkedIn fastest-growing job categories
https://www.zdnet.com/article/artificial-intelligence-tops-linkedin-fastest-growing-job-categories/#ftag=RSSbaffb68

華為被控資安漏洞　國泰金總座：提出證據來
https://bit.ly/2zXbFIG

華為設備有資安漏洞？國泰金總座：要有證據不是用想像
https://bit.ly/2CdE5Qm

率先接軌國際！國泰世華自願遵循「聯合國責任銀行原則PRB」
https://www.chinatimes.com/realtimenews/20181214002777-260410

多國政府採購禁華為 顧立雄：國銀核心主機未用
https://www.cna.com.tw/news/firstnews/201812140229.aspx

金融機構清查中 顧立雄：國銀核心主機皆未採用
https://www.chinatimes.com/newspapers/20181215000225-260202

靠臉就能吃飯！支付寶推刷臉支付「蜻蜓」
https://cnews.com.tw/005181214a03/

資安、高齡化商品，納保險業安定基金計提標準
https://bit.ly/2GhaSI9

【金融業不能忽視的國家級駭客威脅】FireEye：APT 38組織發展針對SWIFT的攻擊軟體
https://ithome.com.tw/news/127650

利用「閃付」漏洞 匪徒隔空「偷錢」
http://paper.wenweipo.com/2018/12/16/YO1812160010.htm

匿名者組織針對銀行系統的OpIcarus 2018攻擊預警
https://www.easyaq.com/news/478715784.shtml

銀行惡意軟件攻擊巴西移動用戶
https://ek21.com/news/3/18527/

台灣金融研訓院董事長 吳中書放軟身段 建金融溝通平台
https://bit.ly/2A4bETp

金融業瘋考理財顧問證照　銀行業近千人最多
https://www.ettoday.net/news/20181214/1331305.htm

上海一犯罪團伙利用銀行APP漏洞非法獲利2800餘萬元
https://news.sina.com.tw/article/20181217/29287170.html

利用網銀APP漏洞非法獲利超2800萬6名嫌犯被刑拘
https://finance.sina.com.cn/money/bank/bank_hydt/2018-12-17/doc-ihqhqcir7592937.shtml

團伙利用網銀漏洞獲利數千萬女子一人佔三座睡覺被拘留
https://www.ximalaya.com/toutiao/12580759/145573021

網傳某銀行APP疑遭駭客入侵　部分用戶存款被歸零！還有網友稱：密碼錯誤也可以登陸
http://www.orgs.one/show/482603

防洗錢…銀行清理DBU帳戶
https://udn.com/news/story/7239/3542685

康和證券交易下單系統升級，因應逐筆交易新制
https://m.ctee.com.tw/livenews/aj/12172018101451639

CIMB Clicks用戶請註意！部分用戶銀行戶口遭盜用
https://bit.ly/2EtWb1V

line pay卡回饋要排除其他間電子支付了
https://www.ptt.cc/bbs/creditcard/M.1545067453.A.12C.html

西聯匯款攜手TerraPay將支付選擇擴大至數百萬行動錢包
http://www.businesswirechina.com/hk/news/39358.html

上海商銀黑客松競賽結果揭曉
https://www.chinatimes.com/newspapers/20181218000341-260210

景文科大財經高峰會暢談數位銀行與FinTech
https://n.yam.com/Article/20181217361128

京東數科與西聯匯款戰略合作 涉足跨境匯款
https://news.sina.com.tw/article/20181217/29285972.html

銀行斷直連提速，中國銀行20日關閉第三方支付合作通道
https://news.sina.com.tw/article/20181217/29288968.html

區塊鏈e-Check認證汽車保險 保單真假車主一掃便知
https://bit.ly/2UU9hve

用ATM漏洞撳$900萬 酒保變花花公子歎夠後自首
https://hk.news.appledaily.com/international/realtime/article/20181219/59042999

發票兌獎APP上路 領獎無紙化24hr兌獎
https://bit.ly/2UV5Oww

南韓 推動金融產業創新 將核准第三家純網銀
https://money.udn.com/money/story/5602/3547010

擁80萬用戶卻拒配合檢警調查　LINE Pay盜刷揪不出兇手
https://tw.news.appledaily.com/local/realtime/20181219/1485942/

LINE PAY盜刷拒絕給用戶資料　檢警抓不到兇手
https://news.tvbs.com.tw/local/1050410

信用卡莫名遭綁定 LINE Pay盜刷找嘸賊
https://tw.appledaily.com/headline/daily/20181220/38210411/

LINE PAY被盜刷 檢警調用戶資料遭拒
https://news.cts.com.tw/cts/life/201812/201812191946433.html

遭指安全性有問題　LINE 強調與其他平台綁卡方式相同
https://tw.news.appledaily.com/new/realtime/20181219/1486472/

防行動支付盜刷　銀行業：刷卡設定本人驗證
https://tw.appledaily.com/new/realtime/20181219/1486444/

台壽保產物保險股份有限公司受金管會裁罰案之說明處分案說明
https://bit.ly/2LpVCHT

俄羅斯擬立法禁止支付寶微信等為俄公民提供服務
http://shanghaibiz.sh-itc.net/article/dwtz/dwtzhwsc/201812/1463624_1.html

最多跑一次：納稅人可通過微信支付掃碼一鍵交納稅費
https://news.sina.com.tw/article/20181219/29318484.html

持卡人注意 金管會金檢發現有銀行超收違約金
https://udn.com/news/story/7239/3546590

金融業資安成本 兩年內恐激增
https://www.chinatimes.com/newspapers/20181221000344-260205

電子支付太夯　央行：現金有4大優勢有存在必要　
https://www.ettoday.net/news/20181220/1336404.htm

楊金龍挺現金支付 列四優勢
https://money.udn.com/money/story/5613/3549227

Mobile payment behaviors, biases examined in report
https://www.atmmarketplace.com/news/mobile-payment-behaviors-biases-examined-in-report/

2018 Health of Cash study: US consumers value payment choice
https://www.atmmarketplace.com/blogs/2018-health-of-cash-study-us-consumers-value-payment-choice/

徵才 - 金融業大獵才 明年逾萬人
https://udn.com/news/story/7239/3539680

徵才 - 一銀明年將徵才450人　起薪3萬6000元
https://tw.appledaily.com/new/realtime/20181215/1484173/

徵才 - 鐵飯碗來了！中華郵政明年再徵千人　起薪3萬1
https://tw.news.appledaily.com/life/realtime/20181217/1485000/

徵才 - 行動支付系統工程師
https://www.1111.com.tw/job/85006375/


3.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體

「驅動人生」利用高危漏洞傳播病毒 12月14日半天感染數萬台電腦
https://ek21.com/news/3/15435/

驅動人生回應傳播蠕蟲病毒：系舊版組件漏洞被黑客利用
https://www.landiannews.com/archives/53858.html

「驅動人生」升級現木馬病毒 半天感染數萬台電腦
https://news.sina.com.tw/article/20181215/29266818.html

「驅動人生」木馬病毒爆發 建議採取六種措施應對
https://news.sina.com.tw/article/20181216/29276414.html

新病毒爆發：利用「永恆之藍」傳播，2小時感染10萬台電腦挖礦
https://kknews.cc/tech/pkxxvke.html

新款macOS惡意程式OSX.LamePyre會把螢幕畫面傳給駭客
https://www.ithome.com.tw/news/127701

曾攻擊全球最大石油公司Shamoon/Disttrack 磁碟清除病毒,出現了新變種：你需要知道什麼
https://blog.trendmicro.com.tw/?p=58260

駭客利用 Twitter 發送 Meme迷因梗圖,藉圖像隱碼術( Steganography )躲避偵測
https://blog.trendmicro.com.tw/?p=58281

趨勢科技：推特帳號淪為駭客攻擊幫兇，發送meme圖片下令惡意程式發動攻擊
https://www.ithome.com.tw/news/127735?fbclid=IwAR1DQRXXO6Qze8W3TPjJm0-cTSVAonr2qbVDmIpC_MqokdTR-mj65VJ4Y_Y

AutoIt 蠕蟲透過可移除磁碟,散播無檔案後門程式BLADABINDI/njRAT
https://blog.trendmicro.com.tw/?p=58182

Brazilian mobile users hit with banking malware
https://brica.de/alerts/alert/public/1240466/brazilian-mobile-users-hit-with-banking-malware/

CYBER | Brazilian mobile users hit with banking malware (THU-13-DEC-2018)
https://localdemo.starfishbc.com/2018/12/13/brazilian-mobile-users-hit-with-banking-malware/

Stay on Top of Zero-Day Malware Attacks With Smart Mobile Threat Defense
https://securityintelligence.com/stay-on-top-of-zero-day-malware-attacks-with-smart-mobile-threat-defense/

Fancy Bear exploits Brexit to target government groups with Zebrocy Trojan
https://www.zdnet.com/article/fancy-bear-exploits-brexit-to-target-government-groups-with-zebrocy-trojan/#ftag=RSSbaffb68

Moldovian sentenced for stealing millions using Bugat banking malware
https://cyware.com/news/moldovian-sentenced-for-stealing-millions-using-bugat-banking-malware-54126a1e

New Shamoon Malware Variant Targets Italian Oil and Gas Company
https://bit.ly/2zXRZEH

New Shamoon Malware Variant Targets Italian Oil and Gas Company
https://thehackernews.com/2018/12/shamoon-malware-attack.html

Shamoon Attackers Employ New Tool Kit to Wipe Infected Systems
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/?utm_content=sf204617046&utm_source=twitter&utm_campaign=McAfee#sf204617046

Shamoon data-wiping malware believed to be the work of Iranian hackers
https://www.zdnet.com/article/shamoons-data-wiping-malware-believed-to-be-the-work-of-iranian-hackers/#ftag=RSSbaffb68

Kronos banking Trojan: How does the new variant compare
https://searchsecurity.techtarget.com/answer/Kronos-banking-Trojan-How-does-the-new-variant-compare

New Malware Takes Commands From Memes Posted On Twitter
https://bit.ly/2A57xXj

APT Sidewinder complicates theirs malwares
https://medium.com/@Sebdraven/apt-sidewinder-complicates-theirs-malwares-4e15683e7e26


B.行動安全 / iPhone / Android / App

iOS 破解達人 Adam Donenfeld
https://bit.ly/2GeqNXB

關於「資安漏洞回報獎金計劃」請直接至LINE官網申請
http://official-blog.line.me/tw/archives/78459057.html

人臉辨識真的安全嗎!? 3D列印頭像成功騙過Samsung S9，但iPhone X擋住了
https://www.ithome.com.tw/news/127714

手機的臉部辨識有多不安全？外媒用3D列印的臉部模型，成功騙過這 4款 Android 手機
https://bit.ly/2Ac7Pf9

Google 為 Keystore 加入新功能，提升 Android 裝置安全性
https://bit.ly/2rMoL75

悲報！iPhone越獄必裝的「Cydia」將在年底前關閉
https://www.cool3c.com/article/139828

Cydia 停止 Jailbreak App Store 購買機制
https://unwire.hk/2018/12/16/cydia-jailbreak-app-store-purchase-feature-shuts-down/software/cydia-app/

New Keystore features keep your slice of Android Pie a little safer
https://bit.ly/2Ekp9RM

Security Best Practices: Symmetric Encryption with AES in Java and Android
https://bit.ly/2QBaVTW

Cydia app store pulls plug on purchases for jailbroken iPhones
https://www.zdnet.com/article/cydia-app-store-pulls-plug-on-purchases-for-jailbroken-iphones/#ftag=RSSbaffb68

Google announces crackdown on Play Store ratings and reviews
https://www.zdnet.com/article/google-announces-crackdown-on-play-store-ratings-and-reviews/#ftag=RSSbaffb68

5G Networks: The New Security Challenges
https://www.bankinfosecurity.asia/interviews/5g-networks-new-security-challenges-i-4197


C.事件 / 駭客 / DDOS / APT / 徵才 / 國際資安事件

2019資安預測 趨勢科技提出3大警示
https://bit.ly/2GteMh5

三星官網介面出現CSRF，險成會員帳號劫持途徑
https://www.twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=5069

趨勢科技公布2019資安預測：資料外洩攻擊白熱化、網路釣魚攻擊件數明顯大增、工控系統威脅持續升高
https://blog.trendmicro.com.tw/?p=58307

及早防患於未然，國家資安防護範圍以ISP網路為前線
https://www.ithome.com.tw/news/127761

網絡黑客利用漏洞“截胡”商家服務費牟利2500餘萬元
http://m.xinhuanet.com/2018-12/18/c_1123870817.htm

為臺灣高等資安教育努力，持續強化暑期與跨校課程，與國際結合則成新手段
https://www.ithome.com.tw/news/127704?fbclid=IwAR1xevNReQo33wMpVYdvtKWlDct_vCa_yyOjoLU_cfNANi0XO5Kgs6Tqcfg

區塊鏈、資安 下一代數位科技
https://bit.ly/2rBOYVM

雙因素驗證並非100%安全，伊朗駭客成功繞過驗證機制入侵Gmail、Yahoo帳號
https://bit.ly/2SVO8ij

HITCON Defense競賽打造企業真實資安攻防環境
https://bit.ly/2UO3Uxv

讓用戶自然而然操作才是正道，GNOME資安團隊從軟體開發強化作業系統安全
https://www.ithome.com.tw/news/127703

強韌的恢復能力已成為資安攻防的重要心法
https://ithome.com.tw/news/127688

FIDO正式成為國際標準 加速政府部門與產業導入應用
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=45&id=0000550140_qzr0od9e5kivxcleq15rh

全球FIDO標準發展 落實於銀行服務、電信與消費電子
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=40&id=0000550146_nbo2than3ovc117hs2294

新「太空國防」當道　反情報靠大數據制
https://news.tvbs.com.tw/focus/1047629

多樣的社交工程手法網紅成駭客新目標，入侵掌握帳號或是當作散佈惡意連結的管道
https://bit.ly/2SdsoyK

兩年前被Twitter輕忽的臭蟲遭到駭客開採，洩漏用戶的國碼
https://www.ithome.com.tw/news/127771?fbclid=IwAR0lEDCxmLetZ0DAUnYsp_V5LBrOisxJ9RkbEBkMfE_eR6dNZVDEI3WJYVU

給特斯拉挑錯 黑客大賺
https://bit.ly/2A1diVY

資安黑天鵝亂竄 還能鴕鳥心態
https://udn.com/news/story/11321/3542660

BTS港騷 售票網站遭駭客入侵
https://bit.ly/2Sd0pyV

網軍皮卡丘？介入美國大選，Pokémon Go成為俄國煽動媒介
https://global.udn.com/global_vision/story/8662/3543071

俄國網軍壓境！連寶可夢也遭滲透？　IG成美國社群網戰主場
https://www.ettoday.net/news/20181219/1334815.htm

以桌遊模擬國家當局資安攻防！捷克資安專家首度在臺舉行相關演練
https://ithome.com.tw/news/127782

「兩階段驗證」被破解了？伊朗駭客成功繞過
https://applealmond.com/posts/45708

地標遭冠「中華台北」 疑陸網軍所為
https://bit.ly/2Lq9LVJ

天網入侵？火鍋店有60台監視器 恐資安危機
https://bit.ly/2SZgybq

川普獵殺中國科技黑名單揭密，下一家公司會是誰
https://technews.tw/2018/12/15/trump-hunts-china-science-and-technology-blacklist/

捷克總理下令 政府機關禁用華為手機
https://bit.ly/2Btsjzx

華為事件影響 資安專家：沒有槍的戰爭已開打
http://www.epochtimes.com/b5/18/12/19/n10920380.htm

不受美國影響，傳印度將和華為合作測試5G
https://www.ithome.com.tw/news/127737

印度邀華為演示5G 當地業者反彈
https://www.chinatimes.com/newspapers/20181219000326-260203

印度政府籲禁用陸設備 華為命運一波三折
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?cnlid=9&cat=305&id=0000550160_sey26zle5xpnpv1f3sp2y

華為：日本與法國並未真的禁止我們的設備、為資安將投20億美元
https://applealmond.com/posts/45751

捷克資安當局警告 華為和中興設備構成國安威脅
https://www.cna.com.tw/news/afe/201812180022.aspx

遭全球封殺 華為給丹麥的「求情信」曝光
https://www.secretchina.com/news/b5/2018/12/15/879199.html

自以為聰明的英國，放任華為替中國打開歐洲資安的後門
https://www.thenewslens.com/article/110111

華為的國家安全風險：西方和盟國聯合布防
https://www.bbc.com/zhongwen/trad/46595173

華為 Huawei 資安漏洞後門大開造成全球國安危機
https://www.vedfolnir.com/huawei-security-vulnerability-national-security-crisis-29834.html

遏制華為「五眼聯盟」早有共識
https://ec.ltn.com.tw/article/breakingnews/2645418

安全擔憂日益升溫 華為在歐洲面臨盟友「圍剿」
https://news.cnyes.com/news/id/4255320

美報告：軍方導彈系統安全防護不足，漏洞未補，未加密傳輸及多因素驗證
https://www.ithome.com.tw/news/127766

美海軍網絡多漏洞中國黑客收穫大
https://www.boxun.com/news/gb/finance/2018/12/201812152038.shtml

美國海軍竭力抵禦中國駭客
https://on.wsj.com/2A1308j

傳中國駭美國海軍承包商 竊取飛彈機密
https://money.udn.com/money/story/5599/3538457

中國駭美國海軍承包商 竊取飛彈機密
https://bit.ly/2BkrWY1

杜絕中共黑客攻擊美海軍全面檢查安全漏洞
https://ogate.org/show.aspx?name=c997704

美軍承包商疑遭中國駭客攻擊 飛彈關鍵技術外流
http://news.ltn.com.tw/news/world/breakingnews/2643276

「中」駭美海軍承包商 竊飛彈等機密
https://bit.ly/2zXQlCL

中國駭客盜走緊好多美國海軍機密，海軍方面仍在努力堵大窿
https://m.hkgolden.com/view.aspx?message=6996170&type=CA

中駭客竊取美軍飛彈資料
https://udn.com/news/story/6813/3538655?from=udn-ch1_breaknews-1-cate5-news

美海軍承包商傳遭中國黑客入侵 竊取導彈機密
https://bit.ly/2SR2MYm

飛彈關鍵技術外流！中國駭走美海軍機密　美軍清查資安漏洞
https://www.ettoday.net/news/20181215/1331847.htm

中國駭客 竊美海軍機密 包商淪攻擊目標 軍方急查資安漏洞
https://tw.appledaily.com/international/daily/20181216/38207082/

中網攻美軍包商 軍艦、飛彈機密遭駭
http://news.ltn.com.tw/news/focus/paper/1254389

美軍承包商疑遭中國駭客攻擊 飛彈關鍵技術外流
https://bit.ly/2LkpSDU

【中美角力】中國黑客被批入侵網絡 竊取美軍關鍵技術
https://bit.ly/2A52VjN

美媒：華黑客竊美導彈船艦機密
https://china.hket.com/article/2232626

杜絕中共黑客攻擊 美海軍全面檢查安全漏洞
http://www.epochtimes.com/b5/18/12/14/n10911447.htm

曾竊潛艇超音速反艦導彈方案 軍方指中國黑客屢入侵承包商
https://bit.ly/2GiQ3fx

Chinese hackers stepped up their cyber attacks against companies that are contractors for the U.S. Navy
https://24-my.info/chinese-hackers-stepped-up-their-cyber-attacks-against-companies-that-are-contractors-for-the-u-s-navy/

US ballistic missile systems have very poor cyber-security
https://www.zdnet.com/article/us-ballistic-missile-systems-have-very-poor-cyber-security/#ftag=RSSbaffb68

Audit finds cyber vulnerabilities in U.S. missile defense system
https://bit.ly/2CfASQ0

美批陸千人計畫 盜竊技術
https://www.chinatimes.com/newspapers/20181216000079-260309

中國海外「千人計劃」 被指滲透美研究機構
https://bit.ly/2ChwMaj

抵禦中國資安威脅 日政府編列預算開發反駭客程式
https://times.hinet.net/news/22149068

日本 NTT : 不建議使用華為的產品
https://bit.ly/2PDNYKs

主要機具供應商 日本安川：華為已凍結所有訂單
https://www.chinatimes.com/newspapers/20181215000224-260202

日本全國警戒駭客攻擊　演習參與者破歷史新高
https://www.taiwannews.com.tw/ch/news/3596658

華為遭遇全球抵制的原因
http://www.epochtimes.com/b5/18/12/19/n10919991.htm

華為胡厚崑：美國正在製造「華為產品不安全」的恐慌
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000550257_5ko3lvtr43cmy0898hkh6

資安疑慮 法國跟進排除華為5G
http://ec.ltn.com.tw/article/paper/1254167

捷克資安當局警告 華為和中興設備構成國安威脅
https://www.bannedbook.org/bnews/zh-tw/cbnews/20181218/1048880.html

黃背心恐有俄國網軍操作 法國安單位要查
https://newtalk.tw/news/view/2018-12-15/181038

法外交部網站遭駭 出境旅客資訊洩露
http://www.chinesetoday.com/big/article/1248192

法國旅遊警示登錄網站遭駭 個資恐遭不當使用
https://news.ebc.net.tw/News/world/143749

德國資安辦公室：部份德企可能受中國駭客攻擊
https://ec.ltn.com.tw/article/breakingnews/2646904

德國資安辦公室：部份德企可能受中共駭客攻擊
http://tw.aboluowang.com/2018/1220/1220453.html

傳中國駭客攻擊德國公司
https://www.chinatimes.com/realtimenews/20181219003340-260410

Chinese hackers tap into EU diplomatic communications network
https://www.zdnet.com/article/chinese-government-taps-into-eu-diplomatic-communications-network/#ftag=RSSbaffb68

中國駭客入侵歐盟通訊網路，竊取歐盟成員之間的外交電報
https://www.ithome.com.tw/news/127791

歐盟外交通訊遭駭 上千敏感電文曝光了
https://udn.com/news/story/6809/3548022

中國解放軍精銳駭客遭指多年網襲歐盟外交機密
https://www.bannedbook.org/bnews/zh-tw/cbnews/20181220/1049740.html

中國駭客疑入侵歐盟外交通訊 上千敏感電文曝光
https://bit.ly/2QEXcvB

歐盟電文遭駭 暴露對「雙普」心驚驚
https://udn.com/news/story/11314/3546978

美國資安公司：解放軍偷竊大量歐盟外交文件
https://www.taiwannews.com.tw/ch/news/3600921

陸解放軍無孔不入？歐盟遭駭、上千外交機密疑外洩
https://bit.ly/2R74YOd

美組聯合陣線 譴責並制裁中國駭客與間諜
https://money.udn.com/money/story/5599/3549169

美國務院與國土安全部聯合聲明 譴責中方資助駭客
https://bit.ly/2PWlzzw

中國黑客傳先入侵惠普IBM 再攻擊其客戶
https://bit.ly/2R91RW0

路透：中國駭客入侵惠與和IBM網路 再駭人客戶電腦
https://udn.com/news/story/6813/3549446

美起訴2名陸駭客 涉竊取商業機密
https://udn.com/news/story/6813/3549358

美宣布撤軍敘利亞 庫德族：IS將重新集結
https://bit.ly/2QNq7gP

隱私被看光？澳洲通過新法 允許政府取得加密訊息
https://cnews.com.tw/005181217a04/

萬豪酒店被駭 美官員直指中方主導
https://turnnewsapp.com/global/politics/69697.html

Did China Hack Marriott, Or Is This Fake News
https://www.bankinfosecurity.asia/interviews/did-china-hack-marriott-or-this-fake-news-i-4196

別上當！北美出現勒索比特幣的炸彈勒索信
https://bit.ly/2A2wtia

美加數十處接獲炸彈威脅 歹徒要求付比特幣付贖金
https://bit.ly/2BqII89

駭客廣發炸彈恐嚇電郵，在多國勒索比特幣
https://technews.tw/2018/12/14/bomb-threats-email-for-bitcoin/

駭客廣發炸彈恐嚇電郵，在多國勒索比特幣
https://technews.tw/2018/12/14/bomb-threats-email-for-bitcoin/

19州現炸彈電郵 促以比特幣付兩萬元
https://bit.ly/2BnnVSE

「兩階段驗證」被破解了？伊朗駭客成功繞過
https://applealmond.com/posts/45708

DOD doesn't keep track of duplicate or obsolete software
https://www.zdnet.com/article/dod-doesnt-keep-track-of-duplicate-or-obsolete-software/#ftag=RSSbaffb68

Fake Bomb Threat Emails Demanding Bitcoins Sparked Chaos Across US, Canada
https://bit.ly/2BqxAYF

'Bomb threat' scammers are now threatening to throw acid on victims
https://www.zdnet.com/article/bomb-threat-scammers-are-now-threatening-to-throw-acid-on-victims/#ftag=RSSbaffb68

美台商業會長警告：若使用華為 台美難合作
https://bit.ly/2GjRWZo

美台商業會長警告：若使用華為 台美難合作
http://news.ltn.com.tw/news/focus/paper/1254188

「兩岸2019」兵棋推演：美國打台灣牌 台灣須戒慎恐懼
https://www.chinatimes.com/realtimenews/20181219003402-260409

青松資訊：Anonymous捲土重來OpIcarus2018持續發威
https://www.aqniu.com/vendor/41932.html

STATE-LEVEL RESPONSES TO MASSIVE CYBER-ATTACKS: A POLICY TOOLBOX
https://www.clingendael.org/nl/node/9766

Symantec tracks down a new hacking group Seedworm aka Muddywater
https://www.cybersecurity-insiders.com/symantec-tracks-down-a-new-hacking-group-seedworm-aka-muddywater/

Intelligence Cyber attack, ieri a Roma conclusa l’esercitazione “Cyber Shield: facing the threat”
http://www.reportdifesa.it/cyber-attack-ieri-a-roma-conclusa-lesercitazione-cyber-shield-facing-the-threat/

North Korea Launches Cyber Attack On United States
https://paletiks.com/2018/12/14/north-korea-launches-cyber-attack-on-united-states/

Save the Children Foundation duped by hackers into paying out $1 million
https://www.zdnet.com/article/save-the-children-foundation-duped-by-hackers-into-paying-out-1-million/#ftag=RSSbaffb68

The U.S. Should Use Beijing’s Social Credit System against China
https://bit.ly/2PHyjtx

Macron tente d’acheter la paix sociale
https://bit.ly/2CcKURX

British Teenager gets 3 year sentence for DDoS and False Bomb Threats
https://bit.ly/2QT1G0P

Australia's encryption laws are 'highly unlikely' to dragoon employees in secret
https://www.zdnet.com/article/australias-encryption-laws-are-highly-unlikely-to-dragoon-employees-in-secret/#ftag=RSSbaffb68

5 technologies you'll get sick of hearing about in 2019
https://www.zdnet.com/article/5-technologies-youll-get-sick-of-hearing-about-in-2019/#ftag=RSSbaffb68

Bing recommends piracy tutorial when searching for Office 2019
https://www.zdnet.com/article/bing-recommends-piracy-tutorial-when-searching-for-office-2019/#ftag=RSSbaffb68

Trump, Google, United Nations are among 2018's worst password offenders
https://www.zdnet.com/article/trump-google-un-are-among-2018s-worst-password-offenders/#ftag=RSSbaffb68

Super Micro: Audit Didn't Find Chinese Spying Chip
https://www.bankinfosecurity.asia/super-micro-audit-didnt-find-chinese-spying-chip-a-11846

WSJ website defaced by PewDiePie fan in ongoing YouTube subscribers battle
https://www.zdnet.com/article/wsj-website-defaced-by-pewdiepie-fan-in-ongoing-youtube-subscribers-battle/#ftag=RSSbaffb68

PewDiePie printer hacker strikes again: subscribe and sort out your security
https://www.zdnet.com/article/pewdiepie-printer-hacker-strikes-again-subscribe-and-sort-out-your-security/#ftag=RSSbaffb68

Twitter discloses suspected state-sponsored attack
https://www.zdnet.com/article/twitter-discloses-suspected-state-sponsored-attack/#ftag=RSSbaffb68

New attack intercepts keystrokes via graphics libraries
https://www.zdnet.com/article/new-attack-intercepts-keystrokes-via-graphics-libraries/#ftag=RSSbaffb68

Hackers Intercepted EU Diplomatic Cables for 3 Years
https://www.bankinfosecurity.com/hackers-intercepted-eu-diplomatic-cables-for-3-years-a-11872

徵才 - 【顧問部】顧問師 (新興科技資安技術)-319C
https://m.1111.com.tw/job/85208987/

徵才 - RD20329_1 軟體工程師
https://www.104.com.tw/job/?jobno=6grwd&jobsource=freshman2009

徵才 - 急徵!資安工程師(駐場地點:台北市)
https://www.104.com.tw/job/?jobno=5u8ui&jobsource

徵才 - 資安工程師
https://www.104.com.tw/job/?jobno=6gquk&jobsource=joblist_a_date

徵才 - 資安工程師 (台中市潭子區、台南市永康區)
https://www.1111.com.tw/job/85138458/

徵才 - 網路資安工程師--台北
https://www.104.com.tw/job/?jobno=3ybgp&jobsource=joblist_b_date

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷

當78%的指紋辨識儀器都被欺騙時
https://www.eettaiwan.com/news/article/20181219NT61-antispoofing-schemes-for-fingerprint-recognition-systems

一頁式詐騙不只臉書！就算入口網站、Yahoo新聞也有陷阱
https://zi.media/@wwwmygopencom/post/C87us7

多樣的社交工程手法網紅成駭客新目標，入侵掌握帳號或是當作散佈惡意連結的管道
https://bit.ly/2Gxs24z

Facebook 的瀏覽記錄消除工具要到明年春季才會推出
https://chinese.engadget.com/2018/12/18/facebook-browsing-history-control-delayed/

Facebook再遭打擊！科技泰斗「莫博士」宣布即將銷號
https://news.cnyes.com/news/id/4256464

台人到韓國開偽卡工廠　盜刷3200萬韓元！返台被起訴
https://www.ettoday.net/news/20181217/1333047.htm

組偽卡集團赴首爾盜刷 3台嫌遭起訴
https://www.cna.com.tw/news/asoc/201812170246.aspx

墮假公安騙案 內地女大生被騙360萬
http://www.hkcna.hk/content/2018/1219/733941.shtml

注意了！偽造的Office 365無法傳遞通知成為駭客網釣新手法
https://www.ithome.com.tw/news/127724?fbclid=IwAR2MEpOQHArp7tX7YfLmH952_oMWJPmZ63BRdePKHdlfwL32_6yfaRJEtZo

信用卡假交易套利 涉款2億
http://orientaldaily.on.cc/cnt/china_world/20181216/00178_005.html

推特爆個資漏洞 異常流量疑來自中、沙贊助的駭客
http://news.ltn.com.tw/news/world/breakingnews/2645502

Twitter 個人資料外洩，疑似遭國家支持駭客入侵
http://technews.tw/2018/12/19/twitter-leaks-chinese-and-saudi-arabia-ip/

假檢察官騙了10多年仍管用　翁領光86萬老本警神速登門攔阻
https://www.ettoday.net/news/20181216/1332412.htm

數據庫沒加密毋須密碼 大陸軟件 Boomoji 洩露大量用戶資料
https://unwire.hk/2018/12/17/boomoji-databases-leaked/tech-secure/

確保遵守隱私法 愛爾蘭主管機關調查臉書
https://bit.ly/2SMZ5mr

「勞保局」未接快回撥？竟是詐騙新招
https://bit.ly/2UODvzS

哪些密碼最容易被破解、遭駭竊取？安全機構公布十大「最不安全」密碼最新排名
http://3c.ltn.com.tw/news/35350

2018十大「最不安全」密碼　「123456」五連冠
https://www.ettoday.net/news/20181217/1332803.htm

2018年密碼觀念最差者：五角大厦、Nutella榜上有名，Google意外拿下第八
https://www.ithome.com.tw/news/127712

設定密碼別偷懶　連5年奪冠的危險密碼是這個
https://tw.appledaily.com/new/realtime/20181216/1484740/

愛爾蘭查個資外洩案　Facebook將面臨16億美元罰款
https://www.ettoday.net/news/20181217/1332714.htm

保護用戶個資不力　華盛頓特區檢察總長控告臉書
https://tw.news.appledaily.com/international/realtime/20181220/1486627/

第三方軟件可隨意存取照片　Facebook Stories 漏洞影響 680 萬人
https://bit.ly/2Espy4D

臉書又爆資安漏洞 數百萬用戶「私密照片」遭曝光
https://bit.ly/2SN47iI

臉書資安漏洞爆不完！相片應用程式出包，680萬用戶私人照片外洩
https://www.storm.mg/article/714687

臉書證實發現新Bug！　680萬用戶「私人照」外洩
https://www.ettoday.net/news/20181215/1331474.htm

臉書再爆洩漏用戶私訊！150家企業窺個資
https://news.ftv.com.tw/news/detail/2018C20I05M1

注意！臉書資安又出包　高達680萬人隱私照片恐外流
https://www.setn.com/News.aspx?NewsID=470913

Facebook再發生數據洩漏 影響6800萬用戶
http://www.metroradio.com.hk/news/default.aspx?NewsId=20181215042751

Facebook defends giving tech giants access to extensive user data
https://www.zdnet.com/article/facebook-defends-giving-tech-giants-access-to-extensive-user-data/#ftag=RSSbaffb68

臉書9月竟曾出現大漏洞　680萬名用戶照片外流
https://www.taiwannews.com.tw/ch/news/3597376

Facebook新醜聞：微軟、亞馬遜等公司甚至可以讀取用戶私信
https://news.cnyes.com/news/id/4256854

Facebook 爆用戶私隱漏洞 合作夥伴 Netflix / Spotify 可共享兼刪除帳號訊息
https://bit.ly/2GJ0OYX

Uber個資外洩案 法國處40萬歐元罰款
https://money.udn.com/money/story/10511/3549062

E乳梓梓裸照外流遭疑自導自演　嘆「沒有這麼白痴」
https://tw.news.appledaily.com/new/realtime/20181214/1483533/

伊朗駭客假冒Gmail和Yahoo Mail遭駭通知信來發送釣魚郵件，專門鎖定記者、社運人士和官員
https://bit.ly/2EsC2KF

刷卡訂機票遭疑「違法盜刷」取消 乘客控樂桃：離譜
https://news.ebc.net.tw/News/Article/144002

趨勢科技：2019憑證資料外洩遭盜用詐騙事件將增加
https://udn.com/news/story/7239/3545890

美國太空總署員工資料遭不明存取，影響範圍與數量正在調查中
https://www.zdnet.com/article/nasa-discloses-data-breach/

Mayday! NASA Warns Employees of Personal Information Breach
https://bit.ly/2T3x6yN

NASA驚爆伺服器遭駭客入侵，過去12年員工個資恐遭外流
https://www.ithome.com.tw/news/127788

NASA discloses data breach
https://www.zdnet.com/article/nasa-discloses-data-breach/#ftag=RSSbaffb68

GDPR: EU Sees More Data Breach Reports, Privacy Complaints
https://www.bankinfosecurity.com/gdpr-eu-sees-more-data-breach-reports-privacy-complaints-a-11873

Seven from ten Americans worried about holiday shopping identity theft
https://www.zdnet.com/article/seven-from-ten-americans-worried-about-holiday-shopping-identity-theft/#ftag=RSSbaffb68

Brazilian IT firm Tivit suffers data leak
https://www.zdnet.com/article/brazilian-it-firm-tivit-suffers-data-leak/#ftag=RSSbaffb68

Technologies That Help in Breach Investigations
https://www.bankinfosecurity.asia/technologies-that-help-in-breach-investigations-a-11838

Gartner's Avivah Litan on Impact of Marriott Breach
https://www.bankinfosecurity.com/gartners-avivah-litan-on-impact-marriott-breach-a-11863

Hackers have earned $1.7 million so far from trading data stolen from US gov payment portals
https://www.zdnet.com/article/hackers-have-earned-1-7-million-from-trading-stolen-us-gov-payment-portal-data/#ftag=RSSbaffb68

Data Leak Exposes Psychologists' Home Addresses
https://www.bankinfosecurity.asia/data-leak-exposes-psychologists-home-addresses-a-11871


E.研究報告

OSX Github桌面版RCE漏洞分析
http://www.4hou.com/vulnerable/15004.html

Asuswrt-merlin 自定義 dnsmasq 解析
https://bit.ly/2GlI01q

分析Pwn2Own上的一個Adobe漏洞利用
https://xz.aliyun.com/t/3595

網站安全公司對於網站邏輯漏洞的修復方案分享
https://my.oschina.net/u/3887295/blog/2988660

phpMyAdmin LOAD DATA INFILE 任意文件讀取漏洞
https://www.v2ex.com/t/517722

ThinkPHP V5高危漏洞分析騰訊禦界高級威脅檢測系統可成功檢出
https://s.tencent.com/research/report/607.html

Python Web之瓶會話和格式化字符串漏洞
https://xz.aliyun.com/t/3569

基於Android組件的應用程序脆弱性分析
http://cdmd.cnki.com.cn/Article/CDMD-10013-1017291182.htm

CVE-2018-8611 Windows kernel事務管理器0 day漏洞分析
http://www.4hou.com/vulnerable/15203.html

UPnProxy：一種利用路由器UPnP漏洞的惡意代理系統
https://www.freebuf.com/articles/terminal/191013.html

挖洞經驗| 價值$7500的Google MyAccount服務端點擊劫持漏洞（Clickjacking）
https://www.freebuf.com/vuls/190709.html

使用本地DTD文件來利用XXE漏洞
https://www.anquanke.com/post/id/168012

python自動化測試人工智能
https://china-testing.github.io/practices.html

RF-14310（CVE-2018-12533）分析
https://paper.seebug.org/766/

S2-003 遠程代碼執行漏洞
https://blog.csdn.net/Fly_hps/article/details/84999857

S2-005 遠程代碼執行漏洞檢測與利用
https://blog.csdn.net/Fly_hps/article/details/85000125

S2-013 遠程代碼執行漏洞檢測與利用
https://blog.csdn.net/Fly_hps/article/details/85034215

S2-016遠程代碼執行漏洞檢測與利用
https://blog.csdn.net/Fly_hps/article/details/85035223

S2-045（CVE-2017-5638）分析
https://paper.seebug.org/767/

S2-057遠程代碼執行漏洞檢測與利用
https://blog.csdn.net/Fly_hps/article/details/85037056

Web安全漏洞分析-路徑遍歷漏洞
http://www.twoeggz.com/news/12604098.html

(Android Root)CVE-2017-7533 漏洞分析和復現
https://bbs.pediy.com/thread-248481.htm

《夢幻模擬戰》漏洞挖掘全過程
https://hk.saowen.com/a/fe09d93f538f926eb5408f746584d92ab05bc9ce4048ac7403669c01e9b20253

針對多個DirectX內核漏洞的分析
https://hk.saowen.com/a/b95196f5d1f9f16fc5d425746f6892cdf609f910bf1a4f40bb8d2e6e8d8b128d

挖洞經驗| Google服務端Referer信息洩露漏洞
https://www.freebuf.com/vuls/190605.html

驅動人生旗下應用分發惡意代碼事件分析- 一個供應鏈攻擊的案例
https://www.anquanke.com/post/id/168017

淺入淺出網站系統的信息安全
https://zhuanlan.zhihu.com/p/52518413

漏洞預警：DB2數據庫存在執行任意代碼漏洞
https://www.freebuf.com/company-information/192288.html

Web漏洞掃描器的設計與實現（一）
https://zhuanlan.zhihu.com/p/52851722

Thinkphp5 遠程代碼執行漏洞事件分析報告
https://paper.seebug.org/770/

對CVE-2018-8587（Microsoft Outlook）漏洞的深入分析
https://www.anquanke.com/post/id/168205

通過MS17_010來學習msf對滲透的利用
https://www.cnblogs.com/bmjoker/p/10151708.html

POC 2017 - Make LoadLibrary Great Again.pdf
https://github.com/f0rgetting/Presentations/blob/master/POC%202017%20-%20Make%20LoadLibrary%20Great%20Again.pdf?fbclid=IwAR2PfVE8F9h78qryPsMCRSDaEqDyJVl3mv18vy0N1_6Eyal6aeCkxwPgIW4

Ghost 2.8.0 release, modern online content professional release platform
https://meterpreter.org/ghost/?fbclid=IwAR35DWJ0Pp3ZvPOfU1hvCuhglGiT5miWsas12Myjpr_FUYegyr-rFRNJPdo

Microsoft Office has the dark mode on macOS Mojave
https://bit.ly/2Lgxzv2

Joomscan – Open Source Joomla Vulnerability Scanner
https://bit.ly/2RUsT0i

Vivaldi 2.2 release: improves accessibility, navigation and media experience
https://meterpreter.org/vivaldi-2-2/?fbclid=IwAR0b4nZEPayYxvaxyW_t37olVGj7m9tYGA_VtWizTMGg3FCQuqGYR7329XY

NoSQLMap – Open Source Audit and Attack NoSQL Databases
https://bit.ly/2UJpXpi

StalkPhish v0.9.5 releases: The Phishing kits stalker
https://securityonline.info/stalkphish-the-phishing-kits-stalker/

WhatWaf v0.11.11 releases: Detect & bypass web application firewalls and protection systems
https://securityonline.info/whatwaf/

HELK v0.1.6-alpha12132018 Releases: The Hunting ELK
https://securityonline.info/helk/

ThunderShell v2.0.2 Releases: Fully encrypted powershell RAT
https://securityonline.info/thundershell-encrypted-powershell-rat/

Laravel Collections Every Laravel Developers Goto Resource
https://laravelcollections.com/?fbclid=IwAR2rjmYvkDrrJEEOxerebbCmQNFwBH2T4L6-JmmhHDjjTys1Obp5lMQWb-E


F.商業

安碁導入AI資安防護　2019年可望雙位數成長
https://www.digitimes.com.tw/tech/dt/n/shwnws.asp?id=0000549889_qo49x8n17ve7d1lvay1oj

Fortinet 2019威脅態勢預測：網絡犯罪五大趨勢
https://www.secrss.com/articles/7078

Docker推新版Docker Hub，一次整併Docker商城、Docker Cloud服務
https://ithome.com.tw/news/127686

英特爾和TPG洽談以逾42億美元出售McAfee給私募股權Thoma Bravo
https://news.cnyes.com/news/id/4255273

日本Line強化資料防護 收購南韓網路安全公司
https://money.udn.com/money/story/5602/3539656

Fortify 源碼弱點檢測 助應用程式安全快速上線
https://marketing.ares.com.tw/dm/newsletter-2018-12-fortify/

資安整合服務平台的緣起與意義
https://bit.ly/2SQX3l9

Chrome 瀏覽器 未來將阻止網站竄改使用者瀏覽記錄，告別回不去的上一頁
https://www.kocpc.com.tw/archives/234388

中小型企業可負擔的企業級資安防護-FireEye
https://www.zerone.com.tw/Content/Product/CD62D2A1CD97EBFF

中華電信首推Android零接觸註冊機制
https://bit.ly/2Lvdx02

Microsoft officially announces 'Windows Sandbox' for running applications in isolation
https://www.zdnet.com/article/microsoft-officially-announces-windows-sandbox-for-running-applications-in-isolation/#ftag=RSSbaffb68

Microsoft's new Office app for Windows 10 is coming to all Office users for free
https://www.zdnet.com/article/microsofts-new-office-app-for-windows-10-is-coming-to-all-office-users-for-free/#ftag=RSSbaffb68


G.政府

台灣8大行業 明年禁用華為等大陸電信設備
http://www.epochtimes.com/b5/18/12/14/n10911159.htm

國安會宣布！明年起8大關鍵基礎建設禁用中國製產品
https://bit.ly/2QwOj76

1月1日起　台灣嚴禁「華為」進入八大敏感行業
https://www.secretchina.com/news/b5/2018/12/16/879316.html

網攻頻傳 國防院籲跨國資安聯防
http://news.ltn.com.tw/news/focus/paper/1254530

「共軍擬2020年侵台？」國防院報告出爐
https://www.secretchina.com/news/b5/2018/12/14/879141.html

國防院首發中共政軍報告 點出中共以「代理人」統戰台灣
https://bit.ly/2rB3e1g

ＮＣＣ：已禁用中製核心網路設備
http://ec.ltn.com.tw/article/paper/1254166

全美警戒中國資安威脅　傳電信雙雄將拒用華為基地台
https://www.taiwannews.com.tw/ch/news/3597402

江雅綺：張善政的科技決勝論解決不了網路假新聞難題
https://www.upmedia.mg/news_info.php?SerialNo=54210

回應陸「人臉辨識」設備風險 金管會示警
https://bit.ly/2CdFMxa

金管會訂定商業銀行以全權委託方式辦理「銀行法」第74條之1所定有價證券投資者應符合之相關規定
https://bit.ly/2S43fX6

防範假訊息　行政院提修法最重可處無期徒刑
https://tw.appledaily.com/new/realtime/20181215/1484331/

顧立雄：不是新創就非得支持
https://bit.ly/2QABSHi

金管會下令：銀行雲端伺服器都要在台灣
https://bit.ly/2PJLY3u

政府應為雲端服務建立相關規範！雲端安全聯盟促使新加坡當局制訂COIR指南
https://www.ithome.com.tw/news/127772?fbclid=IwAR2wXziZH-w0sOI1zELhiVg9IBB42_iMhfvFPFQ8a5WeDMeouLPvPXNrC1Q


H.工控系統/ICS/SCADA
Siemens TIM 1531 IRC security bypass CVE-2018-13816
https://cert-portal.siemens.com/productcert/pdf/ssa-982399.pdf

Three Things ICS Security Pros Can Do to Maximize Uptime
https://www.powermag.com/three-things-ics-security-pros-can-do-to-maximize-uptime/

ICS Security Risks For 2019 Revealed
https://www.sensorsmag.com/embedded/ics-security-risks-for-2019-revealed

Indegy Publishes Industrial Cyber Security Predictions for 2019
https://www.businesswire.com/news/home/20181218005097/en/Indegy-Publishes-Industrial-Cyber-Security-Predictions-2019

I.教育訓練類
一篇文章讓你理解SQL注入漏洞的原理
http://www.safebase.cn/article-254519-1.html

一篇文章讓你理解CSRF、點擊劫持和url跳轉的攻擊原理
http://www.safebase.cn/article-254502-1.html

網絡安全入門的16個基本問題
http://www.safebase.cn/article-254521-1.html

GRE一戰327 兩星期衝刺心得分享
https://bit.ly/2A05WSG

網路直播危機多 教育部推直播二三事懶人包
https://money.udn.com/money/story/7307/3547704

Building a Smart Card Transit Ticketing System with Redis and Raspberry Pi
https://bit.ly/2S1vLZi

Designing Multi-Threaded Applications Using Swift
https://bit.ly/2rBHmTn

Improving code testability with Swift protocols
https://bit.ly/2QyL3bl

What Is Microservices Architecture
https://medium.com/fintechexplained/what-is-microservices-architecture-1da41a94a29b

Turning Python Scripts into CLI Commands
https://bit.ly/2EAtxgH



J.物聯網/IOT/人工智慧/車聯網/光聯網/深度學習/機器學習/無人機

防特網公司 揭露物聯網資安關鍵
https://readers.ctee.com.tw/cm/20181214/a43ac7/946642/share

安全漏洞 5G 網路將會對自動駕駛造成威脅
https://www.7car.tw/articles/read/54430

為對付跟蹤狂，Taylor Swift 演唱會使用臉部辨識技術
http://technews.tw/2018/12/14/taylor-swift-tracked-stalkers-with-facial-recognition-tech-at-her-concert/

全球物聯網大會TIOTA成立物聯網區塊鏈委員會
https://bit.ly/2S3DSoj

你以為是填 reCAPTCHA 驗證碼，其實在幫 Google 訓練 AI
https://technews.tw/2018/12/17/keying-recaptcha-working-for-google/

物聯網時代「資安防禦網」不可少！工控系統不灌防毒軟體怎麼防毒？就讓它來把關
https://www.damanwoo.com/node/92532

卡巴斯基：可連網的家用電動車充電器漏洞，可讓駭客隨意控制充電甚至引發火災
https://www.ithome.com.tw/news/127731

這廠商人臉辨識 失誤率僅0.3%
https://bit.ly/2QXrrND

艾拉物聯：台灣發展物聯網 要放眼全球商機
https://udn.com/news/story/7240/3546469

艾拉物聯聯合創始人張南雄 發展物聯網 放眼全球
https://money.udn.com/money/story/5648/3547046

智慧城鄉蘊含產業商機　下世代潛力股待孵育
https://www.digitimes.com.tw/iot/article.asp?cat=158&id=0000550321_QZX208II3U4VKM08GDQH9

研華建立共創生態系統，描繪物聯網新世界
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=10&id=0000550200_jc112c8h1klhzhlmfmlng

趨勢科技的 2019 資安年度大預測：駭客攻擊由 IT 轉向 OT，人機界面是主要漏洞
https://buzzorange.com/techorange/2018/12/19/2019-trend-micro-security-predict/

趨勢科技結盟夥伴 攻物聯網資安商機
https://www.chinatimes.com/realtimenews/20181220002563-260410

陸車聯網市場料維持高成長，2025年規模估逾2千億RMB
https://bit.ly/2R7seLJ

智慧工廠浪潮下的六種潛在資安威脅
https://blog.trendmicro.com.tw/?p=58195

智慧製造衍生隱憂　資安防護須從晶片端導入
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=10&id=0000550433_2k15m5462vh1t34kr44z8

This Wearable Patch Detects Stress Hormone in Sweat
https://bit.ly/2UJV4AX

New machine learning algorithm breaks text CAPTCHAs easier than ever
https://www.zdnet.com/article/new-machine-learning-algorithm-breaks-text-captchas-easier-than-ever/#ftag=RSSbaffb68

K.CTF

CTF-Writeup/browser/PlaidCTF_2018_Roll-a-d8/
https://bit.ly/2GiGaP7

CTF-Writeup/browser/Blaze_CTF_2018_blazefox/
https://github.com/wwkenwong/CTF-Writeup/tree/master/browser/Blaze_CTF_2018_blazefox

CTF-Writeup/browser/Codegate_CTF_2017_Preliminary_jsworld/
https://github.com/wwkenwong/CTF-Writeup/tree/master/browser/Codegate_CTF_2017_Preliminary_jsworld

4.近期資安活動及研討會

  物聯網應用發展策略與安全設計-1天，假日速成班  2018/12/22 09:30(+0800)~18:30
  https://cyber-training.kktix.cc/events/404221c0-copy-2

  【課程】AI 人工智慧實戰班，類神經網路 DNN、CNN、RNN 通通傳授，兩天時間專家帶你進入Deep Learning 的大門  12/22 ~  12/23
  https://www.techbang.com/posts/62515-course-ai-artificial-intelligence-practical-class-deep-learning-machine-learning-image-recognition

  入門UI設計！Adobe Xd 快速上手工作坊 (台北假日場) 12/23
  https://www.accupass.com/event/1811221341231138544404

  專業手機暨硬碟資料救援教育訓練課程 12/26 ~ 12/28
  http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=46

  Taipei 暗号通貨 (Cryptocurrency) Meetup  12/26
 https://bit.ly/2Ercv4p

  Taipei.py 十二月月會 (Monthly Meeting) 2018  12/27
  https://www.meetup.com/Taipei-py/events/256337705/

  系統日誌分析實務  12/27
  https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3653&from_course_list_url=homepage

  亥客書院 - 高階網頁滲透測試    2019/1/5
  https://hackercollege.nctu.edu.tw/?p=768

  資策會2019/1/5開辦CompTIA Security+ 國際網路資安認證班
  https://n.yam.com/Article/20181129286231

  2019 政府資安戰略論壇  2019/01/03 13:00(+0800)~16:30
  https://csa.kktix.cc/events/csa190103

  【課程】Arduino四軸飛行器開發實作，無人機硬體、無線遙控器、飛控軟體整合、飛行教學，一天學會 1/5
   https://bit.ly/2LdYJ5H
 
  ISDA 白帽入門讀書會 黑帽python入門  1/5
  https://www.twcert.org.tw/subpages/securityInfo/securityactivity_details.aspx?id=299

  【課程】用Google TensorFlow實作推薦系統，讓機器學習應用各種商務情境、提升商品曝光達到精準行銷 1/12
  https://bit.ly/2PysEaH