資安事件新聞週報 2021/5/31 ~ 2021/6/4
1.重大弱點漏洞/後門/Exploit/Zero Day
Fortinet fixed a Post-Auth RCE in FortiWeb (CVE-2021-22123)
https://www.fortiguard.com/psirt/FG-IR-20-120
Researchers Warn of Critical Bugs Affecting Realtek Wi-Fi Module
https://thehackernews.com/2021/06/researchers-warn-of-critical-bugs.html
Open Source Vulnerabilities Converging DevOps & SecOps
https://cybersecdn.com/index.php/2021/05/31/open-source-vulnerabilities-converging-devops-secops/
FBI警告APT組織廣泛開採各類已知漏洞，廠商給修補但使用者無作為，等於坐等被入侵
https://www.ithome.com.tw/news/144692
SonicWall產品存在安全性弱點
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0014
Newly Discovered Bugs in VSCode Extensions Could Lead to Supply Chain Attacks
https://thehackernews.com/2021/05/newly-discovered-bugs-in-vscode.html
CSS-WHAT PACKAGE 直到5.0.0 於NODE.JS ATTRIBUTE 未知漏洞
https://vuldb.com/zh/?id.176096
RHEL 7 : kernel-alt (RHSA-2021:1379)
https://www.tenable.com/plugins/nessus/149235
https://thehackernews.com/2021/06/hackers-actively-exploiting-0-day-in.html
2.銀行/金融/保險/證券/支付系統/ 新聞及資安
防疫優先 擬開放交易員居家辦公
https://www.chinatimes.com/newspapers/20210529000126-260202?chdtv
國泰產導入Open ID多元身分驗證，金控業子公司雙向身分認證產險首家
https://reurl.cc/ZG7bRl
新光產又被罰60萬元！資安爆多項瑕疵遭懲處 今年已吞3張罰單「業界最多」
https://www.phew.tw/article/cont/phewpoint/current/topic/11361/2021053111361
疫情期間別跑銀行 線上金融服務免出門免紙本都能搞定
https://www.mirrormedia.mg/story/20210601money004/
政大金融科技研究中心與勤業眾信聯手發表第一份臺灣金融科技趨勢展望報告，提出10項Fintech發展建議
https://www.ithome.com.tw/news/144679
疫情推動數位金融 星展銀：疫後7成轉帳透網銀或行動銀
https://money.udn.com/money/story/5617/5507054
How Cybercriminals are Hacking ATM Machines? Here's a Quick Look
https://www.ehackingnews.com/2021/05/how-cybercriminals-are-hacking-atm.html
Interpol intercepts $83 million fighting financial cyber crime
https://www.bleepingcomputer.com/news/security/interpol-intercepts-83-million-fighting-financial-cyber-crime/#.YLOfObzLhOU.twitter
Hackers steal ₹39.6 lakh from 3 ATMs of bank in Kolkata
https://www.hindustantimes.com/india-news/hackers-steal-rs-39-6-lakh-from-3-atms-of-bank-in-kolkata-101622396502287.html
Boss of ATM Skimming Syndicate Arrested in Mexico
https://krebsonsecurity.com/2021/05/boss-of-atm-skimming-syndicate-arrested-in-mexico/
Breached companies facing higher interest rates and steeper collateral requirements
https://www.zdnet.com/article/breached-companies-facing-higher-interest-rates-and-steeper-collateral-requirements/
The Vulnerabilities of the Past Are the Vulnerabilities of the Future
https://thehackernews.com/2021/06/the-vulnerabilities-of-past-are.html
3.電子支付/行動支付/pay/資安
電子付款 App Venmo 有私隱漏洞 拜登私人好友清單全曝光
https://unwire.hk/2021/05/29/venmo-private-friends-list/fun-tech/
疫情促升電子支付 未來5年成長翻倍
https://www.chinatimes.com/realtimenews/20210603001097-260410?chdtv
怕拿現金傳病毒 中市推電子支付倍增創「零接觸商機」
https://udn.com/news/story/7325/5503863
疫情加速電子支付發展 資誠調查：亞洲無現金交易總額5年內增109%
https://tw.appledaily.com/property/20210531/JG3N4J755ZFJHDORIESRC2OLKI/
中國央行：一季度移動支付業務量保持增長態勢 銀行共處理電子支付業務710萬億元
https://big5.sputniknews.cn/economics/202106031033820306/
倚天資訊、酷碁科技正式合併，首發行動支付⼿環展開募資
https://technews.tw/2021/06/01/acer-gadget-beads/
防疫零接觸！Acer Gadget行動支付手環募資登場
https://udn.com/news/story/7266/5497716
信用卡綁定行動支付 有額外驚喜
https://money.udn.com/money/story/12040/5493092
Coinbase宣布 卡片可綁定Apple Pay與Google Pay
https://news.cnyes.com/news/id/4654531
新冠疫情推波助瀾 數位貨幣、行動支付激增
https://www.chinatimes.com/newspapers/20210530000117-260203?chdtv
隨著退出手機市場，LG Pay 也要下台一鞠躬
https://www.eprice.com.tw/mobile/talk/4531/5649439/1/
台灣大電支服務不變 Wali智慧錢包移轉至行動客服APP
https://udn.com/news/story/7240/5501497
4.加密貨幣/挖礦/區塊鍊/智能合約 資安
虛擬通貨納管洗錢防制7月上路，共有5大類業者須遵循
https://www.ithome.com.tw/news/144682
外匯天眼：經濟學家再轟比特幣/毫無用處，終將破滅
https://reurl.cc/0jO6Dx
比特幣今年4月已短期見頂
http://www.hkcd.com/content/2021-05/28/content_1271218.html
BSC上閃電貸攻擊再現！BurgerSwap 被駭技術分析 — 我竟騙了我自己
https://www.blocktempo.com/burgerswap-hit-by-flash-loan-attack/
BSC官方：8起閃電貸攻擊恐為「同一駭客組織」所為
https://www.blocktempo.com/binance-bsc-over-8-flashloan-hacks-well-organized-hackers-targeting/
加密貨幣市場的成長潛力到底有多大
https://news.knowing.asia/news/e6f4c93b-5d71-415f-b2e5-124786264ca6
持續完善加密貨幣服務！PayPal 將開放「提幣到外部錢包」
https://reurl.cc/XWkql7
印度央行聲明：銀行不得引用「失效的加密貨幣禁令」拒絕客戶交易；BTC聞訊回升13.7%
https://www.blocktempo.com/india-says-banks-cannot-restrict-crypto-transactions/
區塊勢推出狗狗幣文章 NFT，成台灣首家發行「內容 NFT」的媒體
https://buzzorange.com/techorange/2021/06/02/nft-taiwan-blocktrend-oursong/
俄央行總裁：數位貨幣是金融體系的未來
https://reurl.cc/gW8V3R
Mt. Gox 清償方案開放投票！14.1 萬枚比特幣將以「7 千美元」計價賠償
https://technews.tw/2021/06/02/mtgox-settlement-plan-is-open-for-voting/
美國加密貨幣產業參與方，目前所面臨的監管方式為何
https://news.knowing.asia/news/b0a41f94-615d-4a3d-b145-3e3c42725ada
防毒軟體｜諾頓 LifeLock 推「以太坊挖礦」功能， 供客戶用 PC 挖礦賺ETH
https://www.blocktempo.com/antivirus-nortonlifelock-launches-eth-mining-services-for-customers/
英國數位銀行 Starling 臨時禁令：用戶不得「入金」加密貨幣交易所，有金融犯罪疑慮
https://www.blocktempo.com/uk-bank-bans-crypto-exchange-deposits-due-to-suspected-financial-crime/
美國 | 白宮發言人：正擴大「加密貨幣金流」追蹤；SEC 再推遲 WisdomTree 比特幣 ETF 審核
https://www.blocktempo.com/biden-white-house-ransomware-cryptocurrency-sec-delay-btc-etf/
歐洲央行報告 | 肯定「央行數位貨幣」可助升國際地位，欠缺CBDC恐面金融穩定風險
https://www.blocktempo.com/erc-central-bank-digital-currency-report/
競爭Robinhood！中國 “老虎、富途證券” 進軍加密貨幣，計畫往美國、新加坡拓展海外交易
https://www.blocktempo.com/tiger-futu-brokers-launching-offshore-cryptocurrency-trading-service/
DeFi獲投資者追捧，助推加密貨幣市場繁榮的同時引發波動
https://reurl.cc/KAA1lp
NortonLifeLock Unveils Norton Crypto
https://www.businesswire.com/news/home/20210602005361/en/NortonLifeLock-Unveils-Norton-Crypto
Cybercriminals Hold $115,000-Prize Contest to Find New Cryptocurrency Hacks
https://thehackernews.com/2021/06/cybercriminals-hold-115000-prize.html
5.資安事件新聞
A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式/IOC
Avaddon 勒索軟體攻擊防範須知
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9261
上膛的武器落入壞人手中：合法工具變成勒索病毒的超級武器
https://blog.trendmicro.com.tw/?p=68278
惡意軟體勒贖衝擊經濟 為何難擋? 政府真沒轍
https://www.worldjournal.com/wj/story/121469/5505412
富士軟片遭勒索軟體攻擊
https://www.ithome.com.tw/news/144803
美國FBI指控REvil涉嫌網路攻擊巴西肉品商JBS
https://reurl.cc/Nrr6rn
目標式勒索病毒攻擊特徵大解析，混淆技術、無檔案式與修改OS內建程式等手法越來越常見
https://www.ithome.com.tw/news/144813
勒索軟體威脅增 美擬提升調查至類恐攻層級
https://www.cna.com.tw/news/aopl/202106040124.aspx
SolarWinds Hackers Target Think Tanks With New 'NativeZone' Backdoor
https://thehackernews.com/2021/05/solarwinds-hackers-target-think-tanks.html
Malvertising Campaign On Google Distributed Trojanized AnyDesk Installer
https://thehackernews.com/2021/05/malvertising-campaign-on-google.html
Facefish Backdoor Steals Login Credentials & Execute Arbitrary Commands on Linux Systems
https://gbhackers.com/facefish-backdoor/
Suspected Iranian Ransomware Group Targets Israeli Firms
https://www.infosecurity-magazine.com/news/suspected-iranian-ransomware-group/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
Malware Can Use This Trick to Bypass Ransomware Defense in Antivirus Solutions
https://thehackernews.com/2021/06/malware-can-use-this-trick-to-bypass.html
Windows Moriya rootkit used in highly targeted attacks
https://securityaffairs.co/wordpress/117626/malware/moriya-rootkit-operation-tunnelsnake.html
Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware
https://cybersecdn.com/index.php/2021/06/02/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware/
SharpPanda Targets Southeast Asian Government With Previously Unknown Backdoor
https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/
SkinnyBoy Bear’s BackDoor
https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf
B.行動安全 / iPhone / Android /穿戴裝置 /App / 5G / 即時通訊
測血氧App爆紅！印度警方警告「資安問題」：資料可能被盜用
https://www.ftvnews.com.tw/news/detail/2021530W0014
下載APP用手機閃光燈可量血氧？專家曝恐怖結果：遭盜個資
https://www.chinatimes.com/realtimenews/20210530003507-260402?chdtv
手機測血氧 Careplix Vitals 是真假？實測存在4個資安外洩隱憂
https://mrmad.com.tw/careplix-vitals
網傳可用APP測血氧 查核中心：數值只能參考
https://news.ltn.com.tw/news/life/breakingnews/3554377
「測量血氧的App原理與資安」之專家意見
https://smctw.tw/9959/
手機測血氧App「CarePlix Vitals」3大疑點是真是假？官方有話要說
https://udn.com/news/story/11017/5499390
舊版 Android 系統新漏洞 黑客可利用藍牙盜取手機資料
https://today.line.me/hk/v2/article/n2785x
社交距離App沒用？ 負責人籲勿刪：資料將開始大量上傳
https://tw.appledaily.com/life/20210531/A3X6HVSK3BCP5O7IJIEPWZ2RDM/
台灣社交距離App上傳率僅0.5%，網友喊已刪？負責人：現在刪除就失去了自己的寶貴紀錄
https://www.techbang.com/posts/87201-taiwan-social-distance-app
路透：義大利政府將有條件開放華為5G設備
https://news.cnyes.com/news/id/4654036
中國瀏覽器 App 遭爆追蹤用戶！無痕模式擋不了、還知道你住哪
https://3c.ltn.com.tw/news/44631
台灣社交距離App下載數破7百萬人 為什麼民眾使用後沒感覺
https://www.cmmedia.com.tw/home/articles/27859
掃店家QR Code後，注意簡訊是否傳到1922！避免發送到不明號碼
https://www.mygopen.com/2021/06/qr-code1922.html
C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
2021年5月10大資安新聞
https://times.hinet.net/topic/23355934
勒索油管一戰成名 「黑暗面」兜售作案教學
https://udn.com/news/story/6812/5502897?from=udn-catelistnews_ch2
疫情期間網購大增 資安專家籲戒掉2項帳密惡習
https://www.cna.com.tw/news/ahel/202106033001.aspx
FBI 與 Have I Been Pwned 合作，擴大查詢外洩密碼情況的來源資料
https://reurl.cc/no0l6n
數百萬網安職位求才孔急，但有錢也找不到
https://www.worldjournal.com/wj/story/121477/5497161
駭客攻擊如病毒 供應鏈、基建資安防護2大要素
https://www.digitimes.com.tw/iot/article.asp?cat=158&cat1=20&cat2=10&id=0000611590_YEL6P2YI8I4I0112IN4QS
富士通代管平臺被駭，影響眾多日本政府單位
https://www.ithome.com.tw/news/144686
小心駭客！微軟示警：俄國主使的駭客 鎖定政府機構
https://ec.ltn.com.tw/article/breakingnews/3549591
麻州往返鱈魚角、瑪莎葡萄園島渡輪 訂票系統遭駭勒贖
https://www.worldjournal.com/wj/story/121469/5505317
事隔3年 阿蘇薩警局再遭駭客勒索、損失慘重
https://www.worldjournal.com/wj/story/121359/5508318
北韓駭客大軍搶銀行、竊情報 比核武更具威脅
https://vip.udn.com/vip/story/121937/5507285
拜登總統簽署行政命令 以加強美國網路安全
https://www.aili.com.tw/message2_detail/122.htm
俄羅斯駭客組織肆虐多國組織 疑為美俄會談情蒐
https://news.ttv.com.tw/news/11005290025200L
蒐集外交情報 微軟：俄駭客鎖定美政府智庫發動網攻
https://tw.appledaily.com/international/20210530/NGUWPEOQNFEAPIYJHNSAII4BYA/
俄國駭客捲土重來！微軟：全球150多個組織遭殃
https://newtalk.tw/news/view/2021-05-31/581781
再有美企遭黑客勒索 拜登：將研究報復方式
http://www.hkcd.com/content/2021-06/03/content_1272301.html
全球最大肉品加工業者JBS遭俄羅斯駭客攻擊，週三可望恢復運作
https://reurl.cc/qgm7ky
JBS疑似遭到俄羅斯駭客的勒索軟體攻擊，美國政府介入協商
https://www.ithome.com.tw/news/144768
白宮：拜登正檢視勒索軟體威脅 將與蒲亭峰會討論
https://udn.com/news/story/6813/5504971
美國司法部將展開為期120天的網路安全挑戰審查
https://blog.twnic.tw/2021/06/02/18655/
紐約大都會運輸署4月遭入侵，駭客據信與中國政府有關
https://cn.nytimes.com/usa/20210603/mta-cyber-attack/zh-hant/
此地無銀三百兩! 華為稱「已無關係」還替間諜案被告付訴訟費
https://newtalk.tw/news/view/2021-06-01/582501
美攻防兼備 肆應網路灰色地帶威脅
https://reurl.cc/YOWyqX
APT 駭侵團體針對東南亞某國政府發動後門監聽攻擊長達三年
https://twcert.pixnet.net/blog/post/332520492
Hackers Using Fake Foundations to Target Uyghur Minority in China
https://thehackernews.com/2021/05/hackers-using-fake-foundations-to.html
US announces new security directive after critical pipeline hack
https://www.bleepingcomputer.com/news/security/us-announces-new-security-directive-after-critical-pipeline-hack/
A Holistic and Collaborative Approach to DNS Security in the Asia Pacific Region
https://blog.twnic.tw/2021/05/31/18864/
SolarWinds Hackers Targets Individual Accounts Across 150 Organizations Worldwide
https://cybersecuritynews.com/solarwinds-nobelium-hacker-group/
Chinese APT Threat Actors Hacking Pulse Secure VPN Devices Remotely
https://gbhackers.com/chinese-apt-threat-actors-hacking-pulse-secure-vpn-devices-remotely/
NobleBaron New Poisoned Installers Could Be Used In Supply Chain Attacks
https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/
Your Amazon Devices to Automatically Share Your Wi-Fi With Neighbors
https://thehackernews.com/2021/05/your-amazon-devices-to-automatically.html
Report: Danish Secret Service Helped NSA Spy On European Politicians
https://thehackernews.com/2021/06/report-danish-secret-service-helped-nsa.html
JBS USA Cybersecurity Attack
https://www.globenewswire.com/news-release/2021/05/31/2239049/17532/en/Media-Statement-JBS-USA-Cybersecurity-Attack.html
https://nypost.com/2021/06/01/worlds-largest-meat-processor-jbs-foods-hit-by-cyberattack/
https://www.beefcentral.com/news/jbs-global-meat-processing-operations-paralysed-by-cyber-attack/
The Incredible Rise of North Korea’s Hacking Army
https://www.newyorker.com/magazine/2021/04/26/the-incredible-rise-of-north-koreas-hacking-army
Researchers Uncover Hacking Operations Targeting Government Entities in South Korea
https://thehackernews.com/2021/06/researchers-uncover-hacking-operations.html
US Seizes Domains Used by SolarWinds Hackers in Cyber Espionage Attacks
https://thehackernews.com/2021/06/us-seizes-domains-used-by-solarwinds.html
Chinese threat actors hacked NYC MTA using Pulse Secure zero-day
https://www.bleepingcomputer.com/news/security/chinese-threat-actors-hacked-nyc-mta-using-pulse-secure-zero-day/
Experts Uncover Yet Another Chinese Spying Campaign Aimed at Southeast Asia
https://thehackernews.com/2021/06/experts-uncover-yet-another-chinese.html
合庫銀徵才 最高起薪6.4萬元
https://money.udn.com/money/story/5613/5497925
資安防護管理人員(網路安全)
https://www.104.com.tw/job/6wvip?jobsource=jolist_a_relevance
資安管理資深專業人員-數位資安架構
https://www.104.com.tw/job/7ask3
資安管理資深專業人員-數位資安架構
https://www.104.com.tw/job/7ask3?jobsource=googlejobs
資安管理專業人員-數位資安工程
https://www.104.com.tw/job/7ask6
技術整合部：資安工程師 /資訊安全副理
https://www.104.com.tw/job/79h09?jobsource=job_same_B
資安制度管理人員
https://www.1111.com.tw/job/91457613/
資訊安全專案顧問
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=2374573&HIRE_ID=10457055
資安稽核專案經理
https://www.104.com.tw/job/7aq0e
資安工程師
https://www.104.com.tw/jb/104i/job/view?j=75hpb
【資安所】資安工程師
https://www.104.com.tw/job/7asj8
D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
個人帳號被盜要不要緊？原來你的個資在暗網上都有價目表
https://m.eprice.com.tw/tech/talk/1141/5647389/1/
2021暗網個資價目表出爐！這帳號竟比信用卡資料更值錢
https://newtalk.tw/news/view/2021-05-31/581667
詐騙集團擱來啊！假賣家稱：帳戶遭駭客入侵 高雄女誤信險遭詐
https://www.ettoday.net/news/20210530/1994412.htm
佯稱駭客攻擊帳戶 湖內警方阻止女子被騙
https://www.chinatimes.com/realtimenews/20210530001459-260402?chdtv
疫情在家網購 婦遭詐騙集團盯上險失萬元
https://reurl.cc/rg8L5r
ATM轉帳金額輸入解除扣款代碼？ 詐騙新手法警一秒破解
https://udn.com/news/story/7320/5496204?from=udn-ch1_breaknews-1-0-news
她被騙到ATM輸「解除扣款程式碼」16250 警趕來掛斷歹徒電話
https://tw.appledaily.com/local/20210530/55U2P2QWUZDWNBQYVXNF2NEHNQ/
5月報稅季到了！留意2大詐騙手法 小心駭客入侵專家提3招自保
https://reurl.cc/EnzGDg
駭客入侵遠端鍵入代號能關帳？ 湖內警成功攔截詐騙
https://today.line.me/tw/v2/article/7KaD58
美軍核武機密因人員使用線上字卡App外洩
https://www.ithome.com.tw/news/144711
結合串流媒體與電話客服！專家警告：當心新型釣魚詐騙手法
https://newtalk.tw/news/view/2021-05-31/581666
一頁式購物詐騙爆量，以防疫類物資為名行詐財之實尤其猖獗
https://www.kocpc.com.tw/archives/386578
大考中心驚傳資料外洩，2千考生受影響
https://www.ithome.com.tw/news/144769
大考中心報名系統驚傳遭駭 2000筆考生資料遭遭不明人士瀏覽
https://reurl.cc/gW8KKR
新學測試考系統遭駭客入侵 大考中心:不影響指考
https://globalnewstv.com.tw/202106/154625/
教育學程報名系統疑個資外洩 台大：已修復補強
https://www.cna.com.tw/news/ahel/202106030339.aspx
防疫物資詐騙網站爆量！A你錢竊個資
https://reurl.cc/bXzQLM
疫情再起，趨勢科技兩周攔截高達 75 萬次一頁式詐騙網址
https://ccc.technews.tw/2021/05/31/trend-micro-4/
陽明校區疑似個資外洩通知
https://it.nycu.edu.tw/news/6808/
民進黨主任范綱皓、網紅Sabrina涉假訊息案 調查局：資安站偵辦中
https://www.chinatimes.com/realtimenews/20210602003906-260402?chdtv
今年首季錄145宗電郵騙案涉$4.8億 警方演習揭7成公司員工曾開釣魚電郵
https://hk.appledaily.com/local/20210601/W72RZS7NHZHIJH3UQGPSUOG44M/
首季145電郵騙案 駭客扮美國「副總裁」騙上海公司7600萬元
https://reurl.cc/gW8K5V
在家上班連wifi，卻讓客戶資料、公司機密外洩⋯為什麼？怎麼應對
https://www.businessweekly.com.tw/careers/blog/3006692
散布不實確診足跡引恐慌 調查局逮2網友送辦
https://udn.com/news/story/7320/5509694
Microsoft details new sophisticated spear-phishing attacks from NOBELIUM
https://securityaffairs.co/wordpress/118352/apt/spear-phishing-attacks-nobelium.html
Army of fake fans boosts China’s messaging on Twitter
https://apnews.com/article/asia-pacific-china-europe-middle-east-government-and-politics-62b13895aa6665ae4d887dcc8d196dfc
Data of 21 million users from 3 popular free mobile VPNs advertised for sale online
https://cybersecdn.com/index.php/2021/06/01/data-of-21-million-users-from-3-popular-free-mobile-vpns-advertised-for-sale-online/
Data leak makes Peloton’s Horrible, No-Good, Really Bad Day even worse
https://arstechnica.com/gadgets/2021/05/peloton-takes-3-months-to-fix-flaw-that-exposed-users-private-information/
E.研究報告
DarkSide 勒索病毒與美國輸油管攻擊事件(更新)
https://blog.trendmicro.com.tw/?p=68204
利用redis未授權訪問漏洞(windows版)
https://codingnote.cc/zh-tw/p/394403/
Fastjson 1.2.68 反序列化漏洞Commons IO 2.x 寫文件利用鏈挖掘分析
https://www.chainnews.com/articles/005686486820.htm
Google揭露新型態的Rowhammer記憶體漏洞技術：Half-Double可影響更遠的位元
https://www.ithome.com.tw/news/144723
0day安全學習筆記：MS06-040漏洞分析
https://bbs.pediy.com/thread-267893.htm
竊取信用卡卡號之釣魚信件分析報告
https://portal.cert.tanet.edu.tw/docs/pdf/202105310105545460955345255207.pdf
【IoT漏洞分析】FragAttack系列WiFi漏洞分析
https://forum.butian.net/share/154
內容農場給我下去！搜尋引擎的內容守門員：Panda 熊貓演算法
https://pansci.asia/archives/322173
BlackDragon
https://github.com/Cyber-Guy1/BlackDragon
Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat
https://unit42.paloaltonetworks.com/docker-honeypot/
Reverse Shell Generator by Ryan Montgomery
https://hakin9.org/reverse-shell-generator-by-ryan-montgomery/
Detecting CVE-2021-31166 – HTTP vulnerability
https://securityboulevard.com/2021/05/detecting-cve-2021-31166-http-vulnerability/
Vidar Stealer infrastructure
https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed
Supercharge Your Response to Security Incidents With AWS and FireEye Helix
https://www.fireeye.com/blog/products-and-services/2021/05/supercharge-response-to-incidents-with-aws-and-helix.html
Chinese Cyber Espionage Hackers Continue to Target Pulse Secure VPN Devices
https://thehackernews.com/2021/05/chinese-cyber-espionage-hackers.html
Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices
https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html
LINE_notify_collection
https://github.com/hazel-shen/LINE_notify_collection
Web Cache Poisoning: A Tale of chaining unkeyed inputs
https://infosecwriteups.com/web-cache-poisoning-a-tale-of-chaining-unkeyed-inputs-6e3cb026bd23
AutoPentest-DRL
https://github.com/crond-jaist/AutoPentest-DRL
Red Kube
https://github.com/lightspin-tech/red-kube
Hetty - An HTTP Toolkit For Security Research
https://hakin9.org/hetty-an-http-toolkit-for-security-research/
CheeseTools - Self-developed Tools For Lateral Movement/Code Execution
https://www.kitploit.com/2021/05/cheesetools-self-developed-tools-for.html
A Complete Malware Analysis Tutorials, Cheatsheet & Tools list for Security Professionals
https://gbhackers.com/malware-analysis-cheat-sheet-and-tools-list/
Kaiju - A Binary Analysis Framework Extension For The Ghidra Software Reverse Engineering Suite
https://www.kitploit.com/2021/05/kaiju-binary-analysis-framework.html
Open-source tool Yor automatically tags IaC resources for traceability and auditability
https://cybersecdn.com/index.php/2021/05/30/open-source-tool-yor-automatically-tags-iac-resources-for-traceability-and-auditability/
yor
https://github.com/bridgecrewio/yor/releases
Akamai Security Research: Financial Services Continues Getting Bombarded With Credential Stuffing And Web Application Attacks
https://www.akamai.com/us/en/about/news/press/2021-press/akamai-soti-security-research-phishing-for-finance.jsp
Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents
https://thehackernews.com/2021/05/researchers-demonstrate-2-new-hacks-to.html
Carbanak and FIN7 Attack Techniques
https://cybersecdn.com/index.php/2021/06/01/carbanak-and-fin7-attack-techniques/
Attackers Seek New Strategies to Improve Macros' Effectiveness
https://reurl.cc/Q97G2o
Top 10 Network Packet Analyzer Tools for Sysadmin & Security Analysts 2021
https://cybersecuritynews.com/network-packet-analyzer-tools/
Redline, Taurus and mini-Redline Infostealers delivered through Google PPC Ads
https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers
WebLogic RCE Leads to XMRig
https://thedfirreport.com/2021/06/03/weblogic-rce-leads-to-xmrig/
F.商業
Microchip推出首款用於加強FPGA設計的防護工具
https://reurl.cc/nonaAe
QNAP 推出新世代三頻 Mesh Wi-Fi SD-WAN 智能路由器
https://hk.xfastest.com/118367/qnap-mesh-wifi-sd-wan-qmiroplus-201w/
電信三雄 搶攻企業防疫商機
https://ctee.com.tw/news/tech/468094.html
增金鑰自動輪替與多因素認證，MOVEit強化日常資安防護
https://www.ithome.com.tw/review/144726
防疫期間企業遠距不中斷 數位通推雲端主機及桌面雲短租服務
https://money.udn.com/money/story/5640/5501672
5G 新興威脅讓智慧製造面臨資安難題
https://www.zerone.com.tw/Content/Product/543AFE3EF2724D4A
遠距商機爆發 銓鍇與精誠資訊策略合作 開拓雲端新格局
https://money.udn.com/money/story/5612/5501326
中華電信「hiBox 電子郵件簽章」因應遠距辦公為企業電子郵件 打造更安全的資安防護
https://reurl.cc/mLqERl
普萊德參加全球安全科技展，秀安防監控網路基礎建設設備和管理方案
https://fnc.ebc.net.tw/fncnews/stock/135369
Google助台全力防疫 分享遠距教學、居家工作多元指引
https://www.chinatimes.com/realtimenews/20210602003802-260412?chdtv
中小企業注意！遠傳攜手數聯資安推出「3S 遠距安全辦公方案」讓遠距工作不犧牲資安
https://www.ftvnews.com.tw/news/detail/2021602W0210
亞馬遜便道有資安疑慮 6/8在美啟動
https://reurl.cc/ZGQpMW
亞洲供應鏈重洗牌 是方電訊插旗東南亞推全新智慧交換連結服務
https://money.udn.com/money/story/5635/5503915
G.政府
唐鳳再出手 疫苗預約平台6月上線
https://reurl.cc/O0qR1A
刑事局資安實驗室 獲國際程式行為分析認證
https://www.cna.com.tw/news/asoc/202105310166.aspx
台灣之光！刑事局資安鑑識實驗室 全球第一通過ISO／IEC資安鑑識認證
https://www.ettoday.net/news/20210531/1995386.htm
刑事局資安鑑識實驗室全球首創：將惡意程式分析流程標準化並取得ISO國際認證
https://www.ithome.com.tw/news/144756
智慧移動與資安金融正夯 台盧森堡將辦經濟合作會議
https://www.taiwannews.com.tw/ch/news/4213623
【國防部成立75周年】國防組織完備 建構精銳勁旅
https://reurl.cc/dGVNK6
防疫大作戰 司法院公布「法院遠距視訊開庭操作手冊」
https://www.chinatimes.com/realtimenews/20210601006065-260402?chdtv
COMPUTEX 2021改全線上服務 王美花：8家指標性海外企業今年加碼投資台灣
https://www.taiwannews.com.tw/ch/news/4213984
領先科技部會！工研院非實驗人員全面居家上班
https://udn.com/news/story/7240/5507516
H.工控系統/ICS/SCADA/IOT/物聯網/車聯網/電動車 相關資安
如何抵擋駭客攻擊，提升工控系統主動防禦力? (上篇)
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9255
如何抵擋駭客攻擊，提升工控系統主動防禦力? (下篇)
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9256
自動運転車セキュリティ入門 第１回：自動運転車セキュリティの概要
https://www.mbsd.jp/research/20210531/autonomous-car/
工業物聯網新危機 企業無法停機修補關鍵漏洞暴露被攻擊的成本
https://reurl.cc/dG57a2
入侵5G專網的破口，智慧製造面臨資安難題
https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=9260
聯網更有保護力 使用智慧家電不駭怕
https://reurl.cc/83yENy
德國萊因安全驗證 使用智慧家電不駭怕
https://ctee.com.tw/industrynews/technology/469142.html
所有車都是物聯網的時代來臨！瑞昱：軟體定義汽車，車用乙太網路是關鍵
https://www.bnext.com.tw/article/63146/realtek-computex-2021
「智慧製造不是革命，而是進化！」鴻海旗下富鴻網如何讓5G助攻智慧工廠
https://www.bnext.com.tw/article/63170/computex-2021-fhnet
Tesla 車內監控鏡頭有漏洞！駭客：邊開邊睡系統沒反應
https://auto.ltn.com.tw/news/17837/3
趨勢科技揭車聯網資安趨勢：當汽車成了行駛中的「超級電腦」，該如抵禦駭客攻擊
https://today.line.me/tw/v2/article/9jzxxg
A New Bug in Siemens PLCs Could Let Hackers Run Malicious Code Remotely
https://thehackernews.com/2021/05/a-new-bug-in-siemens-plcs-could-let.html
I.教育訓練
常考滲透測試面試問題
https://zhuanlan.zhihu.com/p/376107902
All about File upload XSS
https://infosecwriteups.com/all-about-file-upload-xss-c72c797aaba3
Cross Site Scripting -XSS
https://hackersonlineclub.com/cross-site-scripting-xss/
Windows 10 quietly got a built-in network sniffer, how to use
https://www.bleepingcomputer.com/news/microsoft/windows-10-quietly-got-a-built-in-network-sniffer-how-to-use/
J.人工智慧/AI/ML/人臉辨識
本週無合適議題。
6.近期資安活動及研討會
Golang Taipei Gathering #57 Webinar 6/1
https://www.meetup.com/golang-taipei-meetup/events/278400349/
從Python到TensorFlow線上讀書會-二部曲(14) -集群 6/1
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/274981394/
Taipei Creative Coders Meetup #9 6/2
https://www.meetup.com/tpecreativecoders/events/278466192/
TensorFlow Everywhere | From 0 to 1 6/10
https://www.meetup.com/TensorFlow-User-Group-Taipei/events/277170902/
2021製造業資安論壇 6/10
https://docs.google.com/forms/d/e/1FAIpQLSeJEpc_ePmJGx2RO6hlSJQnmsFTzBT-2zkzjcnPHbdYS2UAhQ/viewform
行動應用APP安全檢測與實務(可抵內稽) 6/11
https://www.caa.org.tw/coursedetail-3515.html
Maximize the Output, or Optimize the Outcome 6/24
https://www.meetup.com/the-liberators-network-taiwan-user-group-taipei-taiwan/events/276003947/
【白帽駭客工坊】2021資安實務培訓課程 6/25
https://pttcareer.com/tech_job/M.1620115144.A.C05.html
Making websites run faster and environmentally friendly 6/25
https://www.meetup.com/taiwan-code-camp/events/278096767/
國家高速網路與計算中心 教育訓練 【資安進階課程】實體滲透與手法研究 6/29
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3950&from_course_list_url=homepage
Golang Taipei Gathering #58
https://www.meetup.com/golang-taipei-meetup/events/277604159/
Cyber Security Global Summit 21 6/29 ~ 6/30
https://cs.geekle.us/?utm_content=INFO_SEC_TIER2
元智資工夏令營-由programming邁入AI大數據與資安世界 7/15 ~ 7/17
https://cse-yzu.kktix.cc/events/yzcsapcs5
國立臺灣科技大學執行教育部「先進資通安全實務人才培育計畫」，將於110年7月26日至8月1日舉辦「110年新型態資安暑期課程(AIS3 2021)
http://cc.ncku.edu.tw/p/406-1002-220949,r804.php?Lang=zh-tw
學生計算機年會 SITCON 2021 9/4
https://sitcon.org/2021/
Cyber Defense Summit 2021 Oct. 4-7, 2021
https://summit.fireeye.com/
沒有留言:
張貼留言