資安新聞及事件週報 2018/09/24 ~ 2018/09/28
1.重大弱點漏洞
IBM DB2 多個漏洞
https://www-01.ibm.com/support/docview.wss?uid=ibm10731657
Office噩夢公式遠程代碼執行漏洞
https://blog.csdn.net/qq_39850969/article/details/82806675
Trend Micro Deep Discovery Inspector Reflected Cross-site Scripting 反射式跨網站指令
https://github.com/nixwizard/CVE-2018-15365
FragmentSmack DoS 漏洞影響80多款思科產品
https://www.easyaq.com/news/1589039024.shtml
思科：逾80款路由器、交換器產品受Linux DoS漏洞影響
https://www.ithome.com.tw/news/126120
macOS Mojave正式版問世，馬上傳出有隱私漏洞
https://www.ithome.com.tw/news/126062
Red Hat 內核多個漏洞
https://www.auscert.org.au/bulletins/68846
Red Hat JBoss 多個漏洞
https://securitytracker.com/id/1041707
Apache HTTPD 阻斷服務漏洞
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-11763
New CVE-2018-8373 Exploit Spotted in the Wild
https://blog.trendmicro.com/trendlabs-security-intelligence/new-cve-2018-8373-exploit-spotted-in-the-wild/
New CVE-2018-8373 Exploit Spotted in the Wild
https://bit.ly/2xQa0CR
Tenda AC9和AC10操作系統命令注入漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16334
整數溢位漏洞Mutagen Astronomy正潛藏多種Linux版本
https://twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=5025
WiFi新漏洞可致數據洩露影響所有路由器
http://net.zol.com.cn/698/6987439.html
谷歌公開披露尚未修補的微軟Jet 數據庫引擎RCE 漏洞
https://www.oschina.net/news/100211/google-discloses-microsoft-jet-rce
知道還不補！研究人員踢爆WD低階NAS有身分驗證繞過漏洞，但WD知情一年遲遲未修
https://www.ithome.com.tw/news/125993
推測式執行的旁路攻擊漏洞 L1 Terminal Fault
https://bit.ly/2Nwn2jF
留神4GEE WiFi Mini數據機driver資料夾，恐用以接管Windows
https://twcert.org.tw/subpages/securityInfo/loophole_details.aspx?id=5024
Flaw in 4GEE WiFi Modem Could Leave Your Computer Vulnerable
https://bit.ly/2znD9HL
Wi-Fi加密協議漏洞（WPA2）
https://bit.ly/2O8rwfI
WiFi新漏洞可致數據泄露 影響所有路由器
https://hk.saowen.com/a/8ffc9edd78d418a9f14210ac437d7f23714c59d2ef1a64c43777bb6fbb972cd6
Cisco 已發布安全更新以解決 Webex Network Recording Player 遠端執行程式碼弱點
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180919-webex
Cisco IOS XE Software Static Credential漏洞（CVE-2018-0150）
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xesc
Researcher Discloses New Zero-Day Affecting All Versions of Windows
https://thehackernews.com/2018/09/windows-zero-day-vulnerability.html?m=1
ASUS GT-AC5300拒絕服務漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17127
資安業者踢爆微軟JET Database Engine含有遠端程式攻擊的零時差漏洞
https://www.ithome.com.tw/news/126068
趁虛而入! 2001年CodRed 開啟漏洞攻擊元年-盤點歷年漏洞攻擊
https://blog.trendmicro.com.tw/?p=57025
New Linux Kernel Bug Affects Red Hat, CentOS, and Debian Distributions
https://bit.ly/2OUPici
Google Chrome 安全漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6055
IBM Sterling B2B Integrator 漏洞
https://www-01.ibm.com/support/docview.wss?uid=ibm10731379
New CVE-2018-8373 Exploit Spotted
https://blog.trendmicro.com/trendlabs-security-intelligence/new-cve-2018-8373-exploit-spotted/
Vulnerability Spotlight: Epee Levin Packet Deserialization Code Execution Vulnerability
https://blog.talosintelligence.com/2018/09/epee-levin-vuln.html
Holes found in Mojave’s privacy protection
https://blog.malwarebytes.com/security-world/privacy-security-world/2018/09/holes-found-in-mojaves-privacy-protection/
Buggy implementation of CVE-2018-8373 vulnerability used to deliver Quasar RAT
https://blog.malwarebytes.com/threat-analysis/2018/09/buggy-implementation-of-cve-2018-8373-used-to-deliver-quasar-rat/
Simple Authentication and Security Layer (SASL) vulnerabilities
https://blog.malwarebytes.com/cybercrime/2018/09/simple-authentication-and-security-layer-sasl-vulnerabilities/
ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability
https://bit.ly/2NH58uF
TP-Link EAP Controller に安全でないデシリアライゼーションの問題
https://jvn.jp/vu/JVNVU96340370/
Solaris - 'EXTREMEPARR' dtappgather Privilege Escalation (Metasploit)
https://www.exploit-db.com/exploits/45479/
2.銀行/金融/保險/證券/電子支付/行動支付/支付系統/虛擬貨幣/區塊鍊 新聞及資安
門羅幣的錢包軟體暗藏可「燒毀」業者貨幣的重大漏洞
https://www.ithome.com.tw/news/126111
Monero 開發人員已修復“燃燒”加密貨幣的漏洞
http://www.bitcoin86.com/szb/29132.html
區塊鏈革命 打造信任機器
https://money.udn.com/money/story/5648/3385177
RAM漏洞利用引煩惱EOS尋求解決方案
https://bcsec.org/index/detail/tag/2/id/293
漏洞再藏交易所，黑客盯上行情區
http://www.bcpress.com/2018/09/25/66927/
前華爾街分析師：持有但不交易比特幣，會損害其作為電子支付的系統生態
https://bit.ly/2N3r8uu
瑞波支付平台 百家銀行採用
https://money.udn.com/money/story/5599/3387187
以太坊智慧合約 廣受企業歡迎
https://money.udn.com/money/story/5599/3387185
比特幣軟體爆 DoS 漏洞，僅 8 萬美元就能讓整條鏈崩潰
https://www.inside.com.tw/2018/09/20/a-major-bug-in-bitcoin-software-could-have-crashed-the-currency
Bitcoin Core Software Patches a Critical DDoS Attack Vulnerability
https://bit.ly/2QVSupF
開發人員修補可破壞比特幣生態體系的Bitcoin Core漏洞
https://www.ithome.com.tw/news/126006
比特幣發現最新致命漏洞開發人員將其全部細節保密
https://www.tuoniaox.com/56416.html
符合實名交易！全家代收比特幣服務 照常進行
https://www.chinatimes.com/realtimenews/20180922002816-260410
超商買比特幣，10月起也列管
https://bit.ly/2xN4uB8
向政府釋善意 幣託、Maicoin等15家交易所簽下自律準則
https://www.chinatimes.com/realtimenews/20180921003836-260410
比特幣驚現拒絕服務漏洞，Bitcoin Core開發者已發布緊急修復客戶端
https://bit.ly/2I8l5DW
上海資安中心制定區塊鏈安全標準
https://bit.ly/2QRCtBc
黑客正在利用軟件漏洞增發加密貨幣(比特幣、門羅幣)
http://www.jingyubc.com/articles/1872310815676170735
拉攏年輕人用台灣Pay 彰銀行動網銀推高回饋「柴寶幣」
https://n.yam.com/Article/20180921872821
LINE一卡通完全攻略技巧：帳號申請、自動加值、綁定教學
https://mrmad.com.tw/linepay-ipass
行動支付補貼大戰！ LINEPay、街口發紅包搶客
http://e6705003.pixnet.net/blog/post/48553281
趙揚清介紹本土行動支付
https://bit.ly/2OcijTX
電支龍頭戰 LINE一卡通挑戰街口
http://ec.ltn.com.tw/article/breakingnews/2560179
LINE Pay一卡通個資全都露 官方：姓名改採遮罩處理
https://www.nownews.com/news/20180921/2976833/
電子支付雙雄爭霸戰 決勝要素在三大關鍵
https://bit.ly/2MWioq4
金管會︰街口無中資持股
http://ec.ltn.com.tw/article/paper/1234442
行動支付補貼大戰！ LINEPay、街口發紅包搶客
https://news.tvbs.com.tw/life/997716
WeChat Pay中港雙向支付下月開通
http://hd.stheadline.com/news/realtime/hk/1327054/
悠遊卡可買運彩 台彩卻卡關財政部
https://newtalk.tw/news/view/2018-09-24/143534
中鈔信用卡董事長：目前已暫停信用卡業務，開始佈局區塊鏈數位業務
https://bit.ly/2xBZjoh
美國政府支付網站存漏洞 1400萬用戶信息遭泄露
https://bit.ly/2MUfguN
政府支付平台Click2Gov被駭信用卡資料
https://bit.ly/2QQPKtz
2年期以上保單 14天內可撤約…三天審閱期將解套
https://udn.com/news/story/7239/3383787
虛擬銀行推動金融科技革新！市民未來在家開戶
http://hk.on.cc/hk/bkn/cnt/finance/20180923/bkn-20180923181004392-0923_00842_001.html
國銀大清「洗」 OBU關掉5萬戶
http://ec.ltn.com.tw/article/paper/1234670
個人信用免費凍結 防範盜卡賊
https://money.udn.com/money/story/5599/3381794
信用卡要求「照片調大」！ 老爸大頭照變滿版...刷臉不怕盜刷
https://www.ettoday.net/dalemon/post/38613
中國人民銀行舉辦2018國家網路安全宣傳周金融網路安全論壇
https://news.sina.com.tw/article/20180925/28289648.html
2019秋招啟幕金融科技崗搶戲 20家銀行總行招賢納士
https://news.sina.com.tw/article/20180921/28261604.html
電子支付機構業務定型化契約應記載事項修正 控管風險與使用者約定儲值限額
https://bit.ly/2IkgPl3
歐買尬旗下歐付寶定位大轉彎 將協助銀行打造自有品牌電子支付系統
https://news.cnyes.com/news/id/4208786
從支付網路看 美國移動支付的低滲透率
https://iview.sina.com.tw/post/17199740
川普轟伊朗腐敗 「北韓模式」施壓 歐盟擬另設支付系統維持貿易關係
https://bit.ly/2NH9SAA
歐盟稱將建立與伊結算金融機制 規避美制裁
http://www.hkcna.hk/content/2018/0925/710352.shtml
傳外銀不讓立委開戶 顧立雄：不得因身份拒絕
https://money.udn.com/money/story/5641/3386700
歐買尬旗下歐付寶 電子支付定位大轉彎
https://bit.ly/2NJqKqp
Akamai報告：近兩個月全球金融服務業有超過83億次的惡意登入嘗試
https://www.ettoday.net/news/20180926/1267041.htm
外媒：迅雷與新大陸戰略合作探索網絡安全和電子支付領域
https://www.ithome.com/0/385/361.htm
兩男子利用刷卡器漏洞盜竊76萬
http://www.bj148.org/zixun/zxbb/201809/t20180925_1446137.html
ATM小額跨行轉帳提款 金管會擬減免手續費
https://bit.ly/2NFhxzf
中信銀行積極開展2018年國家網路安全周活動
https://iview.sina.com.tw/post/17218702
情侶業務員高峰會上演武打行 遭開除？保險圈議論過重
https://www.ettoday.net/news/20180927/1267598.htm
純網銀24小時服務明年上路 資安是關鍵
https://news.tvbs.com.tw/life/999999
3.資安事件新聞
A.病毒木馬 / 殭屍網路 / 勒索軟體
NSS Labs控告多家防毒業者壟斷
https://www.ithome.com.tw/news/126041
惡意採掘程式今年大增 459%
https://bit.ly/2xssLwX
新惡意軟體即服務Black Rose Lucy現身，中國可能是下一個攻擊目標
https://www.ithome.com.tw/news/126049
經營惡意版VirusTotal服務Scan4You的駭客被判處14年刑期
https://www.ithome.com.tw/news/126046
「警察強迫裝間諜軟體，該怎麼辦？」中國民眾發問求助 全球網友力挺幫他想辦法
https://www.limitlessiq.com/news/post/view/id/6798/
惡意挖礦程式猖獗！降維安全實驗室又有新發現
https://bit.ly/2xGQrh8
新Njrat木馬（Bladabindi）的新功能源碼分析
http://www.freebuf.com/articles/terminal/184930.html
ESET 發現第一個 UEFI rootkit 惡意程式 LoJax，感染後連重灌系統也沒轍
https://bit.ly/2Q9yU8a
QRecorder 通話錄音程式暗藏木馬 盜取金融憑證轉走銀行存款
https://bit.ly/2DCNLXa
自我傳播的Emotet銀行木馬捲土重來
https://news.softpedia.com/news/self-propagating-emotet-banking-trojan-making-a-comeback-522862.shtml
新的Virobot惡意軟體可以用作勒索軟體、鍵盤側錄程式和殭屍網路
https://www.zdnet.com/article/new-virobot-ransomware-will-also-log-keystrokes-add-pc-to-a-spam-botnet/
新型殭屍勒索病毒 Virobot ,透過 Outlook濫發夾毒垃圾信
https://blog.trendmicro.com.tw/?p=57436
虛擬貨幣挖礦病毒針對 Windows 和 Linux 的Kodi多媒體串流使用者
https://blog.trendmicro.com.tw/?p=57367
Urpage 與 Bahamut、Confucius 及 Patchwork 等駭客集團的關聯性
https://blog.trendmicro.com.tw/?p=57158
Operator of VirusTotal Like Malware-Scanning Service Jailed for 14 Years
https://thehackernews.com/2018/09/scan4you-malware-scanner.html?m=1
New Malware Combines Ransomware, Coin Mining and Botnet Features in One
https://bit.ly/2xER2PJ
Mirai Botnet Creators Helping FBI Fight Cybercrime to Stay Out of Jail
https://bit.ly/2DnRMP5
Scotland's Arran Brewery Slammed by Dharma Bip Ransomware
https://www.bankinfosecurity.com/scotlands-arran-brewery-slammed-by-dharma-bip-ransomware-a-11537
HOW RYUK RANSOMWARE TARGETS AV SOLUTIONS, NOT JUST YOUR FILES
https://www.aurigasec.com/blog/how-ryuk-ransomware-targets-av-solutions-not-just-your-files
Viro Botnet Ransomware Breaks Through
https://blog.trendmicro.com/trendlabs-security-intelligence/virobot-ransomware-with-botnet-capability-breaks-through/
VPNFilter III: More Tools for the Swiss Army Knife of Malware
https://blog.talosintelligence.com/2018/09/vpnfilter-part-3.html
VPNFilter Router Malware Adds 7 New Network Exploitation Modules
https://bit.ly/2NL745u
FBI wants to keep “helpful” Mirai botnet authors around
https://nakedsecurity.sophos.com/2018/09/20/fbi-wants-to-keep-helpful-mirai-botnet-authors-around/
Cybersecurity Researchers Spotted First-Ever UEFI Rootkit in the Wild
https://bit.ly/2DBsCNf
LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild
https://www.bleepingcomputer.com/news/security/apt28-uses-lojax-first-uefi-rootkit-seen-in-the-wild/
ESET has discovered the first UEFI rootkit in the wild
https://www.techspot.com/news/76651-eset-has-discovered-first-uefi-rootkit-wild.html
Malware hits fashion giant SHEIN; 6.42 million online shoppers affected
https://nakedsecurity.sophos.com/2018/09/27/malware-hits-fashion-giant-shein-6-42-million-online-shoppers-affected/
B.行動安全 / iPhone / Android / App
Android 手機 9 成都中招！Linux 內核新漏洞曝光簡易「Root 機」
https://bit.ly/2PUwPgk
最新旗艦級《Android 9 Pie》手機無一倖免
https://lihkg.com/thread/831379/page/1
民間版台鐵訂票App出包 研發者送辦
https://udn.com/news/story/11322/3379232
宏達電這款手機 打開錢包要社交密碼
https://tw.finance.appledaily.com/realtime/20180924/1435110/
宏達電區塊鏈手機 2大安全性關鍵技術
https://bit.ly/2PZKqmm
手機這樣充電，1秒泄露你的銀行帳戶！現在看還不晚
http://ek21.com/news/1/85057/
趕緊檢查自己的應用程序！你是否下載過以下這些假冒銀行APP
https://www.huaglad.com/zh-tw/aunews/20180921/333324.html
Fed前副主席費雪警告︰ 中國若掌握5G 威脅更勝貿易戰
http://news.ltn.com.tw/news/focus/paper/1234638
政府新解密法或強迫手機安間諜軟件 通信公司擔心會損害網絡安全
http://www.epochtimes.com/b5/18/9/25/n10739320.htm
企業行動資安面臨多重威脅與挑戰
https://technews.tw/2018/09/26/corporate-action-security-faces-multiple-threats-and-challenges/
新版iOS 11再出安全漏洞, HomeKit輕鬆破解, 網友: 國內沒人用
https://t.cj.sina.com.cn/articles/view/6534032620/185756cec00100c60k
被孩子們發現漏洞！蘋果iOS 12屏幕限制時間可輕鬆繞過
https://www.ithome.com/html/iphone/385474.htm
Android通話錄音程式QRecorder暗藏木馬，專偷金融憑證盜轉銀行存款
https://www.ithome.com.tw/news/126136
iOS 12新漏洞：App顯示大小與實際不符 明顯偏大
https://hk.saowen.com/a/138d54da9d29d63d564459979cf7cde4a620b4f6d98ce88815eef42e9d90a330
香港地區 Google Play 商店應用程式保安風險報告 (2018年 9 月)
https://www.hkcert.org/my_url/zh/blog/18092801
香港地區 Google Play 商店應用程式保安風險報告 (2018年 8 月)
https://www.hkcert.org/my_url/zh/blog/18090301
Police forcing me to install Jingwang spyware app, how to minimize impact
https://security.stackexchange.com/questions/194353/police-forcing-me-to-install-jingwang-spyware-app-how-to-minimize-impact
iTunes is assigning you a ‘trust score’ based on emails and phone calls
https://nakedsecurity.sophos.com/2018/09/24/itunes-is-assigning-you-a-trust-score-based-on-emails-and-phone-calls/
iOS 12 is here: these are the security features you need to know about
https://nakedsecurity.sophos.com/2018/09/19/ios-12-is-here-these-are-the-security-features-you-need-to-know-about/
Years on, third party apps still exposing Grindr users’ locations
https://nakedsecurity.sophos.com/2018/09/19/years-on-third-party-apps-still-exposing-grindr-users-locations/
Mobile Menace Monday: SMS phishing attacks target the job market
https://blog.malwarebytes.com/cybercrime/2018/09/mobile-menace-monday-sms-phishing-attacks-target-the-job-market/
Pangu Hackers have Jailbroken iOS 12 on Apple's New iPhone XS
https://thehackernews.com/2018/09/ios12-iphone-jailbreak-exploit.html
Cryptojacking – coming to a server-laptop-phone near you (and how to stop it)
https://nakedsecurity.sophos.com/2018/09/27/cryptojacking-coming-to-a-server-laptop-phone-near-you-and-how-to-stop-it/
Phone spampocalypse: fighting back in the age of unwanted calls
https://blog.malwarebytes.com/101/2018/09/phone-spampocalypse-fighting-back-in-the-age-of-unwanted-calls/
C.事件 / 駭客 / DDOS / APT / 徵才 / 國際資安事件
防「假新聞」再影響選舉，臉書動員300人的「作戰室」如何運作
https://www.thenewslens.com/article/104651
美參議員私人電郵遭駭客攻擊 批參院不理
https://udn.com/news/story/6813/3380965
檢測開原始碼安全漏洞，Snyk獲2200萬美元B輪融資
https://read01.com/7DL2gJn.html
Mozilla 新服務 Firefox Monitor 正式上線 ， 幫助以 email 排查網路帳號安全
https://www.kocpc.com.tw/archives/219597
網絡安全周圓滿落幕漏洞銀行踐行公眾網絡安全意識普及
http://tech.chinadaily.com.cn/2018-09/27/content_36990587.htm
資安借力學的崛起
https://www.ithome.com.tw/voice/126024
16歲蘋果少年駭客 遭處8個月緩刑
https://news.cnyes.com/news/id/4208971
沃爾瑪：菜農也得用共享加密系統
http://www.epochtimes.com/b5/18/9/26/n10741807.htm
處理資安事件的正確心態
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=71&aid=8670
[資安小錦囊] 如何防範「資安事件」於未然
https://www.informationsecurity.com.tw/article/article_detail.aspx?tv=71&aid=8666
資科辦推跨行業平台 協作抗黑客
https://news.mingpao.com/pns/%E5%89%B5%E7%A7%91%E7%B7%9A/web_tc/article/20180924/special/1537728572391
手機通訊「定位」外籍嫌 千支電眼查行蹤
https://bit.ly/2Nyd4OC
PTT的社交工程攻擊與資安危機
http://talk.ltn.com.tw/article/paper/1234615
香港政府牽頭「網絡安全資訊共享協作平台」啟動 暫有80間機構參與
https://bit.ly/2O9iz66
政府把關 《香港》全面提升資安防護
https://www.trademag.org.tw/content02.asp?id=733656&type=19&url=%2Findex%2Easp%3Fno%3D19
騰訊員工好奇檢查酒店WiFi漏洞 被新加坡安全局逮捕
http://www.hkcd.com/content/2018-09/25/content_1103680.html
臺灣公益漏洞通報平臺助企業推動獎勵計畫
https://www.ithome.com.tw/news/126022
新加坡提供漏洞賞金計劃，並成立東協網路安全中心
https://www.zdnet.com/article/singapore-to-offer-bug-bounty-set-up-asean-cybersecurity-centre/
英國政府通訊總部和英國國防部將用2.5億英鎊組建“聯合網路力量”
http://www.itpro.co.uk/cyber-warfare/31958/gchq-and-mod-to-form-250m-joint-cyber-force
英砸百億僱2千網軍 打擊俄駭客
https://tw.appledaily.com/international/daily/20180922/38132464/
廣東打黑客集團 刑拘160餘人
https://bit.ly/2zoE0HZ
加強防禦 《英國》擴大資安部署
https://www.trademag.org.tw/content02.asp?id=733226&type=19&url=%2Findex%2Easp%3Fno%3D19
當心中共天網籠罩台灣
http://www.peoplenews.tw/news/ad3e1978-332e-4013-95de-4f434d127278
美聯邦人事管理局遭駭 幕後黑手恐是中共
https://www.ydn.com.tw/News/306253
美2200萬份個資被駭 白宮高官：中國是幕後黑手
https://tw.appledaily.com/new/realtime/20180923/1434921/
美政府2200萬份個資被駭... 白宮顧問：中國發動的！
http://news.ltn.com.tw/news/world/breakingnews/2559507
美陸軍開始接收戰術數位媒體工具包
https://www.ydn.com.tw/News/306340
川普首頒「國家網路戰略」 這4國列敵對國
https://bit.ly/2pxDphF
川普政府：俄羅斯、中國、伊朗、北韓為網路四大對手
https://bit.ly/2zAXwBk
川普指控中國干預選舉 凸顯美國另啟戰線
https://www.nownews.com/news/20180928/2987291/
川普新戰略 授權多部門 主動反擊中共網攻
http://www.epochtimes.com/b5/18/9/23/n10735959.htm
對抗俄「中」網攻 美決主動出擊
https://bit.ly/2pANpqt
防堵中、俄網軍攻擊 美國國安顧問：將與台灣等盟友合作反制
https://bit.ly/2O1lzkV
環時：美國編排「中國間諜劇」產生新受害者
https://www.chinatimes.com/realtimenews/20180927001926-260409
歐盟要求網路平台需有迅速移除恐怖主義內容之機制
https://www.nccst.nat.gov.tw/NewsRSSDetail?lang=zh&RSSType=news&seq=16151
記取俄干預美歐大選教訓 拉脫維亞加強網路戒備
https://www.nownews.com/news/20180923/2980443/
美鞏固網絡領先地位 防駭客轉守為攻
http://www.ntdtv.com/xtr/b5/2018/09/22/a1392491.html
美中衝突！美官員首次公開指控 中國駭客入侵
https://news.ftv.com.tw/news/detail/2018923I01M1
大規模反制中國 美最快數週內行動
http://news.ltn.com.tw/news/world/paper/1234685
川普簽網路戰略 主動打擊駭客
http://beta.orientaldaily.com.my/s/260626
美鞏固網路領先地位 防中俄駭客轉守為攻
https://bit.ly/2Dlq4md
國安官員：台灣資安戰略應與美合作
http://news.ltn.com.tw/news/focus/paper/1233988
黑客來襲 中國「網軍」的目標是台灣大選
https://www.secretchina.com/news/b5/2018/09/21/871550.html
中國招聘網站 滲透台灣搶人才
http://news.ltn.com.tw/news/focus/paper/1234254
情蒐美國防科技人才個資 中國線民在美被捕
https://bit.ly/2xQZEmm
把機密資料帶回家又被俄羅斯駭客偷走的NSA前員工被判5.5年徒刑
https://www.ithome.com.tw/news/126114
攜回內部資料致機密外洩 美國安局前雇員遭判刑
https://udn.com/news/story/6809/3387540
2018網絡安全人才發展白皮書重磅發布
http://www.freebuf.com/articles/paper/185402.html
徵才 - S01:駐點資安助理工程師(新北市板橋區)#W12
https://www.104.com.tw/job/?jobno=6di28
徵才 - 資安規劃與專案管理師
https://www.104.com.tw/job/?jobno=6di0n
徵才 - 急徵!資安工程師(駐場地點:台北市)
https://www.104.com.tw/job/?jobno=5u8ui&jobsource=
Advanced DDoS Detection and Defense
https://www.bankinfosecurity.com/interviews/advanced-ddos-detection-defense-i-4124
The Link Between Volatility and Risk
https://www.bankinfosecurity.com/link-between-volatility-risk-a-11548
How to Spot and Stop Newer Email Threats
https://www.bankinfosecurity.com/how-to-spot-stop-newer-email-threats-a-11547
SIEM & Security Analytics: What's On the Horizon
https://www.bankinfosecurity.com/webinars/siem-security-analytics-whats-on-horizon-w-1730
Cybersecurity , DDoS , DDoS Attacks Defending Against Next-Generation DDoS Attacks
https://www.bankinfosecurity.com/defending-against-next-generation-ddos-attacks-a-11539
Cybercrime Markets Sell Access to Hacked Sites, Databases
https://www.bankinfosecurity.com/cybercrime-markets-sell-access-to-hacked-sites-databases-a-11536
Ex-NSA Developer Gets 5.5 Years in Prison for Taking Top Secret Documents Home
https://bit.ly/2DvTuhG
Incident Report Guessing: Chatbots, the BA Hack and Ticketmaster
https://bit.ly/2R0B6Qq
Domain flub leaves 30 million customers high and dry
https://nakedsecurity.sophos.com/2018/09/26/domain-flub-leaves-30-million-customers-high-and-dry/
Woman hijacked CCTV cameras days before Trump inauguration
https://nakedsecurity.sophos.com/2018/09/25/woman-hijacked-cctv-cameras-days-before-trump-inauguration/
Police accidentally tweet bookmarks that reveal surveilled groups
https://nakedsecurity.sophos.com/2018/09/24/police-accidentally-tweet-bookmarks-that-reveal-surveilled-groups/
All VestaCP installations being attacked
https://forum.vestacp.com/viewtopic.php?f=10&t=17641
16-Year-Old Boy Who Hacked Apple's Private Systems Gets No Jail Time
https://thehackernews.com/2018/09/apple-server-hack.html
Russia’s Elite Hackers Have a Clever New Trick That's Very Hard to Fix
https://www.wired.com/story/fancy-bear-hackers-uefi-rootkit/
Russian hackers are taking their cyber warfare to the next level
https://mashable.com/article/russia-fancy-bear-hackers-lojax-rootkit-malware/#vksU99GDtaqX
D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷
查一查你的航空公司哩程！小心別被駭走
https://udn.com/news/story/6809/3381355
FBI警告：釣魚騙局瞄準工資直接存款
https://bit.ly/2Du9SPJ
修補漏洞加強監管 杜絕財務詐騙空間
http://paper.wenweipo.com/2018/09/22/WW1809220002.htm
外洩1.4億筆用戶資料的Equifax被英國判罰50萬英鎊
https://www.ithome.com.tw/news/126040
UK Regulator Fines Equifax £500,000 Over 2017 Data Breach
https://bit.ly/2DxPIEz
英媒揭TripAdvisor三分一評論疑偽造 「5星好評」索價390港元
https://bit.ly/2QSTTgI
買房遭電郵詐騙個案 美國2年內暴增11倍
https://udn.com/news/story/6813/3383485
twitter介面漏洞 恐洩百萬用戶私訊
http://paper.wenweipo.com/2018/09/23/GJ1809230002.htm
SHEIN-時尚購物網站遭駭，650萬用戶資料外洩
https://twcert.org.tw/subpages/securityInfo/hackevent_details.aspx?id=869
刑事局公布 9/17~9/23 詐騙高風險網站
https://blog.trendmicro.com.tw/?p=57462
火眼：《2018上半年電子郵件威脅報告》
https://www.aqniu.com/industry/39170.html
New FireEye Email Threat Report Underlines the Rise in Malware-less Email Attacks
https://www.fireeye.com/company/press-releases/2018/new-fireeye-email-threat-report-underlines-the-rise-in-malware-l.html
Twitter API Flaw Exposed Users Messages to Wrong Developers For Over a Year
https://bit.ly/2OOHmcy
網查病 小心醫療隱私曝光
https://bit.ly/2Iayc7C
立法保護裸奔年代個資安全
https://opinion.chinatimes.com/20180924001622-262102
優步個資外洩案以1.5億美元在美和解
http://www.chinatimes.com/realtimenews/20180927001051-260408
5700萬筆個資被竊 Uber願支付45億和解金
https://news.cts.com.tw/cts/international/201809/201809271938256.html
數位隱私保護主義抬頭 歐盟個資法來勢洶洶 GDPR法案風暴來襲 業者資安法遵嚴陣以待
https://www.netadmin.com.tw/article_content.aspx?sn=1809130005
交出金融帳戶陷阱多 台灣司法人權進步協會：千萬別隨便交給他人
https://bit.ly/2R2uCjZ
防詐利器「地籍異動即時通」 財產移轉立刻收警報
https://news.housefun.com.tw/news/article/204563208236.html
匯出鉅款才知道上當! BEC 商務電子郵件詐騙一再得逞的六個因素
https://blog.trendmicro.com.tw/?p=57183
Hackers Steal Customers' Credit Cards From Newegg Electronics Retailer
https://bit.ly/2QQFth4
Breach Investigations: The Detective's View
https://www.bankinfosecurity.com/breach-investigations-detectives-view-a-11550
Winning the Battle Against New Account Fraud
https://www.bankinfosecurity.com/winning-battle-against-new-account-fraud-a-11546
Why Was Equifax So Stupid About Passwords
https://www.bankinfosecurity.com/blogs/was-equifax-so-stupid-about-passwords-p-2666
Using Machine Data Analysis to Detect Fraud
https://www.bankinfosecurity.com/using-machine-data-analysis-to-detect-fraud-a-11538
When Will GDPR Show Its Teeth
https://www.bankinfosecurity.com/interviews/when-will-gdpr-show-its-teeth-i-4122
SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users
https://bit.ly/2xDy6BC
Warning issued as Netflix subscribers hit by phishing attack
https://nakedsecurity.sophos.com/2018/09/21/warning-issued-as-netflix-subscribers-hit-by-phishing-attack/
Bankrupt NCIX customer data resold on Craigslist
https://nakedsecurity.sophos.com/2018/09/24/bankrupt-ncix-customer-data-resold-on-craigslist/
Here we Mongo again! Millions of records exposed by insecure database
https://nakedsecurity.sophos.com/2018/09/19/here-we-mongo-again-millions-of-records-exposed-by-insecure-database/
6 sure signs someone is phishing you—besides email
https://blog.malwarebytes.com/101/2018/09/6-sure-signs-someone-is-phishing-you-besides-email/
Uber to pay $148m to settle cyber-attack dispute
https://www.malextra.com/tech/uber-pay-148m-settle-cyber-attack-dispute-1165062.html
COI on SingHealth cyber attack: IHiS staff took six days to discover data had been stolen
http://www.singaporelawwatch.sg/Results/coi-on-singhealth-cyber-attack-ihis-staff-took-six-days-to-discover-data-had-been-stolen
E.研究報告
JavaMelody 组件 XXE 漏洞解析
https://paper.seebug.org/705/
Adobe Reader類型混淆導致代碼執行漏洞分析（CVE-2018-12794）
http://www.4hou.com/vulnerable/13735.html
IKEA官網本地文件包含(LFI)漏洞分析
http://www.4hou.com/vulnerable/13759.html
禪道pms-路由及漏洞分析
https://bit.ly/2Oce2zT
2018網絡安全人才發展白皮書
https://book.yunzhan365.com/umta/dwpr/mobile/index.html
ZooPark：Android逆向之靜態分析
http://www.freebuf.com/articles/system/184286.html
多種使用SMB端口遠程連接PC的方法介紹
http://www.freebuf.com/articles/system/183670.html
偽造電子郵件以及製造電子郵件炸彈的攻防探討
http://www.freebuf.com/sectool/184555.html
LAME：通過SSL加密通信進行橫向滲透的新技術
http://www.freebuf.com/articles/system/183666.html
漏洞管理的定義與最佳實踐
https://www.aqniu.com/learn/39198.html
從CVE-2018至1273年學漏洞分析
https://www.secpulse.com/archives/75930.html
Apache Commons Fileupload Dos漏洞分析
https://blog.spoock.com/2018/09/26/cve-2014-0050/
5 Ways to Hack SMB Login Password
http://www.hackingarticles.in/5-ways-to-hack-smb-login-password/
IDA-minsc Wins Second Place in Hex-Rays Plugins Contest
https://blog.talosintelligence.com/2018/09/ida-minsc.html
Three New DDE Obfuscation Methods
https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation
Open Sourcing HASSH A profiling method for SSH Clients and Servers
https://engineering.salesforce.com/open-sourcing-hassh-abed3ae5044c
How Microsoft rewrote its C# compiler in C# and made it open source
https://bit.ly/2xUHsIr
F.商業
中華電信導入細胞廣播技術
https://bit.ly/2DqfQB0
微軟產品發布 AI人工智能•IoT 仍是重點
https://bit.ly/2xW5Vxh
微軟拚永續成長 推出產品更新和資安、AI新服務
https://udn.com/news/story/6811/3385458
微軟持續推動人工智慧與開放數據架構 協助企業轉型、加速科技成長
https://bit.ly/2MZFR9K
Cloudflare推出數位簽章時間校準服務Roughtime
https://www.ithome.com.tw/news/126051
全球10月登場！全新Windows Server 2019四大亮點搶先看
https://www.techbang.com/posts/61413-new-windows-server-20194-highlights-first-glance
COMPUTEX 2019新增資訊安全與影像監控展區
http://www.tca.org.tw/tca_news1.php?n=1246
技嘉與大猩猩科技聯手推出AI智慧影像方案
https://www.techbang.com/posts/61454-gigabyte-and-gorilla-technology-launch-ai-intelligent-imaging-program
Microsoft is killing passwords one announcement at a time
https://nakedsecurity.sophos.com/2018/09/26/microsoft-is-killing-passwords-one-announcement-at-a-time/
中華電發展4重點 5G純網銀入列
http://photo.udn.com/money/story/5612/3387551
G.政府
中秋連假 金管會要求保險公司保戶服務不中斷
https://www.ydn.com.tw/News/305955
資安學院29日開課 首波鎖定金融業
https://money.udn.com/money/story/5641/3384211
國安局官員：「五星寺」不除必成國安隱患
http://news.ltn.com.tw/news/politics/breakingnews/2559857
年投10億培養晶片設計人才 科技部「半導體射月計畫」強化跨領域研發
https://www.storm.mg/article/515235
國安會資安業務竟外包 橘委憂成國安漏洞
https://www.mirrormedia.mg/story/20180927inv004
資策會改造再出發，執行長于孝斌自許 Digital Transformation Enabler
https://technews.tw/2018/09/28/iii-digital-transformation-enabler/
H.工控系統 SCADA / ICS Security
Fuji Electric V-Server VPR內存錯誤引用漏洞
http://monitouch.fujielectric.com/site/support-e/download-index-01.html
Rockwell Automation棧溢出高危漏洞（CVE-2018-14829）
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14829
Schneider Electric Modicon TM218LDAE40DRPHN存在拒絕服務漏洞
http://www.cnvd.org.cn/flaw/show/CNVD-2018-17389
I.教育訓練類
網頁掛馬常見漏洞分析與檢測
http://www.4hou.com/vulnerable/13732.html
Windows 內核系列一: UAF基礎
https://bbs.pediy.com/thread-247019.htm
ZDResearch Advanced Web Hacking Training 2018 – Learn Online
https://bit.ly/2NG3BVC
Web Security: an introduction to HTTP
https://medium.freecodecamp.org/web-security-an-introduction-to-http-5fa07140f9b3
Unsecure RDP Connections are a Widespread Security Failure
https://www.webroot.com/blog/2018/09/25/unsecure-rdp-connections-widespread-security-failure/
J.玄武實驗室每日安全動態推送
每日安全動態推送(09-25)
https://tw.weibo.com/xuanwulab/4288125134299881
每日安全動態推送(09-26)
https://tw.weibo.com/xuanwulab/4288485726687440
每日安全動態推送(09-27)
https://tw.weibo.com/xuanwulab/4288841823706609
每日安全動態推送(09-28)
https://tw.weibo.com/xuanwulab/4289202704744880
K.物聯網/IOT/人工智慧/車聯網/光聯網/深度學習/機器學習/無人機
Future-Proofing for IoT Risks
https://www.bankinfosecurity.com/future-proofing-for-iot-risks-a-11549
《Blackberry》表示自動駕駛科技難以避免遭駭客入侵
https://www.kingautos.net/224914
勤業：挑選知名智慧連網 避免資安風險
https://udn.com/news/story/7240/3388372
互聯網時代 IP CAM變DDOS武器
https://www.chinatimes.com/realtimenews/20180926002723-260410
縱橫物聯網時代！打造數位資訊安全防護策略 勤業眾信：縱向建立資安框架 橫向管理跨域資訊風險
https://times.hinet.net/news/21983260
勤業：挑選知名智慧連網 避免資安風險
http://news.m.pchome.com.tw/living/cna/20180926/index-15379485912064518009.html
互聯網時代 資安漏洞變經濟危機
https://bit.ly/2DvUq5G
物聯網時代來臨 別忽略資安防護
https://money.udn.com/money/story/5612/3389492
物聯網時代增加資安犯罪 須提高警覺
https://news.wearn.com/c24733.html
互聯網時代 資安漏洞變經濟危機
https://www.wantgoo.com/news/content/index?ID=861077
加州議會通過IoT裝置安全法案
https://www.nccst.nat.gov.tw/NewsRSSDetail?lang=zh&RSSType=news&seq=16152
4.近期資安活動及研討會
Call For Paper | HITCON PACIFIC 2018 9/17 ~ 10/14
https://blog.hitcon.org/2018/09/call-for-paper-hitcon-pacific-2018.html
【課程】金融大數據分析技術與演算法實戰，用 Python + 機器學習技術，分析房價、股價、匯率數據及預測趨勢 9/29
https://bit.ly/2PwvT2g
亥客書院 - 數位鑑識概念與實作 9/29
https://hackercollege.nctu.edu.tw/?p=594
ISDA 教育訓練 Burpsuite實戰百分百 9/29
https://reg.isda.org.tw/info.php?no=36
TDOH Conf 2018 9/29
https://tdoh-conf.online/
TWCERT / CC 2018年台灣資安通報應變年會 10/3
https://www.informationsecurity.com.tw/edm/IS_EDM_181003/
亥客書院 -網路流量分析與檢測 10/6
https://hackercollege.nctu.edu.tw/?p=891
物聯網資安培訓專班(國立臺灣大學) 10/7 ~ 10/21
https://w3.iiiedu.org.tw/coursedetail.php?id=ICSA04I&l=40&c=ICSA04I1801
國家高速網路與計算中心教育訓練 - 惡意程式分析 10/9
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3646&from_course_list_url=homepage
Windows Server 高峰會 10/9
https://www.microsoftevents.com/profile/form/index.cfm?PKformID=0x4938443abcd&wt.mc_id=AID738824_EML_5710125
金融資安培訓專班(國立臺灣大學) 10/10 ~ 10/15
https://w3.iiiedu.org.tw/coursedetail.php?id=FCSA04I&l=40&c=FCSA04I1801
中部科學園區管理局 - 跨平台資安防範全面啟動研討會 10/11
http://www.fstopsoft.com/DynamicContent.aspx?id=3DB42D1290F9C34F
金融資安專業培訓(中華電信) 10/13 ~ 11/10
https://w3.iiiedu.org.tw/coursedetail.php?id=FCSA03I&l=30&c=FCSA03I1801
金融資安培訓課程(中華民國資訊軟體協會) 10/13 ~ 11/10
https://w3.iiiedu.org.tw/coursedetail.php?id=FCSA01I&l=35&c=FCSA01I1801
金融資安培訓課程(勤業眾信風險管理諮詢股份有限公司) 10/16 ~ 11/13
https://w3.iiiedu.org.tw/coursedetail.php?id=FCSA05I&l=30&c=FCSA05I1801
AWS Transformation Day Taipei 10/16
https://amzn.to/2NKLQob
XRY Certification 教育訓練 10/17 ~ 10/18
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=39
JCCONF 2018 10/19
https://jcconf.tw/2018/
2018 健康物聯網黑客松 10/19 ~ 10/21
http://hack.tmu.edu.tw/2018.php
物聯網資安培訓課程(崑山科技大學) 10/20 ~ 11/3
https://w3.iiiedu.org.tw/coursedetail.php?id=ICSA05I&l=30&c=ICSA05I1801
物聯網資安專業培訓(中華電信) 10/20 ~ 11/17
https://w3.iiiedu.org.tw/coursedetail.php?id=ICSA02I&l=30&c=ICSA02I1801
Foundations in Digital Forensics with EnCase? (DF120) (原CF1) 10/23 ~ 10/26
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=40
國家高速網路與計算中心教育訓練 - 網路封包分析 10/23
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3650&from_course_list_url=homepage
107年度各級專業人員持續訓練課程 - 資安治理概論與規劃 10/26
https://www.tpipas.org.tw/course_view.aspx?no=118&tid=219
物聯網資安培訓課程(中華民國資訊軟體協會) 10/26 ~ 11/9
https://w3.iiiedu.org.tw/coursedetail.php?id=ICSA01I&l=35&c=ICSA01I1801
金融資安培訓課程(台灣雲端安全聯盟) 10/26 ~ 11/3
https://w3.iiiedu.org.tw/coursedetail.php?id=FCSA02I&l=30&c=FCSA02I1801
亥客書院 -惡意程式檢測實務 10/27
https://hackercollege.nctu.edu.tw/?p=885
ISDA 白帽駭客巡迴入門〈1〉10/27
https://reg.isda.org.tw/info.php?no=27
TANET 2018-台灣網際網路研討會 暨資訊工程X智慧計算學門成果發表會 10/21 ~ 10/26
https://cis.ncu.edu.tw/SeminarSys/activity/TANET2018/home
Red Hat Forum 2018 TAIPEI 11/2
https://www.redhat.com/en/events/red-hat-forum-taipei-2018?sc_cid=701f2000001OEJMAA4
物聯網資安實務課程(台灣雲端安全聯盟) 11/2 ~ 11/10
https://w3.iiiedu.org.tw/coursedetail.php?id=ICSA03I&l=30&c=ICSA03I1801
ISDA 白帽駭客巡迴入門〈1〉11/03
https://reg.isda.org.tw/info.php?no=28
Building and Investigation with EnCase? (DF210) (原CF2) 11/5 ~ 11/8
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=41
亥客書院 - DDoS原理與實務 11/10
https://hackercollege.nctu.edu.tw/?p=774
Magnet原廠授權認證課程Magnet AXIOM Examinations 11/12 ~ 11/15
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=42
原廠認證Cellebrite Certified Operator (CCO) 11/19 ~ 11/20
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=43
Metasploit與滲透測試實務 11/25 ~ 11/26
https://hackercollege.nctu.edu.tw/?p=641
EnCase EnCE 認證考試 Preparation 課程 12/5 ~ 12/7
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=44
駭客入侵調查暨資安緊急應變實務 12/10 ~ 12/11
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=45
亥客書院 - 進階網頁滲透測試 12/15
https://hackercollege.nctu.edu.tw/?p=323
專業手機暨硬碟資料救援教育訓練課程 12/26 ~ 12/28
http://www.iforensics.com.tw/cgi-bin/registform.cgi?pick=46
亥客書院 - 高階網頁滲透測試 2019/1/5
https://hackercollege.nctu.edu.tw/?p=768
沒有留言:
張貼留言