2023.12.30 보안 이슈

==2023.12.30==

# 취약점 / 악성코드 

- Most Sophisticated iPhone Hack Ever Exploited Apple's Hidden Hardware Feature

https://thehackernews.com/2023/12/most-sophisticated-iphone-hack-ever.html

- EXPERTS ANALYZED ATTACKS AGAINST POORLY MANAGED LINUX SSH SERVERS

https://securityaffairs.com/156466/hacking/threat-actors-linux-ssh-servers-attacks.html

- XAMALICIOUS ANDROID MALWARE DISTRIBUTED THROUGH THE PLAY STORE

https://securityaffairs.com/156514/malware/xamalicious-android-backdoor.html

- EXPERTS WARN OF CRITICAL ZERO-DAY IN APACHE OFBIZ

https://securityaffairs.com/156530/security/apache-ofbiz-auth-bypass.html

https://www.bleepingcomputer.com/news/security/apache-ofbiz-rce-flaw-exploited-to-find-vulnerable-confluence-servers/

- 유명 뱅킹 멀웨어 카르바낙, 랜섬웨어 기능까지 덧입고 새출발

https://www.boannews.com/media/view.asp?idx=125268&page=4&kind=1

https://securityaffairs.com/156410/malware/carbanak-malware-ransomware-attacks.html

- 휴네시온의 시스템 접근제어 및 계정관리 솔루션, 취약점 4건 발견... 보안 업데이트 발표

https://www.boannews.com/media/view.asp?idx=125339&page=1&kind=1

# 국가지원 해킹그룹

- IRAN-LINKED APT33 TARGETS DEFENSE INDUSTRIAL BASE SECTOR WITH FALSEFONT BACKDOOR

https://securityaffairs.com/156366/apt/apt33-falsefont-targets-defense-sector.html

- RUSSIA-LINKED APT28 USED NEW MALWARE IN A RECENT PHISHING CAMPAIGN

https://securityaffairs.com/156623/apt/apt28-phishing-new-malware.html

- CYBER ATTACKS HIT THE ASSEMBLY OF THE REPUBLIC OF ALBANIA AND TELECOM COMPANY ONE ALBANIA

https://securityaffairs.com/156644/security/cyber-attacks-hit-albania.html

- UAC-0999, 윈라의 취약점 통해 우크라이나 조직들 공격 중

https://www.boannews.com/media/view.asp?idx=125170&page=10&kind=1

https://securityaffairs.com/156381/hacking/uac-0099-apt-exploits-winrar-flaw.html

- 해킹 그룹 클라우드아틀라스, 러시아 기업들 공격 중

https://www.boannews.com/media/view.asp?idx=125171&page=10&kind=1

- 애플, 인도 정부에 비판적인 사용자들의 아이폰에서 수상한 점 발견

https://www.boannews.com/media/view.asp?idx=125315&page=2&kind=1

- 북한 해킹그룹 김수키, AppleSeed 악성코드 유포... 감염 시스템 제어

https://www.boannews.com/media/view.asp?idx=125135&page=10&kind=1

- 북한 해커조직 ‘APT37’ 공격 포착... ‘북한 시장 물가 분석’ 문서 위장했다

https://www.boannews.com/media/view.asp?idx=125338&page=1&kind=1

# 랜섬웨어 / 정보유출

- 베트남 해커들, 침실 CCTV 해킹해 영상 녹화한 뒤 판매해

https://www.boannews.com/media/view.asp?idx=125172&page=10&kind=1

- [단독] 중국 해커, 국내 IP 카메라 해킹... 4,500개 사생활 영상, 텔레그렘에 노출

https://www.boannews.com/media/view.asp?idx=125342&page=1&kind=1

# 다크웹 / OSINT / 계정 / 피싱

- Malware abuses Google OAuth endpoint to ‘revive’ cookies, hijack accounts

https://www.bleepingcomputer.com/news/security/malware-abuses-google-oauth-endpoint-to-revive-cookies-hijack-accounts/

- 다크웹에서 벌어진 리크스마스, 전 세계 사용자들 위협

https://www.boannews.com/media/view.asp?idx=125317&page=2&kind=1

https://securityaffairs.com/156560/deep-web/leaksmas-dark-web-data-leak.html


#AI 

- [파이낸셜뉴스] "챗GPT가 저작물 무단 사용?"..뉴욕타임스, 오픈AI·MS 소송

https://www.fnnews.com/news/202312280824391601

- ELECTIONS 2024, ARTIFICIAL INTELLIGENCE COULD UPSET WORLD BALANCES

https://securityaffairs.com/156485/security/elections-2024-artificial-intelligence-impact.html

- [2024 보안 핫키워드-1] 생성형 AI 보안위협, 재앙될까 전 세계 바짝 ‘긴장’

https://www.boannews.com/media/view.asp?idx=124894&page=9&kind=5

# 공급망

- 26일에 슬더스 ‘다운폴’ 모드 실행했다면? 해킹 피해 경고

https://m.thisisgame.com/webzine/news/nboard/4/?n=182830

https://www.boannews.com/media/view.asp?idx=125318&page=2&kind=1

https://www.bleepingcomputer.com/news/security/steam-game-mod-breached-to-push-password-stealing-malware/

- Blockchain dev's wallet emptied in "job interview" using npm package

https://www.bleepingcomputer.com/news/security/blockchain-devs-wallet-emptied-in-job-interview-using-npm-package/

# 기타

- 이란 해킹 그룹이 美 수도시설 시스템을 헤집을 수 있었던 이유

https://www.digitaltoday.co.kr/news/articleView.html?idxno=499423

- 이스트시큐리티가 선정한 2023년 보안 이슈와 2024년 보안 위협 전망

https://www.boannews.com/media/view.asp?idx=125217&page=9&kind=3

- [2024 보안 핫키워드-3] 더욱 조직화되고 있는 ‘랜섬웨어’ 생태계

https://www.boannews.com/media/view.asp?idx=124921&page=5&kind=1

- 재난이 쏟아질 2024년, 효과적인 대비책이 필요하다

https://www.boannews.com/media/view.asp?idx=125183&page=2&kind=1