WhatsApp hack, Sowing Discord, Horde zero-day, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 02 June, 2022
Episode 236 - 02 June 2022
WhatsApp hack- https://www.bleepingcomputer.com/news/security/hackers-steal-whatsapp-accounts-using-call-forwarding-trick/
Sowing Discord -
https://threatpost.com/scammers-target-nft-discord-channel/179827/
New Windows zero-day - https://www.bleepingcomputer.com/news/security/new-windows-search-zero-day-added-to-microsoft-protocol-nightmare/
Elasticsearch snatched -
https://www.securityweek.com/cybercriminals-hold-1200-unsecured-elasticsearch-databases-ransom
Horde zero-day -
https://portswigger.net/daily-swig/horde-webmail-contains-zero-day-rce-bug-with-no-patch-on-the-horizon
Hi, I’m Paul Torgersen. It’s Thursday June 2nd, 2022, I think I said yesterday was Tuesday, and Tuesday was Monday. Obviously my brain is not comprehending the holiday very well. Anyway, this is a look at the information security news from overnight.
From BleepingComputer.com
Hackers are going after WhatsApp accounts to gain access to personal messages and contact lists. The method relies on the mobile carriers’ automated service to forward calls to a different phone number, and WhatsApp’s option to send a one-time password verification code via voice call. You can pursue all the details in the article.
From ThreatPost.com:
Hackers are escalating phishing and scamming attacks targeting NFT servers to exploit a popular Discord bot and persuade users to click on the malicious links. The discord bot mee6, which is used to automate welcome messages and inform visitors about the server rules, etc., seems to be compromised across several high profile servers. As always, when in doubt, don’t click the link.
From BleepingComputer.com:
A new Windows Search zero-day vulnerability can be used to automatically open a search window containing malware executables simply by launching a Word document. This error stems from Windows support of a URI protocol handler called 'search-ms' that allows applications and HTML links to launch customized searches on a device. Details in the article.
From SecurityWeek.com:
Over 1,200 Elasticsearch databases that could be accessed without authentication have fallen victim to a ransomware attacker, which replaced their indexes with a note demanding a payment of 0.012 Bitcoin in exchange for their data. In each case, data held in the databases was replaced with a ransom note stored in the 'message' field of an index called 'read_me_to_recover_database'. Inside the 'email' field is a contact email address. THe article has a link to the full Secureworks write up.
And last today, from PortSwigger.net
A zero-day vulnerability in Horde Webmail enables attackers to execute arbitrary code on the underlying server. Going from bad to worse, Horde has already flagged this version of their webmail to be their final release, so it is likely that a patch will not be forthcoming.
That’s all for me today . Have a great rest of your day. Like and subscribe, And until tomorrow, be safe out there.