Educause conference: https://events.educause.edu/security-professionals-conference/2020/hotel-and-travel    Amanda’s Training that everyone should come to!!! https://nolacon.com/training/2020/security-detect-and-defense-ttx Follow twitter.com/infosecroleplay   Part 1: New year, new things   Discussion:   What happened over the holidays? What did you get for christmas?   PMP test is scheduled for 10 March Proposal:  Anonymous Hacker segment     Similar to “The Stig” on Top Gear. If you would like to come on and discuss any topic you would like. You’ll have anonymity, we won’t share your contact info   Will allow people worried that they’ll be ridiculed to share their knowledge We can record your 20-30 segment whenever (will need audio/video for it) You can take a tutorial from another site (or your own) and review it for us 1-2 segments per month  We can discuss content prior to (we won’t put you on the spot) We do have a preliminary News:   Google removed 1.7K+ Joker Malware infected apps from its Play Store                      Full article: https://securityaffairs.co/wordpress/96295/malware/joker-malware-actiity.html   Excerpt: Google revealed it successfully removed more than 1,700 apps from the Play Store over the past three years that had been infected with the Joker malware. Google provided technical details of its activity against the Joker malware (aka Bread) operation during the last few years. The Joker malware is a malicious code camouflaged as a system app and allows attackers to perform a broad range of malicious operations, including disable the Google Play Protect service, install malicious apps, generate fake reviews, and show ads. The spyware is able to steal SMS messages, contact lists and device information along with to sign victims up for premium service subscriptions. In October, Google has removed from Google Play 24 apps because they were infected with Joker malware, the 24 malicious apps had a total of 472,000 installs. “Over the past couple of weeks, we have been observing a new Trojan on GooglePlay. So far, we have detected it in 24 apps with over 472,000+ installs in total.”    apps typically fall into two categories: SMS fraud (older versions) and toll fraud (newer versions). Both of these types of fraud take advantage of mobile billing techniques involving the user’s carrier.” reads the post published by Google. The newer versions of the Joker malware were involved in toll fraud that consist of tricking victims into subscribing to or purchasing various types of content via their mobile phone bill. WAP billing: https://en.wikipedia.org/wiki/WAP_billing Example: “pokemon go allows in-app purchases Over 25,000 Citrix (NetScaler) endpoints vulnerable to CVE-2019-19781   Full Article: https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/   Excerpt: On Friday, January 10, 2020, our honeypots detected opportunistic mass scanning activity originating from a host in Germany targeting Citrix Application Delivery Controller (ADC) and Citrix Gateway (also known as NetScaler Gateway) servers vulnerable to CVE-2019-19781. This critical vulnerability allows unauthenticated remote attackers to execute commands on the targeted server after chaining an arbitrary file read/write (directory traversal) flaw.   What type of organizations are affected by CVE-2019-19781?  (industries with typically poor or outdated security practices… --brbr) 4,576 unique autonomous systems (network providers) were found to have vulnerable Citrix endpoints on their network. We’ve discovered this vulnerability currently affects:   Military, federal, state, and city government agencies Public universities and schools Hospitals and healthcare providers Electric utilities and cooperatives Major financial and banking institutions Numerous Fortune 500 companies   How is CVE-2019-19781 exploited and what is the risk? This critical vulnerability is easy for attackers to exploit u