Google

Google's Domain Name Registrar is Out of Beta After Seven Years (engadget.com) 36

Posted by msmash from the about-time dept.
Seven long, long years ago, Google started offering users a way to buy a domain without having to deal with a host provider. Now, Google Domains is at last out of beta as a full-fledged product. Engadget: Google says, to date, millions of people have used the service to manage a domain. It has added more features and tools to Domains over the years. Folks in 26 countries can now use the full version of the service. [...] To mark the occasion of Domains becoming a fully formed entity, Google's offering new and returning users a discount until April 15th.
IT

DigitalOcean Acquires CSS-Tricks (digitalocean.com) 7

Posted by msmash from the moving-forward dept.
DigitalOcean, in a blog post: I am excited to announce that DigitalOcean has acquired the CSS-Tricks website, a learning site with 6,500 articles, videos, guides and other content focused on frontend development. CSS-Tricks will broaden and complement our existing library of content, furthering DigitalOcean's reach with both frontend and full-stack developers, and supports our community strategy, a key differentiator for DigitalOcean in the cloud computing space. CSS-Tricks will continue operating as a standalone site supported by DigitalOcean, and CSS-Tricks founder Chris Coyier will support CSS-Tricks in an advisory capacity.

At DigitalOcean we take great pride in our commitment to the developer and startup communities. We truly believe that our community is bigger than just us, and we have demonstrated this through our creation of more than 6,000 high-quality developer tutorials and approximately 30,000 community-generated questions & answers, hosting of community-focused events such as deploy, and support of the open source community through Hacktoberfest and other initiatives.
Security

Germany Warns Kaspersky Software Risks Being Exploited by Russia (bloomberg.com) 44

Posted by msmash from the how-about-that dept.
Germany warned against using anti-virus software from Moscow-based Kaspersky Lab due to risks it could be exploited by Russia for a cyber attack. From a report: The Federal Office for Information Security, or BSI, issued the warning on Tuesday, saying that companies and authorities with special security status and operators of critical infrastructure could be "particularly at risk." The danger has increased since Russia's invasion of Ukraine, the Bonn-based agency said in a press release, citing threats made by Moscow against NATO, the European Union and Germany. In 2017, the U.S. government banned all use of Kaspersky Lab software in federal information systems, citing concerns about the firm's links to the Russian government and espionage. The company denied any wrongdoing in that case and pushed back against Germany's move now.
Security

New CaddyWiper Data Wiping Malware Hits Ukrainian Networks (bleepingcomputer.com) 13

Posted by BeauHD from the lost-and-found dept.
Newly discovered data-destroying malware was observed earlier today in attacks targeting Ukrainian organizations and deleting data across systems on compromised networks. BleepingComputer reports: "This new malware erases user data and partition information from attached drives," ESET Research Labs explained. "ESET telemetry shows that it was seen on a few dozen systems in a limited number of organizations." While designed to wipe data across Windows domains it's deployed on, CaddyWiper will use the DsRoleGetPrimaryDomainInformation() function to check if a device is a domain controller. If so, the data on the domain controller will not be deleted. This is likely a tactic used by the attackers to maintain access inside the compromised networks of organizations they hit while still heavily disturbing operations by wiping other critical devices.

While analyzing the PE header of a malware sample discovered on the network of an undisclosed Ukrainian organization, it was also discovered that the malware was deployed in attacks the same day it was compiled. "CaddyWiper does not share any significant code similarity with HermeticWiper, IsaacWiper, or any other malware known to us. The sample we analyzed was not digitally signed," ESET added. "Similarly to HermeticWiper deployments, we observed CaddyWiper being deployed via GPO, indicating the attackers had prior control of the target's network beforehand."
Encryption

Researcher Uses 379-Year-Old Algorithm To Crack Crypto Keys Found In the Wild (arstechnica.com) 17

Posted by BeauHD from the cracking-the-code dept.
An anonymous reader quotes a report from Ars Technica: Cryptographic keys generated with older software now owned by technology company Rambus are weak enough to be broken instantly using commodity hardware, a researcher reported on Monday. This revelation is part of an investigation that also uncovered a handful of weak keys in the wild. The software comes from a basic version of the SafeZone Crypto Libraries, which were developed by a company called Inside Secure and acquired by Rambus as part of its 2019 acquisition of Verimatrix, a Rambus representative said. That version was deprecated prior to the acquisition and is distinct from a FIPS-certified version that the company now sells under the Rambus FIPS Security Toolkit brand.

Researcher Hanno Bock said that the vulnerable SafeZone library doesn't sufficiently randomize the two prime numbers it used to generate RSA keys. (These keys can be used to secure Web traffic, shells, and other online connections.) Instead, after the SafeZone tool selects one prime number, it chooses a prime in close proximity as the second one needed to form the key. "The problem is that both primes are too similar," Bock said in an interview. "So the difference between the two primes is really small." The SafeZone vulnerability is tracked as CVE-2022-26320. Cryptographers have long known that RSA keys that are generated with primes that are too close together can be trivially broken with Fermat's factorization method. French mathematician Pierre de Fermat first described this method in 1643. Fermat's algorithm was based on the fact that any number can be expressed as the difference between two squares. When the factors are near the root of the number, they can be calculated easily and quickly. The method isn't feasible when factors are truly random and hence far apart. The security of RSA keys depends on the difficulty of factoring a key's large composite number (usually denoted as N) to derive its two factors (usually denoted as P and Q). When P and Q are known publicly, the key they make up is broken, meaning anyone can decrypt data protected by the key or use the key to authenticate messages.

So far, Bock has identified only a handful of keys in the wild that are vulnerable to the factorization attack. Some of the keys belong to printers originally branded as Fuji Xerox and now belonging to Canon. Printer users can use the keys to generate a Certificate Signing Request. The creation date for the keys was 2020 or later. The weak Canon keys are tracked as CVE-2022-26351. Bock also found four vulnerable PGP keys, typically used to encrypt email, on SKS PGP key servers. A user ID tied to the keys implied they were created for testing, so he doesn't believe they're in active use. Bock said he believes all the keys he found were generated using software or methods not connected to the SafeZone library. If true, other software that generates keys might be easily broken using the Fermat algorithm. It's plausible also that the keys were generated manually, "possibly by people aware of this attack creating test data." The researcher found the keys by searching through billions of public keys that he either had access to, were shared with him by other researchers, or that were available through certificate transparency programs. UPDATE: The headline incorrectly stated that a "600-Year-Old Algorithm" was used. It's been changed to "379-Year-Old-Algorithm" to reflect the updated headline on Ars.
Microsoft

Microsoft is Testing Ads in the Windows 11 File Explorer (bleepingcomputer.com) 164

Posted by msmash from the but-of-course dept.
Microsoft has begun testing promotions for some of its other products in the File Explorer app on devices running its latest Windows 11 Insider build. From a report: The new Windows 11 "feature" was discovered by a Windows user and Insider MVP who shared a screenshot of an advertisement notification displayed above the listing of folders and files to the File Explorer, the Windows default file manager. As shown in the screenshot, Microsoft will use such ads to promote other Microsoft products, for instance, about how to "write with confidence across documents, email, and the web with advanced writing suggestions from Microsoft Editor. As you can imagine, the reaction to this was adverse, to say the least, with some saying that "File Explorer one of the worst places to show ads," while others added that this is the way to go if Microsoft wants "people ditching Explorer for something else."
Security

Ukraine Ethical Hackers Bewildered as HackerOne Bug Bounty Platform Said To Halt Their Payouts (gadgets360.com) 28

Posted by msmash from the closer-look dept.
Amid the ongoing disruption from Russia, some ethical hackers in Ukraine are feeling lost as bug bounty platform HackerOne has allegedly withheld their payouts. From a report: The loss due to the sudden halt is said to have mounted to hundreds and thousands of dollars. A few of the affected ethical hackers -- also known as cybersecurity researchers -- have taken the issue to social media. Some of them have also written to the platform to get clarity on why exactly it has disabled their payments in the middle of the humanitarian catastrophe in the country. Ethical hackers normally earn payouts ranging from tens and hundreds to over millions of dollars in the form of rewards through bug bounty platforms for reporting flaws in various Internet-based solutions. However, HackerOne is said to have suddenly stopped payouts for some Ukrainian hackers.

Earlier this month, HackerOne CEO Marten Mickos had announced, "[A]s we work to comply with the new sanctions, we'll withdraw all programmes for customers based in Russia, Belarus, and the occupied areas of Ukraine." On Monday, he clarified that the restrictions were for sanctioned regions - Russia and Belarus, not mentioning any clear details about the status of Ukraine. "That's a really weird situation," said independent security researcher Bob Diachenko, who has been associated with the San Francisco, California-based platform for the last two-three years now. The security researcher tweeted on Sunday that HackerOne stopped paying bounties worth around $3,000 for the flaws he reported. Alongside stopping payouts, HackerOne has removed its 'Clear' status from all Ukraine accounts. The status essentially allows ethical hackers to participate in private programmes run by various companies to earn a minimum of $2,000 for a high-severity vulnerability or $5,000 for a critical one. It requires background-check for researchers to participate in the listed programmes.
AMD

Intel Finds Bug In AMD's Spectre Mitigation, AMD Issues Fix (tomshardware.com) 44

Posted by EditorDavid from the in-the-chips dept.
"News of a fresh Spectre BHB vulnerability that only impacts Intel and Arm processors emerged this week," reports Tom's Hardware, "but Intel's research around these new attack vectors unearthed another issue.

"One of the patches that AMD has used to fix the Spectre vulnerabilities has been broken since 2018." Intel's security team, STORM, found the issue with AMD's mitigation. In response, AMD has issued a security bulletin and updated its guidance to recommend using an alternative method to mitigate the Spectre vulnerabilities, thus repairing the issue anew....

Intel's research into AMD's Spectre fix begins in a roundabout way — Intel's processors were recently found to still be susceptible to Spectre v2-based attacks via a new Branch History Injection variant, this despite the company's use of the Enhanced Indirect Branch Restricted Speculation (eIBRS) and/or Retpoline mitigations that were thought to prevent further attacks. In need of a newer Spectre mitigation approach to patch the far-flung issue, Intel turned to studying alternative mitigation techniques. There are several other options, but all entail varying levels of performance tradeoffs. Intel says its ecosystem partners asked the company to consider using AMD's LFENCE/JMP technique. The "LFENCE/JMP" mitigation is a Retpoline alternative commonly referred to as "AMD's Retpoline."

As a result of Intel's investigation, the company discovered that the mitigation AMD has used since 2018 to patch the Spectre vulnerabilities isn't sufficient — the chips are still vulnerable. The issue impacts nearly every modern AMD processor spanning almost the entire Ryzen family for desktop PCs and laptops (second-gen to current-gen) and the EPYC family of datacenter chips....

In response to the STORM team's discovery and paper, AMD issued a security bulletin (AMD-SB-1026) that states it isn't aware of any currently active exploits using the method described in the paper. AMD also instructs its customers to switch to using "one of the other published mitigations (V2-1 aka 'generic retpoline' or V2-4 aka 'IBRS')." The company also published updated Spectre mitigation guidance reflecting those changes [PDF]....

AMD's security bulletin thanks Intel's STORM team by name and noted it engaged in the coordinated vulnerability disclosure, thus allowing AMD enough time to address the issue before making it known to the public.
Thanks to Slashdot reader Hmmmmmm for submitting the story...
United States

Critical US Companies Will Soon Be Required to Report All Breaches and Ransomware to the DHS (apnews.com) 16

Posted by EditorDavid from the Department-of-Homeland-Security dept.
"Companies critical to U.S. national interests will now have to report when they're hacked or they pay ransomware, according to new rules approved by Congress," reports the Associated Press: The rules are part of a broader effort by the Biden administration and Congress to shore up the nation's cyberdefenses after a series of high-profile digital espionage campaigns and disruptive ransomware attacks. The reporting will give the federal government much greater visibility into hacking efforts that target private companies, which often have skipped going to the FBI or other agencies for help. "It's clear we must take bold action to improve our online defenses," Sen. Gary Peters, a Michigan Democrat who leads the Senate Homeland Security and Government Affairs Committee and wrote the legislation, said in a statement on Friday.

The reporting requirement legislation was approved by the House and the Senate on Thursday and is expected to be signed into law by President Joe Biden soon. It requires any entity that's considered part of the nation's critical infrastructure, which includes the finance, transportation and energy sectors, to report any "substantial cyber incident" to the government within three days and any ransomware payment made within 24 hours....

The legislation designates the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency as the lead agency to receive notices of hacks and ransomware payments.... The new rules also empower CISA to subpoena companies that fail to report hacks or ransomware payments, and those that fail to comply with a subpoena could be referred to the Justice Department for investigation.
Security

Ubisoft Won't Say Why It Reset Employee Passwords After 'Cyber Incident' (techcrunch.com) 6

Posted by msmash from the stranger-things dept.
Gaming giant Ubisoft has confirmed a cybersecurity incident that led to the mass-reset of company passwords, but has declined to say what the incident actually was. From a report: In a brief statement, Ubisoft said: "Last week, Ubisoft experienced a cyber security incident that caused temporary disruption to some of our games, systems, and services. Our IT teams are working with leading external experts to investigate the issue. As a precautionary measure we initiated a company-wide password reset. Also, we can confirm that all our games and services are functioning normally and that at this time there is no evidence any player personal information was accessed or exposed as a by-product of this incident," the statement said. The France-headquartered video game company is best known for its Assassin's Creed and Far Cry brands. According to the company's latest earnings report from October, Ubisoft had 117 million active players.
Security

Big Web Security Firms Ditch Russia, Leaving Internet Users Open To More Kremlin Snooping (forbes.com) 16

Posted by msmash from the tussle-continues dept.
Ordinary Russians face another major blow to their everyday lives due to the backlash to President Vladimir Putin's invasion of Ukraine. On the same day, two major web-security companies have decided to quit selling to them, making Russians' internet use more vulnerable to Kremlin snooping, hacking and other cybercrimes. From a report: The departure of the two companies, Avast, a $6 billion antivirus provider based in the Czech Republic, and Utah-based website-certification firm DigiCert, will further isolate the country of 145 million people. "We are horrified at Russia's aggression against Ukraine, where the lives and livelihoods of innocent people are at severe risk, and where all freedoms have come under attack," Avast CEO Ondrej Vlcek wrote on Thursday. Vlcek said the company was including Belarus in the withdrawal of services, and was continuing to pay the full salaries of employees in Russia and Ukraine, many of whom it was helping to relocate. "We do not take this decision lightly," Vlcek wrote. "We've offered our products in Russia for nearly 20 years and users in this country are an important part of our global community." While Avast joins other antivirus companies, including NortonLifeLock and ESET, in halting sales, Russians will still be able to get antivirus protection from Moscow-based Kaspersky and other providers within the country. The departure of DigiCert could prove more significant. DigiCert is one of the world's biggest providers of website certificates, which aim to prove that when a person visits a site it's owned by the entity they expected.
Security

WhatsApp's New Browser Extension is Aimed at Making Web Chats More Secure (theverge.com) 24

Posted by msmash from the PSA dept.
Code Verify is a new browser extension from WhatsApp parent company Meta that aims to improve the security of WhatsApp's web version, the company has announced. From a report: The extension works by verifying that the contents of WhatsApp's web version haven't been tampered with. The aim is to make it a lot more difficult for a would-be attacker to compromise data or the privacy of WhatsApp's end-to-end encrypted messages when using the browser-based version of the service. The extension follows the launch of WhatsApp's multi-device beta last year. This aims to make using the messaging service from devices other than your primary phone easier and more seamless. Since the feature's launch, WhatsApp says it's seen an increase in people accessing its service through web browsers, which present new security challenges compared to an app. There's nothing particularly new about the security methods underpinning Code Verify. Ultimately it's just comparing a hash of the code running in your browser, with a hash held by trusted third-party Cloudflare.
The Internet

Russia Creates Its Own TLS Certificate Authority To Bypass Sanctions (bleepingcomputer.com) 59

Posted by msmash from the how-about-that dept.
Russia has created its own trusted TLS certificate authority (CA) to solve website access problems that have been piling up after sanctions prevent certificate renewals. From a report: The sanctions imposed by western companies and governments are preventing Russian sites from renewing existing TLS certificates, causing browsers to block access to sites with expired certificates. [...] The Russian state has envisioned a solution in a domestic certificate authority for the independent issuing and renewal of TLS certificates. "It will replace the foreign security certificate if it is revoked or expires. The Ministry of Digital Development will provide a free domestic analogue.

The service is provided to legal entities -- site owners upon request within 5 working days," explains the Russian public services portal, Gosuslugi (translated). However, for new Certificate Authorities (CA) to be trusted by web browsers, they first needed to be vetted by various companies, which can take a long time. Currently, the only web browsers that recognize Russia's new CA as trustworthy are the Russia-based Yandex browser and Atom products, so Russian users are told to use these instead of Chrome, Firefox, Edge, etc.
Microsoft

Microsoft is Finally Bringing Tabs To File Explorer on Windows 11 (windowscentral.com) 65

Posted by msmash from the up-next dept.
Microsoft appears to be adding a tabbed interface to the top of File Explorer, as Insiders testing the latest Windows 11 preview build have discovered the feature in a hidden state. From a report: First spotted by Windows Insider Rafael Rivera on Twitter, once enabled, tabs will appear along the top of the File Explorer app, allowing users to have multiple folders open in one window. Tabs in File Explorer has been a highly requested feature among the Windows community for years at this point. Microsoft almost delivered the feature via its canceled "Sets" UX, which saw the introduction of tabs in every app window, including File Explorer. But when Sets was killed off, so was the idea of tabs in File Explorer. But now, Tabs in File Explorer appears to be making a return, and it works exactly like you'd expect. This feature is yet to be officially announced by Microsoft, and since this is currently only in the Dev Channel, it's possible that Microsoft could cancel the feature before it ships, though we think that's unlikely.
Nintendo

YouTuber Leaves OLED Switch on for 3,600 Hours To Test Image Burn-in (inputmag.com) 54

Posted by msmash from the closer-look dept.
Does the Nintendo's larger and more vivid Switch suffer from the image-burn in that has crippled several devices with such display? An unusual and unexpected comprehensive test hasoffered some answers. InputMag: After 3,600 hours of subjecting an OLED Switch to the the same image -- one that was ripped from The Legend of Zelda: Breathe of the Wild -- Wulff Den, a YouTuber who specializes in gaming videos, concluded that the device is finally, surprisingly, showing faint signs of burn-in. As reported by ArsTecnica, the damage is minor -- on a white screen, like the Switch's main menu, there was a faint "blue ghosting," that appeared following the six-month experiment. But as, Wulff Den himself points out, "It's still a little subtle. It's not anything that I would do an RMA request for." The experiment began as soon as the OLED Switch was released, when Wulff Den decided to find out whether users would have to worry about burn-in. The YouTuber left his OLED Switch on, displaying the same image and set to its full brightness, without any interruptions aside from the occasional check-in. After 1,800 hours, or three months, the project yielded negligible effects -- white pixels were slightly dimmer but Wullf Den noted he most likely wouldn't have noticed, if not for relentlessly monitoring the changes during his test.
Security

Stolen Nvidia Certificates Used To Hide Malware in Driver Downloads (pcworld.com) 32

Posted by msmash from the security-woes dept.
Last week Nvidia confirmed that it had been the victim of an internal hack, though it claimed no customer information was compromised. Now we're seeing one of the first effects of the hack on end-users: Nvidia GPU driver packages with malware hidden inside. PCWorld: While it was always possible for malefactors to host links pretending to be drivers in the hopes of installing viruses, trojans, and other nasty stuff on a user's PC, this situation is more concerning. The hackers appear to have leaked Nvidia's official code signing certificates, a means by which users (and Microsoft) can verify that a downloaded program comes from the publisher it says it's from. That's allowing files containing a host of popular malware suites to be posted and downloaded, bypassing Windows Defender's built-in executable verification and slipping past anti-virus software. BleepingComputer reports that two now-expired (but still usable) verification codes have been compromised and used to deliver remote access trojans. Another example, using the Nvidia verification to sign a fake Windows driver, was also spotted.
China

Cybersecurity Firm Says Chinese Hackers Breached Six US State Agencies (cnn.com) 19

Posted by BeauHD from the another-day-another-breach dept.
An anonymous reader quotes a report from CNN: A Chinese government-backed hacking group has breached local government agencies in at least six US states in the last 10 months as part of a persistent information-gathering operation, investigators at cybersecurity firm Mandiant said Tuesday. The wide range of state agencies targeted include "health, transportation, labor (including unemployment benefit systems), higher education, agriculture, and court networks and systems," the FBI and US Cybersecurity and Infrastructure Security Agency (CISA) said in a separate, private advisory to state governments obtained by CNN. For agencies in two states, the hackers broke into networks using a critical software flaw that was revealed in December just as the Biden administration was scrambling to respond to the flaw's discovery, according to Mandiant.

The hackers' motives aren't clear, but their victims are "consistent with an espionage operation," the firm said. The list of state agencies affected by the hacking could grow as the investigation continues. CISA on December 10 publicly warned that Log4J -- software used by big tech firms around the world -- had a vulnerability that hackers could easily exploit to gain further access to computer systems. Hundreds of millions of computers around the world ran the vulnerable software, US officials later estimated. For weeks, US officials urged companies to update their software; the White House hosted a meeting in January with tech executives to try to address the root problem of software that is not secure by design. Within hours of the CISA advisory, the Chinese hackers had begun using the Log4J flaw to break into the two US state agencies, according to Mandiant.

Agencies in four other states were hacked via other means. In one state, Mandiant said, the hackers accessed personal data on some Americans, including names, email addresses and mobile phone numbers. Mandiant declined to name the US states or agencies affected. While the hackers' ultimate objectives are unclear, state agencies could provide a wealth of useful information to foreign spies, whether data related to elections or government contracting. Mandiant blamed the hacking campaign on a group that the Justice Department has linked with China's civilian intelligence agency. That hacking group, according to a US indictment unsealed in September 2020, has been linked to attempts to breach hundreds of organizations around the world, from hardware makers to pro-democracy politicians in Hong Kong.
Security

Apple Files Lawsuit Against NSO Group, Saying US Citizens Were Targets (reuters.com) 19

Posted by msmash from the tussle-continues dept.
Apple said on Tuesday it has filed a lawsuit against Israeli cyber firm NSO Group and its parent company OSY Technologies for alleged surveillance and targeting of U.S. Apple users with its Pegasus spyware. From a report: The iPhone maker said it is also seeking to ban NSO Group from using any Apple software, services or devices to prevent further abuse. Apple is the latest in a string of companies and governments to come after NSO, the maker of the Pegasus hacking tool that watchdog groups say targeted human rights workers and journalists.
Security

Linux Has Been Bitten By Its Most High-Severity Vulnerability in Years (arstechnica.com) 110

Posted by msmash from the security-woes dept.
Cognitive Dissident writes: Ars Technica is reporting a major new vulnerability in Linux. Named "Dirty Pipeline" it involves abuse of 'pipes' at the shell level as you might guess.

The name Dirty Pipe is meant to both signal similarities to Dirty Cow and provide clues about the new vulnerability's origins. "Pipe" refers to a pipeline, a Linux mechanism for one OS process to send data to another process. In essence, a pipeline is two or more processes that are chained together so that the output text of one process (stdout) is passed directly as input (stdin) to the next one. Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer's Linux machine. After months of analysis, the researcher finally found that the customer's corrupted files were the result of a bug in the Linux kernel.


Bug

Millions of Palm-Sized, Flying Spiders Could Invade the East Coast (scientificamerican.com) 53

Posted by BeauHD from the ready-or-not-here-they-come dept.
An anonymous reader quotes a report from Scientific American: New research, published in the journal Physiological Entomology, suggests that the palm-sized Joro spider, which swarmed North Georgia by the millions last September, has a special resilience to the cold. This has led scientists to suggest that the 3-inch (7.6 centimeters) bright-yellow-striped spiders -- whose hatchlings disperse by fashioning web parachutes to fly as far as 100 miles (161 kilometers) -- could soon dominate the Eastern Seaboard. Since the spider hitchhiked its way to the northeast of Atlanta, Georgia, inside a shipping container in 2014, its numbers and range have expanded steadily across Georgia, culminating in an astonishing population boom last year that saw millions of the arachnids drape porches, power lines, mailboxes and vegetable patches across more than 25 state counties with webs as thick as 10 feet (3 meters) deep, Live Science previously reported.

Common to China, Taiwan, Japan and Korea, the Joro spider is part of a group of spiders known as "orb weavers" because of their highly symmetrical, circular webs. The spider gets its name from Jorgumo, a Japanese spirit, or Ykai, that is said to disguise itself as a beautiful woman to prey upon gullible men. True to its mythical reputation, the Joro spider is stunning to look at, with a large, round, jet-black body cut across with bright yellow stripes, and flecked on its underside with intense red markings. But despite its threatening appearance and its fearsome standing in folklore, the Joro spider's bite is rarely strong enough to break through the skin, and its venom poses no threat to humans, dogs or cats unless they are allergic. That's perhaps good news, as the spiders are destined to spread far and wide across the continental U.S., researchers say.

The scientists came to this conclusion after comparing the Joro spider to a close cousin, the golden silk spider, which migrated from tropical climates 160 years ago to establish an eight-legged foothold in the southern United States. By tracking the spiders' locations in the wild and monitoring their vitals as they subjected caught specimens to freezing temperatures, the researchers found that the Joro spider has about double the metabolic rate of its cousin, along with a 77% higher heart rate and a much better survival rate in cold temperatures. Additionally, Joro spiders exist in most parts of their native Japan -- warm and cold -- which has a very similar climate to the U.S. and sits across roughly the same latitude. [...] While most invasive species tend to destabilize the ecosystems they colonize, entomologists are so far optimistic that the Joro spider could actually be beneficial, especially in Georgia where, instead of lovesick men, they kill off mosquitos, biting flies and another invasive species -- the brown marmorated stink bug, which damages crops and has no natural predators. In fact, the researchers say that the Joro is much more likely to be a nuisance than a danger, and that it should be left to its own devices.

Slashdot Top Deals