InfoSec Taiwan 2023

Join us as our experts separate fact from fiction, debunking prevalent misconceptions surrounding information security. From password complexity to antivirus software, small business vulnerabilities, and employee responsibility, we'll challenge these myths and enhance your understanding of cybersecurity in the digital age.

企業在數位轉型階段面臨服務監控技術量能不足的情況下，將導致營運或服務中斷，要如何快速釐清是“設備/網路障礙(Break)”的效能問題或“外部攻擊/入侵(Break in)”安全問題所造成？持續監控避免中斷方能確保營運連續，因此同步監控效能與安全，全面觀測IT/CT/OT網路服務將是營運不中斷的決勝關鍵。

我們將發表NETSCOUT新一代效能管理平台(NETSCOUT nGeniousInsight)與新一代網路偵測回應系統(NETSCOUT NDR)與眾不同的強大功能。

The APNIC community honeynet project was setup as part of APNIC’s engagement work. The data collected is shared with partners. In this presentation, I intend to highlight some of the interesting observations with the audience.

國際資安組織在台灣發揮著重要的角色，透過支持和合作以建立更安全的數位環境，成為掌握資訊安全發展趨勢的關鍵。

In this session I will share my journey of reversing a series of applications and software packages, ranging from big ERP and financial trading systems to small client-side software connecting to state-owned institutions to appliances designed for special purposes, supplied by different vendors in a region classified as high risk for many foreign entities. While it is impractical to thoroughly reverse engineer all details of such a huge codebase written in a variety of languages, I had focused on a dozen of common patterns and to our surprise, quite a number of critical issues were identified for each program. Some of those could be leveraged as backdoors even though there was no evidence of intentional compromise. An interesting finding from my threat modeling indicates that the adversaries can easily leverage certain types of vulnerabilities such as RCE in combination to backdoor the victim’s environment, and I would coin it as “bugdoor”. While I would modify some of the finding details and abstract my experience into more hypothetical scenarios, I would like to highlight the key message that it’s not something novel and real problem can happen any time, even not now.

你是數位世界的先知，還是你仍處在未知領域（ unknow zone ）？你曉得資安威脅情資掌管著你所關心的各種資安資訊，而其扮演著關鍵角色是我們在面對日益複雜的威脅時的指南針和洞察力，它對於資安決策參考依據起了至關重要的決定性。
在這個資訊驅動的時代，了解威脅的本質和形式對於保護個人或組織的數位資產、資料、和資源至關重要。資安威脅情資除了能夠提供關鍵的信息，幫助我們預測和預防攻擊，並及時應變已經發生的威脅事件。
在數位訊息氾濫的情形下，這些情資來自於廣泛的來源，包括專家分析、監控系統、漏洞研究以及合作夥伴間的分享。如何有效率的透過方法篩選出有效益的資安情資將是成為先知的關鍵，而透過這些情資，我們就能夠深入瞭解攻擊者的策略、漏洞的存在以及新興的威脅趨勢，以便我們能夠提前做出反應並做好保護。

ESG 強調企業應在經營中考慮環境影響、社會責任和良好治理，以實現可持續發展。GRC專注於有效的治理結構、風險管理和合規性要求，確保企業合法合規並實現持續經營。
SASE 保護企業網路，確保數據安全，防範威脅，符合ESG的環境和社會要求。這包括保護數據隱私、防止數據洩露和網絡攻擊，以減少企業對環境的負面影響，同時保護權益。
SASE提供風險管理和合規性功能，符合GRC的要求。它建立統一的安全策略和控制機制，監控網路活動並提供報告，有助於企業應對風險並滿足法規要求。透過SASE，企業能夠更好地管理數據安全和合規性，提升治理能力。
SASE 強調數據隱私和透明度，同時符合ESG和GRC。它確保數據在傳輸和處理過程中的安全性和隱私保護，同時提供相應的透明度，讓利害關係人能夠了解企業的網路安全措施和數據處理方式。

本議程將解析如何透過SASE讓企業邁向這些重要議題。

Shift security left - why and how? tools, tactics and more

隨著數位轉型、雲端化、微服務、開源化以及容器化如火如荼在企業機關激盪風行，然而開放性的嶄新科技評估導入，更需要謹慎思考可能的資安風險，避免享受新科技的同時，讓有心人士與駭客有機可乘，同時也要評估如何符合國內外資安法規的遵循性。

本場次分享針對雲端化、微服務、開源化以及容器化之國際相關資安規範與架構機制，助於企業機關可以放心合規的數位轉型、安全上雲，創造隨之的優勢與效益。

• Increase in open proxy usage by nation-sponsored threat actors
• Attack campaigns utilizing open proxies for data exfiltration, DDoS, cryptomining, etc.

• Remote work environment challenges in enforcing security policies and patching
• Increased vulnerability of internet-facing servers and devices

• Fancy Bear, Ocean Lotus, Lazarus, etc.
• Targeting specific vulnerabilities of internet-facing systems
• Maximizing attack capabilities and gathering initial footholds for cyber espionage

• Proxy chains used by threat actor groups
• Anonymity and effectiveness in carrying out attacks
• Dark web sources of proxy chain details

• Understanding the concept and potential risks
• Techniques employed by threat actors

• Identification of entities providing open proxies to nation-sponsored threat actors

• Awareness and detection of open proxy usage
• Implementing robust security measures
• Regular patching and policy enforcement
• Monitoring and response strategies

In this research paper, we delve into the alarming rise of open proxy usage by nation-sponsored threat actors in cyber espionage campaigns. We explore the impact of the COVID-19 pandemic on organizations' security posture and how it has contributed to increased vulnerability. We analyze state-sponsored threat actor groups and their utilization of open proxies, focusing on examples such as Fancy Bear, Ocean Lotus, and Lazarus. Additionally, we provide insights into the common intrusion scenario known as Proxychains and discuss the providers of open proxy servers utilized by these threat actors. Lastly, we offer recommended actions that organizations should consider to mitigate the risks posed by open proxies and bolster their security defenses.

In December 2022, President Biden signed the Quantum Computing Cybersecurity Preparedness Act ( QCCSP ) into law, prioritizing the task of migrating federal IT systems to quantum-resistant cryptography. The signing of this Act indicates that the US government now officially acknowledges that the development of Quantum Computing has come to a stage where it is no longer just a far-fetched future but a real technology that is in development.
In this session we will look into the past, present and the future of Quantum Computing, the promising potential it brings, and the emerging threats that ride alongside its development. In addition, we will take a look at what professionals around the globe have been planning to address the possible complications of such technologies and how it may affect the landscape of cybersecurity.

主要介紹了企業必須採取系統加固和安全配置措施來保障資訊系統安全的重要性和方法。該簡報包括了以下內容：
首先，介紹了系統加固和安全配置的基本概念和重要性。系統加固和安全配置是企業保障資訊系統安全的基本措施，需要全面深入地開展。接著，從系統安全性的角度出發，分析了不進行系統加固的後果，並強調了加固工作的緊迫性。然後，介紹了進行系統加固的基本原則，包括最小化安裝、關閉不必要服務、安全審計等。同時，從系統安全的不同層面出發，介紹了安全配置的基本內容，包括作業系統、資料庫、應用程式等方面。隨後，詳細介紹了系統加固的具體操作步驟，包括查殺病毒、開啟防火牆、禁用不必要的服務、修改預設密碼等。並強調了每一步操作需要注意的事項和技巧。此外，通過案例分析，介紹了實際操作中需要注意的問題和企業在實踐中的經驗和教訓。最後，總結了系統加固和安全配置的重要性和方法，並提出了加強安全審計、加強員工安全教育培訓等進一步措施的建議。

在Application Security的概念裡，測試都是在產品完成後再進行。很多時候這樣的測試卻不能即時性解決一些Critical的Bug。在坊間的解決方案，很多人都說DevSecOps可以解決Application Security的問題，然而，在DevSecOps的角度要怎麼切入，切入的方法如何？同一時間，在過百人的開發團隊中，DevSecOps的切入能讓開發流程進步多少？另外對於產品面向來說，DevSecOps又會對產品有甚麼好處？這樣的問題我可以用在ViewSonic的實例跟大家分享一下。

This study discusses a covert channel technique that leverages the use of ephemeral ports in TCP connections to conduct a non-traditional port knocking then further exfiltrate the data covertly to a remote web server from a client in a strict firewall environment.

In this technique, an attacker can use the source port field in TCP headers to encode and transmit data. The ephemeral ports are randomly assigned by the operating system and typically change for each new connection, making it difficult for security measures to detect the covert channel.

Proof-of-concept (PoC) programs are available to demonstrate how file exfiltration can be achieved through the abuse of ephemeral ports. It is recommended to use a dummy web server listening on the server's < destination_port>, although it is not strictly necessary. Once the client establishes a connection, a request mimicking a software version check will be sent.

Current security measures, such as firewalls and intrusion detection systems, are not designed to detect this type of covert channel. Firewalls typically monitor traffic based on the destination port, not the source port, while intrusion detection systems often focus on detecting known attack signatures rather than analyzing the source port field in TCP headers.

This technique presents a significant threat to network security, as it can be used to exfiltrate sensitive information without detection, highlighting the need to develop new security measures that can detect and prevent this type of covert channel.

響應金管會「金融科技發展路徑圖」推動措施，聯合徵信中心及財金公司協同金融機構導入「金融FIDO」服務；「金融FIDO」係我國泛金融產業共通之行動身分識別工具，本次分享將說明如何應用「晶片金融卡」進行身分核驗，並透過財金公司「身分查驗平台」完成「金融FIDO註冊」，俾利運用「金融FIDO」辦理銀行、證券、保險等金融相關業務。

為配合主管機關推動「金融科技發展路徑圖」政策，本次議程特別邀請三家銀行分享個案經驗，瞭解金融 FIDO 合作的關鍵要素：合作對象、模式、服務項目以及未來展望等。
透過這些實際案例，共同擴大金融 FIDO 應用場景，落實跨領域金融業務合作，實現普惠金融願景。藉此讓會眾一同深入了解金融科技的發展，共襄智慧金融未來！

隨著智慧科技與跨界應用趨勢的發展，兼顧安全、可靠、便利的身分識別機制，已經成為強化資安防護、保障個資隱私的第一道關卡，也是全球政府與國際組織近年來政策制定的焦點。本次演講將分享如何掌握快速變遷的國際發展趨勢與現況，正確而快速的導入並運用國際標準，建立接軌全球主流規範的數位信任環境與應用基礎。

  1. 有哪些國際的 FIDO 趨勢，是台灣產業可以借鏡的?
  2. 金融 FIDO 的應用目前還有哪些挑戰？
  3. 對於金融 FIDO 的發展，未來還有哪些潛在的應用機會？