Month: March 2021

Enlarge (credit: Getty Images)

Tens of thousands of US-based organizations are running Microsoft Exchange servers that have been backdoored by threat actors who are stealing administrator passwords and exploiting critical vulnerabilities in the email and calendaring application, it was widely reported. Microsoft issued emergency patches on Tuesday, but they do nothing to disinfect systems that are already compromised.

KrebsOnSecurity was the first to report the mass hack. Citing multiple unnamed people, reporter Brian Krebs put the number of compromised US organizations at at least 30,000. Worldwide, Krebs said there were at least 100,000 hacked organizations. Other news outlets, also citing unnamed sources, quickly followed with posts reporting the hack had hit tens of thousands of organizations in the US.

Assume compromise

“This is the real deal,” Chris Krebs, the former head of the Cybersecurity and Infrastructure Security Agency, said on Twitter, referring to the attacks on on-premisis Exchange, which is also known as Outlook Web Access. “If your organization runs an OWA server exposed to the internet, assume compromise between 02/26-03/03.” His comments accompanied a Tweet on Thursday from Jake Sullivan, the White House national security advisor to President Biden.

• 

  Meet the happy couple: Wanda Maximoff (Elizabeth Olsen) and Vision (Paul Bettany). [credit: YouTube/Disney+ ]

For all its touted meta-elements celebrating different TV decades, WandaVision wrapped up its nine-episode run in classic Marvel fashion, with Elizabeth Olsen's Wanda and Paul Bettany's Vision valiantly defending their suburban nuclear family from the nefarious forces lined up against them. It was a satisfying, quite moving finale to this imaginative series. But fans expecting a surprise big-name cameo—Benedict Cumberbatch's Doctor Strange was a favorite of the pre-finale rumor mill—were disappointed.

(Some spoilers below; major reveals for finale below the gallery. We'll give you a heads up when we get there,)

Frankly, I was skeptical of the WandaVision concept when the studio offered a brief sneak peek during D23 Expo 2019, Disney's annual fan extravaganza. Marvel Studios President Kevin Feige—a fan of classic sitcoms—envisioned the series as a love letter to the golden age of television, with each episode channeling a sitcom style from a particular decade. Head writer Jac Schaeffer (Captain Marvel, Black Widow) championed the concept from the start, despite a brief backlash against the perceived silliness of the title. Schaeffer thought viewers would change their minds once they actually saw the series, and she was right: WandaVision currently boasts a 92 percent fresh rating on Rotten Tomatoes. It even won over my skeptical soul.

Enlarge (credit: Getty Images)

A new type of supply chain attack unveiled last month is targeting more and more companies, with new rounds this week taking aim at Microsoft, Amazon, Slack, Lyft, Zillow, and an unknown number of others. In weeks past, Apple, Microsoft, Tesla, and 32 other companies were targeted by a similar attack that allowed a security researcher to execute unauthorized code inside their networks.

The latest attack against Microsoft was also carried out as a proof-of-concept by a researcher. Attacks targeting Amazon, Slack, Lyft, and Zillow, by contrast, were malicious, but it’s not clear if they succeeded in executing the malware inside their networks. The npm and PyPi open source code repositories, meanwhile, have been flooded with more than 5,000 proof-of-concept packages, according to Sonatype, a firm that helps customers secure the applications they develop.

“Given the daily volume of suspicious npm packages being picked up by Sonatype’s automated malware detection systems, we only expect this trend to increase, with adversaries abusing dependency confusion to conduct even more sinister activities,” Sonatype researcher Ax Sharma, wrote earlier this week.

Enlarge

Susanne Foitzik is a proud myrmecologist: an entomologist who specializes in ants (it was a new vocab word for me, too). Her lab at the Ludwig Maximilian University of Munich studies the dynamics between slave-making ant species, which capture ants of other species and get them to work for them, and the host species they exploit. What genetic changes have turned a species of diligent worker ants like Temnothorax longispinosus into ravaging hordes of slave makers like Temnothorax americanus?

And what induces the enslaved ant workers to rise up in revolt, killing their oppressor’s pupae? (This is not metaphorical; it really happens). Ant eggs and larvae don’t yet make a species-specific scent, so the enslaved nursemaids caring for them think they’re rearing the young of their own colony. Once the babes hit the pupal stage, though, they start to stink like the slave-makers they are destined to become and their caretakers realize they’ve been duped. At that point they “bite the defenseless young insects to death, rip them to shreds, and throw them out of the nesting chamber.”

A labor of love

Dr. Foitzik really, really loves ants—even the slave-making kind. That love shines through on every page of her new book, Empire of Ants: The Hidden Worlds and Extraordinary Lives of Earth's Tiny Conquerors, co-authored with Olaf Fritsche. She loves them so much, in fact, that she's chosen to start each chapter with her charming drawings of different ant species engaged in their daily activities (see example above). 

Enlarge (credit: Ore Huiying/Bloomberg via Getty Images)

Unemployment in the US remains stubbornly high at 6.3 percent. Job growth has stalled, with 9.6 million fewer jobs in January than the same month a year earlier. But gig companies say they’re having trouble finding people to drive, pick up, and deliver for them.

“I'm worried about one thing going into the second half of the year: Are we going to have enough drivers to meet the demand that we're going to have?” Uber CEO Dara Khosrowshahi told an analyst last month. DoorDash chief financial officer Prabir Adarkar called the situation “a tale of two cities,” with hordes of new customers racing to order takeoutbut fewer drivers offering to deliver it. DoorDash orders more than tripled in the last part of 2020, compared with the same period a year earlier.

The looming driver shortage confounds executives’ predictions. “With record unemployment, we expect driver supply to outstrip rider demand” for the “foreseeable future,” Lyft CEO Logan Green said in May. For a time early in the pandemic, Lyft blocked new drivers from signing up. It was understandable, because today’s tech gig companies were born during the Great Recession. They benefited from a deep pool of workers newly outfitted with smartphones and suddenly in need of supplemental income.