ポッドキャスト収録用のメモですよ。
podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。
事件、事故
MITRE から不正侵入事案に関する続報
(5/3) Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion | MITRE-Engenuity
英国防省で外部からの不正アクセス
(5/7) Defence Secretary Oral Statement to provide a Defence Personnel Update - 07 May 2024 - GOV.UK
In recent days, the Ministry of Defence has identified indications that a malign actor gained access to part of the Armed Forces payment network.
This is an external system, completely separate to MOD’s core network, and it is not connected to the main military HR system.
The House will wish to note that it is operated by a contractor, and there is evidence of potential failings by them, which may have made it easier for the malign actor to gain entry.
(5/7) China hacked Ministry of Defence, Sky News learns | Politics News | Sky News
(5/8) UK confirms attack on MoD system, opens review of contractor • The Register
米司法省が LockBit ランサムウェアの開発者を起訴
(5/7) LockBit leader unmasked and sanctioned - National Crime Agency
(5/7) New series of measures issued against the administrator of LockBit | Europol
(5/8) ランサムウェア「LockBit」被疑者の起訴等について
DigiCert が一部の EV 証明書を再発行すると発表
(5/8) 【重要】EV証明書における再発行、ならびに入れ替え手順のご案内
首記の件につき、弊社が発行いたしましたEV TLS証明書の一部にBusiness Categoryの記載フォーマットに誤りがあるものを確認し、CA Browser Forum SSL/TLS証明書のBaseline Reuqirementの取り決めにより、2024年 5月 12日午前1時（日本時間）に、失効しなくてはならないことが判明いたしました。
攻撃、脅威
CISA、FBI などが共同で Black Basta ランサムウェアに関する注意喚起
(5/10) #StopRansomware: Black Basta | CISA
脆弱性
Google が Chrome のゼロデイ脆弱性を修正
(5/9) Chrome Releases: Stable Channel Update for Desktop
[N/A][339266700] High CVE-2024-4671: Use after free in Visuals. Reported by Anonymous on 2024-05-07
Google is aware that an exploit for CVE-2024-4671 exists in the wild.
CISA が脆弱性に関する様々な付加情報を提供する新たな取り組み Vulnrichment を発表
Today, we want to inform organizations of an enrichment effort we are calling "Vulnrichment," which focuses on adding Common Platform Enumeration, Common Vulnerability Scoring System, Common Weakness Enumeration, and Known Exploited Vulnerabilities to CVEs. We recently enriched 1,300 CVEs and continue to diligently work to ensure all submitted CVEs are enriched. We ask all CVE Numbering Authorities (CNAs) to provide complete CVEs when making initial submission to CVE.org.
(5/9) GitHub - cisagov/vulnrichment: A repo to conduct vulnerability enrichment.
その他
CISA が提唱する "Secure by Design" の誓約に、Google、Microsoft、IBM など 68の組織が署名
(5/8) CISA Announces Secure by Design Commitments from Leading Technology Providers | CISA
