資安事件新聞週報 2019/9/9 ~ 2019/9/13
1.重大弱點漏洞/後門/Exploit/Zero Day
藏在純文字檔的Jenkins外掛漏洞
https://blog.trendmicro.com.tw/?p=61935
上百萬台網路收音機暗藏可遭駭客挾持的安全漏洞
https://ithome.com.tw/news/132984
Palo Alto Global 漏洞(CVE-2019-1579)
https://nosec.org/home/detail/2951.html
Pulse Secure VPN嚴重漏洞（CVE-2019-11510）警報
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Remote Code Execution
https://www.exploit-db.com/exploits/47354
Telnet backdoor vulnerabilities impact over a million IoT radio devices
https://www.zdnet.com/article/critical-vulnerabilities-impact-over-a-million-iot-radio-devices/#ftag=RSSbaffb68
Imperial & Dabman Internet Radio - Undocumented Telnetd & Code Execution
https://www.vulnerability-db.com/?q=articles/2019/09/09/imperial-dabman-internet-radio-undocumented-telnetd-code-execution
Java finally goes all in on open source with the Jakarta EE 8 release
https://www.zdnet.com/article/java-finally-goes-all-in-on-open-source-with-the-release-of-jakarta-ee-8/#ftag=RSSbaffb68
OfficeScan 11.0 SP1終止技術服務通知
https://esupport.trendmicro.com/zh-tw/business/topic_techsupport/topic_eosproduct.aspx
Vulnerability Spotlight: Denial-of-service vulnerabilities in some NETGEAR routers
https://blog.talosintelligence.com/2019/09/vuln-spotlight-Netgear-N300-routers-DoS-sept-2019.html
IBM WebSphere Application Server 資料洩露漏洞
https://www.ibm.com/support/pages/security-bulletin-path-traversal-vulnerability-websphere-application-server-admin-console-cve-2019-4442
CVE-2019-5475/Nexus Repository Manager遠程命令執行
https://qiita.com/shimizukawasaki/items/12f0b69945498e6d5aa9
Nexus Repository Manager 2.x遠程命令執行（CVE-2019-5475）
https://www.secpulse.com/archives/112290.html
Cisco RV110W/RV130(W)/RV215W Routers Management Interface - Remote Command Execution (Metasploit)
https://www.exploit-db.com/exploits/47348
Cisco UCS Director - default scpuser password (Metasploit)
https://www.exploit-db.com/exploits/47346
Android 多個漏洞
https://source.android.com/security/bulletin/2019-09-01
Android 全新 0-Day 漏洞，可導致駭侵者取得更高操作權限
https://www.twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=5105
Multiple Code Execution Flaws Found In PHP Programming Language
https://thehackernews.com/2019/09/php-programming-language.html
SA121 : OpenSSH Shell Command Restriction Bypass
https://support.symantec.com/us/en/article.SYMSA1361.html
Exim TLS Flaw Opens Email Servers to Remote 'Root' Code Execution Attacks
https://thehackernews.com/2019/09/exim-email-server-vulnerability.html
Exim 伺服器再傳根權限RCE漏洞
https://www.ithome.com.tw/news/132935
數百萬Exim郵件服務器存在嚴重漏洞易遭受root授權攻擊
http://bit.ly/2m62OjN
Exim TLS Flaw Opens Email Servers to Remote 'Root' Code Execution Attacks
https://thehackernews.com/2019/09/exim-email-server-vulnerability.html
Millions of Exim servers vulnerable to root-granting exploit
https://www.zdnet.com/article/millions-of-exim-servers-vulnerable-to-root-granting-exploit/#ftag=RSSbaffb68
Email Servers: Exim Flaw Leaves Millions at Risk of Hacking
https://www.bankinfosecurity.com/email-servers-exim-flaw-leaves-millions-at-risk-hacking-a-13053
Facebook Patches "Memory Disclosure Using JPEG Images" Flaws in HHVM Servers
https://thehackernews.com/2019/09/facebook-hhvm-vulnerability.html
GPS追蹤器漏洞 中間人攻擊子女被消失
http://bit.ly/2k98CZg
GPS 追蹤器曝漏洞 逾60萬用戶資訊被洩露
http://bit.ly/2kGJoSm
WordPress 5.2.3 fixes new clutch of security vulnerabilities
https://nakedsecurity.sophos.com/2019/09/09/wordpress-5-2-3-fixes-new-clutch-of-security-vulnerabilities/
Adobe Flash, Application Manager patch update squashes critical code execution bugs
https://www.zdnet.com/article/adobe-flash-application-manager-patch-update-squashes-critical-code-execution-bugs/#ftag=RSSbaffb68
Mozilla launches Firefox VPN extension for US users
https://www.zdnet.com/article/mozilla-launches-firefox-vpn-extension-for-us-users/#ftag=RSSbaffb68
Mozilla to gradually enable DNS-over-HTTPS for Firefox US users later this month
https://www.zdnet.com/article/mozilla-to-gradually-enable-dns-over-https-for-firefox-us-users-later-this-month/#ftag=RSSbaffb68
新型態NetCAT攻擊可竊取英特爾伺服器CPU資料
https://www.ithome.com.tw/news/133020
Intel server-grade CPUs impacted by new NetCAT attack
https://www.zdnet.com/article/intel-server-grade-cpus-impacted-by-new-netcat-attack/#ftag=RSSbaffb68
NetCAT: New Attack Lets Hackers Remotely Steal Data From Intel CPUs
https://thehackernews.com/2019/09/netcat-intel-side-channel.html
微軟Patch Tuesday修補2個發生攻擊的零時差漏洞
https://ithome.com.tw/news/132991
New Windows 10 20H1 test build delivers a bunch of fixes, minor updates
https://www.zdnet.com/article/new-windows-10-20h1-test-build-delivers-a-bunch-of-fixes-minor-updates/#ftag=RSSbaffb68
Microsoft patches two zero-days in massive September 2019 Patch Tuesday
https://www.zdnet.com/article/microsoft-patches-two-zero-days-in-massive-september-2019-patch-tuesday/#ftag=RSSbaffb68
Microsoft Patches 2 Windows Flaws Already Being Exploited
https://www.bankinfosecurity.com/microsoft-patches-2-windows-flaws-already-being-exploited-a-13072
Microsoft Patch Tuesday — Sept. 2019: Vulnerability disclosures and Snort coverage
https://blog.talosintelligence.com/2019/09/microsoft-patch-tuesday-sept-2019.html
Microsoft's new Windows 10 20H1 test build adds ARM64 support for WSL
https://www.zdnet.com/article/microsofts-new-windows-10-20h1-test-build-adds-arm64-support-for-wsl/#ftag=RSSbaffb68
Microsoft DirectWrite - Invalid Read in SplicePixel While Processing OTF Fonts
https://www.exploit-db.com/exploits/47381
Microsoft DirectWrite - Out-of-Bounds Read in sfac_GetSbitBitmap While Processing TTF Fonts
https://www.exploit-db.com/exploits/47382
Remote Desktop Protocol: The Security Risks
https://www.bankinfosecurity.com/interviews/remote-desktop-protocol-security-risks-i-4436
修復了 Lync Server 2013 資訊洩露漏洞
https://support.microsoft.com/zh-tw/help/4515509/fix-for-lync-server-2013-information-disclosure-vulnerability
September Patch Tuesday Bears More Remote Desktop Vulnerability Fixes and Two Zero-Days
https://blog.trendmicro.com/trendlabs-security-intelligence/september-patch-tuesday-bears-more-remote-desktop-vulnerability-fixes-and-two-zero-days/
Weaponized BlueKeep Exploit Released
https://www.bankinfosecurity.com/weaponized-bluekeep-exploit-released-a-13051
Metasploit 釋出高危漏洞BlueKeep 利用庫，中國70 萬設備需當心
https://www.oschina.net/news/109668/metasploit-releases-bluekeep-exploit
Metasploit team releases BlueKeep exploit
https://www.zdnet.com/article/metasploit-team-releases-bluekeep-exploit/#ftag=RSSbaffb68
開源安全測試框架Metasploit嵌入BlueKeep攻擊程式
https://www.ithome.com.tw/news/132949
威脅預警| 蠕蟲級漏洞BlueKeep(CVE-2019-0708) EXP被公佈
https://www.freebuf.com/vuls/213745.html
Watchbog and the Importance of Patching
https://blogs.cisco.com/security/talos/watchbog-importance-of-patching
[漏洞預警] CVE-2019-14811 / Ghostscript的遠程命令執行漏洞
https://qiita.com/shimizukawasaki/items/3e9172ffeed7211960fb
Google discloses vulnerability in Chrome OS 'built-in security key' feature
https://www.zdnet.com/article/google-discloses-vulnerability-in-chrome-os-built-in-security-key-feature/#ftag=RSSbaffb68
Google announces alpha of Cloud Dataproc for Kubernetes
https://www.zdnet.com/article/google-announces-alpha-of-cloud-dataproc-for-kubernetes/#ftag=RSSbaffb68
Google to run DNS-over-HTTPS (DoH) experiment in Chrome
https://www.zdnet.com/article/google-to-run-dns-over-https-doh-experiment-in-chrome/#ftag=RSSbaffb68
Chrome 77 released with no EV indicators, contact picker, permanent Guest Mode
https://www.zdnet.com/article/chrome-77-released-with-no-ev-indicators-contact-picker-permanent-guest-mode/#ftag=RSSbaffb68
Security researchers expose another instance of Chrome patch gapping
https://www.zdnet.com/article/security-researchers-expose-another-instance-of-chrome-patch-gapping/#ftag=RSSbaffb68
2.銀行/金融/保險/證券/支付系統/ 新聞及資安
林國良專訪（一）／財金公司 打通金融高速路
https://money.udn.com/money/story/5649/4036337
林國良專訪（二）／他，逐水草而居的IT人
https://money.udn.com/money/story/5649/4036336
研訓院看世界－純網銀如何克服 監理與資安兩大痛點
http://bit.ly/2lEgHpg
國內首例保險監理沙盒問市將實施 另有兩沙盒案待審
http://bit.ly/2ka0U1a
首件「沙盒」實驗成功！手機門號開戶 最快年底上路
https://money.udn.com/money/story/5613/4036512
凱基證券雲端下單系統結合LINE 更即時
https://udn.com/news/story/7255/4036969
純網銀董事派任須遵守金金分離 銀行局：兩周內召集業者說明原則
https://www.ettoday.net/news/20190908/1531174.htm
3家純網銀竟有2股東喊撤資 兆豐銀開第一槍！另家也不玩了
https://tw.appledaily.com/hot/realtime/20190908/1629874
證券業協會指港交所上周四應同時暫停現貨及期貨市場
http://www.metroradio.com.hk/news/default.aspx?NewsID=20190909102719
香港期貨停市非駭客所為 港交所：交易已恢復正常
http://bit.ly/2ky74Iw
香港交所期貨交易當機停市 否認人為破壞
https://www.rti.org.tw/news/view/id/2033479
因新系統漏洞香港期貨停市半日 李小加：不涉及人為錯誤或破壞
http://www.hkcna.hk/content/2019/0906/783317.shtml
港交所(388)李小加:對昨日系統故障事件 感遺憾
https://www.metroradio.com.hk/news/default.aspx?NewsID=20190906105319
港交所：交易系統崩潰是供應商軟件的鍋 但網站的確遭惡意攻擊
https://www.finet.hk/newscenter/news_content/5d71f8f1bde0b3718d7084db
港交所改用舊系統 期貨復市
http://paper.wenweipo.com/2019/09/07/FI1909070006.htm
港交所改用舊系統期貨復市 業界：應擬定方案應對
https://news.sina.com.tw/article/20190907/32588892.html
李小加指期貨停市為重大決定 港交所繼續調查事件
http://www.hkcna.hk/content/2019/0906/783299.shtml
港交所死機兒戲 敗壞名聲須問責
https://hk.on.cc/hk/bkn/cnt/finance/20190906/bkn-20190906232857988-0906_00842_001.html
供應商系統軟件故障 非黑客攻擊
http://bit.ly/2ky8EtW
香港交易所有關衍生產品市場交易暫停的聲明
https://www.hkex.com.hk/News/News-Release/2019/1909052news?sc_lang=zh-HK
衍生產品市場暫停交易
https://www.hkex.com.hk/News/News-Release/2019/190905news?sc_lang=zh-HK
20年唯一1次盤中停市！港交所衍生品暫停交易，90％訂單未成交，能否索賠
https://news.sina.com.tw/article/20190906/32580914.html
八道關卡守護的「數據銀行」：中國聯通（香港）環球中心
https://news.sina.com.tw/article/20190907/32591526.html
斷裂的南山人壽 系統錯誤 保戶業務員權益受損
https://www.peopo.org/news/422029
ATM吃10萬銀行竟冷回！ 「有多的會補匯款」拒給證明
https://tw.appledaily.com/hot/realtime/20190909/1630362/
新安東京海上產險首推「保單辨識」！拍照上傳自動填欄位 智能客服速解答
https://www.ettoday.net/news/20190909/1531864.htm
中國加強保險公司關聯交易監管 嚴防險企成「提款機」
https://news.sina.com.tw/article/20190909/32606544.html
銀行錯誤轉入374萬元 夫婦倆狂花333萬現在慘了
https://news.ltn.com.tw/news/world/breakingnews/2911060
中秋連假外出機會多 金管會要求保戶服務不中斷
https://udn.com/news/story/7239/4041078
港交所擬併倫敦證交所 台灣證交所：不憂競爭力
https://udn.com/news/story/7239/4043023
元朗渣打銀行分行被賊人淋易燃液體打劫 失約6萬元
http://bit.ly/2kGq3AI
台網攜手中華郵政，簡化線上身分核驗
http://bit.ly/2kFyQmt
郵局帳號變網路身分證 TWID實名認證免臨櫃
http://bit.ly/2lQmsQE
資安再升級 樂天將在台打造資安團隊
https://ec.ltn.com.tw/article/breakingnews/2914324
外銀自建私有雲 金管會：採報備及補正程序辦理
https://udn.com/news/story/7239/4045003
Hackers stole $1.66M from German bank OLB by cloning EVM cards
https://www.atmmarketplace.com/news/hackers-stole-166m-from-german-bank-olb-by-cloning-evm-cards/
Financial threats in H1 2019: Mobile financial attacks rise by 107%
https://www.paymentscardsandmobile.com/mobile-financial-attacks-rise-by-107/
OCBC integrates voice command service with banking app
https://www.zdnet.com/article/ocbc-integrates-voice-command-service-with-banking-app/#ftag=RSSbaffb68
3.電子支付/電子票證/行動支付/ pay/新聞及資安
明明微信錢包裡有那麼多錢，駭客為什麼沒盯上？駭客們是怎麼想的
https://ek21.com/news/tech/139358/
網路交友綁電子支付 想退費竟卡關
http://bit.ly/2k87aGH
頂級「駭客」入侵支付寶，轉帳成功前一秒，螢幕上出現了12個字
https://ek21.com/news/tech/141167/
手機就是POS機！三星推解決方案，行動裝置也能刷卡收款
http://bit.ly/2kbK8ic
Amadeus攜手Visa CyberSource助推旅遊業反欺詐升級
https://www.travelweekly-china.com/77494
俄擬禁止支付寶、微信等外國電子支付向俄羅斯人提供服務
http://www.touchcrunch.com/20190908/tnkelwvm.html
「大家是不是討厭支付寶才抵制行動支付？」？鄉民這樣說
https://zi.media/@AI-News/post/wbVPs5
4.虛擬貨幣/區塊鍊 新聞及資安
事在必行！人民銀行快推自家虛擬貨幣
https://hk.on.cc/hk/bkn/cnt/finance/20190906/bkn-20190906194009999-0906_00842_001.html
比特幣雖能受益於中國央行數位貨幣，但USDT可能會被取代
http://news.knowing.asia/news/bfab8dfa-f7bb-43ac-a05e-1d6ec8b2c793
中國研發數位貨幣 類似Libra可用於支付寶
https://news.sina.com.tw/article/20190906/32582862.html
人行官員：距離推出中國數碼貨幣已不遠
https://news.rthk.hk/rthk/ch/component/k2/1479169-20190906.htm
穆長春履新央行數研所掌門人，中國數字貨幣亮相在即
https://news.sina.com.tw/article/20190906/32576126.html
全球謀推虛擬貨幣！現鈔必消失
https://hk.on.cc/hk/bkn/cnt/finance/20190908/bkn-20190908184404715-0908_00842_001.html
專家傳真－比特幣非貨幣？新型態的犯罪標的
http://bit.ly/2lEudcu
加密貨幣被破解？美國國家安全局 NSA 正在開發「量子密碼學」，抵禦量子電腦造成的資安問題
https://www.blocktempo.com/nsa-reportedly-developing-quantum-resistant-crypto/
Libra 開源代碼含安全漏洞！網路安全公司：耗時近 1 個月完成修補
https://news.cnyes.com/news/id/4381023
區塊鏈投票系統遭破解！莫斯科官方承諾盡快解決問題
http://news.knowing.asia/news/002a016a-573b-4192-a34d-92049c3af008
開發人員發現「比特幣閃電網路」出現資安漏洞：呼籲用戶不要存放太多資金
https://www.blocktempo.com/lightning-network-developers-warn-of-bug-that-could-cause-loss-of-bitcoin/
Coinsuper 入駐慢霧區，發布「安全漏洞與威脅情報賞金計劃」
https://www.chainnews.com/articles/605351111694.htm
千萬別踩！虛擬貨幣新手不知不覺就誤踩的5大地雷
http://bit.ly/2lJmvxV
許毓仁：證券型代幣STO市場 台灣最好一步到位
https://udn.com/news/story/6848/4043554
瞄準數千億美元的市場！「區塊鏈＋會計」正夯
http://news.knowing.asia/news/574c6f42-09c9-4aaa-85c5-702317206ba3
High stakes major global brand cryptocurrency competition is evolving fast
https://www.zdnet.com/article/high-stakes-major-global-brand-cryptocurrency-competition-is-evolving-fast/#ftag=RSSbaffb68
Singapore amongst currencies Facebook wants tied to Libra
https://www.zdnet.com/article/singapore-amongst-currencies-facebook-wants-tied-to-libra/#ftag=RSSbaffb68
5.資安事件新聞
A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式
新勒索軟體Lilocked瞄準伺服器展開攻擊
https://www.ithome.com.tw/news/132941
挖礦軟體進化 感染目標由 ARM 擴散至 Intel 伺服器
http://bit.ly/2m9QvTN
市長請注意！市政網路綁架案頻傳，全美 40 城市被攻擊
https://technews.tw/2019/09/12/cyberattack-40-cities-usa/
新勒索軟體Lilocked瞄準伺服器展開攻擊
https://www.ithome.com.tw/news/132941
A Summer of Discontent: The Hottest Malware Hits
https://thehackernews.com/2019/09/its-been-summer-of-ransomware-hold-ups.html
No municipality paid ransoms in 'coordinated ransomware attack' that hit Texas
https://www.zdnet.com/article/no-municipality-paid-ransoms-in-coordinated-ransomware-attack-that-hit-texas/#ftag=RSSbaffb68
Texas Ransomware Responders Urge Remote Access Lockdown
https://www.bankinfosecurity.com/texas-ransomware-responders-urge-remote-access-lockdown-a-13043
Thousands of servers infected with new Lilocked (Lilu) ransomware
https://www.zdnet.com/article/thousands-of-servers-infected-with-new-lilocked-lilu-ransomware/#ftag=RSSbaffb68
2019-09-06 - QAKBOT INFECTION FROM MALSPAM
https://www.malware-traffic-analysis.net/2019/09/06/index.html
Arizona School District Cancels Classes Due to Ransomware
https://www.bankinfosecurity.com/arizona-school-district-cancels-classes-due-to-ransomware-a-13035
A Ransomware Tale: Mayor Describes City's Decisions
https://www.bankinfosecurity.com/ransomware-tale-mayor-describes-citys-decisions-a-13033
Ransomware Protection and Containment Strategies: Practical Guidance for Endpoint Protection, Hardening, and Containment
https://www.fireeye.com/blog/threat-research/2019/09/ransomware-protection-and-containment-strategies.html
GootKit Malware Bypasses Windows Defender by Setting Path Exclusions
https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Malware Classification with ‘Graph Hash,’ Applied to the Orca Cyberespionage Campaign
https://blog.trendmicro.com/trendlabs-security-intelligence/malware-classification-with-graph-hash-applied-to-the-orca-cyberespionage-campaign/
FunkyBot Malware Intercepts Android Texts, 2FA Codes
https://threatpost.com/funkybot-malware-intercepts-android-texts-2fa-codes/148059/
Spam Campaign Abuses PHP Functions for Persistence, Uses Compromised Devices for Evasion and Intrusion
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abuses-php-functions-for-persistence-uses-compromised-devices-for-evasion-and-intrusion/
GootKit Malware Bypasses Windows Defender by Setting Path Exclusions
https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
2019-09-04 - DATA DUMP: URSNIF INFECTION WITH TRICKBOT
https://www.malware-traffic-analysis.net/2019/09/04/index.html
New Malware Uses Windows BITS Service to Stealthy Exfiltrate Data
https://thehackernews.com/2019/09/stealthfalcon-virus-windows-bits.html
ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group
https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/
A Summer of Discontent: The Hottest Malware Hits
https://thehackernews.com/2019/09/its-been-summer-of-ransomware-hold-ups.html
Malicious Android apps containing Joker malware set up shop on Google Play
https://www.zdnet.com/article/malicious-android-apps-containing-joker-malware-reach-half-a-million-installs-on-google-play/#ftag=RSSbaffb68
North Korean Malicious Cyber Activity
https://www.us-cert.gov/ncas/current-activity/2019/09/09/north-korean-malicious-cyber-activity
Malware Analysis Report (AR19-252A) MAR-10135536-10 – North Korean Trojan: BADCALL
https://www.us-cert.gov/ncas/analysis-reports/ar19-252a
Malware Analysis Report (AR19-252B) MAR-10135536-21 – North Korean Proxy Malware: ELECTRICFISH
https://www.us-cert.gov/ncas/analysis-reports/ar19-252b
‘Purple Fox’ Fileless Malware with Rookit Component Delivered by Rig Exploit Kit Now Abuses PowerShell
https://blog.trendmicro.com/trendlabs-security-intelligence/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell/
PsiXBot malware upgraded with Google DNS over HTTPS, sexploitation kit
https://www.zdnet.com/article/psixbot-malware-upgraded-with-google-dns-over-https-sexploitation-kit/#ftag=RSSbaffb68
PsiXBot Now Using Google DNS over HTTPS and Possible New Sexploitation Module
https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module
Malicious Android apps containing Joker malware set up shop on Google Play
https://newsvire.com/malicious-android-apps-containing-joker-malware-set-up-shop-on-google-play/
Ryuk Related Malware Steals Confidential Military, Financial Files
https://www.bleepingcomputer.com/news/security/ryuk-related-malware-steals-confidential-military-financial-files/
B.行動安全 / iPhone / Android /穿戴裝置 /App
首度超越 iOS 價值 Android 漏洞值 1,960 萬
https://m.eprice.com.hk/mobile/talk/124/213970/1/
蘋果遭鎖定維吾爾人網襲:兩年還是兩月
http://bit.ly/2m2z0od
中共駭入iPhone 蘋果證實是針對維吾爾人
http://bit.ly/2lJJfgX
蘋果證實駭客鎖定維吾爾人 但稱Google研究誤導
https://money.udn.com/money/story/5599/4034199
惡意網站入侵 iPhone 用戶 蘋果：網站均與維吾爾族資訊有關 安全漏洞已解決
http://bit.ly/2m65YnX
手機上網就被駭 蘋果：都是維族網站
http://bit.ly/2kyWqkE
挺香港示威者！Telegram修改個資漏洞
http://bit.ly/2k5hLC6
Twitter宣布暫停簡訊推文功能 真正原因讓人哭笑不得
https://cnews.com.tw/134190906a04/
小勞勃道尼驚傳IG被盜 限時動態「送2000台手機」引暴動
https://star.ettoday.net/news/1530325
Android 新漏洞允許黑客發送詐騙 OMA CP 消息 Samsung、LG、SONY、Huawei 手機受波及
http://bit.ly/2kzZv3U
交友軟體管理鬆散 不乏充斥約炮、援交內容
https://udn.com/news/story/11319/4032479
FB推出約會服務 聲明：結果風險自負
http://bit.ly/2m5ahzL
「臉書約會」推出！ 整合Instagram列「暗戀名單」秘密配對：風險自負
https://www.ettoday.net/news/20190906/1529681.htm
全美「臉書約會」上線！ 整合IG搶攻網路交友市場
https://news.tvbs.com.tw/world/1196446
觀看「成人網站」真沒人知道嗎？駭客早就盯上了，手機已經被利用
https://ek21.com/news/tech/141186/
Google揭多個iOS漏洞指iPhone用戶長期受攻擊，Apple：沒這麼嚴重
https://www.ithome.com.tw/news/132927
APP竊隱私 陸數據監獄已成型
http://www.epochtimes.com/b5/19/9/8/n11507090.htm
美國政府要求蘋果與谷歌交出曾下載步槍瞄準程式的使用者名單
https://ithome.com.tw/news/132960
IG漏洞讓非公開帳號上傳內容在瀏覽器下曝光並轉傳
https://www.ithome.com.tw/news/132968
幣寶台灣控告幣寶日本：交易所遭駭後侵佔台用戶資產
https://www.inside.com.tw/article/17503-bitpoint-lawsuit
華為Mate 30宣傳片藏特色 Google應用可能讓用戶自己裝
https://www.sogi.com.tw/articles/huawei_mate_30/6253535
Check Point 揭露安全性漏洞 三星、華為、LG、Sony 及其他 Android 手機易遭釣魚攻擊
https://gnn.gamer.com.tw/detail.php?sn=185575
Check Point揭露安卓漏洞 華為／Sony手機恐受「駭」
https://www.chinatimes.com/realtimenews/20190912004801-260412?chdtv
手機掃描程式引疑慮 三星稱重視私隱防護
http://bit.ly/2kx54jV
中國 42 款手機 App 涉私隱風險 不乏「西瓜視頻」等追劇程式【附名單】
http://bit.ly/2kFlsPd
Facebook自爆上傳JPEG漏洞
http://bit.ly/2mczN6e
【事實釐清】微信Wechat會不會「自動」連結Facebook
http://bit.ly/2mcqD9N
AdaptiveMobile Security發現針對手機的複雜駭客攻擊，揭開大規模網路漏洞
http://n.yam.com/Article/20190912931614
有些東西千萬不能借！資安專家：充電線超危險
https://money.udn.com/money/story/12524/4044940
「你的IG 帳號出現非法登入活動」一點選帳號就被盜
https://blog.trendmicro.com.tw/?p=61937
Android 10—The Ars Technica Review
https://arstechnica.com/gadgets/2019/09/android-10-the-ars-technica-review/
New SIM Card Flaw Lets Hackers Hijack Any Phone Just By Sending SMS
https://thehackernews.com/2019/09/simjacker-mobile-hacking.html
Most Android flashlight apps request an absurd number of permissions
https://www.zdnet.com/article/most-android-flashlight-apps-request-an-absurd-number-of-permissions/#ftag=RSSbaffb68
Apple disputes Google's accuracy on recent iOS hacks, and they may be right
https://www.zdnet.com/article/apple-disputes-googles-accuracy-on-recent-ios-hacks-and-they-may-be-right/#ftag=RSSbaffb68
Analysis: Report on China Attacking Mobile Devices
https://www.bankinfosecurity.com/interviews/analysis-report-on-china-attacking-mobile-devices-i-4434
Zero-day disclosed in Android OS
https://www.zdnet.com/article/zero-day-disclosed-in-android-os/
Non-public 5G networks will be a critical building block of your enterprise network strategy
https://www.zdnet.com/article/non-public-5g-networks-will-be-a-critical-building-block-of-your-enterprise-network-strategy/#ftag=RSSbaffb68
Apple Accuses Google of 'Stoking Fear' With iOS Bug Report
https://www.bankinfosecurity.com/apple-accuses-google-stoking-fear-ios-bug-report-a-13047
Telegram fixes privacy-breaking bug that stopped recipient message and image deletion
https://www.zdnet.com/article/telegram-fixes-privacy-breaking-bug-that-prevented-full-recipient-message-deletion/#ftag=RSSbaffb68
Popular Period Tracking Apps Share Your Sexual Health Data With Facebook
https://thehackernews.com/2019/09/facebook-period-tracker-privacy.html
C.事件 / 駭客 / DDOS / APT / 雲端/暗網/徵才 / 國際資安事件
HITB GSEC新加坡大會將會揭示網路安全領域的最新趨勢和威脅
http://bit.ly/2kbJwJq
eBay遭駭客攻擊，公司的標誌被裸體女孩照片取代
https://ek21.com/news/tech/144567/
Ebay ‘investigating’ hack that swapped email icon for topless woman
https://metro.co.uk/2019/09/09/ebay-investigating-cheeky-hack-swapped-email-icon-topless-woman-10711234/
C/C++ 最易受攻擊、70% 漏洞無效，揭秘全球開源組件安全現狀
https://ek21.com/news/tech/144383/
解決太空、地球問題 「NASA黑客松」開放報名
https://news.ltn.com.tw/news/life/breakingnews/2912906
「NASA黑客松」台灣成績優 AIT官員誇非常不簡單
https://news.ltn.com.tw/news/life/breakingnews/2913013
讓白帽駭客為企業助陣！漏洞懸賞平台 HackerOne 募資 3,640 萬美元
https://technews.tw/2019/09/13/bug-bounty-platform-hackerone-raises-36-4-million-dollars/
挖漏洞竟能賺取百萬美金？來認識一下這 6 位百萬美元白帽黑客
https://kknews.cc/tech/8vg8bp4.html
擁有軟體存取權限的車廠等製造商,才知道的隱藏版功能
https://blog.trendmicro.com.tw/?p=61657
網釣駭客利用Captcha來繞過安全機制
https://ithome.com.tw/news/133024
資安漏洞？中國天眼在身邊 北市購逾170支中國監視器
https://www.setn.com/News.aspx?NewsID=601680
台北也淪陷？綠議員爆市府曾採購200支中製監視器
https://news.ltn.com.tw/news/politics/breakingnews/2912545
北市多處「中國製監視器」爆資安疑慮 柯文哲一問三不知
https://www.nownews.com/news/20190911/3626252/
北市採購中國監視器議員要求撤換 柯文哲允諾
https://udn.com/news/story/7323/4042296
議員曝北市採購中國監視器 資訊局：有全面列管
https://udn.com/news/story/7323/4042381
遭議員質疑裝中國製監視器 北市府 : 已盤查並列管
https://newtalk.tw/news/view/2019-09-11/297783
台北市府採購陸製監視器 議員：應清查汰換
http://www.epochtimes.com/b5/19/9/11/n11514190.htm
有關議員質詢中國製監視器一事 台北市資訊局回應
http://bit.ly/2lJJE3g
驚！台中竟有34校1599支中國製監視器 學生隱私全都露
https://news.ltn.com.tw/news/life/breakingnews/2910145
台中34校用陸製監視器1599支 議員：盡速汰換一個不留
https://udn.com/news/story/7325/4037134
34校掛1599支中國監視器 中市資安再陷疑慮
http://bit.ly/2kz2BoZ
中市學校1599支海康威視監視器 議員促汰換
http://bit.ly/2k6e9jd
台中34所校園遭中國監視器入侵！學生個資恐外洩
https://www.ftvnews.com.tw/news/detail/2019909C08M1
海康威視入侵台中34所校園！ 學生個資恐外洩
http://bit.ly/2kt7Czv
「你在瀏覽色情網站時，已被側錄」駭客威脅不給錢,就公開
https://blog.trendmicro.com.tw/?p=61951
倪光南：網路安全空間如不能技術自主可控 會有風險
https://news.sina.com.tw/article/20190909/32601818.html
趨勢科技2019上半年資安總評：無檔案式威脅成長265%
https://www.techbang.com/posts/72624-trend-micro-reports-265-increase-in-undocumented-threat
大鑊！連登討論區受瀏覽器漏洞影響 黑客放入假對話框偷密碼
https://www.winandmac.com/2019/09/dadengshouqiloudongyingheikefangrujiakuangtoumi/
《魔獸世界》懷舊服太過火爆 慘遭駭客DDoS攻擊
http://big5.pconline.com.cn/b5/news.pconline.com.cn/1289/12896768.html
維基百科遭DDoS攻擊 歐洲數國網域癱瘓無法連線
https://news.ltn.com.tw/news/world/breakingnews/2909185
維基媒體遭DDoS攻擊 數國查不了維基百科
http://bit.ly/2m5md4w
打造Satori殭屍網路的青少年認罪了
https://www.ithome.com.tw/news/132918
尼泊爾首富採購華為設備
http://bit.ly/2lEKCO6
向美靠攏？越南在5G上擬排除華為設備
https://news.cnyes.com/news/id/4377679
專家：中共山寨黑客武器 在美設網絡「後門」
http://www.epochtimes.com/b5/19/9/6/n11504563.htm
北美防空司令部要求加拿大軍方增強網路安全
http://www.epochtimes.com/b5/19/9/9/n11510150.htm
熙爾擬創加拿大網絡安全認證 驗證數碼產品符聯邦安全標準
http://www.mingpaocanada.com/Tor/htm/News/20190907/tdb1_r.htm
諜對諜：中國駭客設陷阱來捕獲美國NSA的網路攻擊工具
https://www.ithome.com.tw/news/132974
中國北韓名列10大媒體監控國 CPJ︰監禁和騷擾記者
https://tw.appledaily.com/new/realtime/20190910/1631136/
全國2573萬人，只有2萬人可以上網的悲慘國度：全世界上網普及率最低的國家—北韓
https://www.storm.mg/article/1690701
以色列指伊朗有核武研發設施 曝光後已摧毀
http://bit.ly/2lGGM78
CIA挖到黃金！潛伏在俄的間諜能拍下普亭辦公桌上文
https://udn.com/news/story/6809/4039314
神祕諜爆料：普亭為助川普 親自介入美大選
https://udn.com/news/story/6813/4040734
普亭身旁臥底 美在俄最高階間諜險曝光 CIA急撤人
http://bit.ly/2kFkbrp
北韓的駭客能力有多強呢？是連韓國都讚譽有加的「世界前五名」
https://www.thenewslens.com/article/124622
韓駭客組織HIDDEN COBRA利用惡意程式BADCALL運用知名網站憑證進行fake TLS連線，以及利用惡意程式ELECTRICFISH建立隱密通道進行通訊
https://www.kl.edu.tw/v7/eduweb/index.php?func=edu_msg&edumsg_id=69951
陸淨網再升級 炒作八卦、緋聞Out扼止歪風 最重可處停業甚至吊銷許可證
https://turnnewsapp.com/global/culture/128750.html
中國之手入侵全球社交網操控輿論 《華郵》：香港前車可鑑促美國反擊
https://hk.news.appledaily.com/international/realtime/article/20190912/60032331
中國利用社群網站操控台港議題
https://tw.appledaily.com/new/realtime/20190912/1632075/
Attacks Targeting IoT Devices and Windows SMB Surge
https://www.bankinfosecurity.com/attacks-targeting-iot-devices-windows-smb-surge-a-13082
Iranian Hacking Group Continues Targeting Universities
https://www.bankinfosecurity.com/iranian-hacking-group-continues-targeting-universities-a-13081
Chinese APT Group 'Thrip' Powers Ahead
https://www.bankinfosecurity.com/chinese-apt-group-thrip-powers-ahead-a-13077
European police arrest Dark Web counterfeit currency traders
https://www.zdnet.com/article/european-police-arrest-dark-web-counterfeit-currency-traders/#ftag=RSSbaffb68
EUROPE’S SECOND-LARGEST COUNTERFEIT CURRENCY NETWORK ON THE DARK WEB TAKEN DOWN IN PORTUGAL
https://www.europol.europa.eu/newsroom/news/europe%E2%80%99s-second-largest-counterfeit-currency-network-dark-web-taken-down-in-portugal
Student pleads guilty to IRS hack attempt for Trump tax returns
https://www.zdnet.com/article/student-pleads-guilty-to-irs-hack-attempt-for-trump-tax-returns/#ftag=RSSbaffb68
Cyber-security incident at US power grid entity linked to unpatched firewalls
https://www.zdnet.com/article/cyber-security-incident-at-us-power-grid-entity-linked-to-unpatched-firewalls/#ftag=RSSbaffb68
Belarusian police shut down notorious hacking forum
https://www.zdnet.com/article/belarusian-police-shut-down-notorious-hacking-forum/#ftag=RSSbaffb68
Alleged Capital One Hacker Pleads Not Guilty
https://www.bankinfosecurity.com/alleged-capital-one-hacker-pleads-guilty-a-13044
Chinese APT Group Began Targeting SSL VPN Flaws in July
https://www.bankinfosecurity.com/chinese-apt-group-began-targeting-ssl-vpn-flaws-in-july-a-13037
LYCEUM Takes Center Stage in Middle East Campaign
https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign
Here are 235 apps that will not run with macOS Catalina
https://www.zdnet.com/article/here-are-235-apps-that-will-not-run-with-macos-catalina/#ftag=RSSbaffb68
US Government Ban on Kaspersky Formalized
https://www.bankinfosecurity.com/us-government-ban-on-kaspersky-formalized-a-13058
Hackers Attempted DDoS Attack Against Utility: Report
https://www.bankinfosecurity.com/hackers-attempted-ddos-attack-against-utility-report-a-13057
Cybercrime Black Markets: RDP Access Remains Cheap and Easy
https://www.bankinfosecurity.com/cybercrime-black-markets-rdp-access-remains-cheap-easy-a-13054
Singapore turns on data channel linking Chongqing industrial parks
https://www.zdnet.com/article/singapore-turns-on-data-channel-linking-chongqing-industrial-parks/#ftag=RSSbaffb68
駐點工程師(中區-資安)
https://www.104.com.tw/job/6qb8a?jobsource=keyword2Keyword
中央存款保險公司甄才公告
https://www.cdic.gov.tw/main_ch/docDetail.aspx?uid=18&pid=6&docid=2151
資訊安全管理師
https://www.104.com.tw/job/6qeyl
D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
轉發近期台北大學電子郵件信箱近來屢次收到詐騙信件，這是駭客使用假造寄件人詐騙比特幣(BTC)勒索郵件
http://www.ntpu.edu.tw/admin/a6/news_more.php?id=1054
Google法國稅務詐欺調查 逾300億和解
https://ec.ltn.com.tw/article/breakingnews/2914539
個資全都露 網路時代你我都是透明人
https://www.cna.com.tw/news/afe/201909130040.aspx
以 Deepfake 技術偽造 CEO 來電，歹徒「命令」子公司匯款詐騙成功
https://www.twcert.org.tw/subpages/securityInfo/securitypolicy_details.aspx?id=920
網路釣魚進化成 AI 語音釣魚,偽裝老闆聲音騙走 770 萬台幣
https://blog.trendmicro.com.tw/?p=2091
PayPal假網站現金回贈 慳幾蚊變輸幾千
http://bit.ly/2kFhupP
Facebook遭爆 超過4億用戶電話遭到洩漏
https://www.chinatimes.com/realtimenews/20190906004925-260412?chdtv
Facebook 近四億二千萬筆用戶個資外洩，資料庫被公開在網路上
https://www.twcert.org.tw/subpages/securityInfo/securitypolicy_details.aspx?id=921
美動員產官學資源 打擊假訊息
https://www.ydn.com.tw/News/351930
高中生竊取1億條公民信息獲利2萬 高考卻落榜
https://news.sina.com.tw/article/20190910/32609614.html
陸追劇APP恐曝個資！ 讀取電話簿、錄音監聽
http://bit.ly/2kxt1aw
追劇要當心！這些中國APP爆錄音侵犯用戶隱私
http://bit.ly/2lE7yNo
刑事局論流程：無論真假 須先受理報案
https://news.ltn.com.tw/news/society/paper/1316342
無碼外流片特多的AV女優是她 網揭真相
https://www.chinatimes.com/realtimenews/20190907000946-260404?chdtv
DevOps服務Circleci資料外洩事件調查，攻擊者未取得任何用戶機密資料
https://www.ithome.com.tw/news/132884
老翁接獲詐騙電話慌張報案 機智警即時阻詐成功
https://times.hinet.net/news/22548364
假技術真詐財？ 沈智慧踢爆「節電達人」行騙千萬
https://www.ettoday.net/news/20190906/1530059.htm
接獲健保卡預購藥品電話要匯3萬 他不知真假警戮破詐騙技倆
https://www.ettoday.net/news/20190906/1529838.htm
「你中了香港彩券！」婦匯款保證金險被騙18萬
https://udn.com/news/story/7320/4034678
特派員在現場／微信嚴查個資 海外吃不開
https://money.udn.com/money/story/5603/4035259
中國安徽破獲微博詐騙組織 涉案金額高達2.19億台幣
http://bit.ly/2k8u4xC
【捐錢就能活400年】中國安徽破獲微博詐騙組織 涉案金額高達2.19億台幣
http://bit.ly/2k8u4xC
北京警方打掉一「鏈條化」信用卡詐騙犯罪團伙
https://news.sina.com.tw/article/20190904/32557640.html
河南警方「雷霆」出擊破案１０３２起
https://news.sina.com.tw/article/20190909/32600562.html
偽造郵件、偽造筆跡、機器人電話、語音複製......AI「花式詐騙」的N種方式
https://www.techbang.com/posts/72650-fake-mail-forged-handwriting-robot-phone-calls-voice-reproduction-n-ways-to-ai-fancy-scams
誤信網友「CoCo」投資虛擬貨幣 百萬 「摳摳」差點被騙光
https://news.ltn.com.tw/news/society/breakingnews/2909760
「投資虛擬貨幣」工程師匯款百萬 警即時圈存保住匯款阻詐
https://www.ettoday.net/news/20190908/1531055.htm
【全民自保】檢查帳號有否被出賣 Firefox Monitor 幫到你
http://bit.ly/2lDVL1K
假冒國安局長騙婦結婚 無良再洗她540萬
https://www.ctwant.com/article/6590
收銀員靠「過目不忘」 盜刷1300張信用卡
https://udn.com/news/story/6810/4036900?from=udn-catelistnews_ch2
日男趁結帳記顧客卡號 「盜刷筆記本」藏1300筆資料
https://news.ltn.com.tw/news/world/breakingnews/2910266
豐田子公司遭變臉詐騙攻擊損失40億日圓
https://www.ithome.com.tw/news/132936
他受騙後找到「創業」靈感！被害人變百萬詐欺犯
https://money.udn.com/money/story/5648/4032970
南京破獲一起冒用他人身份證辦理信用卡並惡意透支案
https://news.sina.com.tw/article/20190905/32563998.html
新騙局來襲！「循環信用卡」鼓吹借錢不用還的荒唐論
https://twgreatdaily.com/3pj4GW0BJleJMoPMqjM8.html
陳德霖退休前再拍片 教大家保護數碼身份
http://bit.ly/2kvL2pY
廣東掃詐騙 破案數、抓獲人數雙升
https://udn.com/news/story/7332/4042868
建構兒童資安保護 陸新定個資法
https://turnnewsapp.com/global/culture/128757.html
假司法官詐150萬存摺 ATM前才準備開領...就被抓了
https://www.ettoday.net/news/20190912/1534069.htm
卡巴斯基實驗室：2019年Q2垃圾郵件和網絡釣魚數據匯總
http://www.199it.com/archives/935177.html
Google行事曆也淪陷！駭客已發起日曆釣魚詐騙
https://www.cheers.com.tw/article/article.action?id=5095194
Major Groupon, Ticketmaster Fraud Scheme Exposed By Insecure Database
https://threatpost.com/major-groupon-ticketmaster-fraud-scheme-exposed-by-insecure-database/148246/
Report: Massive Fraud Network Uncovered, Targeting Groupon & Online Ticket Vendors
https://www.vpnmentor.com/blog/report-groupon-fraud/
198 Million Car-Buyer Records Exposed Online for All to See
https://threatpost.com/198m-car-buyer-records-exposed-online/148231/
Facebook: 419 Million Scraped User Phone Numbers Exposed
https://www.bankinfosecurity.com/facebook-419-million-scraped-user-phone-numbers-exposed-a-13024
Singapore Adopts Stricter ID Collection Rules
https://www.bankinfosecurity.asia/singapore-adopts-stricter-id-collection-rules-a-13036
Flaws in Over Half a Million GPS Trackers Expose Children Location Data
https://thehackernews.com/2019/09/gps-tracking-device-for-kids.html
Google Fined $170 Million For Violating Kids' Privacy On YouTube
https://thehackernews.com/2019/09/youtube-kids-privacy-fine.html
Report: S. Korean Company's Database Leaking Business Data
https://www.bankinfosecurity.asia/report-s-korean-companys-database-leaking-business-data-a-13042
281 suspects arrested in massive crackdown against BEC scammers
https://www.zdnet.com/article/281-suspects-arrested-in-massive-crackdown-against-bec-scammers/#ftag=RSSbaffb68
51 tech CEOs send open letter to Congress asking for a federal data privacy law
https://www.zdnet.com/article/51-tech-ceos-send-open-letter-to-congress-asking-for-a-federal-data-privacy-law/#ftag=RSSbaffb68
E.研究報告
TokyoWesterns CTF 2019格式化漏洞利用的新姿勢
https://www.anquanke.com/post/id/185709
個案分析-X大學系所網站駭侵攻擊事件分析報告_10808
https://cert.tanet.edu.tw/prog/opendoc.php?id=2019083011082828195490327742851.pdf
繞過WAF 限制利用php: 方法實現OOB-XXE 漏洞利用
https://www.chainnews.com/articles/648862940880.htm
網站被黑如何恢復網站修復網站漏洞
https://ek21.com/news/tech/138793/
CVE-2019-15846：exim遠程獲取root權限漏洞預警
https://www.anquanke.com/post/id/186039
滲透測試服務針對CSRF漏洞檢測與代碼防禦辦法
https://cloud.tencent.com/developer/article/1499834
Beosin漏洞分析：偽EOS及其變種攻擊
https://read01.com/J8RPPjg.html
[漏洞預警]CVE-2019-0708遠程桌面代碼執行漏洞利用工具已放出
https://qiita.com/shimizukawasaki/items/4cfabcfb79d0b0270e5f
威脅預警|蠕蟲級漏洞BlueKeep(CVE-2019-0708)EXP被公佈
http://ikan.news/news/2019/0907/1800/5d73aa371e57895e14a13145
【安全預警】RDP遠程高危漏洞攻擊程序面世，大規模蠕蟲攻擊或將爆發
https://www.weibo.com/ttarticle/p/show?id=2309404413858956574734
CVE-2019-0708 RDP RCE漏洞重現(20190907-MSF-EXP)
http://www.lsablog.com/networksec/awd/cve-2019-0708-rdp-rce-20190907-msf-exp/
漏洞分析 - Atlassian Bitbucket數據中心目錄穿越漏洞到RCE（CVE-2019-3397）
https://xz.aliyun.com/t/6266
深入探索在野外發現的iOS的漏洞利用鏈
https://www.anquanke.com/post/id/186262
Web漏洞分析之zzcms多個CVE分析
https://zhuanlan.zhihu.com/p/81136717
CVE-2019-0708/1181/1182：Windows RDP服務蠕蟲級漏洞修復指南(Version 3.0)
https://cert.360.cn/warning/detail?id=5f83e1c0f6f00f3fe001422e81a7a4da
紅隊Pulse Secure SSLVPN 漏洞指南
https://www.cnblogs.com/backlion/p/11491333.html
Adobe ColdFusion RCE(CVE-2019-7839) 漏洞分析
https://www.freebuf.com/vuls/210386.html
研究人員披露Android 0day 提權漏洞
https://www.solidot.org/story?sid=61995
java開發中使用json框架的注意安全漏洞
https://it.baiked.com/dev/4667.html
Fastjson又被發現漏洞，這次危害可導致服務癱瘓
https://www.javazhiyin.com/42695.html
挖洞經驗| 通過購物車參數篡改實現低價免費購買商品
https://www.freebuf.com/vuls/212089.html
開源軟件的供應鏈安全嗎？黑客正在利用源代碼傳播惡意軟件
https://www.freebuf.com/articles/network/212434.html
用Golang打造一款便攜式網絡拓撲可視化的工具
https://www.freebuf.com/sectool/212374.html
Rdpscan：一款BlueKeep快速掃描工具
https://www.freebuf.com/sectool/213344.html
揭秘地下黑客論壇最流行的惡意軟件和黑客工具
https://www.freebuf.com/articles/system/213765.html
摩訶草團伙利用公用平台分發C&C配置攻擊活動揭露
https://www.freebuf.com/articles/system/212584.html
夢裡參加攻防演習活動的過程分享（上）
https://www.freebuf.com/vuls/212909.html
TWINT：一款Twitter信息爬取工具
https://www.freebuf.com/sectool/212601.html
五大網絡威脅檢測和響應的挑戰
https://www.freebuf.com/articles/network/212533.html
釣魚郵件中的Remcos RAT變種分析
https://www.freebuf.com/articles/network/212400.html
一例信息竊取木馬分析報告
https://www.freebuf.com/articles/network/211875.html
漏洞掃描技巧之Web漏洞掃描器研究
https://www.freebuf.com/articles/web/212015.html
Separ木馬分析報告案例分析
https://www.freebuf.com/articles/network/211691.html
Adobe ColdFusion RCE(CVE-2019-7839) 漏洞分析
https://www.freebuf.com/vuls/210386.html
CVE-2019-15512：Total Defense反病毒軟件權限提升漏洞分析
https://www.4hou.com/vulnerable/20224.html
罕見誤判？！Google Ads 被拒登，惡意連結處理方式
https://www.sakamoto.blog/google-ads-malicious/
Metasploit BlueKeep漏洞利用模塊簡要分析
https://bbs.pediy.com/thread-254375.htm
Google 如何進行 Code Review - 1
https://tachingchen.com/tw/blog/how-to-do-a-code-review-by-google-1/
ModSecurity：一款優秀的開源WAF
https://www.freebuf.com/sectool/211354.html
CTF工控信息安全賽分析思路探討（一）
https://www.freebuf.com/articles/ics-articles/212376.html
挖洞經驗| 谷歌peering.google.com中的本地文件包含（LFI）漏洞
https://www.freebuf.com/vuls/212222.html
移動基帶安全研究系列之一：概念和系統篇
https://www.freebuf.com/articles/terminal/213807.html
HTTP被動掃描代理的那些事
https://www.freebuf.com/articles/web/212382.html
如何開展電力行業的安全檢查評估
https://www.freebuf.com/articles/ics-articles/212503.html
深入分析CVE-2019-1663漏洞
https://www.4hou.com/vulnerable/20240.html
Java反序列化漏洞自動挖掘方法
http://www.vipread.com/library/item/2542
MongoDB未授權訪問漏洞分析及整改建議
https://www.freebuf.com/vuls/212799.html
[資安] 常見後台滲透測試
https://firsemisphere.blogspot.com/2019/09/blog-post_9.html
專家教路 嚴防內鬼偷檔案大法
http://bit.ly/2kz4LFh
直播第一集：Palo Alto Networks 2019 與資安大神同行！
https://www.zerone.com.tw/Content/Video/BBD50F460B9A69F9
直播第三集：Palo Alto Networks 當資安菜鳥遇到資安大神
https://www.zerone.com.tw/Content/Video/610C438DE1EC571D
直播第四集：Palo Alto Networks 啟動AI人工智慧為數位金融保駕護航
https://www.zerone.com.tw/Content/Video/5E60D173C33D6973
直播第五集：Palo Alto Networks【資安攻擊防禦新框架】深入淺出談 MITRE ATT&CK 新資安攻防
https://www.zerone.com.tw/Content/Video/F37BF034287C6085
移動基帶安全研究系列之一：概念和系統篇
https://www.freebuf.com/articles/terminal/213807.html
MindShaRE: Hardware Reversing with the TP-Link TL-WR841N Router
https://www.thezdi.com/blog/2019/9/2/mindshare-hardware-reversing-with-the-tp-link-tl-wr841n-router
fireeye/stringsifter
https://github.com/fireeye/stringsifter
Derbycon 2019 Videos
http://www.irongeek.com/i.php?page=videos/derbycon9/mainlist
r2con2019
https://github.com/radareorg/r2con2019
Sophos open-sources Sandboxie, an utility for sandboxing any application
https://www.zdnet.com/article/sophos-open-sources-sandboxie-an-utility-for-sandboxing-any-application/#ftag=RSSbaffb68
Download the latest version of Sandboxie
https://www.sandboxie.com/DownloadSandboxie
Network Forensic Analysis in an Encrypted World
https://speakerdeck.com/icebrg/network-forensic-analysis-in-an-encrypted-world
Evolution of Malware Sandbox Evasion Tactics – A Retrospective Study
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/
macOS Notarization, Hardware-Backed Code Signing Keys, and Sparkle Code Signing Issues
https://duo.com/labs/tech-notes/macos-notarization-hardware-backed-code-signing-keys-and-sparkle-code-signing-issues
Using TensorFlow / machine learning for automated RF side-channel attack classification
https://leveldown.de/blog/tensorflow-sidechannel-analysis/
Watchbog and the Importance of Patching
https://feedproxy.google.com/~r/feedburner/Talos/~3/peidHg1L8SY/watchbog-patching.html
Weisfeiler-Lehman Graph Kernel for Binary Function Analysis
https://blog.quarkslab.com/weisfeiler-lehman-graph-kernel-for-binary-function-analysis.html
chromium-v8-exploit
https://github.com/cosdong7/chromium-v8-exploit
A powerful hacker toolkit collected more than 10 categories of open source scanners from Github
https://github.com/We5ter/Scanners-Box
NodeJsScan is a static security code scanner for Node.js applications
https://github.com/ajinabraham/NodeJsScan
Exploitation Framework for Embedded Devices threat9/routersploit
https://github.com/threat9/routersploit
A container analysis and exploitation tool for pentesters and engineers
https://github.com/brompwnie/botb
Scaling Network Scanning
https://github.com/natlas/natlas
BlackArch Linux – Penetration Testing Distribution
https://kalilinuxtutorials.com/blackarch-linux-penetration-testing-distribution/
WebARX — A Defensive Core For Your Website
https://thehackernews.com/2019/09/webarx-web-application-security.html
Ninja Reverse Engineering on Android APK packages
https://github.com/rovellipaolo/NinjaDroid
Ehtools : Penetration Tools That Can Be Explored Easily
https://kalilinuxtutorials.com/ehtools-penetration-tools/
OWASP-Testing-Guide-v5
https://github.com/OWASP/OWASP-Testing-Guide-v5
How to enable DNS-over-HTTPS (DoH) in Google Chrome
https://www.zdnet.com/article/how-to-enable-dns-over-https-doh-in-google-chrome/#ftag=RSSbaffb68
Threat Research SharPersist: Windows Persistence Toolkit in C#
https://www.fireeye.com/blog/threat-research/2019/09/sharpersist-windows-persistence-toolkit.html
Ransomware Protection and Containment Strategies: Practical Guidance for Endpoint Protection, Hardening, and Containment
https://www.fireeye.com/blog/threat-research/2019/09/ransomware-protection-and-containment-strategies.html
Definitive Dossier of Devilish Debug Details – Part One: PDB Paths and Malware
https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html
Threat Research Healthcare: Research Data and PII Continuously Targeted by Multiple Threat Actors
https://www.fireeye.com/blog/threat-research/2019/08/healthcare-research-data-pii-continuously-targeted-by-multiple-threat-actors.html
What is Security Information and Event Management (SIEM) Tool? A Beginner’s Guide
https://thelinuxos.com/what-is-security-information-and-event-management-siem-tool-beginners-guide/
BLUESPAWN - Windows Based Active Defense Tool To Empower Blue Teams
https://www.kitploit.com/2019/09/bluespawn-windows-based-active-defense.html
Evolution of Malware Sandbox Evasion Tactics – A Retrospective Study
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/
When corporate communications look like a phish
https://blog.malwarebytes.com/business-2/2019/09/when-corporate-communications-look-like-a-phish/
Thrip: Ambitious Attacks Against High Level Targets Continue
https://www.symantec.com/blogs/threat-intelligence/thrip-apt-south-east-asia
10 Reasons Cyber Range Simulation Is Vital to Incident Response
https://securityintelligence.com/articles/10-reasons-cyber-range-simulation-is-vital-to-incident-response/
10 Surprisingly Bright Spots on the Darknet
https://securityintelligence.com/articles/10-surprisingly-bright-spots-on-the-darknet/
From BinDiff to Zero-Day: A Proof of Concept Exploiting CVE-2019-1208 in Internet Explorer
http://bit.ly/2lTT8bZ
Areizen/Android-Malware-Sandbox
https://github.com/Areizen/Android-Malware-Sandbox
F.商業
打入超微鏈 資安需求強 金居零壹 前景看俏
https://www.chinatimes.com/newspapers/20190908000292-260210?chdtv
GCP推出Shielded GKE節點測試版
https://www.ithome.com.tw/news/132993
IBM提三大策略 打造智慧資安
https://news.cnyes.com/news/id/4381957
IBM launches z15 mainframe, aims to automate compliance via Data Privacy Passports
https://www.zdnet.com/article/ibm-launches-z15-mainframe-aims-to-automate-compliance-via-data-privacy-passports/#ftag=RSSbaffb68
AWS provides update on Outposts launch, supported services
https://www.zdnet.com/article/aws-provides-update-on-outposts-launch-supported-services/#ftag=RSSbaffb68
Kaspersky launches anti-cheat solution for pro esports tournaments
https://www.zdnet.com/article/kaspersky-launches-anti-cheat-solution-for-pro-e-sports-tournaments/#ftag=RSSbaffb68
G.政府
從基本個資到行為紀錄，新身分證隱私疑慮有增無減
https://www.storm.mg/article/1675190
憂慮數位身分證變成特洛伊木馬？民團請監委調查
https://newtalk.tw/news/view/2019-09-10/296970
《李忠憲專欄》晶片身分證的資安問題
https://taronews.tw/2019/09/10/461431/
強化個資、資安保護 內政部：New eID比紙本身分證更能保護隱私
https://www.ettoday.net/news/20190910/1532559.htm
沒陸客！政院燒15億推電支 挨批「又是選舉考量」
http://bit.ly/2m4jf01
對外網路去年遭駭17萬次 國安局：均即時偵測阻絕
https://news.ltn.com.tw/news/politics/breakingnews/2908784
中國駭客攻擊無所不在 國安局：全部都阻擋成功
https://newtalk.tw/news/view/2019-09-07/296023
學者：新式身分證 恐釀資安危機／關鍵「私人金鑰」發包民間廠商處理 晶片、系統將成駭客攻擊對象
https://news.ltn.com.tw/news/life/paper/1316927
重申新身分證無資安疑慮 內政部：將辦駭客比賽測試
https://news.ltn.com.tw/news/politics/breakingnews/2912310
內政部：數位身分證私密金鑰無法重製
http://bit.ly/2mcl4Ir
國防報告首納假訊息 學者：網安已受重視
https://www.cna.com.tw/news/aipl/201909110275.aspx
內政部：數位身分證程序嚴謹 重資安
https://www.moi.gov.tw/chi/chi_news/news_detail.aspx?type_code=02&sn=16737
鄧家基副市長出席以色列資安高峰論壇
https://money.udn.com/money/story/10860/4042603
鄧家基副市長出席以色列資安高峰論壇 期望智慧城市從資安開始做起
http://bit.ly/2meoGtw
身分證資安疑雲 藍委批追蹤功能如回到戒嚴
https://www.chinatimes.com/realtimenews/20190912002912-260407?chdtv
2020總統選戰起跑 首設應變中心處理突發狀況
https://www.cna.com.tw/news/aipl/201909120081.aspx
H.ICS/SCADA 工控系統
淺談工業物聯網終端面臨的安全威脅
http://article.cechina.cn/19/0911/09/20190911092931.htm
I.教育訓練
[駭客工具 Day6] WAF偵測 - WAFW00F
https://ithelp.ithome.com.tw/articles/10214125
[駭客工具 Day7] webserver fingerprinting - httprint
https://ithelp.ithome.com.tw/articles/10214260
[駭客工具 Day8] 線上 fingerprinting - Netcraft
https://ithelp.ithome.com.tw/articles/10214456
[駭客工具 Day9] 網站分析插件 - Wappalyzer
https://ithelp.ithome.com.tw/articles/10214659
[駭客工具 Day10] web安全測試 - Burp Suite
https://ithelp.ithome.com.tw/articles/10214839
如何申請成為稽核觀察員
https://ithelp.ithome.com.tw/articles/10214074
資安抗性符文
https://ithelp.ithome.com.tw/articles/10214227
那個夜裡的資安-3
https://ithelp.ithome.com.tw/articles/10214344
使用IDAPython尋找二進制漏洞
https://zhuanlan.zhihu.com/p/81444710
只會用 Excel 還不夠！七大主題，教你如何用 Python 優化數據分析效能
https://buzzorange.com/techorange/2019/09/09/python-replace-excel/
109資訊安全碩士班招生說明會
https://web.ee.ntu.edu.tw/news_detail.php?sn=1474
Cyber Canon Book Review: Security Engineering
https://blog.paloaltonetworks.com/2019/09/cyber-canon-book-review-security-engineering/
Tech Interview Handbook
https://github.com/yangshun/tech-interview-handbook
J.物聯網/IOT/人工智慧/車聯網/光聯網/深度學習/機器學習/無人機/人臉辨識
以雲端為基底，加速催生 AIoT 新興服務
https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=13&id=0000568399_49R2ZUJPLU7NYO8ED65UP
AI bringing truth to data journalism
https://www.zdnet.com/article/ai-is-bringing-truth-to-data-journalism/#ftag=RSSbaffb68
IoT Attack Opportunities Seen in the Cybercrime Underground
https://blog.trendmicro.com/trendlabs-security-intelligence/iot-attack-opportunities-seen-in-the-cybercrime-underground/
Are IoT Threats Discussed In The Cybercriminal Underground
https://blog.trendmicro.com/are-iot-threats-discussed-in-the-cybercriminal-underground/
6.近期資安活動及研討會
HITCON HackDoor 駭入辦公室 7/2 ~ 9/28
https://www.accupass.com/event/1906050355291064968019
資安檢核核心技術及進階技術研討會 9月16日至9月18日
http://bit.ly/2TN2UtD
MLDM Monday｜TensorFlow All Around 9/16
https://www.meetup.com/Taiwan-R/events/264154315/
Kotlin/Everywhere GDG Hsinchu - Kotlin on Cloud and Web 9/17
https://www.meetup.com/GDG-Hsinchu/events/263741333/
Cosmos SDK Workshop - 打造自己的新手區塊鏈 9/17
https://www.meetup.com/Taipei-Blockchain/events/264188406/
2019網路治理分享會 台灣、亞太、與全球的焦點議題 9/17
https://www.nii.org.tw/events/igf19/
Cyber Attack Taipei Series 2019 9/17
https://www.eventbrite.com/e/cyber-attack-taipei-series-2019-tickets-68951581035
稽核主管研習班(108年第二期) 9/17 ~ 9/18
https://edu.tii.org.tw/pt_training/mpage/index/info/1072673781
Android Code Club(Taipei) 9/18
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/bsctnqyzmbxb/
SyntaxError 9/18
https://www.meetup.com/pythonhug/events/tnzzgpyzmbxb/
HackingThursday 固定聚會 9/19
https://www.meetup.com/hackingthursday/events/vkhnnqyzmbzb/
Cybersecurity Framework 擴大資安視野 Seminar CYBERSEC 101 研討會 9/20
https://signupcybersec101.ithome.com.tw/
金融資安培訓課程 9/20
https://twap.deloitte.com.tw/DTLCRA/Works/CourseDetail.aspx?CourseID=T1906002
Android Code Club(Taipei) 9/21
https://www.meetup.com/Taiwan-Android-Developer-Study-Group/events/bsctnqyzlbcc/
SyntaxError 9/21
https://www.meetup.com/pythonhug/events/tnzzgpyzlbcc/
資策會開辦「認證系統安全從業人員 SSCP 輔導班」2019/9/21
https://ithome.com.tw/pr/131772
交通大學亥客書院-A011:入侵行為發覺與應變指南 9/21
https://hackercollege.nctu.edu.tw/?p=1082
AIC課程 _ Python 入門 9/21 ~ 9/22
https://www.facebook.com/events/429157554391837/?event_time_id=429157561058503
資訊安全管理系統-進階課程 9/21
https://www.accupass.com/event/1907160908138705889800
Open UP Summit Fukuoka Outreach 9/21
https://www.meetup.com/TaipeiWomeninTech/events/263683783/
Build Your First Custom Blockchain - 親手打造你的第一個客制區塊鏈 9/24
https://www.meetup.com/Polkadot-Taipei/events/264188190/
Android Taipei - 2019 九月聚會 9/24
https://www.facebook.com/events/421900911784891/
TANET 2019 - 臺灣網際網路研討會 9/25
https://www.twcert.org.tw/subpages/securityInfo/securityactivity_details.aspx?id=310
Nextlink Technology 9/25 (三)
https://www.accupass.com/event/1908020858535104977240
DEVCORE Conference 2019 9/25
https://devco.re/conf/2019/
面對 APT進階持續性滲透攻擊，企業如何建立正確防護觀念與有效、低成本的資安防護能力 9/26
https://www.techbang.com/posts/72484-lecturecorporate-apt
Thinking Thursday 第四場 9/26
https://www.meetup.com/Thinking-Thursday/events/263826166/
[CyCarrier]-奧義智慧資安活動_Fintech威脅剖析 金融科技資安升級 9/26
https://www.zerone.com.tw/TrainingDetial/Seminar/2CB2943BF5366C08%7C581222C91497B312
[Akamai]-Akamai線上研討會快速部署與高效預測抵禦的資安防護網 9/27
https://www.zerone.com.tw/TrainingDetial/Seminar/33439C9B5852933A%7C4D840EFFD881209B
交通大學亥客書院-B022:基礎網頁安全與滲透測試 9/28
https://hackercollege.nctu.edu.tw/?p=1084
JavaScript Developer Conference-2019 2019-09-28(六) 09:30 ~ 2019-10-26(六) 17:30 (GMT+8)
https://www.accupass.com/event/1907081509101081922774
2019 NASA黑客松賽前技術分享[Microsoft]_Azure 雲端運算與認知識別服務 10/1
https://www.facebook.com/events/421753888461417/
GDG DevFest Taipei 2019 10/1
https://www.meetup.com/GDGTaipei/events/263142255/
資安檢核核心技術及進階技術研討會 10月7日至10月9日
http://bit.ly/2TN2UtD
HITB+ CYBER WEEK 2019/10/12 ~17
https://d2p.hitb.org/
AI時代下，資安與視覺化的觀點與實例 10/16
https://www.tiai.org.tw/tiaiActDetailClass?sno=19
交通大學亥客書院-A006:數位足跡追蹤與分析 10/19
https://hackercollege.nctu.edu.tw/?p=1088
Splunk .conf 19 10/21 ~ 10/24
https://conf.splunk.com/
AIoT智能物聯網開發人才就業養成班[免費諮詢] 10/22
https://ittraining.kktix.cc/events/aiot-training-2019
Industrial Control Systems (ICS) Cyber Security Conference USA October 21 – 24, 2019
https://www.icscybersecurityconference.com
[Palo Alto Networks]-Palo Alto Networks 直播研討會Part6. MITRE ATT&CK 新資安攻防框架進階產業應用 10/24
https://www.zerone.com.tw/TrainingDetial/Seminar/7747B901A8198AC3%7C1C130FE6FEC34700
Cybersecurity Framework 擴大資安視野 Seminar CYBERSEC 101 研討會 10/25
https://signupcybersec101.ithome.com.tw/
交通大學亥客書院-A015:進階網頁滲透測試 10/26
https://hackercollege.nctu.edu.tw/?p=1090
資安檢核核心技術及進階技術研討會 10月28日至10月30日
http://bit.ly/2TN2UtD
Cybersecurity Framework 擴大資安視野 Seminar CYBERSEC 101 研討會 11/8
https://signupcybersec101.ithome.com.tw/
交通大學亥客書院-P006:高階網頁滲透測試 11/16
https://hackercollege.nctu.edu.tw/?p=1092
Trend Micro CTF 2019 // Raimund Genes Cup FINAL / NOVEMBER 23–24, 2019
https://www.trendmicro.com/en_us/campaigns/capture-the-flag.html
資安檢核核心技術及進階技術研討會11月26日至11月28日
http://bit.ly/2TN2UtD
Cybersecurity Framework 擴大資安視野 Seminar CYBERSEC 101 研討會 11/29
https://signupcybersec101.ithome.com.tw/
交通大學亥客書院-B015:惡意程式檢測 11/30
https://hackercollege.nctu.edu.tw/?p=1098
交通大學亥客書院-A018:企業網域控管－Active Directory攻擊與防禦 12/14
https://hackercollege.nctu.edu.tw/?p=1094
Japan Security Analyst Conference
https://jsac.jpcert.or.jp/
沒有留言:
張貼留言