## Android 漏洞研究介紹

### Android 研究環境準備
進行 Android 漏洞研究的環境可分為模擬器(emulator)環境以及實體手機環境，模擬與實體手機上的研究還是存在差異性。如模擬環境中無法將硬體一同模擬，不同廠牌的手機也會有自己實作應用程式、保護機制等，因此在研究的選擇上主要會以實體手機為主。

選擇較好進行刷機 (rooting) 的手機做為研究設備能夠較快建立好研究環境，如 Google 、小米等。 Rooting 的目的在於能幫助研究人員能夠進行更加便利的使用，以及較能不受到 SELinux 安全機制的影響。 

### 高層級攻擊面 (High-level Attack surface)
Android APP 層面的攻擊面有非常多，包含受保護的組件 (protected component) 上的錯誤設定(misconfiguration)，導致 APP 能夠存取到任意系統檔案。或者 APP 開發者使用動態方式將系統路徑的函式庫進行載入，若該 APP 存在路徑遍歷 (path traversal) 相關漏洞的話，則能將該 APP 載入惡意的函式庫 (share object file) 達到持久性本地程式碼執行 (persistent local code execution) 或者遠端程式碼執行 (RCE, Remote Code Execution)。

- **Android 深度連結 (Deep link)** : Android 中的 Deep Link 是一種特殊的 URL，允許應用程式直接導到應用內的特定內容或頁面，而不僅是啟動應用程式的主畫面。在 Pwn2own 2022 有參賽者 利用 Samsung Galaxy Store 中的 Deeplink 漏洞達到程式碼執行，能夠安裝並開啟任意 APP。

- **動態程式碼載入 (Dynamic code loading)** : Android APP 也會使用 share object files，以 CVE-2021-40724 為例，該漏洞發生在 adobe PDF Reader APP 中，漏洞成因為 APP 允許使用者以 URL 形式將期望開啟的 PDF 路徑傳給 APP。然而在後續功能實作中並未對該路徑內容進行檢查，導致了 path traversal 的漏洞。攻擊者能夠透過該漏洞建立出任意檔案，PoC 為利用 path traversal 建立 APP 預設會載入的 share object file，其中 share object file 的內容為攻擊者所能控制，藉此達到 RCE。

- **受保護的組件 (Protected components)** : 在 Android 系統中 `intent` 是一個可序列化 (Parcelable) 的物件，然而開發者可能會不小心使用錯誤的呼叫方式，或者檢查不夠嚴謹，導致攻擊者能夠從使用第三方 app 來存取到目標 app 底下的相關資訊。
 

### 低層級攻擊面 (Low-level Attack surface)

- **Android kernel** : 由於 Android kernel 是基於 Linux kernel 開發的，因此若是在 Linux kernel 中存在的漏洞， Android 系統上也是有可能具有相關漏洞，如 Dirty-CoW , Dirty Pipe 等漏洞皆能夠在 Android 系統中重現，但由於 OS 環境上的差異性，會使得重現過程中需繞過如 SELinux 等問題。

- **Android kernel driver** : Android kernel driver 負責與硬體設備的溝通，若在其中存在漏洞也可能導致攻擊者能夠在目標手機上提權拿到 root。如 ARM 的 Mali GPU driver 目前已被發現存在多個漏洞。

- **Android TEE** : Android 系統中大多使用 TEE (Trust Execution Environment) 來保護裝置的安全性，不同手機廠牌會根據所使用的 CPU 晶片來決定使用哪個架構的 TEE，如 Samsung Exynos 使用的 TEE 環境為 TEEGRIS，而 Pixel4 XL 使用的為高通的 QSEE。 TEE 的攻擊面有 TEEOS 以及 TA (Trusted Applications) 等。

## 漏洞重現

我們針對 Android 系統環境中進行漏洞的移植及重現，幫助研究人員了解成因及系統架構上的差異性。在 2022 年的 HITCON 中，我們以成功移植 Dirty-Pipe (CVE-2022-0847) 的漏洞到 Android 12 Pixel6 的手機。

在該研究的最終目的是希望能夠在 Android 系統中使用 Dirty-Pipe 漏洞，並且能夠獲取繞過 SELinux 的 reverse root shell。

### Dirty-Pipe 漏洞介紹

當 Pipe 在進行操作時，會使用 zero copy，來降低資源的浪費。對 page 進行操作時會使用 page reference 進行操作。其中 `PIPE_BUF_FLAG_CAN_MERGE` flag 設上後會以當下的 page 進行寫入而不會重新 allocate 新的 page。

Dirty-Pipe 漏洞發生在 Pipe 操作時由於 `PIPE_BUF_FLAG_CAN_MERGE` 並未初始化而導致使用時不會重新分配新的 page 而是直接對拿到的 page 進行寫入，因此可以透過 splice system call 來獲取想要 overwrite 目標的 page ，再以 Dirty-Pipe 漏洞進行寫入，就能達到對 read-only 檔案有著趨近於任意寫的功能。


 
![pic_introduction-to-android-vulnerability-research.png](https://uploads.teamt5.org/upload/original/pic_introduction-to-android-vulnerability-research.png)
 

Dirty-Pipe 本身在任意寫上存在一些限制：
1. 對檔案必須要有 read 與 open 的權限
2. 每一次寫入只能寫 1 個 page 大小
3. page 的第 1 個 byte 無法進行寫入
4. None-regular file 是不能寫入

### Linux 系統中 Dirty-Pipe 漏洞提權方法
有著趨近於任意寫的功能下，能夠對任何能夠 open read 的檔案進行寫入，在 linux 系統中提權方法相較於 Android 系統中較為簡單與直接。


- 找出帶有 SUID 的程式作為目標，如 `/usr/bin/sudo`，將該程式的 Entry point 複寫為 Shellcode 的位置即可以 root 權限開啟 Shell 。

### Reference
- https://starlabs.sg/blog/2023/06-the-old-the-new-and-the-bypass-one-clickopen-redirect-to-own-samsung-s22-at-pwn2own-2022/
- https://hulkvision.github.io/blog/post1/
- https://dirtypipe.cm4all.com/

 
>TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案 - ThreatSonar，有效偵測，避免企業系統漏洞遭到有心人士濫用、遭遇資安攻擊。
>
>團隊具備超過10年的惡意程式與進階持續性威脅(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響；更經常受邀參加世界級資安會議、發表研究成果。
>
>若您有資安防護的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/request-information/?utm_source=blogs&utm_medium=website)

Android 漏洞研究介紹

##Introduction to Android Vulnerability Research
###Preparing the Android Research Environment
The environment for conducting Android vulnerability research can be categorized into emulator environments and physical device environments. There are notable differences between research conducted on emulators and physical devices. For instance, emulator environments cannot replicate hardware interactions, and different manufacturers implement their applications and protection mechanisms. Therefore, for research purposes, the primary focus will be on physical devices.

It is advisable to choose a physical phone that is more convenient for rooting, such as devices from Google or Xiaomi. Rooting is intended to provide researchers with more convenient usage and minimize the impact of the SELinux security mechanism.

###High-Level Attack Surface
The attack surface at the Android application level is extensive, including misconfigurations in protected components that allow the app to access arbitrary system files. Additionally, if app developers dynamically load libraries from system paths, with path traversal vulnerabilities, attackers can load malicious shared object files, enabling persistence in local devices or remote code execution (RCE).

- **Android Deep Linking**: In Android, a deep link is a specific type of URL that allows an application to navigate directly to specific content or pages. At Pwn2Own 2022, a participant exploited a deep link vulnerability in the Samsung Galaxy Store, achieving code execution that allowed for the installation and launch of any app.
- 
- **Dynamic Code Loading**: Android apps often utilize shared object files. For instance, CVE-2021-40724 was a vulnerability found in the Adobe PDF Reader app, where the app allowed users to provide the expected PDF path via a URL. However, the implementations did not validate the content of this path, resulting in a path traversal vulnerability. Attackers could exploit this flaw to create arbitrary files. A proof of concept (PoC) for this vulnerability demonstrated how to create a shared object file that the app would load by default, with content controlled by the attacker, thereby achieving RCE.

- **Protected Components**: In the Android system, an `intent` is a serializable (Parcelable) object. However, developers may inadvertently use incorrect calling methods or fail to conduct rigorous checks, resulting in attackers accessing sensitive information from the target app using third-party applications.


###Low-level Attack surface
- **Android Kernel**: Since the Android kernel is based on the Linux kernel, vulnerabilities present in the Linux kernel can also manifest in the Android system. For example, vulnerabilities such as Dirty COW and Dirty Pipe can be reproduced in Android. However, due to differences in the operating system environment, the reproduction process may need to navigate issues such as SELinux.

- **Android Kernel Driver**: The Android kernel driver is responsible for communication with hardware devices. If vulnerabilities exist within these drivers, attackers may be able to escalate privileges and gain root access to the target device. For instance, multiple vulnerabilities have been identified in the ARM Mali GPU driver.

- **Android TEE**: The Android system primarily utilizes the Trusted Execution Environment (TEE) to enhance device security. Different manufacturers determine which TEE architecture to implement based on the CPU chipset. For example, Samsung Exynos employs the TEEGRIS environment, while the Pixel 4 XL uses Qualcomm’s QSEE. The attack surface of the TEE includes TEEOS and Trusted Applications (TAs).

##Vulnerability reproduction
We reproduced vulnerabilities in the Android system environment to help researchers understand the causes and differences in system architecture. At HITCON 2022, we successfully ported the Dirty-Pipe (CVE-2022-0847) vulnerability to Android 12 Pixel6 phones.

The ultimate goal of this research is to use the Dirty-Pipe vulnerability in the Android system and bypass SELinux to gain the reverse root shell.


###Dirty-Pipe Vulnerability Introduction
When a pipe is in operation, it employs zero-copy techniques to minimize resource wastage. Page operations are conducted using page references. When the `PIPE_BUF_FLAG_CAN_MERGE` flag is set, data is written to the current page without reallocating a new page.

The Dirty-Pipe vulnerability occurs during pipe operations when the `PIPE_BUF_FLAG_CAN_MERGE` is not properly initialized. This oversight prevents the allocation of a new page, allowing data to be written directly to the acquired page. By utilizing the splice system call, an attacker can obtain the page to overwrite. Subsequently, by exploiting the Dirty-Pipe vulnerability, it can perform almost arbitrary writes to files.


 
![pic_introduction-to-android-vulnerability-research.png](https://uploads.teamt5.org/upload/original/pic_introduction-to-android-vulnerability-research.png)
 

Dirty-Pipe itself has some limitations on arbitrary writing:

1. The file must have read and open permissions
2. Each write operation can only write 1 page size
3. The first byte of the page cannot be written.
4. None-regular files cannot be written

###Privilege escalation in the Linux system
Using the vulnerability we can almost achieve arbitrary writing on read-only files, it can write to any file that can be open-read. The privilege escalation method in the Linux system is simpler than in the Android system.

- Find the program with SUID flag as the target, such as `/usr/bin/sudo`. Overwrite the entry point of the SUID binary to the address of the shellcode after that it will spawn the shell with root privileges.

 
####Reference
- https://starlabs.sg/blog/2023/06-the-old-the-new-and-the-bypass-one-clickopen-redirect-to-own-samsung-s22-at-pwn2own-2022/
- https://hulkvision.github.io/blog/post1/
- https://dirtypipe.cm4all.com/

 
>TeamT5 specializes in cyber threat research and provides an endpoint detection and response (EDR) solution - ThreatSonar, which effectively detects and prevents enterprise system vulnerabilities from being abused by malicious parties and encountering cybersecurity attacks.
>
>TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences.
>
>For vulnerability research and endpoint protection inquiries, please contact us at [https://teamt5.org/en/request-information/](https://teamt5.org/en/request-information/?utm_source=blogs&utm_medium=website)

Introduction to Android Vulnerability Research

Technical Analysis

October is [Cybersecurity Awareness Month](https://staysafeonline.org/programs/cybersecurity-awareness-month/), set by the USA National Cybersecurity Alliance. It’s a time dedicated to raising awareness about the importance of cybersecurity and empowering individuals and organizations to protect their digital lives. As we navigate an increasingly interconnected world, safeguarding our online presence has never been more critical. 

This year, the National Cybersecurity Alliance has emphasized four key tips to enhance your cybersecurity posture: 
- Using strong passwords and a password manager
- Turning on multi factor authentication
- Recognizing and reporting phishing
- Updating software to the latest versionLet's dive into each of these vital practices.

 
 

Here are action steps you can take -
##1. Using Strong Passwords and a Password Manager
**Why It Matters**: Weak passwords are a common entry point for cybercriminals. Using easily guessable passwords puts your sensitive information at risk.

**Action Steps**:
- **Create Complex Passwords**: Use a mix of uppercase and lowercase letters, numbers, and special characters. Avoid using easily guessable information like birthdays or common words.
- **Unique Passwords for Each Account**: Never reuse passwords across multiple accounts. If one account gets compromised, others will remain secure.
- **Use a Password Manager**: Password managers store and generate complex passwords, ensuring you only need to remember one master password.

##2. Turn on Multi Factor Authentication (MFA)
**Why It Matters**: MFA adds an extra layer of security by requiring multiple forms of verification before granting access to an account. This makes it significantly harder for attackers to gain unauthorized access.

**Action Steps**:
- **Enable MFA Everywhere**: Turn on MFA for all your online accounts that offer it. This often involves a second step, like entering a code sent to your phone or using a biometric scan.
- **Use Authenticator Apps**: Instead of relying solely on SMS-based MFA, consider using authenticator apps like Google Authenticator or Authy for better security.

##3. Recognize and Report Phishing
**Why It Matters**: Phishing attacks trick users into revealing personal information or downloading malicious software by pretending to be a trustworthy entity. These attacks are increasingly sophisticated and can have serious consequences.

**Action Steps:**
- **Be Skeptical of Unsolicited Emails**: If you receive an unexpected email asking for personal information or urging you to click a link, verify its legitimacy before taking any action.
- **Check the Sender's Email Address**: Phishers often use email addresses that look similar to legitimate ones. Look for subtle differences or misspellings.
- **Report Phishing Attempts**: Most email providers and organizations have mechanisms for reporting phishing. Use these tools to help combat cyber threats.

##4. Update Software Regularly
**Why It Matters**: Software updates often include security patches that fix vulnerabilities. Failing to update your software leaves you exposed to potential attacks.

**Action Steps**:
- **Enable Automatic Updates**: Whenever possible, enable automatic updates for your operating system, applications, and devices.
- **Manually Check for Updates**: For software that doesn't update automatically, set a reminder to check for updates regularly.
- **Prioritize Critical Updates**: Install security patches and critical updates as soon as they become available to stay protected against the latest threats.

##Conclusion
Cybersecurity Awareness Month 2024 is an excellent opportunity to strengthen your digital defenses and promote a culture of security awareness. By incorporating these key practices—using strong passwords and a password manager, turning on multi factor authentication, recognizing and reporting phishing, and updating software—you can significantly reduce your risk of falling victim to cyber threats. Join us in spreading the word and making the digital world a safer place for everyone.
Stay safe and secure!

>**TeamT5 Threat Analyst Summit: “Stay Informed. Stay Secured.”**
>Embrace the Power of Intelligence at the Threat Analyst Summit 2024! 
>
>In the ever-evolving landscape of cybersecurity, staying one step ahead is not just an advantage – it's imperative. Join us at this year's Threat Analyst Summit, where we bring together the brightest minds in the industry to explore, learn, and collaborate. Our theme, "Stay Informed, Stay Secure", underscores the critical role of continuous intelligence in safeguarding against emerging threats.
>
>Join the Summit, and you may - 
>*Uncover cutting-edge insights from experts around the world.
>*Explore the latest attacks methods of APT and cybercrime, and then defend them 
>*Deep dive into innovative strategies for incident response
>
>**Sign up > https://teamt5tw.kktix.cc/events/tas2024**

Cybersecurity Awareness Month 2024: Strengthening Your Digital Defenses

Products & Services

Businesses face increasingly complex and frequent online threats. This surge in cyber threats poses a significant challenge to network security personnel, who must navigate a constant stream of alerts and incidents. Without a clear understanding of these threats, companies risk making incorrect judgments that can lead to wasted resources and serious damages. Here’s how ThreatVision’s Indicators of Compromise (IoCs) can make a substantial difference.

 

##Overcoming Cyber Threats is Hard...
As business operations become more digitized, the complexity and prevalence of cyber threats grow. Network security teams often deal with frequent alerts that are difficult to fully understand without professional intervention. This ambiguity can lead to incorrect decisions, resource wastage, and significant damage from overlooked signs of intrusion. Outsourcing every incident investigation isn't sustainable due to high costs and fragmented vendor involvement.

 

##Let TeamT5’s ThreatVision IoCs Help You!
TeamT5, with years of experience studying hacker behavior in the Asia-Pacific region, has refined its expertise into precise Indicators of Compromise (IoCs). These IoCs are essential for effective cybersecurity operations, enabling businesses to identify and block intrusions.

![pic_making-the-most-of-threatvision-iocs.jpg](https://uploads.teamt5.org/upload/original/pic_making-the-most-of-threatvision-iocs.jpg)

 

##Key Features of ThreatVision IoCs
1. **High-precision APT IoCs**: These are derived from complex investigations and provide insights into specific adversaries and their methods, offering valuable intelligence to strengthen your cybersecurity posture.
2. **Broad-ranging Cybercrime IoCs**: Cover a wide array of cyber threats including infostealer, crypto miner, vulnerability weaknesses and more, ensuring comprehensive protection.
3. **API Integration**: Seamlessly integrates with various network defense devices and firewall applications, facilitating easy and automated deployment.
4. **Traceable Sources and CSV/STIX Format Support**: Ensures IoCs are easily deployable and verifiable.

 

##How ThreatVision IoCs Enhance Cybersecurity
###Accurate Alert Judgement
By importing ThreatVision IoCs into your network devices and software tools, you can establish robust monitoring across your environment. When an IoC is detected, it triggers an alarm, allowing cybersecurity personnel to swiftly block, isolate, and clear the threat. This proactive approach significantly reduces the risk and impact of cyber attacks.

###Comprehensive Threat Understanding
ThreatVision IoCs link to three rich data types within the platform:
- **Adversary Database**: Understand the background and motivation of adversaries to deploy defenses for specific digital assets in advance.
- **Malicious Program Database**: Gain technical details to select and deploy effective defense tools.
- **Threat Intelligence Reports**: Confirm your situation against recent threats and ensure your defenses are up-to-date.

###Proactive Defense Measures
Using ThreatVision IoCs, enterprises can:

- **Deploy IoCs Properly**: Ensure complete and consistent deployment using our API.
- **Respond to Alerts Immediately**: Block, quarantine, and remove malware to minimize damage.
- **Investigate Thoroughly**: Identify the source and purpose of the attack to better understand adversary tactics and tools.

 

##Benefits of ThreatVision IoCs
1. **Enhanced Alert Accuracy**: Make better-informed decisions based on precise IoCs.
2. **Proactive Threat Management**: Understand threats in-depth to take preemptive measures.
3.** Ease of Automation**: Simplify deployment and management through API integration.
4. **Rapid Deployment**: Utilize generic file formats like CSV and STIX for quick implementation.

 

##Summary
In the battle against cyber threats, understanding both your capabilities and the adversary's tactics is crucial. TeamT5’s ThreatVision platform, with its extensive database of adversaries, malware, and comprehensive threat intelligence reports, empowers enterprises to navigate the threat landscape effectively. By leveraging ThreatVision’s powerful features, businesses can enhance their cybersecurity posture and safeguard against evolving threats.

 
>Making the most of ThreatVision IoCs - [contact us](https://teamt5.org/en/request-information/?utm_source=blog&utm_medium=website) !

Making the Most of ThreatVision IoCs

企業面臨著日益複雜且頻繁的網路威脅。隨著網路威脅的爆炸性增加，讓他們必須應對不斷湧入的警報和事件，對資訊安全人員構成了重大挑戰。若企業不夠清楚了解這些威脅，很可能會做出錯誤判斷，導致資源浪費和嚴重損害。 ThreatVision 的入侵指標（Indicators of Compromise, IoCs）如何在抵禦網路威脅中發揮重大作用呢？

 

##克服網路威脅的困難...
隨著企業營運越來越數位化，網路威脅的複雜性和普遍性也隨之增長。資訊安全團隊被迫處理頻繁的警報，缺少知識背景的情況下，這些警報往往難以完全理解。對於威脅的模糊認知可能導致錯誤決策、資源浪費，或甚至會因忽視入侵跡象，而造成的重大損害。加上外包調查事件的成本高昂、服務供應商參與的過程破碎化，使得外包調查策略也難以延續

 

##讓 TeamT5 的 ThreatVision IoCs 助您一臂之力！
TeamT5 多年來持續研究亞太地區駭客行為，將其專業知識精煉為精準的入侵指標（IoCs）。這些 IoCs 是有效網路安全營運的關鍵，使企業能夠精確識別並阻止入侵。

![pic_making-the-most-of-threatvision-iocs.jpg](https://uploads.teamt5.org/upload/original/pic_making-the-most-of-threatvision-iocs.jpg)

 

##ThreatVision IoCs 的主要特點
- **高精準度的 APT IoCs**：這些 IoCs 源自複雜且長年累月的調查，提供對特定威脅者及其方法的深入了解，為加強您的網路安全態勢提供寶貴的情報。
- **廣泛的網路犯罪 IoCs**：涵蓋 APT 入侵、勒索軟體攻擊、漏洞弱點等各種網路威脅，確保全面保護。
- **API 整合**：無縫整合各種網路防禦設備和防火牆應用，輕鬆自動化部署。
- **可追溯來源和支援 CSV/STIX 格式**：讓 IoCs 易於部署和驗證。

 

##ThreatVision IoCs 增強網路安全的方式
###準確的警報判斷 

透過將 ThreatVision IoCs 導入您的網路設備和軟體工具，就如同在整個環境中建立強大的監控系統。當檢測到 IoCs 時，會觸發警報，使資訊安全人員能夠迅速封鎖、隔離和清除威脅。這種主動防禦方式，能夠顯著減少網路攻擊的風險和影響。

 

###全面的威脅理解 

ThreatVision IoCs 連接到平台內三種類型的豐富數據：
- **威脅者資料庫**：了解威脅者的背景和動機，提前部署針對特定資產的防禦措施。
- **惡意軟體資料庫**：獲取惡意軟體技術詳情，以選擇和部署有效的防禦工具。
- **威脅情報報告**：確認您在當前威脅中的情況，能夠採取最有效且新穎的防禦措施。

 

###主動防禦措施 
使用 ThreatVision IoCs，企業可以：
- **正確部署 IoCs**：藉由使用 API，確保完整和一致的部署。
- **立即回應警報**：封鎖、隔離和移除惡意軟體，以將損害降至最低。
- **徹底調查**：識別攻擊的來源和目的，更充分地了解威脅者的戰術和工具。

 

## ThreatVision IoCs 的好處
- **提高警報準確性**：基於精確的 IoCs 做出更明智的決策。
- **主動威脅管理**：深入了解威脅，主動採取預防措施。
- **易於實現自動化**：透過 API 整合，簡化部署和管理。
- **快速部署**：利用 CSV 和 STIX 等通用文件格式快速完成部署。

 

##總結
在對抗網路威脅的過程中，了解自身的能力和威脅者的戰術至關重要。TeamT5 的 ThreatVision 平台，擁有廣泛的威脅者資料庫、惡意軟體和全面的威脅情資報告，使企業能夠有效地駕馭威脅情勢。透過利用 ThreatVision 的強大功能，企業可以增強其資訊安全策略，並保護資產免受不斷演變的威脅影響。

 
>立刻試用 ThreatVision 入侵指標，禦敵致勝
>
>[聯絡我們](https://teamt5.org/tw/request-information/?utm_source=blog&utm_medium=website)

 ThreatVision 入侵指標（ IoCs）  幫助您禦敵致勝

ThreatVision Resources

This webinar is co-hosted by TeamT5 and EclecticIQ. As Elliott (fromTeamT5) and Ben (from EclecticIQ) discuss how to integrate ThreatVision’s expert APAC intelligence into the EclecticIQ platform and automate it at scale. 

Featuring an introduction to ThreatVision, EclecticIQ and even a demo featuring real intelligence, this webinar is a must watch for SOC teams and cyber threat intelligence researchers and analysts.

 

**Fill out the form and you can have the recording link.**

**Form:** https://forms.gle/kuXTc2g6Tni8akJA6

 
 
key words: threat intelligence, threat intelligence platform, TIP

Image source: Pexel

[Webinar Recording] Automating Asia-Pacific Cyber Threat Intelligence at Scale

We’ll be in VNISA Vietnam Cyber Security Day and present our intelligence-driven cybersecurity solutions.

##Exhibiting Solutions 
###ThreatVision
>Used by 15+ national cybersecurity agencies, ministries of defense, financial institutions, and multinational enterprises

- **Real-Time Data Collection** : Gain daily insights into emerging advanced persistent threats from Asia.
- **Comprehensive Analytics** : Deep dive into threat patterns and vulnerabilities.
- **Actionable Intelligence** : Enable informed decision-making to fortify your defenses.


###ThreatSonar
>Used by 3 of the top banks in Vietnam

- **Proactive Detection** : Identify and neutralize threats before they impact your organization.
- **Customized Strategies** : Threat hunting for compromise assessment and incident response.
- **Expert Team** : Leverage our seasoned analysts with extensive industry experience.

 
 

##Event Info
- Date : November 21, 2024 (Thursday)
- Time: 7:30 - 17:30
- Venue: Hotel Melia Hanoi Hotel Melia Hanoi (44 Ly Thuong Kiet St, Hanoi, Vietnam)
- Event website: https://securityday.vn/en/

TeamT5 will be at VNISA Vietnam Cyber Security Day 2024

Events

>TeamT5がNHKにインタビューを実施。インタビューは情報操作について。これはインタビューの抜粋です。[全文はここからお読みいただけます](https://www3.nhk.or.jp/news/html/20240920/k10014585911000.html)。

リサーチャーのひとりが、旧ツイッター、Xに不思議な投稿を見つけた。投稿にはURL。その先に飛ぶと、ある文書がダウンロードできるようになっていた。

中国の企業から流出したとみられることは、すぐにわかった。

上海に本社を置くサイバーセキュリティー企業「i-SOON」だった。中国当局と連携して世界でサイバー攻撃を展開しているのではないかと、T5がかねてからマークしていた企業のひとつだった。

文書は大量にあり、その内容は驚くべきものだった。

ハッキングなどのサイバー攻撃に使えるセキュリティー製品の技術書や取引先とみられる一覧表。海外の組織などから盗み取ったと見られるデータのリスト。そして、3年に及ぶ社内チャットの記録など、合わせて577点に上った。

TEAM T5 張哲誠さん：「中国のサイバーセキュリティー企業からこれほど多くの内部資料が流出したのは初めてです。中国政府と民間企業の関係を理解する上で、近年で最も重要な文書です」

 
 
>TeamT5 は、20 年以上の実績を持つ世界クラスのサイバーセキュリティアナリストで構成されています。 地理的・文化的利点を活用し、当社はアジア太平洋地域のサイバー攻撃者について最もよく理解しています。
>
>精確な脅威インテリジェンスと独自のエンドポイント脅威ハンティング技術により、サイバースパイ活動やランサムウェア対策のサイバーセキュリティソリューションを提供します。米国、日本、台湾の政府機関、金融、テクノロジー、電気通信、情報セキュリティサービスプロバイダーなど、各業界のお客様にご利用頂いており、機密文書の保護やサイバー攻撃の遮断を継続的に行っています。
>[会社概要](https://teamt5.org/jp/about-us/?utm_source=news&utm_medium=website)

TeamT5がNHKのインタビューを受ける

> 本公司杜浦數位安全(TeamT5)接受[NHK採訪]((https://www3.nhk.or.jp/news/html/20240920/k10014585911000.html)。)，該次採訪獲得台灣媒體進一步報導，本篇節錄中央廣播電台，完整報導請見[此連結](https://www.rti.org.tw/news/view/id/2224778)

NHK採訪了發現外流文件的台灣情資研究機構杜浦數位安全(TeamT5)。他們在社群媒體X上發現了一個神秘的URL，認為是攻擊者或者洩露的人額外創造出來的一個帳號，打開後發現的577份文件，包含了大量用於網路攻擊的技術訊息，像是能入侵微軟和谷歌電子郵件信箱的工具，以及能遠程操控智慧型手機的技術等。......

 
 

>TeamT5 杜浦數位安全專精於亞太地區網路威脅研究，長期研究網路攻擊，追蹤攻擊者，專精類別如進階持續性攻擊(APT)、勒索軟體。我們以精準的威脅情資與獨特的端點威脅狩獵技術，提供反制網路間諜、勒索軟體之資安解決方案。客戶來自美國、日本、臺灣，產業別涵蓋政府機關、金融、科技、電信、資安服務提供商，持續保護機密文件，阻斷網路攻擊。
>更多公司介紹請參考[關於我們](https://teamt5.org/tw/about-us/?utm_source=news&utm_medium=website)

[中央廣播電台] NHK追溯安洵外洩文件 探討中國認知戰真相

Japan NHK's documentary reveals the shady story of China's "cognitive warfare". And TeamT5, APAC threat intelligence leading brand from Taiwan, discover this information. It noticed the anomaly as early as 2021 and continued to monitor and reveal the truth.

- In February this year, i-Soon leaked information. This Shanghai-based cybersecurity company has long been labeled by TeamT5 as one of the organizations that may cooperate with the Chinese government and participate in global cyber attacks. The TeamT5 threat intelligence team traced a mysterious URL on social media.

- NHK’s documentary "Tracking China's Leaked Documents" took the reporter half a year to visit 7 countries and conduct in-depth tracking and analysis of these 577 leaked documents. They reveal the shocking story of the Chinese government, military and civilians working together to carry out cyber attacks and "cognitive warfare".

 

👉NHK’s report: https://www3.nhk.or.jp/news/html/20240920/k10014585911000.html

TeamT5 conducts an interview with NHK

News

The biggest information security conference in Japan, [CODE BLUE 2024](https://codeblue.jp/), will be held in Tokyo on November 14-15. TeamT5, with its Taiwan headquarter & Japan subsidiary, is proud to sponsor and participate in this Asia top international cybersecurity event.

This year, our cyber threat analysts will share their latest study - “China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations”.

See below for highlights of our events at CODE BLUE 2024.

 

##China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations
- **Time** : 11 / 15 (Wed.) 11:30 – 12:10
- **Presented by** : Li-an, Huang (Security Researcher) & Chih-yun, Huang (Security Researcher)

As we approach the largest election year in history, 2024 is already shadowed by China’s influence operations (IO) aiming to destabilize the democratic systems. Since 2023, Chinese threat actors have launched multiple IO campaigns targeting elections, including an evolving tactic that merges the hack-and-leak with IO campaigns.
In the first part of the presentation, we will introduce Chinese threat actors’ newly developed tactics, specifically the combination of hack-and-leak tactics with IO campaigns. We will elaborate on how China learned and advanced Russia’s playbook to influence the election with asserted leaked documents within our real-world case study from the 2024 Taiwan presidential election.

At the same time, the proliferation of generative artificial intelligence (AI) technology has enhanced threat actors’ capability. In the second part of the presentation, we will demonstrate how Chinese threat actors apply AI for such hack-and-leak and IO campaigns. The integration of AI, hack-and-leak, and IO allows the threat actors to create disinformation that targets broader audiences with ease.

As billions of people are heading to vote in the rest of 2024, including the critical U.S. presidential election in November, the stakes have never been higher. Alarmingly, with the enhanced capability, Chinese threat actors have expanded their target scope from presidential candidates to include legislators. The expansion serves as a dire warning as individual legislators often lack the resources to defend against influence operations. We will conclude the presentation by providing mitigation strategies and policy recommendations aiming to counter the threat at an early stage.

 

##What is CODE BLUE?
CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on [CODE BLUE Official Website](https://codeblue.jp/2024/en/).

 

*Image courtesy of CODE BLUE.

【TeamT5 x CODE BLUE 2024】Because Security Matters

日本最大的資訊安全會議 [CODE BLUE 2024](https://codeblue.jp/) 將於 11 月 14 日至 15 日在日本東京舉辦。 TeamT5 台灣總部和日本子公司很榮幸能夠贊助和參與這一亞洲頂級國際資安盛會。

今年，我們的資安威脅分析師將分享他們的最新研究 – 「中國持續演進的攻擊策略：結合駭侵-洩密與資訊戰的手法（China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations）」。

請參閱下文，了解我們將於 CODE BLUE 2024 帶來的研究分享。

 

##中國持續演進的攻擊策略：結合駭侵-洩密與資訊戰的手法(China’s Evolving Playbook: The Combination of Hack-and-Leak and Influence Operations)
- **時間** : 11月15(週三) 11:30 - 12:10
- **講者** : Li-an, Huang（威脅情資分析師）& Chih-yun, Huang（威脅情資分析師）

隨著史上規模最大的選舉年度來臨，2024 年已被中國旨在破壞民主制度穩定的影響力行動所籠罩。自 2023 年以來，中國威脅行為者發起了多次針對選舉的資訊戰（Influence Operations），其中包括一種將駭侵-洩密與資訊戰相結合並不斷發展的策略。

在演講的第一部分，我們將介紹中國威脅行為者新開發的策略，特別是駭客洩漏策略與資訊戰的結合。我們將在 2024 年台灣總統選舉的真實案例研究中，詳細闡述中國如何學習和推動俄羅斯的策略，利用所謂的洩漏文件來影響選舉。

同時，生成式人工智慧（AI）技術的擴散增強了威脅行為者的能力。因此在演講的第二部分，我們將展示中國威脅行為者如何將人工智慧應用於此類駭客攻擊和資訊戰活動。人工智慧、駭客攻擊和資訊輸入的結合使威脅行為者能夠輕鬆地製造針對更廣泛受眾的虛假資訊。

隨著數十億人將在 2024 年餘下時間投票，包括 11 月至關重要的美國總統選舉，賭注從未如此之高。令人擔憂的是，隨著能力的增強，中國威脅行為者已將目標範圍從總統候選人擴大到國會議員。這種擴張是一個可怕的警告，因為個別國會議員往往缺乏抵禦資訊戰的資源。

演講結尾，我們將提供早期應對威脅的緩解策略和政策建議。

 

##資安會議 Code Blue 介紹
CODE BLUE 是日本最大的國際資安研討討會，旨在通過 CODE（技術）跨越 BLUE（海洋）將人們聯繫起來，為更美好的網路世界做出貢獻。 每年，世界頂級專家和研究人員齊聚一堂，分享最新發現並進行技術演講。 它是所有參與者交流資訊、合作資安事件應變和解決資訊安全問題的殿堂。

更多資訊，請參考 [CODE BLUE 官網](https://codeblue.jp/2024/en/)。

 

*圖片來源: CODE BLUE

TeamT5 參與 CODE BLUE 2024

アジア太平洋地域でトップクラスのサイバー脅威インテリジェンスとエンドポイント検出応答 (EDR) ソリューションを提供する TeamT5 は、11月14日(木)から15日(金)に開催される[CODE BLUE 2024](https://codeblue.jp/)に参加いたします。


また、今年度は弊社のサイバー脅威アナリスト2名が登壇し、最新の研究結果を発表いたします。

## タイトル：「進化する中国の戦術：ハック・アンド・リークと影響力工作とのコンビネーション」
- 時間：11月15日(金)11:30 - 12:10
- 会場：Track1(HALL B)
- 講演者： 
TeamT5サイバー脅威アナリスト 
リアン・ホアン- Li-an Huang、チーユン・ホアン- Chih-yun Huang 

- 概要：

2024年は史上最大の選挙の年を迎えようとしており、すでに中国の影響力工作（IO：Infulence Operations）が民主主義システムを不安定化させようとしている影を落としている。2023年以降、中国の脅威アクターは複数のIOキャンペーンを選挙を標的にして展開しており、その中でも進化した手法として、ハック・アンド・リーク、そしてIOキャンペーンを組み合わせた戦術が見られるようになった。

講演の前半では、中国の脅威アクターが開発した新しい戦術、特にハック・アンド・リークとIOキャンペーンの統合について紹介する。2024年の台湾大統領選挙における実際の事例を基に、中国がいかにしてロシアの戦術を学び、流出したとされる文書を利用して選挙に影響を与える技術を発展させたかを詳しく説明する。
同時に、生成AI技術の急速な普及が脅威アクターの能力を強化している。

講演の後半では、中国の脅威アクターがどのようにAIを活用して、ハック・アンド・リーク、そしてIOキャンペーンを展開しているかを実演する。AI、ハック・アンド・リーク、そしてIOを統合することで、脅威アクターはより幅広い対象に対して容易に偽情報（ディスインフォメーション）を流布できるようになっている。

2024年の残りの期間で、数十億の人々が投票に向かう中、特に11月に行われる米国大統領選挙が控えているため、その影響は非常に大きい。驚くべきことに、強化された能力を持つ中国の脅威アクターは、標的を大統領候補者から議員にまで拡大している。この拡大は、特に個々の議員が影響工作に対抗するための資源を欠く場合に、重大な警告となる。講演の最後には、この脅威に早期に対処するための緩和策や政策提言を提示し、結論とする。

 

TeamT5は、脅威インテリジェンスこそがサイバー防御の要であると考え、企業がサイバー攻撃を予測し、事前に防御戦略を展開できるよう、行動指向でローカライズされたインテリジェンスを提供します。

是非、この機会に弊社と脅威インテリジェンスについの理解を深めていただければ幸いです！

 

##CODE BLUE 2024 概要
世界トップクラスのサイバーセキュリティ専門家による国際会議です。本会議はベンダー中立の立場から、欧米の著名な研究者による最新の研究成果を共有するとともに、日本をはじめとするアジア各国の優れた若手研究者を発掘し、その研究成果を世界へと発信しています。2013年度の開催以来、こうした取組みを積み重ねることで国内外のサイバー・セキュリティ・コミュニティから厚い信頼を得てきました。

 

- 会期：2024年11月14日(木)～11月15日(金)
- 主催：CODE BLUE実行委員会
- 会場：ベルサール高田馬場（住友不動産新宿ガーデンタワーB2・1F）
- 詳細はこちら：https://codeblue.jp/2024/

TeamT5 はCODE BLUE 2024に参加いたします。

>September 9, 2024

**TEAM T5, INC.** (Headquarters: Taiwan; Founder & CEO: Sung-ting Tsai; hereinafter referred to as "TeamT5"), a cybersecurity company with an excellent track record of research and knowledge on advanced persistent threat (APT) attacks in the Asia-Pacific region , and **CEL LTD.** (Headquarters: Minato-ku, Tokyo; CEO: Yuya Nakamoto; hereinafter referred to as "CEL"), one of Japan's leading white hat hacker companies, are pleased to announce that TeamT5 and CEL have entered into a partnership agreement to provide advanced cybersecurity support based on threat intelligence from the Asia Pacific region to the Japanese market.

Threat intelligence is vital for effective cybersecurity defense. TeamT5 is honored that CEL will use our intelligence-driven tool ThreatSonar to enhance CEL’s professional support. We believe that ThreatSonar can greatly benefit CEL by improving its ability to identify and address security threats, thus offering stronger protection for Japanese customers.

TeamT5’s ThreatSonar is capable of quickly analyzing data, detecting anomalies, and do fast triage, which enhances endpoint security and accelerates response times. This collaboration will enable partners to deliver more precise security services in Japan, strengthening their industry position, boosting customer satisfaction, and expanding the client base for both parties.

**Sung-ting Tsai, Founder & CEO of TeamT5**, commented as follows: “We are delighted to partner with CEL, combining their outstanding white hat hacking skills with our advanced threat intelligence research capabilities and threat hunting technologies. Together, we aim to enhance the cybersecurity resilience of enterprises and organizations throughout Japan."

**CEL CEO Yuya Nakamoto** commented : "We are very pleased to partner with TeamT5 to provide Japanese companies with more advanced security solutions that respond to the latest APT threat information in the Asia-Pacific region. In particular, the newly launched intrusion investigation service will be an important tool to discover potential threats and significantly strengthen companies' security posture. We are confident that by combining TeamT5's excellent research track record with our practical security technology, we can make a significant contribution to improving the cybersecurity measures of Japanese companies.”


<center>
![pic_teamt5-and-cel-collaboration.png](https://uploads.teamt5.org/upload/original/pic_teamt5-and-cel-collaboration.png)
</center>


###TEAM T5, INC.
TEAM T5, INC. is one of the world's leading malware analysis teams and the best solution provider for cyber espionage in the Asia-Pacific region. We monitor, analyze, and track cyber threats to help protect our clients' systems and networks from attacks. We also provide threat intelligence, analysis reports, APT countermeasure solutions, threat analysis, and incident response services. Members have presented their research results at numerous global security conferences. For more information, please visit our website (https://teamt5.org/).

###CEL LTD.
CEL LTD. 's mission is to "protect society from the threat of cyber attacks as the world's leading white hat hacker group," and offers a wide range of security-related services, including vulnerability diagnosis, penetration testing, threat intelligence, digital forensics, and security consulting. We will continue to contribute to improving corporate cyber resilience through cybersecurity support. For details, please visit our website (https://celab.co.jp/).

 


####Contact Window
TeamT5 marketing team 
pr@teamt5.org

TeamT5 and CEL Form Partnership to Provide Intelligence-Driven Advanced Cybersecurity Service for Asia-Pacific Region

>2024年9月9日

 アジア太平洋地域の高度標的型攻撃(APT攻撃)に関する優れた研究実績と知見を持つセキュリティ企業**TEAM T5, INC.**(本社：台湾、Founder＆CEO：蔡松廷 Sung-ting Tsai、以下「TeamT5」)と国内有数のホワイトハッカー企業である**株式会社CEL**（本社：東京都港区、代表取締役：中本有哉、以下「CEL」）は、日本市場にてアジア太平洋地域の脅威インテリジェンスをもとにした高度なセキュリティ支援を提供するためにパートナー契約を締結したことをお知らせします。

 

 脅威インテリジェンスの活用は効果的なサイバーディフェンスには必要不可欠です。TeamT5はCELが当社の脅威インテリジェンスを活用したツールであるThreatSonarを使用して、CELのプロフェッショナルサポートを強化することを光栄に思います。ThreatSonarはサイバー脅威の特定と対処能力を向上させ、日本のお客様に高度なセキュリティを提供することでCELに大きな利益をもたらすと確信しています。

 

 TeamT5のThreatSonarは、データを迅速に分析し異常を検出、迅速なトリアージを行いエンドポイントのセキュリティ強化と対応時間短縮を実現します。TeamT5とのコラボレーションによりパートナーは日本でより正確なセキュリティサービスを提供できるようになり、顧客満足度を高めるのと同時に顧客基盤を拡大することができます。

 

 **TeamT5の創設者兼CEOの蔡松廷**は次のようにコメントしています。 「CELと提携し、同社の優れたホワイトハットハッキングスキルと当社の高度な脅威インテリジェンス調査能力および脅威ハンティングテクノロジーを組み合わせられることをうれしく思います。私たちは協力して、日本全国の企業や組織のサイバーレジリエンス強化に貢献したいと思います。」

 

 **CEL CEOの中本有哉氏**は次のようにコメントしています。「TeamT5と提携し、アジア太平洋地域の最新のAPT脅威インテリジェンスに対応した、より高度なセキュリティソリューションを日本企業に提供できることを大変うれしく思います。特に、新たに開始した侵害調査サービスは、潜在的な脅威を発見し、企業のセキュリティ体制を大幅に強化できる重要なツールとなります。TeamT5の優れた研究実績と当社の実践的なセキュリティ技術を組み合わせることで、日本企業のサイバーセキュリティの向上に大きく貢献できると確信しています。」

<center>
![pic_teamt5-and-cel-collaboration.png](https://uploads.teamt5.org/upload/original/pic_teamt5-and-cel-collaboration.png)
</center>

###TEAM T5, INC.
TEAM T5, INC.は世界有数のマルウェア分析チームであり、アジア太平洋地域におけるサイバースパイ活動の最高のソリューションプロバイダーです。サイバー脅威を監視、追跡、分析し、クライアントのシステムとネットワークを攻撃から保護します。また、脅威インテリジェンス、分析レポート、APT対策ソリューション、脅威分析、インシデント対応サービスも提供しています。メンバーは数多くの世界的なセキュリティ会議で研究結果を発表しています。詳細については当社のWebサイト(https://teamt5.org/) をご覧ください。

###CEL LTD.
CEL LTD.は「世界有数のホワイトハッカー集団としてサイバー攻撃の脅威から社会を守る」ことをミッションに掲げ、脆弱性診断、ペネトレーションテスト、脅威インテリジェンス、デジタルフォレンジック、セキュリティコンサルティングなど、セキュリティに関わる幅広いサービスを提供しています。今後もサイバーセキュリティ支援を通じて、企業のサイバーレジリエンス向上に貢献してまいります。詳細は当社Webサイト（https://celab.co.jp/）をご覧ください。

 

####お問合せ先
TeamT5 marketing team 
pr@teamt5.org

Intelligence-Driven Cyber Defense

PRODUCT

Designed for APT & Ransomware Protection

An Engine to Hunt down Intruders

A Portal to See Through the Chaos

Build your Anti-Ransomware Plan TODAY

Blog