Month: February 2019

Enlarge / The fairy circles in Namibia seen from the air. New research asserts they form an additional source of water in this arid region, because the rainwater flows towards the grasses on the edge. (credit: Stephan Getzin)

Himba bushmen in the Namibian grasslands have passed down legends about the region's mysterious "fairy circles"—bare, reddish-hued circular patches dotted along the 1200-mile long swath of land. They can be as large as several feet in diameter. Dubbed "footprints of the gods," it's often said they are the work of the Himba deity Mukuru, or an underground dragon whose poisonous breath kills anything growing inside those circles.

Scientists have their own ideas, and over the years two different hypotheses have emerged about how the circles form. One attributes the phenomenon to a particular species of termite (Psammmotermes allocerus), whose burrowing damages plant roots, resulting in extra rainwater seeping into the sandy soil before the plants can suck it up—giving the termites a handy water trap as a resource. As a result, the plants die back in a circle from the site of an insect nest. The circles expand in diameter during droughts because the termites must venture further out for food. The other hypothesis holds that the circles are a kind of self-organized spatial growth pattern arising as plants compete for scarce water and soil nutrients.

Two new papers, one published in the journal Ecosphere and the other in the Journal of Arid Environments, add yet another dimension to the ongoing debate. The authors argue that—at least in northwestern Australia, where fairy circles were first observed in 2014—termite activity may be present at such formations, so there's some correlation in the data. But it isn't what's causing the fairy circles. The authors attribute the circles' emergence to natural weather-related processes like heavy rainfall, extreme heat, and evaporation. These deplete the soil of nutrients, forcing plants to compete for scarcer resources to survive.

In September of 2018, an anonymous independent security researcher (who we'll call X) noticed that their power company's website was offering to email—not reset!—lost account passwords to forgetful users. Startled, X fed the online form the utility account number and the last four phone number digits it was asking for. Sure enough, a few minutes later the account password, in plain text, was sitting in X's inbox.

This was frustrating and insecure, and it shouldn't have happened at all in 2018. But this turned out to be a flaw common to websites designed by the Atlanta firm SEDC. After finding SEDC's copyright notices in the footer of the local utility company's website, X began looking for more customer-facing sites designed by SEDC. X found and confirmed SEDC's footer—and the same offer to email plain-text passwords—in more than 80 utility company websites.

Those companies service 15 million or so clients (estimated from GIS data and in some cases from PR brags on the utility sites themselves). But the real number of affected Americans could easily be several times that large: SEDC itself claims that more than 250 utility companies use its software.