資安事件新聞週報 2020/4/20 ~ 2020/4/24

資安事件新聞週報 2020/4/20  ~  2020/4/24

1.重大弱點漏洞/後門/Exploit/Zero Day
Google Chrome 記憶體釋放後使用漏洞
https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html

Google Chrome爆重大安全漏洞　20億用家或陷攻擊風險
https://bit.ly/3auiykn

蘋果電郵程式存漏洞 5億用戶陷資料被盜風險
http://www.takungpao.com.hk/international/text/2020/0423/440693.html

蘋果電郵應用程式有漏洞　5億iPhone用戶易受駭客攻擊
https://tw.appledaily.com/international/20200423/WQ2FFRDG6FUIRR4WV424H4E5XM/

郵件程式爆漏洞！空白郵件別亂點…五億用戶成駭客眼中大肥羊
https://cnews.com.tw/137200423a02/

iPhone郵件爆資安漏洞 蘋果研發修補程式
https://money.udn.com/money/story/5602/4515036

iPhone Mail應用程式爆資安漏洞！5億支iPhone易受攻擊
https://www.ettoday.net/news/20200423/1698054.htm

Apple investigating report of a new iOS exploit being used in the wild
https://www.zdnet.com/article/apple-investigating-report-of-a-new-ios-exploit-being-used-in-the-wild/#ftag=RSSbaffb68

iPhone與iPad有安全漏洞 收到空白電郵可能遭駭
https://www.cna.com.tw/news/firstnews/202004230046.aspx

研究：iOS Mail App爆存在8年的零時差漏洞，無需點擊就被駭
https://www.ithome.com.tw/news/137163

Liferay Portal –利用遠程執行代碼漏洞（CERT-EU安全通報2020-022）
https://digitpol.hk/zh-TW/liferay-portal-exploited-remote-code-execution-vulnerabilities-cert-eu-security-advisory-2020-022/

微軟遠端桌面用戶端漏洞可讓駭客執行遠端程式碼，但微軟不願修補
https://www.ithome.com.tw/news/137136

微軟緊急修補Office及小畫家3D的遠端程式攻擊漏洞
https://www.ithome.com.tw/news/137165

TVN/CVE漏洞資訊 - iCatch DVR
http://net.nthu.edu.tw/2009/mailing:announcement:20200420_02

TVN/CVE漏洞資訊 - HGiga C&Cmail
http://net.nthu.edu.tw/2009/mailing:announcement:20200420_01

That critical VMware vuln allowed anyone on your network to create new admin users, no creds needed
https://www.theregister.co.uk/AMP/2020/04/17/vmware_vcenter_critical_vuln_anyone_create_admin_users/

美國國土安全部督促使用者修補Pulse Secure VPN漏洞
https://www.ithome.com.tw/news/137095

CISA Warns Patched Pulse Secure VPNs Could Still Expose Organizations to Hackers
https://thehackernews.com/2020/04/pulse-secure-vpn-vulnerability.html

Intel 發表四月平台資安更新，修復多個嚴重資安漏洞
https://www.twcert.org.tw/tw/cp-104-3553-6a9f7-1.html

April Patch Tuesday: Fixes for Font-Related, Microsoft SharePoint, Windows Components Vulnerabilities
https://newsroom.trendmicro.com/blog/security-intelligence/april-patch-tuesday-fixes-font-related-microsoft-sharepoint-windows-com-0

Windows 10 KB4549951 update is causing BSOD, Bluetooth and WiFi issues, random system crashes
https://mspoweruser.com/windows-10-kb4549951-bsod-bluetooth-bug/

Windows 10 SMBGhost 漏洞 RCE PoC 公佈
https://www.chainnews.com/zh-hant/articles/366966166339.htm

Security researcher discloses four IBM zero-days after company refused to patch
https://www.zdnet.com/article/security-researcher-discloses-four-ibm-zero-days-after-company-refused-to-patch/#ftag=RSSbaffb68

多款NETGEAR產品跨站請求偽造漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18848

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
金融業超前部署！滙豐台灣隔離管理學：每通電話都錄音，提醒「不能做的事」
https://www.wealth.com.tw/home/articles/25361

澳門正研究設立人民幣計價證券交易所
https://bit.ly/3cARS2G

超前部署跑第一　金融業194家啟動異地、居家辦公
https://tw.appledaily.com/property/20200423/RLUY3IJ3WARE7RM6U2I7OCM5PY/

【防疫惹議】新光金居家辦公爭議　專家：應減少人群接觸
https://tw.appledaily.com/property/20200423/MUOFIJHBNHFSWXCMEU6Q6XLLTM/

Sustainability, data key to survival for new players eyeing Singapore's digital bank market
https://www.zdnet.com/article/sustainability-data-key-to-survival-for-new-players-eyeing-singapores-digital-bank-market/#ftag=RSSbaffb68

Hackers are again attacking Portuguese banking organizations via Android Trojan-Banker
https://securityaffairs.co/wordpress/101637/mobile-2/portuguese-banking-android-trojan.html

Attackers are using a Brazilian hacking tool against Spanish banks
https://www.cyberscoop.com/attackers-using-brazilian-hacking-tool-spanish-banks/

Grandoreiro Malware Now Targeting Banks in Spain
https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/

Payment distancing: Apple and Google, we need our cashless society even more in pandemic times
https://www.zdnet.com/article/payment-distancing-apple-and-google-we-need-our-cashless-society-even-more-now/

3.電子支付/電子票證/行動支付/ pay/新聞及資安
傳統實體代幣轉向行動支付，大魯閣改造IT要重塑顧客體驗
https://www.ithome.com.tw/people/137097

傳 Facebook 將聯合 Gojek 等印尼公司推跨平台行動支付服務
https://technews.tw/2020/04/22/facebook-three-indonesian-firms-in-early-talks-for-mobile-payment-approval/

無接觸商機、電子支付帶領台灣邁入新消費時代
https://health.udn.com/health/story/120952/4511233

北市公有停車場月票 柯文哲指示悠遊付跟上
https://www.cna.com.tw/news/aloc/202004240213.aspx

〈財經週報-電支電票二合一〉電支電票二合一 轉帳紅利共享共用
https://ec.ltn.com.tw/article/paper/1367149

4.虛擬貨幣/區塊鍊相關新聞及資安
財政部解釋令：3000萬元以下 STO 比照實體有價證券，課徵 1‰ 交易稅
https://www.blocktempo.com/sto-transfer-taxes-will-be-including-in-securities-transaction-tax-act/

中國央行數位貨幣 (DCEP) 已在內測階段，它最終會長什麼樣子
https://www.blocktempo.com/china-dcep-testing-phrase-payment-centralbank-commercialbanks/

支付寶證實參與中國「數位人民幣 DCEP 」開發，傳 5 月最先在蘇州落地
https://www.blocktempo.com/china-dcep-will-pilot-in-suzhou/

央行數字貨幣落地 蘇州用以發放交通補貼
https://www.ntdtv.com/b5/2020/04/18/a102826185.html

dForce楊民道發布「東山再起」宣言，駭客正試圖與他們聯繫
https://www.blocktempo.com/dforce-lendfme-hacked-investigation-comeback-defi/

區塊鏈金融平臺dForce的加密貨幣資產幾乎被盜領一空
https://www.ithome.com.tw/news/137106

香港證監會批准第一支比特幣基金！Arrano 放眼首年 1 億美元
https://www.blocktempo.com/hong-kong-s-first-approved-crypto-fund/

黑客已歸還Lendf.Me 幾乎所有被盜取資產
https://www.panewslab.com/zh_hk/articledetails/1587448754450049.html

Lendf.me 神轉折！駭客將「7.5億贓款」全數歸還，疑因經驗不足 IP 洩漏身份遭掌握
https://www.blocktempo.com/endf-me-attacker-screws-up-returns-all-the-stolen-funds/

信件真偽檢測　區塊鏈即時防詐
http://www.netadmin.com.tw/netadmin/zh-tw/market/E2FD1711883B493AAD45DFFBA47B0699

Hackers steal $25 million worth of cryptocurrency from Uniswap and Lendf.me
https://www.zdnet.com/article/hackers-steal-25-million-worth-of-cryptocurrency-from-uniswap-and-lendf-me/

This is what happens to cryptocurrency paid out in sextortion campaigns
https://www.zdnet.com/article/this-is-what-happens-to-the-cryptocurrency-paid-out-through-sextortion-campaigns/#ftag=RSSbaffb68

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式
Google：Gmail每天擋下1,800萬封與武漢肺炎有關的惡意郵件
https://www.ithome.com.tw/news/137082

網路駭侵事件與資安提醒
https://announce.pu.edu.tw/p/404-1037-8141-1.php?Lang=zh-tw

Tomcat Server存在Ghostcat漏洞，有中國駭客在臺灣校園網站上傳BiFrost後門程式
https://www.ithome.com.tw/news/137074

TrickBot木馬將獲取交易身份驗證碼的應用推向德國銀行客戶
https://www.freebuf.com/articles/terminal/231903.html

假借武漢肺炎最新資訊名義為誘餌，間諜軟體鎖定兩大行動裝置平臺收集各式資料
https://www.ithome.com.tw/news/137061

美國多家大型航太製造業者遭勒贖攻擊，拒付贖款後機密內容遭曝光
https://www.twcert.org.tw/tw/cp-104-3555-3819e-1.html

大型IT服務業者Cognizant證實遭到Maze勒索軟體攻擊
https://www.ithome.com.tw/news/137112

快遞到貨通知,要求確認收據地址,打開ACE檔就中毒
https://blog.trendmicro.com.tw/?p=63942

駭客散布勒索恐嚇郵件詐騙使用者
https://www.twcert.org.tw/tw/cp-104-3568-0207d-1.html

PoetRAT Trojan targets energy sector using coronavirus lures
https://www.zdnet.com/article/poetrat-trojan-targets-energy-sector-using-coronavirus-lures/#ftag=RSSbaffb68

PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors
https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html

Deconstructing an Evasive Formbook Campaign Leveraging COVID-19 Themes
https://www.fortinet.com/blog/threat-research/deconstructing-an-evasive-formbook-campaign-leveraging-covid-19-themes.html

COVID-Themed Lures Target SCADA Sectors With Data Stealing Malware
https://thehackernews.com/2020/04/coronavirus-scada-malware.html

PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors
https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html

Coronavirus-themed attacks April 12 – April 18, 2020
https://securityaffairs.co/wordpress/101868/cyber-crime/coronavirus-themed-attacks-april-12-april-18-2020.html

Over 700 Malicious Typosquatted Libraries Found On RubyGems Repository
https://thehackernews.com/2020/04/rubygem-typosquatting-malware.html

Clipboard hijacking malware found in 725 Ruby libraries
https://www.zdnet.com/article/clipboard-hijacking-malware-found-in-725-ruby-libraries/#ftag=RSSbaffb68

Ransomware Recovery in the 'New Normal'
https://www.bankinfosecurity.com/interviews/ransomware-recovery-in-new-normal-i-4658

Corporate users at most hacking risk from banking malware attacks: Report
https://www.thenewsminute.com/article/corporate-users-most-hacking-risk-banking-malware-attacks-report-122824

KPOT Analysis: Obtaining the Decrypted KPOT EXE
https://isc.sans.edu/diary/KPOT+Analysis%3A+Obtaining+the+Decrypted+KPOT+EXE/26014

Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store
https://isc.sans.edu/diary/rss/26036

Weaponized RTF Document Generator & Mailer in PowerShell
https://isc.sans.edu/diary/Weaponized+RTF+Document+Generator+%26+Mailer+in+PowerShell/26030

Discord users tempted by bots offering “free Nitro games”
https://blog.malwarebytes.com/cybercrime/2020/04/discord-users-tempted-by-bots-offering-free-nitro-games/

New AgentTesla variant steals WiFi credentials
https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/

Emotet JavaScript downloader
https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-javascript-downloader/

OSINT Investigation: Cerberus and the INPS
https://bushidotoken.blogspot.com/2020/04/osint-investigation-cerberus-and-inps.html

Linux Malware: The Truth About This Growing Threat
https://linuxsecurity.com/features/features/linux-malware-the-truth-about-this-growing-threat?showall=1

Understanding the relationship between Emotet, Ryuk and TrickBot
https://blog.intel471.com/2020/04/14/understanding-the-relationship-between-emotet-ryuk-and-trickbot/

2019 IoT Advanced Malware Threat (AMT ) Research Notes
https://docs.google.com/spreadsheets/d/1UMBFtWxfc40TAF4AIXkPZYBD8uBE6xP2HVs9dRHlTF8/edit#gid=0

Cybercriminal group mails malicious USB dongles to targeted companies
https://www.csoonline.com/article/3534693/cybercriminal-group-mails-malicious-usb-dongles-to-targeted-companies.html#tk.rss_all

IT Services Giant Cognizant Hit by Maze Ransomware Cyber Attack
https://gbhackers.com/it-services-giant-cognizant-hit-by-maze-ransomware-cyber-attack/

PSA: If You Get a 'Best Buy Gift Card' on a USB Drive in the Mail, Don't Plug It Into Your PC
https://www.pcmag.com/news/psa-if-you-get-a-best-buy-gift-card-on-a-usb-drive-in-the-mail-dont-plug

Researchers Discover Coronavirus Malicious Applications: What you Should Know
https://medium.com/@janettompson/researchers-discover-coronavirus-malicious-applications-what-you-should-know-a6273ee361f

Trickbot malware is using these unique 'macro-laced' document attachments with a coronavirus theme
https://www.zdnet.com/article/trickbot-malware-is-using-these-unique-macro-laced-document-attachments-with-a-coronavirus-theme/

Mootbot Botnet Targets Fiber Routers with Dual Zero-Days
https://threatpost.com/mootbot-fiber-routers-zero-days/154962/

Multiple fiber routers are being compromised by botnets using 0-day
https://blog.netlab.360.com/multiple-fiber-routers-are-being-compromised-by-botnets-using-0-day-en/

New Coronavirus screenlocker malware is extremely annoying
https://www.bleepingcomputer.com/news/security/new-coronavirus-screenlocker-malware-is-extremely-annoying/#.Xp7pPyK0P1M.twitter

COVID-19 Phishing Emails Mainly Contain TrickBot: Microsoft
https://www.bankinfosecurity.com/covid-19-phishing-emails-mainly-contain-trickbot-microsoft-a-14149

Unkillable xHelper and a Trojan matryoshka
https://securelist.com/unkillable-xhelper-and-a-trojan-matryoshka/96487/#comment-3112205

Hackers have breached 60 ad servers to load their own malicious ads
https://www.zdnet.com/article/hackers-have-breached-60-ad-servers-to-load-their-own-malicious-ads/#ftag=RSSbaffb68

NSA shares list of vulnerabilities commonly exploited to plant web shells
https://www.zdnet.com/article/nsa-shares-list-of-vulnerabilities-commonly-exploited-to-plant-web-shells/#ftag=RSSbaffb68

Guidance for mitigation web shells. #nsacyber
https://github.com/nsacyber/Mitigating-Web-Shells

A look at the ATM/PoS malware landscape from 2017-2019
https://securelist.com/atm-pos-malware-landscape-2017-2019/96750/

Following ESET’s discovery, a Monero mining botnet is disrupted
https://www.welivesecurity.com/2020/04/23/eset-discovery-monero-mining-botnet-disrupted/

B.行動安全 / iPhone / Android /穿戴裝置 /App
【遠端有數，資安要顧】趨勢科技：手機釣魚軟體假冒防疫 App 偷定位、拍照
https://www.inside.com.tw/article/19555-spyware-and-phishing-notice

Zoom強調免費用戶資料不會傳回中國大陸，那台灣呢
https://www.bnext.com.tw/article/57350/zoom-privacy-policy

留著中國血液 ZOOM〈一〉：在牆內資安是黨的事情
https://bit.ly/3eyC7eA

中國基督徒用ZOOM復活節禮拜　公安上門抓人
https://newtalk.tw/news/view/2020-04-19/393981

近期Zoom的資安事件總覽
https://www.ithome.com.tw/news/137058

Zoom強化資安顯成效 新加坡教育部重新開放教師使用
https://newtalk.tw/news/view/2020-04-21/394754

Zoom達成90天資安計劃里程碑 發布Zoom 5.0
https://www.chinatimes.com/realtimenews/20200423001773-260412?chdtv

Zoom adds data center routing, security updates
https://www.zdnet.com/article/zoom-adds-data-center-routing-security-updates/#ftag=RSSbaffb68

Zoom isn’t actually end-to-end encrypted
https://www.theverge.com/2020/3/31/21201234/zoom-end-to-end-encryption-video-chats-meetings

Keep Zoombombing cybercriminals from dropping a load on your meetings
https://blog.malwarebytes.com/how-tos-2/2020/04/keep-zoombombing-cybercriminals-from-dropping-a-load-on-your-meetings/

22校長學習架設Jitsimeet伺服器
https://times.hinet.net/news/22865674

4G災防警告PWS系統介紹：細胞簡訊原理、手機警報訊息教學
https://www.cool3c.com/article/152131

Webhooks URL洩漏可致Slack用戶受釣魚攻擊
https://www.ithome.com.tw/news/137038

抖音驚傳流量傳輸未加密，恐造成中間人攻擊，並藉此傳送假訊息
https://www.ithome.com.tw/news/137083

疫情期間通訊安全－深度解析加密通訊軟體 Signal
https://www.techbang.com/posts/77913-communication-security-depth-resolution-encrypted-communication-software-signal-during-the-outbreak

Webex, Teams, Meet, Jitsi 8款視訊會議軟體需求測試比較表格
https://www.playpcesor.com/2020/04/webex-teams-meet-jitsi-8.html

不怕 GPS 定位洩漏隱私，最好用的疫情追蹤技術就是人人都有的「藍芽」
https://buzzorange.com/techorange/2020/04/23/bluetooth-virus/

WhatsApp Users To Get This Killer New Update: Just Perfect Timing
https://www.forbes.com/sites/zakdoffman/2020/04/19/whatsapp-users-to-get-this-killer-new-update-just-perfect-timing/

France asks Apple to relax iPhone security for coronavirus tracking app development
https://www.zdnet.com/article/france-asks-apple-to-relax-iphone-security-for-coronavirus-tracking-app-development/

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
分流上班、分班在家工作，疫情帶來的資安挑戰， 您準備好了嗎
https://bit.ly/3cJhcnb

任天堂驚傳大量帳號遭駭 官方建議兩步驟驗證保護資料
https://game.udn.com/game/story/10453/4508274?form=udn_ch2_common3_cate

任天堂玩家帳號爆大量外洩！官方建議補救辦法
https://3c.ltn.com.tw/news/40173

Nintendo accounts are getting hacked and used to buy Fortnite currency
https://www.zdnet.com/article/nintendo-accounts-are-getting-hacked-and-used-to-buy-fortnite-currency/#ftag=RSSbaffb68

Switch現安全漏洞？大批玩家投訴帳戶被異常登陸
https://bit.ly/2VrbG2P

美商懸賞300萬破解自家遊戲…卻遭爆料遊戲「不單純」
https://www.setn.com/News.aspx?NewsID=729690

協助研究人員度過疫情難關，Google將發給獎金1,300美元
https://www.ithome.com.tw/news/137138

紐時：Dropbox曾私下找駭客調查Zoom的安全漏洞
https://www.ithome.com.tw/news/137116

伺服器設定錯誤，臉部辨識技術公司 Clearview 不小心公開原始碼
https://technews.tw/2020/04/21/clearview-ais-source-code-and-app-data-exposed-in-cybersecurity-lapse/

反守為攻的不對稱資訊戰
https://talk.ltn.com.tw/article/paper/1367097

趨勢科技：駭客利用「冠狀病毒」進行新一波網路攻擊
https://money.udn.com/money/story/5648/4504607

教授林盈達︰中國部分軟體 有資安危機
https://m.ltn.com.tw/news/life/paper/1366697

人權團體批默許「網路監控」 聯合國暫緩與騰訊合作
https://m.ltn.com.tw/news/world/breakingnews/3137402

俄羅斯封城實施「數位通行證」 一上線就當機惹民怨
https://www.ftvnews.com.tw/news/detail/2020418I10M1

捷克接連遭網攻 布拉格機場與地區醫院都遭鎖定
https://www.ydn.com.tw/News/380423

捷克官方示警恐有網攻 隔天醫院伺服器就受攻擊
https://news.ltn.com.tw/news/world/breakingnews/3137455

駭客趁疫情作亂 捷克2座醫院遭網攻引美關切
https://money.udn.com/money/story/5599/4501137

Google：至少有12個國家級駭客組織利用疫情展開攻擊
https://www.ithome.com.tw/news/137176

Findings on COVID-19 and online security threats
https://www.blog.google/technology/safety-security/threat-analysis-group/findings-covid-19-and-online-security-threats/

對抗中國網戰 國防部射五箭
https://news.ltn.com.tw/news/politics/paper/1367371

中國網軍年後拼復工，以武漢肺炎議題為餌，鎖定臺灣政府和醫療智庫學者發動攻擊
https://www.ithome.com.tw/news/137187

FBI示警 疫苗研發機構遭駭客鎖定
https://news.ltn.com.tw/news/world/paper/1366755

Chinese hackers targeted company behind 'Ragnarok Online' MMORPG
https://www.zdnet.com/article/chinese-hackers-targeted-company-behind-ragnarok-online-mmorpg

WINNTI GROUP: Insights From the Past
https://quointelligence.eu/2020/04/winnti-group-insights-from-the-past/

CrowdStrike: Ongoing Pirate Panda operations using current event themes
https://www.scribd.com/document/451284814/CrowdStrike-Ongoing-Pirate-Panda-operations-using-current-event-themes#download

China-linked ‘Electric Panda’ hackers seek U.S. targets, intel agency warns
https://www.politico.com/amp/news/2020/04/16/china-electric-panda-hackers-seek-us-targets-191220

Gamaredon APT Group Use Covid-19 Lure in Campaigns
https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/

FBI: Hackers Targeting US COVID-19 Research Facilities
https://www.bankinfosecurity.com/fbi-hackers-targeting-us-covid-19-research-facilities-a-14138

FBI says cybercrime reports quadrupled during COVID-19 pandemic
https://www.zdnet.com/article/fbi-says-cybercrime-reports-quadrupled-during-covid-19-pandemic/#ftag=RSSbaffb68

Addressing Shadow IT Issues During COVID-19 Crisis
https://www.bankinfosecurity.com/addressing-shadow-issues-during-covid-19-crisis-a-14137

U.S. Offers Rewards up to $5 Million for Information on North Korean Hackers
https://thehackernews.com/2020/04/north-korea-hackers.html

FBI takes down hacker platform Deer.io
https://nakedsecurity.sophos.com/2020/03/27/fbi-takes-down-russia-based-hacker-platform-deer-io/

Why SaaS opens the door to so many cyber threats (and how to make it safer)
https://thehackernews.com/2020/04/saas-cybersecurity.html

Analysis: Insider Threats Posed by Remote Workforce
https://www.bankinfosecurity.com/interviews/analysis-insider-threats-posed-by-remote-workforce-i-4657

Beware of Coronavirus Dark Web Scams – Starting from Vaccine, Test Kits & Infected Blood For Sale
https://cybersecuritynews.com/coronavirus-dark-web-scams/

Spearphishing attacks hit the oil and gas industry sector
https://securityaffairs.co/wordpress/101967/cyber-crime/spearphishing-energy-oil-gas-industry.html

Cynet Issues Incident Response Challenge 2020 for IR Professionals With $5,000 Prize
https://gbhackers.com/cynet-issues-incident-response/

The Incident Response Challenge
https://incident-response-challenge.com/

美資安公司：越南駭客入侵中國政府系統　尋找武肺資訊
https://tw.appledaily.com/international/20200423/RSUVSVTI3H7KD22PGAMPJVEPCY/

Vietnamese Threat Actors APT32 Targeting Wuhan Government and Chinese Ministry of Emergency Management in Latest Example of COVID-19 Related Espionage
https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html

Security researcher identifies new APT group mentioned in 2017 Shadow Brokers leak
https://www.zdnet.com/article/security-researcher-identifies-new-apt-group-mentioned-in-2017-shadow-brokers-leak/#ftag=RSSbaffb68

Nazar: A Lost Amulet
https://www.epicturla.com/blog/the-lost-nazar

Attackers Target Oil and Gas Industry With AgentTesla
https://www.bankinfosecurity.com/attackers-target-oil-gas-industry-agenttesla-a-14169

Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal
https://labs.bitdefender.com/2020/04/oil-&-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec+-deal/

《CS：GO》原始碼洩漏！Valve發聲明認了
https://newtalk.tw/news/view/2020-04-23/395954

Valve says it's safe to play CS:GO and TF2 after source code leaked online
https://www.zdnet.com/article/valve-says-its-safe-to-play-csgo-and-tf2-after-source-code-leaked-online/#ftag=RSSbaffb68

中央存保公司甄才公告 109年公開甄試正式職員7人
https://ptc.tabf.org.tw/tw/ptc_109cdic/BotDownload.asp

資安管理主管
https://www.104.com.tw/job/6x72f

資安威脅研究員(Cyber Security Analyst)
https://www.104.com.tw/job/5uley?jobsource=company_job

資安工程師 (Security Engineer)
https://www.104.com.tw/job/5zrgs?jobsource=company_job

財金資訊公司109年徵才
https://ptc.tabf.org.tw/tw/ptc_109fisc/BotDownload.asp

財金資訊公司109年系統操作人員甄試
https://ptc.tabf.org.tw/tw/ptc_10902fisc/

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
又有詐騙新花招！NeTflix 遭冒名 免費看成誘餌
https://newtalk.tw/news/view/2020-04-20/394135

< 資安報告>假的「404 Not Found」頁面等四個網路釣魚新手法
https://blog.trendmicro.com.tw/?p=63975

ubereats 被盜刷四千元
https://moptt.tw/p/Gossiping.M.1587198863.A.0F0

駭客正利用「冠狀病毒」進行新一波網路間諜與釣魚活動
https://www.techbang.com/posts/77917-trend-micro-hackers-are-using-the-coronavirus-for-a-new-wave-of-cyberespionage-and-phishing

武肺疫情成釣餌　 駭客與網路間諜騙個資
https://tw.appledaily.com/property/20200418/DVDTYZB5VBU3X7F4CPTR7GLFLM/

用疫情恐慌 詐騙電子郵件大量增加
https://www.ydn.com.tw/News/380365

網路釣魚攻擊進化 最常仿冒蘋果品牌
https://www.cna.com.tw/news/ait/202004230245.aspx

商業電子郵件詐騙 台灣受攻擊次數北亞最多
https://money.udn.com/money/story/5617/4507339

針對電視串流廣告的詐騙攻擊，假冒超過200萬台裝置觀看廣告
https://www.twcert.org.tw/tw/cp-104-3566-cc502-1.html

網路水軍散播假訊息　真相查核防堵資安破口
http://www.netadmin.com.tw/netadmin/zh-tw/technology/7C0872F291FE4DDAB4243117ACDAAB82

【錯誤】重磅消息！中共絕密文件曝光，「透過自願者令香港警察英勇殉職，以吸引媒體的眼球集中在暴徒身上」
https://tfc-taiwan.org.tw/articles/930

超過一億巴基斯坦手機用戶，個資遭駭侵者於暗網出售
https://www.twcert.org.tw/tw/cp-104-3569-2ce3b-1.html

Palo Alto Networks 警告:商業電郵詐騙台灣受攻擊次數北亞最多
https://www.computerdiy.com.tw/20200420_palo-alto-networks/

「臺灣就業通」網頁有漏洞　業者討債竊個資
https://tw.appledaily.com/local/20200421/JGCFOEIY4CTHHBXO6MMSU6VF2E/

隨手一個小動作…路人竟知他老婆生日！背後真相超險惡
https://www.setn.com/News.aspx?NewsID=730405

駭客趁疫情下手？ 世衛等組織傳2.5萬個電郵、密碼外洩
https://3c.ltn.com.tw/news/40183

中國網軍「出奧步」 淡化境內疫情
https://news.cts.com.tw/cts/international/202004/202004221998074.html

FBI：要在臉書上分享自己的高中照片？請三思而後行
https://www.ithome.com.tw/news/137127

PTT使用者反應帳號出現非本人嘗試登入行為，疑似對方利用自動化工具猜密碼
https://www.ithome.com.tw/news/137175

全球衛生機構捲入資安風暴 2.5萬電郵帳密遭外洩
https://newtalk.tw/news/view/2020-04-23/396068

Details of 20 million Aptoide app store users leaked on hacking forum
https://www.zdnet.com/article/details-of-20-million-aptoide-app-store-users-leaked-on-hacking-forum/#ftag=RSSbaffb68

Most consumers admit to sharing passwords with someone outside their home
https://www.zdnet.com/article/most-consumers-admit-to-sharing-passwords-with-someone-outside-their-home/#ftag=RSSbaffb68

Facebook will now warn you if you’ve interacted with fake, dangerous coronavirus posts
https://www.zdnet.com/article/facebook-will-now-warn-you-if-youve-interacted-with-fake-dangerous-coronavirus-posts/#ftag=RSSbaffb68

Demand for Phishing Kits Is Strong: Report
https://www.bankinfosecurity.com/demand-for-phishing-kits-strong-report-a-14140

Hacker leaks 23 million usernames and passwords from Webkinz children's game
https://www.zdnet.com/article/hacker-leaks-23-million-usernames-and-passwords-from-webkinz-childrens-game/#ftag=RSSbaffb68

German government might have lost tens of millions of euros in COVID-19 phishing attack
https://www.zdnet.com/article/german-government-might-have-lost-tens-of-millions-of-euros-in-covid-19-phishing-attack/#ftag=RSSbaffb68

Fraud Guides Top List of Most Frequently Sold Type of Data on Major Dark Web Marketplaces
https://terbiumlabs.com/2020/04/16/fraud-guides-top-list-of-most-frequently-sold-type-of-data-on-major-dark-web-marketplaces/

Coronavirus Dark Web Scams: From infected blood to ventilators
https://www.bleepingcomputer.com/news/security/coronavirus-dark-web-scams-from-infected-blood-to-ventilators/

Economic Stimulus Payments: A Fraud Target
https://www.bankinfosecurity.com/economic-stimulus-payments-fraud-target-a-14145

WHO, Gates Foundation Credentials Dumped Online: Report
https://www.bankinfosecurity.com/who-gates-foundation-credentials-dumped-online-report-a-14167

COVID-19 campaigns highlight the need for phishing protection
https://www.zdnet.com/article/covid-19-campaigns-highlight-the-need-for-phishing-protection/#ftag=RSSbaffb68

Prevent Fraud And Phishing Attacks With DMARC
https://www.forrester.com/report/Prevent+Fraud+And+Phishing+Attacks+With+DMARC/-/E-RES160344#

Cybercriminals Using Zoom, WebEx as Phishing Lures: Report
https://www.bankinfosecurity.com/cybercriminals-using-zoom-webex-as-phishing-lures-report-a-14162

Remote Video Conferencing Themes in Credential Theft and Malware Threats
https://www.proofpoint.com/us/threat-insight/post/remote-video-conferencing-themes-credential-theft-and-malware-threats

Scammers are now taking advantage of US small business relief fund in phishing emails
https://www.zdnet.com/article/scammers-are-now-taking-advantage-of-us-small-business-relief-fund-in-phishing-emails/#ftag=RSSbaffb68

Hackers Steal 25,000 Email Addresses and Passwords From NIH, WHO, Gates Foundation And Others Are Dumped Online
https://cybersecuritynews.com/email-addresses-and-passwords/

E.研究報告
瞭解 MITRE 2020 ATT&CK 端點防衛評估 — 麻瓜版 — Part 1
https://bit.ly/2VQ9aCb

瞭解 MITRE 2020 ATT&CK 端點防衛評估 — 麻瓜版 — Part 2 主偵測類別
https://bit.ly/34ZldBc

行政院技術服務中心109年第1季資通安全技術報告
https://bit.ly/2VzjCiu

SOC日誌可視化工具：SOC Sankey Generator
https://www.freebuf.com/sectool/231106.html

Web Application核心防禦機制記要
https://www.freebuf.com/articles/web/232186.html

域控管理員帳戶架構擴展
https://www.freebuf.com/articles/es/230271.html

TEA：一款基於TAS框架的SSH客戶端蠕蟲
https://www.freebuf.com/articles/network/231963.html

Unicode同形字符域漏洞
https://www.freebuf.com/vuls/229446.html

Github中間人攻擊原理分析
https://www.freebuf.com/articles/web/231802.html

Manul：一款基於覆蓋率引導的並行模糊測試工具
https://www.freebuf.com/articles/terminal/227865.html

網絡層繞過IDSIPS的一些探索
https://www.freebuf.com/articles/system/233678.html

挖洞經驗| 用HTTP請求重寫實現JSON CSRF
https://www.freebuf.com/vuls/230243.html

多款光纖路由器設備在野0天擴展簡報
https://blog.netlab.360.com/multiple-fiber-routers-are-being-compromised-by-botnets-using-0-day/

記錄過某常見WAF最新版
https://www.freebuf.com/articles/web/231905.html

Lazarus APT組織利用新冠疫情誘餌針對某國地區的定向攻擊分析
https://www.freebuf.com/articles/system/233528.html

UEBA實踐：CISO內部威脅管理指南
https://www.freebuf.com/articles/es/234017.html

Dirble：一款高性能目錄掃描與爬取工具
https://www.freebuf.com/articles/network/231596.html

SQL注入萬能Bypass技巧
https://mp.weixin.qq.com/s/RSXc0ACv5DS-GsajdO8IRw

你知道在 Azure 上有幾種 On Demand 啟動 Spark 的方法嗎
https://lab.howie.tw/2020/04/azure-on-demand-spark.html

記一次對PUBG吃雞外掛病毒的反製過程
https://mp.weixin.qq.com/s/u0Ah-bWUnxZBBV1qH3nzcw

從 SQL 到 RCE: 利用 SessionState 反序列化攻擊 ASP.NET 網站應用程式
https://devco.re/blog/2020/04/21/from-sql-to-rce-exploit-aspnet-app-with-sessionstate/

聽說不能用明文存密碼，那到底該怎麼存
https://medium.com/starbugs/how-to-store-password-in-database-sefely-6b20f48def92

乾貨| ATT&CK滲透測試手冊
https://mp.weixin.qq.com/s/bfkSCQonYDd6bpCLzppS_Q

Pentest Notes - Approaching a Target
https://pentestmag.com/pentest-notes-approaching-a-target/

TikTok Vulnerability Enables Hackers to Show Users Fake Videos
https://www.mysk.blog/2020/04/13/tiktok-vulnerability-enables-hackers-to-show-users-fake-videos/

Hacking TikTok to Show Fraudulent Videos on WHO (DNS Attack)
https://www.youtube.com/watch?v=voTnYPfkqlY

Hacking TikTok to Show Fraudulent Videos (DNS Attack)
https://www.youtube.com/watch?v=pHt4jok7v5w

Boost UDP Transaction Performance
https://www.slideshare.net/lfevents/boost-udp-transaction-performance

Exposing Modular Adware: How DealPly, IsErIk, and ManageX Persist in Systems
https://newsroom.trendmicro.com/blog/security-intelligence/exposing-modular-adware-how-dealply-iserik-and-managex-persist-systems

Hackers Exploit Two-factor Authentication to Steal Millions and How to Fix It
https://medium.com/@sub_80999/hackers-exploit-two-factor-authentication-to-steal-millions-and-how-to-fix-it-655145722d45

Getting Started with Reverse Engineering using Ghidra
https://www.peerlyst.com/posts/getting-started-with-reverse-engineering-using-ghidra-chiheb-chebbi

A brute-force password cracker and video auto-downloader for Zoom's "Record to Cloud" functionality.
https://github.com/markbuffalo/zoombo

Manage A Remote SOC: Shift Management Tip
https://blog.paloaltonetworks.com/2020/04/cortex-shift-management/

Rise of the Sensors: Securing LoRaWAN Networks
https://research.nccgroup.com/2020/04/16/rise-of-the-sensors-securing-lorawan-networks/

Methodology for Static Reverse Engineering of Windows Kernel Drivers
https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83

MemLock: Memory Usage Guided Fuzzing
https://wcventure.github.io/MemLock

Red Team Tactics: Utilizing Syscalls in C# - Prerequisite Knowledge
https://jhalon.github.io/utilizing-syscalls-in-csharp-1/

Replay USB messages from Wireshark (.cap) files
https://github.com/JohnDMcMaster/usbrply

Simple Remote Code Execution Vulnerability Examples for Beginners
https://medium.com/bugbountywriteup/simple-remote-code-execution-vulnerability-examples-for-beginners-985867878311

Fuzzing sockets, part 1: FTP servers
https://securitylab.github.com/research/fuzzing-sockets-FTP

Null Terminated Programming 101 - x64
https://0x00sec.org/t/null-terminated-programming-101-x64/20398

Book Review: Windows Kernel Programming and Creating Drivers of Select Exercises
https://truneski.github.io/post/2020/04/03/book-review-windows-kernel-programming-and-creating-drivers-of-select-exercises/

2019 Advent Calendar, vmware pwnables
https://github.com/nafod/advent-vmpwn//

The Kernel Concurrency Sanitizer (KCSAN)
https://github.com/google/ktsan/wiki/KCSAN#upstream-fixes-of-data-races-found-by-kcsan

wasm_runtimes_fuzzing
https://github.com/pventuzelo/wasm_runtimes_fuzzing

CodeQL U-Boot Challenge (C/C++)
https://lab.github.com/githubtraining/codeql-u-boot-challenge-(cc++)

Windows Server 2008R2-2019 NetMan DLL Hijacking
https://itm4n.github.io/windows-server-netman-dll-hijacking/

【ハニーポット簡易分析】Honeypot簡易分析(2020/4/18)
https://sec-chick.hatenablog.com/entry/2020/04/19/182419

Web Application Attacks – Types, Impact & Mitigation – Part-1
https://gbhackers.com/web-application-attacks-part1/

domain_hunter
https://github.com/bit4woo/domain_hunter

Jamfing for Joy: Attacking macOS in Enterprise
https://labs.f-secure.com/blog/jamfing-for-joy-attacking-macos-in-enterprise/

SLAE Exam Assignment 1 - Creating a Bind TCP shellcode
https://slaeryan.github.io/posts/slae-assignment1-blogpost.html

SLAE Exam Assignment 2 - Creating a Reverse TCP shellcode
https://slaeryan.github.io/posts/slae-assignment2-blogpost.html

SLAE Exam Assignment 3 - Creating an Egg-hunter shellcode
https://slaeryan.github.io/posts/slae-assignment3-blogpost.html

SLAE Exam Assignment 4 - Creating a custom shellcode encoder
https://slaeryan.github.io/posts/slae-assignment4-blogpost.html

SLAE Exam Assignment 5 - Analyzing MSFVenom payloads
https://slaeryan.github.io/posts/slae-assignment5-blogpost.html

SLAE Exam Assignment 6 - Creating polymorphic shellcode
https://slaeryan.github.io/posts/slae-assignment6-blogpost.html

SLAE Exam Assignment 7 - Creating a custom shellcode crypter
https://slaeryan.github.io/posts/slae-assignment7-blogpost.html

あやしいサイトの3分調査方法(初心者向け)
https://qiita.com/moneymog/items/2205388ff18b3f89f021

あなたもFakeNetの達人：FakeNet‐NGの裏技をマスターして動的マルウェア解析を改善しませんか
https://www.fireeye.jp/blog/jp-threat-research/2020/04/improving-dynamic-malware-analysis-with-cheat-codes-for-fakenet-ng.html

Introduction to Docker and Kubernets on GCP with Hands-on Configuration (Part 1 — Docker)
https://medium.com/google-cloud/introduction-to-docker-and-kubernets-on-gcp-with-hands-on-configuration-part-1-docker-3d9709ee9f6a

How to Setup Wazuh Open Source SIEM Virtual Machine
https://thelinuxos.com/how-to-setup-wazuh-open-source-siem/

HTBenum : A Linux Enumeration Script For Hack The Box
https://kalilinuxtutorials.com/htbenum/

Now Drag & Drop Files Between Galaxy Phones and Windows 10 PCs
https://techincidents.com/drag-and-drop-galaxy-phones-and-windows-10/

GDA- Android Reverse Engineering Suite
https://hackersonlineclub.com/gda-android-reverse-engineering-suite/

Messy BurpSuite plugin for SQL Truncation vulnerabilities.
https://github.com/InitRoot/BurpSQLTruncSanner

Sherloq- Forensic Image Analysis Suite
https://hackersonlineclub.com/sherloq-forensic-image-analysis-suite/

Open source security auditing tool to search and dump system configuration
https://github.com/trimstray/otseca

Multiple Vulnerabilities in IBM Data Risk Manager
https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md

DNSProbe : Tool That Allows You To Perform Multiple DNS Queries
https://kalilinuxtutorials.com/dnsprobe/

Nazar: A Lost Amulet
https://www.epicturla.com/blog/the-lost-nazar

Researchers Discovered a New Method that Let Hackers to Run Malicious Code Via RDP
https://cybersecuritynews.com/malicious-code-via-rdp/

Sample Results From Processing a Large Feed of Shady Covid-Type Domains
https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/sample-results-processing-large-feed-shady-covid-type-domains

Webcam Hacking for any devices in one link
https://github.com/SharqanAhamed/shasnap

SOC vs MITRE APT29 evaluation – Racing with Cozy Bear
https://www.mcafee.com/blogs/enterprise/security-operations/soc-vs-mitre-apt29-evaluation-racing-with-cozy-bear

RED HAWK- All In One Suite For Information Gathering And Vulnerability Scanning
https://hackersonlineclub.com/red-hawk-all-in-one-suite-for-information-gathering-and-vulnerability-scanning/

Cyber Security - Reducing the Biggest Threat - Emails
https://www.peerlyst.com/posts/cyber-security-reducing-the-biggest-threat-emails-mitch-christian-cissp

goBox : GO Sandbox To Run Untrusted Code
https://kalilinuxtutorials.com/gobox/

A toolkit for developing high-performance HTTP reverse proxy applications.
https://github.com/microsoft/reverse-proxy

Azure Skeleton Key: Exploiting Pass-Through Auth to Steal Credentials
https://blogvaronis2.wpengine.com/azure-skeleton-key/

F.商業
來毅瞄準資安商機 網路帳戶 加上防盜鎖
https://money.udn.com/money/story/8889/4502195

知名資安公司 Wordfence 推出免費的【Fast or Slow】檢測網站效能和速度工具
https://ithelp.ithome.com.tw/articles/10230962?sc=rss.qu

濎通提供加密架構組網　強化物聯網資安
https://www.2cm.com.tw/2cm/zh-tw/news/BD1DA69439B844199CF01BBDEAAD1B8D

佛心！宏碁雲架構 免費供中小企業檢測服務
https://money.udn.com/money/story/5613/4507434

奧義智慧 獲MITRE ATT&CK年度評測告警最高分
https://money.udn.com/money/story/5613/4511202

國際資安大賽，奧義智慧多項告警技冠群雄
https://ec.ltn.com.tw/article/breakingnews/3142543

免額外裝軟體就能登入！Google推BeyondCorp Remote Access免受VPN之苦
https://udn.com/news/story/7088/4510258

甲骨文整合管理軟體提供資料庫自動遷移工具，簡化混合雲管理
https://www.ithome.com.tw/review/137084

Microsoft 365全新更名 加速驅動數位轉型
https://money.udn.com/money/story/5640/4508936

廣告求轉換 內容攬新客！ PIXNET發布2020年社群藍皮書
https://cnews.com.tw/178200422a01/

Delivering the Detections: MITRE ATT&CK Evaluation Demonstrates FireEye Endpoint Security and Mandiant Managed Defense Detection Leadership
https://bit.ly/3eMiik3

G.政府
反毒比賽用抖音遭疑資安漏洞 新北市教育局：已立即停用
https://www.chinatimes.com/realtimenews/20200417003469-260407?chdtv

交通部109年關鍵基礎設施資安資訊分享與分析中心平台擴充維運案
https://bit.ly/2KhwgfE

交通部資安推動計畫專業服務委外案
https://bit.ly/2ROik0T

呂文忠：調查局資安站 維護國家資安生力軍
https://udn.com/news/story/7314/4504715

調查局成立資安站護網域安全 調查官平均年齡僅31歲
https://web01.rti.org.tw/news/view/id/2060535

打擊網路犯罪、假訊息 確維資安
https://bit.ly/2VsYH0G

國防部：積極建立資安應處機制 防杜假訊息危害
https://bit.ly/2KgCZqh

「台北運動吧」粉專遭駭發A片 議員要求檢討資安
https://udn.com/news/story/7323/4505463

圖書館LED燈控制器的IP位址成攻擊跳板，法務部調查局與資安業者合力破獲
https://ithome.com.tw/news/137154

調查局聯手微軟破獲40萬裝置組成的殭屍網路，散毒源頭是一個LED燈控制器
https://www.ithome.com.tw/news/137110

微軟聯手 35 國摧毀 Necurs 殭屍網路，與調查局共享情資攻破非法 IP 位址
https://technews.tw/2020/04/22/microsoft-new-action-to-disrupt-the-largest-online-criminal-network/

國軍強化資安教育 綿密管控機制
https://www.ydn.com.tw/News/380565

由數位身分證New eID談起
https://www.peoplenews.tw/news/bcf95661-d0c4-4615-bd75-908457f20a84

澄清「數位身分證」資安疑慮 內政部：可選是否附憑證功能
https://www.chinatimes.com/realtimenews/20200423005656-260405?chdtv

禁用Zoom之後 教育部全新遠距教學影片上架
https://udn.com/news/story/6885/4510352

工研院虛擬化APP服務平台在疫情檢測獲驗證
https://www.chinatimes.com/realtimenews/20200422003519-260412?chdtv

美國RSA Conference 2020資安研討會 公務出國報告
https://report.nat.gov.tw/ReportFront/ReportDetail/detail?sysId=C10900391

經濟部能源及水資源領域工業控制系統資安防護基準
https://www.rootlaw.com.tw/LawContent.aspx?LawID=A040100021016500-1090420

H.工控系統/SCADA/ICS
Rockwell Automation RSLinx Classic
https://nvd.nist.gov/nvd.cfm?cvename=CVE-2020-10642

I.教育訓練
VMware VCP-NV(2V0–642)網路虛擬化 — 自修考試準備心得與抵免上課教學(Network Virtualization)
https://medium.com/blacksecurity/vmware-network-virtualization-e52b09b526c8

What does it take to become a good reverse engineer
https://securelist.com/become-a-good-reverse-engineer/96743/

How To Analyse And Capture The Packets In Wireshark
https://hackersonlineclub.com/how-to-analyse-and-capture-the-packets-in-wireshark/

J.物聯網/IOT/人工智慧/車聯網/光聯網/深度學習/機器學習/無人機/人臉辨識
物聯網地理資訊整合開發，工業監控系統開發的第一步：取得圖資
https://bit.ly/3axrTrG

聯網車藏安全漏洞　恐致資料外洩及生命危險
https://bit.ly/2wTUEAY

福特、大眾暢銷車曝安全漏洞，黑客可竊取隱私、操控車輛
https://www.freebuf.com/news/233955.html

推物聯網資安標章 德國萊因獲網路攝影機資安檢測實驗室資格
https://n.yam.com/Article/20200422929040

多重破口、攻擊手法進化夾擊　弱點激增防護機制失靈頻傳  物聯網時代掀資安課題　導入新思維避免攻擊威脅
http://www.netadmin.com.tw/netadmin/zh-tw/viewpoint/2BA306A3922C42AB87634330063C5558

Starbleed bug impacts FPGA chips used in data centers, IoT devices, industrial equipment
https://www.zdnet.com/article/starbleed-bug-impacts-fpga-chips-used-in-data-centers-iot-devices-industrial-equipment/

Smart IoT home hubs vulnerable to remote code execution attacks
https://www.zdnet.com/article/smart-iot-home-hubs-vulnerable-to-remote-code-execution-attacks/#ftag=RSSbaffb68

6.近期資安活動及研討會
交通大學駭客書院 - 基礎網頁安全與滲透測試 4/25
https://hackercollege.nctu.edu.tw/?p=1147

2020 LINE Taiwan Developers Recruitment Day  4/25
https://engineering.linecorp.com/zh-hant/blog/2020-line-taiwan-technical-recruitment-day/

金融數據應用 統計+視覺化 4/26
https://tw.pyladies.com/events/event.html?id=179

交通大學駭客書院 -     基礎網站安全建構實務 5/16
https://hackercollege.nctu.edu.tw/?p=1151

資安社 - Forensic(一) 5/20
https://nsysuisc.kktix.cc/events/2020forensic1

交通大學駭客書院 -     電子郵件之偽造攻擊與防護措施 5/23
https://hackercollege.nctu.edu.tw/?p=1156

Taipei 暗号通貨 (Cryptocurrency) Meetup 5/27
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/nrxgwqybchbkc/

交通大學駭客書院 -     進階網頁滲透測試 5/30
https://hackercollege.nctu.edu.tw/?p=1159

109年智能物聯網與資訊安全碩士學分班 5/30 ~ 8/8
https://www.accupass.com/event/2003160837472127685300

邊緣計算系統之大數據與深度學習應用 6/5
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3884&from_course_list_url=course_index

交通大學駭客書院 -     高階網頁滲透測試 6/13 6/20
https://hackercollege.nctu.edu.tw/?p=1161

交通大學駭客書院 -     企業網域控管-Active Directory攻擊與防禦 6/27
https://hackercollege.nctu.edu.tw/?p=1164

CYBERSEC 2020 臺灣資安大會 8/12
https://cyber.ithome.com.tw/