1 – Bitdefender’s Position on Ransomware Attacks and Decryptors

This week Bitdefender was named in a press article regarding our decision to release a free decryptor in January 2021 to help those affected by Darkside ransomware. The authors of the article assert that publicly releasing a ransomware decryptor enables malicious actors to modify their methods to evade future decryption, thus increasing the risk of successful future attacks. This assertion is flawed from a common sense perspective and is contrary to the principles that the cybersecurity community operates under. From a common sense point of view, the assertion is akin to saying that if someone releases a video with self-defense tips then this enables muggers to modify their tactics to thwart such tips – ignoring the fact that posting the video is beneficial to would be victims. From a cybersecurity community perspective, the global community of defenders, which Bitdefender is proud to be a part of, thrives on knowledge sharing. As cyber-attacks become more frequent and sophisticated, it is harder for individual organizations to defend themselves; therefore, the established practice of sharing attack knowledge is only gaining in importance.

2 – No, it doesn’t just crash Safari. Apple has yet to fix exploitable flaw

Apple has yet to patch a security bug found in iPhones and Macs despite the availability of a fix from almost three weeks ago, a researcher said. The vulnerability resides in WebKit, the browser engine that powers Safari and all browsers that run on iOS. When the vulnerability was fixed almost three weeks ago by open source developers outside of Apple, the fix’s release notes said that the bug caused Safari to crash. In fact, a researcher from security firm Theori said the flaw is exploitable, and despite the availability of a fix, it still hasn’t made its way into either iOS or macOS. “This bug yet again demonstrates that patch-gapping is a significant danger with open source development,” Theori researcher Tim Becker wrote in a post published Tuesday. “Ideally, the window of time between a public patch and a stable release is as small as possible. In this case, a newly released version of iOS remains vulnerable weeks after the patch was public.”

3 – Scammers Pose as Celebrities To Swindle Black Lives Matter Donors

A day before the Black Lives Matter movement marked the first anniversary of George Floyd’s death, online scammers set the bait to lure supporters from across the globe with a new crypto scam. On May 24, Bitdefender Antispam Lab spotted hundreds of spam emails using some dirty tricks as they ask recipients to fund the Black Lives Matter movement. They use high-profile figures and celebrities to fuel their deceit while dishonoring the memory of victims’ and protestors’ goodwill. Alicia Keys, Eva Longoria, Meryl Streep, Amy Schumer, Angela Basset, Beyonce, Jay-Z, Chris Evans, George Takei, Katty Perry, Mandy Moore, Taylor Swift, Reese Witherspoon, Mark Ruffalo, Leonardo Dicaprio, Lenny Kravitz, Lebron James and John Legend are just a few of the celebrity names used by the scammers. The fake email opens with a reminder about the movement and offers recipients an easy way to financially support it.

4 – Your personal details don’t interest anyone. Or do they?

Stolen personal details, like phone numbers, passwords, addresses, birth dates, etc. can be used for crime in many ways. For example, they can be sold to other criminals and be utilized for account takeover and identity theft. Identity theft happens when someone uses someone else’s personal information for fraud or other crimes. In practice that means for example using a stolen credit card number to buy goods. Many stores offer billing, installments, or other credit-based payment methods, which criminals can use with stolen details. Identity theft can also result to someone taking loans in your name. What’s important to notice here, is that identity theft mostly is carried out with credit-based payments and loans. Therefore, your actual wealth doesn’t diminish the risk of becoming a victim.

5 – EU Privacy Groups Set Sights on Facial Recognition Firm

Privacy organisations on Thursday complained to regulators in five European countries over the practices of Clearview AI, a company that has built a powerful facial recognition database using images “scraped” from the web. Clearview’s use of images — including those from people’s social media accounts — to offer biometrics services to private companies and law enforcement “goes far beyond what we could ever expect as online users”, Ioannis Kouvakas, legal officer at Privacy International, said in a statement. While Clearview touts its technology’s ability to help law enforcement, its critics say facial recognition is open to abuse and could ultimately eliminate anonymity in public spaces — pointing to cases like China’s massive public surveillance system. Facial recognition has also been attacked for failing to distinguish non-white people’s faces and women as well as it can identify white, male images — potentially leading to false positives.