The ubiquity of social media has altered the way people consume information, which in turn dramatically changed the way electoral campaigns are run. From the 2018 municipal elections to the 2020 general elections, Taiwan has witnessed the growing threat of disinformation to the citizens. It was observed that many malicious actors utilized social media to disseminate a huge amount of fake news, false information, and hate speech. These disinformation are like highly contagious viruses that will not only affect the people consuming them, but also make them secondary disseminators. We assess that:

1. Virus-like disinformation makes everyone on social media both victim and disseminator

   Although public discussion is the cornerstone of a good democratic society, many attacks have used voter enthusiasm to spread on social media. We have observed that many of the voters who participated in the discussion turned out to be the source of dissemination.
2. Disinformation continues to evolve in tactics and quantity, as well as expanding its targets

   The Taiwanese Central Election Commission (CEC) stated that the number of disinformation cases before the 2020 elections reached an unprecedented level. In addition to the evolution in quantity and tactics, we observed that the dissemination of disinformation did not stop even after the election, but instead shifted the target.
3. China continues to increase its influence

   Apart from news agency promoting the Chinese policies, inauthentic accounts run by bot, and patriotic netizens (A.K.A little pink), China has stepped up its influence on social media platforms to shape narratives.
4. Information operations are outsourced, layer-by-layer

   Before the elections, a number of marketing firms and new media were established to spread political messages. We discovered that some of them have connections with certain political parties, implying the layer-by-layer outsourcing of Information Operations by politically motivated actors.

From the perspective of security researchers, we integrated the Information Operations intercepted and investigated by TeamT5 over the past two years, hoping to contribute to the next democratic election.

If you are interested in this white paper, please fill out the form, and we will send you the report by email.

COMING UP NEXT: We will publish reports about how China conduct Information Operation on social media platforms, targeting domestic citizens and foreign audiences. If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper: Observations on 2020 Taiwanese General Elections

社群媒體的普及改變了人們吸收資訊的方式，衝擊了原有的選戰型態。2018到2020年，台灣面臨了新形態的選戰威脅，攻擊者利用社群媒體散播大量的假新聞、不實資訊、仇恨言論。這些攻擊就像高傳染力的病毒不僅會觸及所有社群媒體使用者，更會讓他們感染後進一步成為潛在的假消息散播源。

TeamT5 的 Observations on 2020 Taiwanese General Elections 認為：

1. 假新聞讓各政黨支持者成為可能的散播源

   假新聞攻擊會利用選民對政治的熱情，使參與討論的選民反而成為散播的節點。
2. 假新聞的手法與目標持續地改變

   中選會認為這次選前的假新聞攻擊達到以往不曾有的數量。而除了數量與手法的不同，在選舉過後，相關攻擊並沒有停止，反而轉移了目標。
3. 中國持續加大自己的影響力

   從對台機構的新聞網站到各類假帳號、機器人與自發的小粉紅，中國試圖將影響力延伸到台灣的社群媒體。
4. 假新聞的攻擊行動被層層外包

   在選舉期間大量的行銷公司與新興媒體成立並散播特定政治訊息，讓真正的攻擊者可以輕易地隱藏於之後。

我們以資安研究員的角度出發，整合過去兩年間 TeamT5 拆解過的選舉假新聞攻擊事件，希望能替下一場民主選舉貢獻心力。

若對本份白皮書有興趣，請填寫表單，我們會以電子郵件的方式寄送。 TeamT5 接下來還會解析中國如何對內與對外利用社群媒體進行資訊的操弄。不想錯過我們接下來發布的報告，請追蹤我們的[Twitter](https://twitter.com/TeamT5_Official)。


TeamT5 發布了〈資訊戰白皮書：2020台灣大選觀察〉

To confront the emerging threat of China's Information Operation, TeamT5 threat intelligence team publishes this White Paper covering how China conduct information manipulation across Chinese social media platforms. From the 2019 Hong Kong Protest to the 2020 COVID-19 pandemic, China has demonstrated the art of surveillance, censorship, and most importantly, digital propaganda.

In this white paper, we focus on China's digital propaganda inside the Great Firewall. We suggest that the regime has developed a unique, organizational, and sophisticated propaganda mechanism, which we dub as "digital propaganda formula." With this formula, the Chinese Communist Party (CCP) has managed to transform all the Chinese social media platforms inside the Great Firewall into an almost total pro-CCP environment.

#### Key Takeaways

1. CCP has strengthened its control over Chinese cyberspace by establishing legislations as well as centralizing administrations, and the "last mile" of its cyber governance is to control public opinion through censorship and digital propaganda.

2. We dub China's sophisticated propaganda mechanism the "digital propaganda formula," which consists of state media, communist youth league, governmental affairs new media, as well as trolling factory.

3. Moreover, CCP's policies have bolstered the industry of "public opinion guidance" in China. The industry practitioners have developed AI and big data-powered systems to help the government to collect, store, and analyze public sentiment.

4. China's formula has polluted the online information environment inside the Great Firewall. We assess that the CCP is trying to project its digital propaganda dominance to foreign social media platforms in order to control the world's discourse power. 

Following the global pandemic, the world relies on the internet more than ever. Cyber threat actors and influence operators, either state-backed or money driven, are taking the advantage to conduct information operation. TeamT5 threat intelligence team aims to deliver actionable intelligence and penetrating analytics and contribute to the safeguarding of cyberspace.

If you are interested in this white paper, please fill out the form below and get the full-text PDF.

 

**COMING UP NEXT**

In Part 3 of our Information Operation White Paper, we will focus on the external propaganda of the CCP. We will provide an overview of the current status and impact of Chinese propaganda machine and information operation on Western social media platforms, such as Facebook, Twitter, and YouTube.

If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper (Part 2 of 3): China’s Digital Propaganda Formula inside the Great Firewall

面對中國日趨積極、強烈的資訊操弄（Social Manipulation），TeamT5情資團隊以資訊安全研究員的視角，推出最新的〈資訊戰白皮書二部曲〉（Information Operation White Paper），進一步分析中國在「防火長城」（Great Firewall）內，如何透過社群媒體進行數位政治宣傳（Digital Propaganda）。

除了廣為人知的言論審查制度，中國在防火長城內的資訊操弄，更包含主動的數位政治宣傳。從2019年香港反送中抗爭事件，到2020年的新冠肺炎疫情，我們可以清楚看到中國越來越「爐火純青」的數位政治宣傳實力。防火長城內對社群媒體的操控，神秘、難以探知，中國更設法將牆內轉化成中國共產黨的「一言堂」，阻止了理性政治討論的可能性。

在〈資訊戰白皮書二部曲〉中，我們聚焦於：

1.	近年來，中國藉由大量的網路相關立法與集中整併政府資源，強化網路控制。而控制公眾言論的數位政治宣傳，就是中國網路治理的「最後一哩路」。

2.	我們認為中國的數位政治宣傳機制，依循著一個極為有效的「配方」（Digital Propaganda Formula），由四個要素組成：官方媒體、共青團、政務新媒體，以及中國的水軍大隊。

3.	在中國政府資源帶領下，「輿情引導產業」興起，提供人工智慧與大數據工具，替政府收集、儲存、進而分析網路民意。

4.	我們認為，中國藉著其政治宣傳配方來穩定牆內的網路生態，而下一步，就是要將自身在西方社群媒體的影響力，擴張到國外，競逐世界話語權。

在疫情之後，網路世界成為新常態（new normal）不可或缺的一部分。但於此同時，也讓網路威脅，不論是傳統駭客行動者或是社群媒體操弄者（influence operators），有更多機會發動攻擊。TeamT5情資團隊致力於傳遞有用的情資與協助決策的分析報告，希望對提升網路安全盡一份心力。

若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。

 

**下期預告**

在接下來的〈資訊戰白皮書三部曲〉中，我們將討論中國對外的政治宣傳，看中國政治宣傳機器的現況與其影響，以及中國在西方社群媒體平台上的資訊作戰。

不想錯過我們接下來發布的報告，請追蹤我們的 [Twitter](https://twitter.com/TeamT5_Official)。

TeamT5〈資訊戰白皮書二部曲：中國防火長城內的數位政治宣傳〉

*Image courtesy of CODE BLUE from https://codeblue.jp/2020/en/

CODE BLUE 2020 is held online for two days on October 29th and 30th due to the COVID-19 pandemic. And TeamT5 is thrilled to be sponsoring and participating in this top-class information security conference in Japan.
 
We are very honored to attend this virtual event this year, and our cyber threat analysts and malware researchers are going to talk at CODE BLUE 2020. We also organize a workshop together with our partner, Terilogy Worx Corporation. Join us and don't miss out on this fantastic event!

Here is an overview of our speech and workshop.

### Speech

- **Law & Policy | Dissecting China’s Information Operations with Threat Intelligence**

Our cyberthreat analysts Che Chang and Silvia Yeh will share their findings on China’s Information Operations on social media platforms.

![twitter_talk1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk1_0dcc012fee.png)

 

- **CyberCrime | Operation I am Tom: How APT Actors Move Laterally in Corporate Networks**

Our CTO Charles Li and malware researcher Aragorn Tseng will present lateral movement methods to penetrate corporate network environments and techniques to bypass security monitoring systems.

![twitter_talk2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk2_96b51874a6.png)

 
 
- **Open Talk | Cyber Cold War and Tensions – The Critical Infrastructures Are Under Attack**

Our CEO, Sung-ting Tsai (TT), will share the experience we have learned from the security incidents in Taiwan, especially for the attacks targeting critical infrastructures.

![twitter_open-talk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_open-talk_855b5d4b4b.png)

 

### Workshop: APT Malware Analysis 101

TeamT5 and our partner, Terilogy Worx Corporation, co-host a virtual workshop on CODE BLUE 2020. Our Lab Engine and Global Support team will demonstrate basic techniques of reverse-engineering malware with our threat hunting tool - ThreatSonar. This workshop is available in English and Japanese (consecutive interpretation).

![twitter_worksop](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_worksop_fb1cf3480a.png)

- **Speakers**
 - TeamT5 Lab Engine & Global Support
 - Terilogy Worx Corporation, Director, Business development, Yoichi Matsuura

- **Abstract**

This workshop will teach you about the basic technique of reverse-engineering malware, and how to analyze it according to OSINT. We will focus on two of the most dangerous malware this year: BigPooh (LODEINFO) and LNCookie (TSCookie Linux version) based on both Linux and Windows OS. You will learn a lot of practical concepts when analyzing APT malware. Furthermore, we will also show you how to proceed with analysis and threat hunting by using our simple/light-weight tool - ThreatSonar.

- **Location**: via Google Meet. Registration form on CODE BLUE [EventHub](https://client.eventhub.jp/ticket/tZ8hp0-Qk).

![register2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603770757/register2_ef67e87cf1.png)
_Registration Guide for TeamT5 Workshop_

 

### What’s CODE BLUE?

CODE BLUE is Japan’s largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world’s top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on CODE BLUE 2020 [Official Website](https://codeblue.jp/2020/en/).

TeamT5 Exhibits at "CODE BLUE 2020" Virtual Event

*Image courtesy of CODE BLUE from https://codeblue.jp/2020/en/

今年のCODE BLUEは10月29日、30日の両日、COVID-19の影響によりオンラインで開催されます。Team T5は、日本でトップクラスのこのセキュリティカンファレンスにスポンサーとして参加できることを非常にうれしく思います。

私たちはこのバーチャルイベントに参加し、また、我々のサイバー脅威分析官やマルウェア分析官がCODE BLUE 2020のスピーカーとして登壇できることを誇りに感じております。 

ここで、CODE BLUE 2020で私たちが予定しているイベントについてご紹介しましょう。

### スピーチ

- **法とポリシー：「脅威インテリジェンスによる中国の情報操作の分析」**

私たちのサイバー脅威分析官であるチェ・チャンとシルビア・イェが、中国のソーシャルメディアプラットフォームにおける情報操作についてご説明します。

![twitter_talk1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk1_0dcc012fee.png)

 

- **サイバー犯罪：「Operation I am Tom：企業ネットワークにおいてAPTアクターがその内部で移動する方法」**

Team T5のCTOであるチャールズ・リーとマルウェア分析官のアラゴルン・ツェンから、企業ネットワークにおけるラテラルムーブメントの手法とセキュリティモニタリングシステムのバイパス手法についてご説明します。

![twitter_talk2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk2_96b51874a6.png)

 
 
- **オープントーク：「サイバー冷戦と緊張 ― クリティカルインフラストラクチャは攻撃されている」**

Team T5のCEOであるSung-ting Tsai(TT)が、私たちが実際に台湾で経験したセキュリティインシデントから学んだ経験から、とくにクリティカルインフラストラクチャを目標にした攻撃に関してお話しします。

![twitter_open-talk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_open-talk_855b5d4b4b.png)

 

### ワークショップ：APTマルウェア分析入門

TeamT5のLab Engine & Global Supportチームとパートナーのテリロジーワークスによる、ワークショップです。脅威ハンティングツールである「ThreatSonar」を用いたマルウェアのリバースエンジニアリングのための基本テクニックを、日英両言語で説明します。

![twitter_worksop](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_worksop_fb1cf3480a.png)

- **スピーカー**
 - TeamT5 Lab Engine & Global Support
 - 株式会社テリロジーワークス　ディレクター　ビジネス開発担当 松浦　洋一

- **要約**

このワークショップではマルウェアのリバースエンジニアリングに必要な基礎テクニックとＯＳＩＮＴを用いた分析方法について説明します。今回はLinuxおよびWindows環境の2つの最も危険度の高いマルウェア「BigPooh(LODEINFO)」と「LNCookie(TSCookie Linux version)」に注目して分析を行いますので、APTマルウェアの解析に必要な多くの実践的なコンセプトを学ぶことができます。また、分析と脅威ハンティングに最適な弊社ツール「ThreatSonar」を用いた手法についてもお話しします。

 

- **開催はCODE BLUE [EventHub](https://client.eventhub.jp/ticket/tZ8hp0-Qk)が提供するGoogleMeetで行います。**

![workshop_jp instruction](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603935671/workshop_jp_instruction_653442301b.png)

 

### CODE BLUEとは？

CODE BLUEは日本で最大級の情報セキュリティカンファレンスであり、CODE(技術)を通じて人々を結び、BLUE(海原)を超えて集うことにより、より良いインターネット世界に貢献することを目的としています。毎年世界中からトップクラスのスペシャリストやリサーチャーが最新の発見や最先端の話題を持ち寄って集まっています。ここはすべての参加者にとって、様々なセキュリティ問題に関して情報交換し、協力しながら対応、解決していくための場なのです。

さらに詳しい情報はCODE BLUE 2020オフィシャルサイトへどうぞ。

https://codeblue.jp/2020/en/

TeamT5 は“CODE BLUE 2020”オンラインイベントに登壇します

In the final part of our Information Operation White Paper, we will demonstrate China's Information Operations (InfoOps) targeting the global audience. The first part of the report displays a brief overview of its overt operations which are carried out by state media, embassies, and diplomats. Then we look into the covert operations, which can be observed in pro-China fan pages, content farms, and spam botnet. Last but not least, we provide the case study of "Operation Juiker" on Taiwan's largest forum PTT, which suggests the possibility of the APT (Advanced Persistent Threat) actors entering the threat landscape.

#### Key Takeaways

1. China has escalated the level of overt InfoOps via state-media and diplomats.
 
 
Chinese state media, diplomats, and embassies are the main actors of Chinese overt InfoOps. They shoulder the task to polish the image of the regime and propagate the narrative of the Chinese Communist Party (CCP). It is noteworthy that their official accounts have obtained an unexpected number of followers in recent years. For instance, four Chinese state media are included in the top 20 most-followed pages on Facebook. Their main audience, apart from the Chinese citizens, are overseas Chinese diaspora, which many of them have rights to vote in countries such as the U.S., Canada, and Australia, thus having the ability to influence a country's politics.
 
 
2. Covert InfoOps remain active on Western social media platforms.
 
 
2020 is a year which has set many records. This year, the takedowns of covert Chinese social media accounts by Facebook, Twitter, and Google are more frequent than ever. However, even with such efforts, we observed that there are new covert actors emerging across the platforms, while the banned actors keep coming back to the scene by registering new domains and new accounts. We spotted that there is a huge number of Facebook pages with admins located in China dedicated to disseminating Chinese propaganda content originated from Chinese social media platform, Weibo. Besides, there are sophisticated actors that create websites and subtle content to help the Chinese government shaping the narrative for the Hong Kong protest. We also detected numerous networks of pro-China political accounts that demonstrated strong signs of automated behavior.
 
 
3. APT actors might have entered the InfoOps threat landscape.
 
 
The situation is become more alarming as we discovered that the Advanced Persistent Threat (APT) actors might have entered the InfoOps threat landscape. APT actors, typically a state-sponsored group, usually conduct prolonged and targeted cyberattacks to mine highly sensitive data. However, in mid-2020, we identified an InfoOp that can be linked to a notorious Chinese APT group which TeamT5 intelligence team has tracked for years. We discovered that the threat actors had disseminated disinformation about "Juiker," a messaging app developed by Taiwan's research institute and widely used by government units, on Taiwan's largest forum PTT. The operation, which we dub as "Operation Juiker," aimed to discredit Taiwan's intelligence agency and government-backed research institute by spreading disinformation of the messaging app being hacked.
 
 
4. It is more crucial than ever to adopt threat intelligence solutions to combat the issue.
 
 
The abovementioned Operation Juiker has well demonstrated the possibility of "APT + InfoOp" attack model, which involves targeted social media campaigns disseminating disinformation based on highly confidential data. Such situation is super tricky, and it could pose a great threat to democratic countries. In this case, threat intelligence can help provide instant analysis of actor methodologies, suspicious indicators, and potential risks. We suggest that it is crucial for government units, critical infrastructure operators, and major business vendors to apply threat intelligence to combat this issue.
 
 

If you are interested in this white paper, please fill out the form below and get the full-text PDF.
 
 
And don't miss our blog updates! Follow us on [Twitter](https://twitter.com/TeamT5_Official).

InfoOp White Paper III: China’s Social Manipulation outside the Great Firewall

在 TeamT5〈資訊戰白皮書〉的最後一部曲中，我們將呈現中國的資訊作戰（Information Operation）是如何瞄準全球社群媒體使用者。TeamT5 希望透過這系列白皮書，分享我們作為資安研究員，如何理解中國的社群操弄。

此份白皮書的前兩個章節，介紹中國檯面上與檯面下的行動。首先觀察中國在檯面上（overt operation）如何透過中國的官媒、大使館、外交官，在社群媒體創造自己的聲量。接著分析中國檯面下的行動（covert operation），進一步研究那些無法被輕易歸因的粉絲頁、內容農場與大量的僵屍帳號。最後一章將以 PTT 論壇上關於 Juiker 的假新聞攻擊為例，提出資訊戰當中，我們最擔心的 —— 由「進階持續性滲透威脅」（APT）發起的假新聞攻擊。

 
#### 報告摘要

1. 中國持續透過官媒與外交官進行檯面上的社群操弄
 
 
中國的官媒、外交官、大使館是中國檯面上的主要行動者。這些行動者負責美化中國外在形象，以及散播對中國執政黨有利的論述。根據我們的觀察，這些帳號在西方社群媒體中都擁有大量的追蹤者，Facebook 粉絲頁中，追蹤數排名世界前 20 名的新聞媒體，第一名到第四名就是由中國官媒粉絲頁 CGTN、China Daily、People's Daily、Xinhua News 包辦。中國檯面上的社群操弄，主要針對位在美國、加拿大、澳洲等英語系國家的海外華人，並透過他們對當地的政治進行一定影響。
 
 
2. 檯面下的社群操弄持續在西方主流社群平台出沒
 
 
2020 年，西方主流社群平台 Facebook、Twitter、Google 等，都曾數次移除各自平台上與中國有關的假帳號。儘管平台方已如此頻繁地掃蕩，許多隱匿的行動者仍然在各大平台上出沒，那些曾遭移除的帳號背後，有行動者持續透過註冊新網域和帳號捲土重來。我們不斷觀察到許多可疑帳號，例如許多擁有中國管理員的粉絲頁，會搬運微博上的政治宣傳。更有甚者，我們發現許多配備精良的攻擊者，會自己架設網站和疑似是自動化產生的僵屍帳號，來協助中國政府攻擊香港抗爭者。
 
 
3. APT 攻擊者很可能參與了社群媒體上的資訊戰
 
 
我們擔心 APT 攻擊者很可能參與了社群媒體上的資訊戰。APT 通常是由一個國家所支持的駭客團體，以竊取機敏資料為主，APT 的攻擊者往往具備了強悍的網路攻擊手法與資源。然而，我們今年偵察到了一個可能是由 APT 攻擊者發動的假新聞攻擊。該事件發生在 2020 年七月，PTT 論壇八卦版上，開始有許多被盜用的帳號以假新聞攻擊台灣重要軍事單位，造謠台灣公務機關使用的 Juiker 通訊軟體遭駭，以及台灣重要軍事機關遭駭。我們透過搜索比對貼文與發文 IP，發現其中一個 IP 位址，符合某個中國 APT 曾經使用過的中繼站。
 
 
4. 威脅情資作為對抗資訊戰的重要環節
 
 
如同前述的分析脈絡，APT 與社群操弄的結合會讓防守方更加棘手。在棘手的防守環境中，唯有威脅情資（threat intelligence）可以提供即時的分析，評估攻擊者的攻擊手法、可疑的指標、以及造成的風險。而在快速更迭的社群媒體環境中，平台方與事實查核團體非常難找到證據，歸因大量散播的假新聞。我們認為唯有導入威脅情資，才能有效幫助政府單位、重要關鍵基礎設施與企業，對抗資訊戰。
 
 

若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。
 
 
追蹤 TemaT5 [Twitter](https://twitter.com/TeamT5_Official)，資安動態不漏接！

資訊戰白皮書三部曲：中國的社群操弄

インフォメーション オペレーション

Information Operation

**Time** | Tuesday, 4 August 2020, 3:00 - 4:00 pm (GMT+8)

**Registration** | Please contact our sales and get the registration link: <sales@teamt5.org>

 

Taiwan's 2018 municipal elections and 2020 general elections were both under the great threat of Information Operation (InfoOp). To influence the outcome of elections, state-backed threat actors have exploited the features of social media environment to conduct InfoOps, which involves the spread of disinformation, hate speech, and propaganda. Their operations had polarized and manipulated the voters, which in turn polluted the digital information ecosystem.

Join TeamT5's exclusive live webinar, and hear our cyber threat intelligence analysts, Che Chang and Silvia Yeh, to grasp the basic understanding of InfoOp in Chinese-language cyberspace, and how China conducts InfoOp on social media platforms.

**Register for this webinar to discover:**

- What is Information Operation (InfoOp) and how does it endanger the users on social media platforms?
- How do we contribute to the fight against InfoOp in 2020 Taiwan Presidential Election?
- How does China conduct InfoOp in pursuit of its political interest?

*Note: This live webinar will be offered in English only.

 

####Speakers
**Che Chang** is a Cyber Threat Analyst and the co-author of "TeamT5 Information Whitepaper." He focuses on underground markets research and state-sponsored Information Operation (InfoOp). Che is the invited speaker of many global and regional conferences, including 2020 April vGCTF workshop on Combatting COVID-19 Disinformation, 2019 Cybersec in Taiwan, a closed-door meeting of Taiwan Academia Sinica, etc.

**Silvia Yeh** is a Cyber Threat Analyst at TeamT5 Cyber Intelligence Team and the co-author of "TeamT5 Information Whitepaper." She focuses on issues related to Information Operations (InfoOps) and is currently responsible for cyber policies analysis of China and other Asia-Pacific countries.

Live Webinar: Dissecting Information Operation in Chinese-language Cyberspace

*Image courtesy of Black Hat from https://www.blackhat.com/us-20/

We were glad to announce that TeamT5 was again accepted at Black Hat USA. And this time, our vulnerability research team, D39, presented their latest exploit research on Samsung S10 secure bootloader at the Black Hat Briefings. We were very honored to share our research findings with researchers and security experts all over the world in this annual flagship conference.

![BHUSA_cover](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596699298/BHUSA_cover_48fcf0b266.jpg)
_TeamT5's vulnerability researcher presented on Black Hat USA 2020._

D39 has been focusing on vulnerability research and has identified several critical security flaws. We have found several vulnerabilities in Samsung Secure boot, which can break through Samsung Knox protections. In Black Hat USA 2020, we elaborated how did we discover and exploit the vulnerabilities in detail, demonstrated the exploit on a Samsung Galaxy S10 smartphone, and had a discussion on the possible impact of these vulnerabilities.

![Disclosure timeline](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596699297/Disclosure_timeline_422975e76a.jpg)
_Timeline of the vulnerability disclosure, patch release and assignment of SVE IDs._

Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat USA 2020 went fully virtual this year, held over the same dates from 1 to 6 August, in light of the coronavirus pandemic.

Black Hat’s Talk: D39 Shares Their Research on Breaking Samsung Secure Boot at Black Hat USA 2020

圖片來源：[Pixabay](https://pixabay.com/photos/toys-pony-my-little-pony-horse-4968006/)

## 緣起

WebLogic 是美商 Oracle 的主要產品之一，係商業市場上主要的 Java（J2EE）應用伺服器軟體（application server）之一。於 2020 年爆出高風險漏洞 CVE-2020-14882 與 CVE-2020-14883，其中，CVE-2020-14882 的 CVSS 3.1 評分更高達 9.8，屬於嚴重（Critical）等級之漏洞。

攻擊者可利用漏洞，組合惡意指令，使未經授權的請求繞過 WebLogic 後台登入等限制，最終可以遠端執行代碼攻擊（Remote Code Execution），因此攻擊者可輕易的利用此漏洞發起攻擊。

 

## 技術分析

我們從下圖的漏洞 POC 範例開始看起。

![blog_2101-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_1_7add5099fd.png)
_圖一、POC 攻擊範例_

 

首先 WebLogic 會對 url 進行檢查，當攻擊者試圖存取 console 路徑底下的檔案資源時（階段 A），會將其 url 與 WebLogic 設定檔（web.xml）內的網頁資源路徑進行比對，若該 url 屬於任一資源路徑，將不須驗證即可進行資源存取（階段 B）。其 web.xml 的檔案路徑為 wlserver/server/lib/consoleapp/webapp/WEB-INF/web.xml，如下圖所示。

![blog_2101-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_2_b9ab148ed5.png)
_圖二、web.xml 內容_

 

再來，```http://127.0.0.1:7001/console/images/%252E%252E%252Fconsole.portal``` 會先進行一次 url decode，將 %25 轉成 %，所以該 url 會變成 ```http://127.0.0.1:7001/console/images/%2E%2E%2Fconsole.portal```（階段 C）。

但是在 UIServletInternal.getTree 函式中，WebLogic 又會做再一次 url decode，將 %2E%2E%2F 轉為 ../，於是 url 變成```http://127.0.0.1:7001/console/images/../console.portal```，且後續的操作中 WebLogic 都沒有對路徑進行權限檢查，所以產生了跨目錄穿越攻擊（Directory Traversal）的漏洞。

WebLogic Server 處理後台管理（console）的請求時，會呼叫 BreadcrumbBacking().init 函式進行處理（階段 D）。當 url 中含有 handle 參數時，會將 handle 拆解成 class 和 argument。以 POC 為例，class 就會是 ```com.tangosol.coherence.mvel2.sh.ShellSession()```（階段 E），argument 則是 ```"java.lang.Runtime.getRuntime().exec(%27whoami%27);"```（階段 F）。

後續，會將 argument 傳給 class 的 constructor ，而 ShellSession 函式會再把 argument 傳給 MVELInterpretedRuntime 函式中，最後透過反射執行 argument 中內含的惡意指令，也就是 POC 範例中的 whoami。

 

## 修補插曲

但僅憑跨目錄穿越攻擊、Unauthorized RCE 等問題，何以稱之為「年度最慘漏洞（Most Epic Fail）」？

Oracle 於 2020 年 10 月釋出修補程式，但細究其修補的方法，發現 Oracle 利用黑名單的方式過濾 url 參數，如下圖所示。

![blog_2101-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433542/blog_2101_3_67ba9cf2c5.png)
_圖三、Oracle 透過黑名單修補 CVE-2020-14882_

 

#### 利用黑名單方式過濾，會有什麼問題呢？

只要利用不在黑名單內的 %252e%252e，就可以成功繞過（Bypass）已修補程式中的 url 檢查。

眾多安全研究人員於短時間內發現該問題並通報 Oracle，該漏洞也被編號為 CVE-2020-14750，如下圖所示。此錯誤的漏洞修補方式，也使得 CVE-2020-14882 成功入圍 2020 年 [Pwnie Award Most Epic Fail](https://pwnies.com/nominations/active/most-epic-fail/oracle-weblogic-server-co-oracle/) 項目。

![blog_2101-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_4_677f062e72.png)
_圖四、眾多研究員回報 CVE-2020-14750_

 

漏洞修補是一門深奧的學問，以 CVE-2020-14882 為例，其成因包含對檔案路徑存取控管不確實、對路徑做兩次的 url decode 及後台管理程式提供代碼執行。但 Oracle 一開始只修補兩次的 url decode 問題，更不用說其修補的方式為黑名單限制。因漏洞修補不確實而產生了更多的漏洞，所以不可不慎。

 

## 影響層面

攻擊者利用此漏洞互相搭配，不須登入即可遠端指令執行，進而產生憑證竊取（Credential Dump）、橫向移動（Lateral Movement）等攻擊行為。

- 受影響產品：WebLogic Server
- 受影響版本：10.3.6.0.0、12.1.3.0.0、12.2.1.3.0、12.2.1.4.0、14.1.1.0.0

 

## 防護建議

- 更新 Oracle 官方最新修正 [patch](https://www.oracle.com/security-alerts/cpuoct2020.html)。
- 惡意 payload 檢查，例如檢查 console.portal 和 payload 是否帶有 ```handle=...``` 參數，或是直接關閉 console.portal 和 payload 的 handle 功能。
- 匯入以下 Yara 偵測規則，確認是否存在利用該漏洞的惡意程式。

```
rule CVE_2020_14882 {
 meta:
 author = "TeamT5"
 description = "CVE-2020-14882 exploit"
 strings:
 $resource1 = "console/bea-helpsets/"
 $resource2 = "console/framework/skins/wlsconsole/images/"
 $resource3 = "console/framework/skins/wlsconsole/css/"
 $resource4 = "console/framework/skins/wlsconsole/js/"
 $resource5 = "console/framework/skeletons/wlsconsole/css/"
 $resource6 = "console/framework/skeletons/wlsconsole/js/"
 $resource7 = "console/css/"
 $resource8 = "console/common/"
 $resource9 = "console/images/"

 $console1 = "console.portal"
 $console2 = "consolejndi.portal"
 
 $handle = "handle="

 condition:
 any of ($resource*) and 1 of ($console*) and $handle
}
```

![blog_2101-5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_5_8a00e312e3.png)
_圖五、透過 Yara 偵測規則可有效偵測 CVE-2020-14882 exploit_

年度最慘漏洞！深入探究 Oracle WebLogic CVE-2020-14882

### D39

D39 focuses on vulnerability research and has identified several critical security flaws, including technical exploitation of mobile, IoT devices, and Linux and Windows operating systems. We have reported dozens of vulnerabilities and dedicate to Samsung Vulnerabilities and Exposures (SVE) and Common Vulnerabilities and Exposures (CVE).

Before diving into the main subject this month, we are glad to announce that TeamT5 is again accepted at Black Hat USA, and our vulnerability research team, D39, will talk at the Black Hat Briefings in the upcoming August. We are honored to share our research findings with researchers and security experts all over the world and expect more recognition of Taiwan's vulnerability researchers in the world.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769445/D39_6-1_6807f98c9b.png)
[Black Hat Session](https://www.blackhat.com/us-20/briefings/schedule/index.html#breaking-samsungs-root-of-trust-exploiting-samsung-s-secure-boot-20290)

This article will cover a part of our talk at Black Hat USA in August.

### Introduction

We have found several vulnerabilities in Samsung Secure boot, which can break through Samsung Knox protections. We can even retrieve users' sensitive data from a locked device. The affected Samsung mobiles include Galaxy S8, S9, and S10. Patches to these vulnerabilities have been provided by Samsung.

One of these vulnerabilities allows attackers to execute arbitrary code in Galaxy S8 secure bootloader to access the device. In this article, we will elaborate how we exploit these vulnerabilities to bypass S8 secure bootloader through the USB device and obtain arbitrary code execution in early boot stage.

Note: Another security research team found this vulnerability at the same time and report it to Samsung.
ID: SVE-2019-15230 (details below).
![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/SVE-2019_3bc5eea84d.png)

### KNOX

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769436/D39_6-2_ee457f68cd.png)
[Image courtesy](https://docs.samsungknox.com/whitepapers/knox-platform/hardware-backed-root-of-trust.htm)

As the market leader of smartphone, Samsung conducts a series of protection on Android, known as the Knox Platform, to ensure the security of its devices. During the booting process, Samsung uses S-boot (Secure Boot) to make sure it can only boot a stocked image. If the device tries to boot a custom image, it will trip (turned from 0X0 to 0X1) a one-time programmable bit e-fuse (a.k.a Knox bit). Once a trustzone app (trustlet) detects the Knox bit tripped, it will delete the encryption key of sensitive data to prevent unauthorized data from accessing the locked device.

### Vulnerability

Smartphones with Samsung Exynos processor use a exclusive secure bootloader named S-boot. S-boot has ODIN mode which allows users to upgrade the firmware manually. Due to the insufficiency in its code, the flash command (opcode: 0x66) in ODIN mode is not able to properly check the flash image size, which leads to buffer overflow.

The flash command in ODIN mode uses a temporary buffer to store the image. In Galaxy S8, the buffer is located at 0xC0000000, right in front of sboot code segment (0xC9000000). Although the system will check to ensure that the size being no larger than 0x1e0000, it uses signed comparison to check the size of the image; thus provide us some space to get around. We therefore provide a size larger than 0x80000000, making buffer overflowed and, in the end, the following segments such as code, stack, and heap will be overwritten.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/D39_6-3_8b038e080e.png)

### The Exploit

#### Code Execution

Although we can overflow the code segment of S-Boot, we still cannot hijack the execution flow. Since USB receivers use physical memory to hold the data it received directly, we cannot affect instruction cache unless the cache line has been invalidated.

Fortunately, the heap segment is not cached due to MMU flag. There are some pointers stored in the heap segment, which can be accessed during the USB process. If we overwrite these pointers with null bytes, the processor will trigger an exception and trap into the exception handler while accessing to NULL pointers. Since the handler has never been executed, it is not cached in the instruction cache. Therefore we can also overwrite the exception handler simultaneously and hijack it directly to our shellcode.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769437/D39_6-4_58c7cc6a95.png)

#### Booting Custom Kernel

Since all the run-time data has been overwritten -- including stack, heap and global variables -- the sboot fail to perform further booting operation. These kinds of data are difficult to recover, so we must re-execute the booting process.

Under normal condition, S-boot calls several functions in a particular function table which is located at 0xC90C7350. To re-execute s-boot, these functions have to be invoked sequentially again. They would initialize the memory of heap and stack, set the global variables, and boot the kernel at the end. However, these functions also involve some SMC calls which cannot be executed twice. Since we only compromised EL1 (Exception Level 1), the trustzone in EL3 (Exception Level 3) cannot be reverted. As a result, we have to overwrite these SMC calls with NOP instruction while overflowing the code segment to ignore those SMC (System Management Controller) calls.

After all the run-time data has been reset, we replace the original kernel with our custom one. Then we execute one last function to boot our custom kernel and get the **root privilege without blowing KNOX bit**.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769436/D39_6-5_2f6b6f9ccd.png)

### Timeline

2019-10-02 Report Vulnerability
2019-10-08 Informed Vulnerability duplicated and release patch note

### Appendix: Potential Exploit Path on Galaxy S10

According to our analysis, this vulnerability affects Galaxy S9, Galaxy S10 and Galaxy Note 10 as well. Among them we find that exploitation can still be trigger at different address. For instance, even the temporary buffer located at different addresss, like 0x890000000 in Galaxy S10, there are still chances to exploit it. To explain the complete exploitation flow, we choose the firmware, G970FXXU1ASD5, as an example.

In Galaxy S9 and later version, there is another feature added to the secure boot - compressed_download. It uses another buffer to store the flash image. However if compressed_download failed during the initialization, it will fallback to normal download, and use the buffer (0xC0000000) to store the flash image.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/D39_6-6_724f86aa51.png)

To make S-boot fallback to normal download, we have to make the function `cd_v3_smp_register` fail. After reversing, we noticed that the function `cd_v3_smp_register` may return failed if there is no available core(`booted_cores` > 3) can be booted. Coincidentally, there is a test command - "smp_boot_test" in the UART (Universal Asynchronous Receiver/Transmitter) console. The command smp_boot_test will boot a core and add the count of the booted_cores. Although `smp_boot_test` shutdown the booted up core immediately, it didn't restore the count. Therefore, the compressed_download_init may failed if the command `smp_boot_test` has been invoked more than twice before entering the download mode.

If we have the UART debug cable to get the UART console, we can call the command`smp_boot_test` 3 times and enter the download mode via the command `usb`. The `compressed_download_init` would fail, then the temporary buffer fallback to 0xC0000000. Therefore the arbitrary code execution on S10's bootloader can be achieved as the one in Galaxy S8.

We managed to build our own TypeC debug cable at first. However, after trying every kinds of Pull-up/down resistor value, TypeC accessory mode, TypeC VDM, we cannot yet figure out a cable for RID_523K detection. Still, in the end, we applied other approach that enable us to attain **Galaxy S10 Secure Bootloader's permission of arbitrary code** without having debug cable.

We will have a thorough display on Black Hat. Stay tuned!

For the latest vulnerability research from D39, please follow:

TeamT5 official website: [https://teamt5.org/](https://teamt5.org/ "https://teamt5.org/")

Twitter: [https://twitter.com/TeamT5_Official](https://twitter.com/TeamT5_Official "https://twitter.com/TeamT5_Official")

BlackHat's Talk: Breaking Samsung's Root of Trust - Exploiting Samsung Secure Boot

Technical Analysis

*\*Please noted that this blog post is a shortened version of our analysis. To assess the full version of the analysis, please subscribe our report "Cyber Affairs Biweekly-Update."*

### Key Takeaways

1. China has exerted ever greater influence over the globe since the outbreak of the coronavirus. Over the past three months, TeamT5 has been monitoring how China utilizes its cyber strength and propaganda machine to handle the Covid-19 pandemic.
2. The Chinese authorities have collaborated with telecom firms and tech giants in China, using technologies such as big data to control the public opinion and people's movement. The regime has implemented measures such as digital surveillance, keywords censorship on social media applications, and Health Code System.
3. Moreover, China has also exercised its propaganda machine to shape both domestic and international narrative of the pandemic. The Chinese officials and Chinese state media have utilized various social media platforms, particularly Weibo and Twitter, to disseminate propaganda to Chinese people and foreign audiences. Some Chinese officials have connived and even promoted online conspiracy theory, which claimed China is not the origin of the coronavirus.

### Blurred Lines Between State and Corps: Telecom Surveillance and Health Code System

The Chinese Communist Party (CCP) has collaborated with its national tech giants and telecom firms to implement a series of security measures in the name of containing the coronavirus outbreak.

The regime has elevated its digital control over domestic citizens. In mid-February, China's Ministry of Industry and Information Technology (MIIT) sent a notice to Information and Communications Technology (ICT) service providers, demanding relevant firms to strengthen monitoring and censorship over online public discussion.\[1\] The MIIT also announced the utilization of telecom big data analysis in support of the battle against the coronavirus. \[2\]

As the country tried to resume normal operations, the Chinese authorities launched Health Code System, using big data to monitor citizens' health status and then regulate their movement. The Health Code System is developed by the Ant Financial, an affiliate company of the Chinese Alibaba Group, and Tencent in collaboration with the Chinese authorities.

The system has raised privacy concerns since it connects and integrates databases of government units and private firms, forming a comprehensive surveillance system which contains real name, phone number, ID, address, travel history, health status and contact history. Moreover, only 3 out of 16 Health Code Apps list their user agreement and privacy policy at installation, while others will directly direct users to the registration page to fill out personal information.\[3\] This shows that most of the users' data are collected, processed, and shared without informed consent.

### Strategic Distraction and Positive Propaganda Targeting Domestic Citizens

The authoritarian regime is also in another battle to shape the public opinion about the epidemic. Initially, the Chinese state media employed strategic distraction to mitigate the seriousness of the coronavirus. Before Wuhan Lockdown on January 23, Chinese state media started reporting the Influenza B in the United States.\[4\] The topic "Influenza B outbreak in the US" (美国爆发乙型流感) reached 500 million views and 31,000 discussions on Weibo.\[5\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_1_4fb4158a6a.png)_Figure 1: News report by the China Central Television (CCTV)._

As the number confirmed cases soared in China, the Chinese state media outlets started to spread positive propaganda. For instance, they highly praised the Chinese authorities' handling of the virus by highlighting the rapid construction of Huoshenshan Hospital.\[6\] They also promoted narratives such as "the Chinese people are sacrificing to fight the virus", accompanied by praises from WHO Director General Tedros Adhanom Ghebreyesus.\[7\]\[8\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718736/SR_2_0b7b7f6542.png)_Figure 2: YouTube video by China Global Television Network (CGTN)._

The regime has seized the opportunity to demonstrate the country's strength to contain the virus as well as the advantages of an authoritarian regime. The CCP uses the case to show that its authoritarian governance system is more effective than the liberal democracies when facing a crisis like the Covid-19 pandemic.

### Propaganda, Hoaxes and Conspiracy Theories: From Troublemaker to Global Savior

Although China was widely criticized for its delayed and opaque treatment to the coronavirus outbreak during the initial stage, the regime has backed on its feet to polish its international image after the pandemic seems to have subsided in China.

In particular, Italy, the first G-7 country to join China's Belt and Road Initiative (BRI), became a favorable environment for the regime to launch propaganda. We observed a series of propaganda was launched against Italy.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_3_c2c0ee47d2.png)_Figure 3: The Chinese embassy posted a series of tweets to promote China's medical aids foe Italy, using hashtag #ForzaCinaeItalia_

The campaign is revealed to have boosted by social manipulation, as the hashtag #ForzaCinaeItalia (Go China, go Italy) was promoted by Twitter bot accounts.\[9\]

In another case, since March 15, Chinese state media outlets as well as Chinese diplomats Hua Chunying and Zhao Lijian have promoted a video of Italian chanting "Grazie, Cina!" on their balconies with the Chinese anthem "March of the Volunteers" playing.\[10\] The video was examined by researchers and was claimed to be manufactured.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718737/SR_4_b4d7e95934.png)_Figure 4: Hua Chunying's sharing the video on Twitter._

### "Origin" Propaganda: Conspiracy Theories of Patient Zero

Conspiracy theories of the origin of the coronavirus have emerged across social media platforms as early as January. One of the significant cases is a conspiracy theory claiming that the US military had brought the coronavirus to Wuhan during the 2019 Military World Games.

Starting from March 12, 2020, Zhao Lijian, a deputy director of the Chinese Foreign Ministry's Information Department, has posted a series of tweet to amplify the conspiracy theory on Twitter. In one of his tweets, he shared a video clip of US Centers for Disease Control (CDC) chief Robert Redfield saying some Covid-19 death might have been diagnosed as influenza in the US, using it as evidence that the virus originated in the US.\[11\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_5_2802d4b539.png)_Figure 5: A series of tweets by Zhao Lijian promoting the conspiracy theory, along with articles of "globalresearch.ca". The website often promotes anti-US conspiracy theory._

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_6_2bb97447e7.png)_Figure 6: Global Times reporting the conspiracy theory about US military personnel bringing COVID-19 to China._

Besides the US, Italy is also one of the scapegoats for China's coronavirus origin propaganda. Starting from March 22, multiple Chinese state media outlets have published news article titled "Coronavirus may have existed in Italy since November: local researcher," implying that Italy was the origin of Coronavirus.\[12\]\[13\] They cited the words of the Italian physician Giuseppe Remuzzi in an interview with NPR on March 19 \[14\], using it as statement to prove that China is not the origin of the coronavirus.

Although Remuzzi protested that his words were twisted by China, the narrative has already gone viral.\[15\] The CCTV created a topic "Expert claims the coronavirus may have existed in Italy since November" (专家称疫情去年11月或已在意大利流行), which reached approximately 500 million views and 35,000 discussion posts.

### Conclusion

China's cyber strength and digital influence did not scale down even in the times of the pandemic. Instead, the regime took the opportunity to pose itself as a global leader more capable than the US. We can see that the CCP has well mastered its cyber capabilities and propaganda machine, expanding the regime's control from physical entities to public opinion. Moreover, the CCP has elevated its efforts to shape international opinion through the Twitter platform. We assess that the CCP will have more power of discourse and influence after they learned to conduct propaganda campaign on foreign social media platforms, and every party should be vigilant about it.

### Reference

\[1\] 工业和信息化部办公厅关于做好疫情防控期间信息通信行业网络安全保障工作的通知 (MIIT's Notice on Cybersecurity Practice for Information and Communications Technology (ICT) Service Providers During Epidemic Control)  
http://www.miit.gov.cn/n1146290/n1146402/c7681785/content.html

\[2\] 工业和信息化部召开媒体通气会 介绍电信大数据分析、支撑服务疫情防控总体情况 (MIIT's Media Briefing on the Utilization of Telecom Big Data Analysis on Epidemic Control)  
http://www.miit.gov.cn/n1146290/n1146402/c7678438/content.html

\[3\] 健康码的隐私政策还有哪些改进空间？(Room of Improvement on the Health Code System's Privacy Policy)  
https://www.jiemian.com/article/4120372.html

\[4\] 美国暴发40年来最致命流感 已有6600人死亡 (US' Worst Influenza Outbreak in 40 Years, 6600 Americans Killed)  
http://news.sina.com.cn/w/2020-01-22/doc-iihnzhha4088647.shtml

\[5\] https://s.weibo.com/weibo?q=%23美国爆发乙型流感%23&Refer=SWeibo_box

\[6\] CGTN: Time lapse video: Construction of Wuhan Huoshenshan Hospital completed  
https://www.youtube.com/watch?v=53nhErXUd9A

\[7\] 中国人民"正在为全人类作贡献" (Chinese People are Contributing for All Human Kind)  
http://world.people.com.cn/n1/2020/0308/c1002-31622166.html

\[8\] Xinhua Net: China deserves appreciation for efforts, sacrifices in fighting epidemic: WHO chief  
http://www.xinhuanet.com/english/2020-02/16/c_138789289.htm

\[9\] How China unleashed Twitter bots to spread COVID-19 propaganda in Italy  
https://formiche.net/2020/03/china-unleashed-twitter-bots-covid19-propaganda-italy/

\[10\] https://twitter.com/SpokespersonCHN/status/1239041044580188162  
https://twitter.com/zlj517/status/1239112822908276736  
CGTN: Italians play Chinese national anthem to thank China for its aid  
https://www.youtube.com/watch?v=8ZKsA2jbwlk  
CCTV: Italians play Chinese national anthem, chanting "Grazie Cina"  
https://www.facebook.com/watch/?v=201784281098386

\[11\] https://twitter.com/zlj517/status/1238111898828066823

\[12\] Coronavirus may have existed in Italy since November: local researcher  
https://news.cgtn.com/news/2020-03-22/Coronavirus-may-have-existed-in-Italy-since-November-local-researcher-P4i2As2OAg/index.html

\[13\] Italian doctors saw strange pneumonia cases before China's COVID-19 outbreak, report says   
http://www.china.org.cn/world/Off_the_Wire/2020-03/22/content_75845579.htm

\[14\] 'Every Single Individual Must Stay Home': Italy's Coronavirus Surge Strains Hospitals  
https://www.npr.org/2020/03/19/817974987/every-single-individual-must-stay-home-italy-s-coronavirus-deaths-pass-china-s?t=1585131614833

\[15\] Beijing twisted my words on coronavirus's Italian origin, says scientist Giuseppe Remuzzi  
https://www.thetimes.co.uk/article/beijing-twisted-my-words-on-coronaviruss-italian-origin-says-scientist-giuseppe-remuzzi-6twwhkrvn

Special Report: How China Utilizes Its Cyber Strength and Propaganda Machine to Handle the COVID-19 Pandemic

Events

News

TeamT5 攜手日商 Macnica Networks 與 Terilogy Technology 合作提供「企業 APT 攻擊防疫計畫」，協助日本境內關鍵基礎設施（Critical Infrastructure）的相關企業在新冠肺炎疫情期間對抗 APT 攻擊（Advanced Persistent Threat）。

「企業 APT 攻擊防疫計畫」將使用 ThreatSonar 掃描與診斷 14 個關鍵基礎設施產業，包括：政府、軍事國防、情報通信、金融、航空、鐵路、電力、水利、醫療、物流、化學、石油瓦斯及半導體等。我們的威脅診斷工具 ThreatSonar 可協助企業防範資安事件於未然，及早偵測潛藏的 APT 風險。

同時因應台灣各大企業，尤其是關鍵基礎設施營運單位，在疫情時期大幅上升的資安危機，TeamT5 同時推出「遠端辦公防疫計畫」（WFH Cloud Program）來替各大企業診斷與辨認一般防毒軟體無法有效守備的 APT 攻擊。

關於日本境內的「企業 APT 攻擊防疫計畫」申請方式與服務內容，請洽詢當地代理商來了解更多申請資訊與適用辦法。至於台灣的「遠端辦公防疫計畫」，請洽台灣業務。

TeamT5 聯手 Macnica Networks 與 Terilogy Technology，幫助「關鍵基礎設施」對抗 APT 攻擊

TeamT5 and Macnica Networks have published our joint research on APT attacks targeting Japan over the past year. In this collaborative research, we provide valuable insight into four advanced persistent threat (APT) groups and actors. The full report will first be available in Japanese and can be accessed at Macnica Networks' website.
 
The APT groups' highlighted in this joint project were believed to have been launching cyber espionage campaigns elsewhere in the world. To enhance APT defense strategies, we take a closer look at the four APT groups, including DarkHotel, Huapi (BlackTech), Nian (Tick), and one unclassified backdoor LODEINFO. These APT groups have been threatening crucial sectors in Japan, such as government, military and defense, manufacturing, telecommunication, education, media, and etc.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590655880/APT_Attack_Timeline_2019_2da7de1832.png)
_The attack timeline of the APT groups' campaigns in Japan in 2019._

Macnica Networks is one of the largest system integrators (SI) in Japan. As a leading network distributor, it provides a wide range of advanced network products and information technology to government offices, educational institutions, and general companies.

To access the full report, please visit: [https://www.macnica.net/mpressioncss/feature_06.html/](https://www.macnica.net/mpressioncss/feature_06.html/ "https://www.macnica.net/mpressioncss/feature_06.html/")