The RISKS Digest
Volume 31 Issue 73

Sunday, 26th April 2020

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

The illusion of certainty
Spectator
That no-click iOS Zero-day reported to be under exploit doesn't exist, Apple says
Ars Technica
The Untold Story of the Birth of Social Distancing
NYTimes
Germany changes course on contact tracing app, abandoning PEPP-PT
Politico
Inexpensive, portable detector identifies pathogen in minutes
Lois Yoksoulian
Re: Coronavirus Antibody Tests: Can You Trust the Results?
PGN
Re: Cox email creation policy change I'd missed!
John Levine
Re: e-postage, Internet Usage update
John Levine
Re: Zoom 5.0 update will bring much-needed security upgrades
John Levine
Monty Solomon
Info on RISKS (comp.risks)

The illusion of certainty (Spectator)

Dave Farber <farber@gmail.com>
Sat, 25 Apr 2020 15:39:34 +0900

https://app.spectator.co.uk/2020/04/22/the-illusion-of-certainty/content.html


That no-click iOS Zero-day reported to be under exploit doesn't exist, Apple says (Ars Technica)

Monty Solomon <monty@roscom.com>
Sun, 26 Apr 2020 09:18:23 -0400

Other critics also question evidence and say 0day may have been confused with simple bug.

https://arstechnica.com/information-technology/2020/04/apple-disputes-report-of-non-click-ios-0day-under-exploit-for-two-years/


The Untold Story of the Birth of Social Distancing (NYTimes)

Monty Solomon <monty@roscom.com>
Sat, 25 Apr 2020 14:52:57 -0400

The idea has been around for centuries. But it took a high school science fair, George W. Bush, history lessons and some determined researchers to overcome skepticism and make it federal policy.

https://www.nytimes.com/2020/04/22/us/politics/social-distancing-coronavirus.html


Germany changes course on contact tracing app, abandoning PEPP-PT (Politico)

“Peter G. Neumann” <neumann@csl.sri.com>
Sun, 26 Apr 2020 10:17:36 PDT

Laura Kayali and Janosch Delcker, Politico, 26 Apr 2020

The German government announced today that Berlin would adopt a decentralized approach to a coronavirus contact-tracing app, now backing an approach championed by U.S. tech giants Apple and Google.

“We will promote the use of a consistently decentralized software architecture for use in Germany,” the country's Federal Health Minister Jens Spahn said on Twitter, echoing an interview in “Die Welt am Sonntag”.

<https://www.welt.de/wirtschaft/webwelt/article207509833/Corona-App-Bundesregierung-favorisiert-dezentralen-Ansatz.html>

Earlier this month, Google and Apple announced they would team up to unlock their smartphones' Bluetooth capabilities to allow developers to build interoperable contact tracing apps. […]


Inexpensive, portable detector identifies pathogen in minutes (Lois Yoksoulian)

Dewayne Hendricks <dewayne@warpspeed.com>
April 27, 2020 0:38:52 JST

[Note: This item comes from friend David Rosenthal. DLH]

Lois Yoksoulian, University of Illinois at Urbana-Champaign, 23 Apr 2020

<https://phys.org/news/2020-04-inexpensive-portable-detector-pathogens-minutes.html

Most viral test kits rely on labor and time-intensive laboratory preparation and analysis techniques; for example, tests for the novel coronavirus can take days to detect the virus from nasal swabs. Now, researchers have demonstrated an inexpensive yet sensitive smartphone-based testing device for viral and bacterial pathogens that takes about 30 minutes to complete. The roughly $50 smartphone accessory could reduce the pressure on testing laboratories during a pandemic such as COVID-19.

The results of the new multi-institutional study, led by University of Illinois at Urbana-Champaign electrical and computer engineering professor Brian Cunningham and bioengineering professor Rashid Bashir, are reported in the journal Lab on a Chip.

“The challenges associated with rapid pathogen testing contribute to a lot of uncertainty regarding which individuals are quarantined and a whole host of other health and economic issues,” Cunningham said.

The study began with the goal of detecting a panel of viral and bacterial pathogens in horses, including those that cause severe respiratory illnesses similar to those presented in COVID-19, the researchers said.

“Horse pathogens can lead to devastating diseases in animal populations, of course, but one reason we work with them has to do with safety. The horse pathogens in our study are harmless to humans,” Cunningham said.

The new testing device is comprised of a small cartridge containing testing reagents and a port to insert a nasal extract or blood sample, the researchers said. The whole unit clips to a smartphone.

Inside the cartridge, the reagents break open a pathogen's outer shell to gain access to its RNA. A primer molecule then amplifies the genetic material into many millions of copies in about 10 or 15 minutes, the researchers said. A fluorescent dye stains the copies and glows green when illuminated by blue LED light, which is then detected by the smartphone's camera.

“This test can be performed rapidly on passengers before getting on a flight, on people going to a theme park or before events like a conference or concert,” Cunningham said. “Cloud computing via a smartphone application could allow a negative test result to be registered with event organizers or as part of a boarding pass for a flight. Or, a person in quarantine could give themselves daily tests, register the results with a doctor, and then know when it's safe to come out and rejoin society.”


Re: Coronavirus Antibody Tests: Can You Trust the Results? (RISKS-31.72)

“Peter G. Neumann” <neumann@csl.sri.com>
Sun, 26 Apr 2020 10:24:17 PDT

Apoorva Mandavilli, The New York Times, 24 Apr 2020 https://www.nytimes.com/2020/04/24/health/coronavirus-antibody-tests.html

A team of scientists worked around the clock to evaluate 14 antibody tests. A few worked as advertised. Most did not.

The researchers worked around the clock, in shifts of three to five hours, hoping to stave off weariness and keep their minds sharp for the delicate task.

They set up lines of laboratory volunteers: medical residents, postdoctoral students, even experienced veterans of science, each handling a specific task. They checked and rechecked their data, as if the world were depending on it. Because in some ways, it is.

For the past few weeks, more than 50 scientists have been working diligently to do something that the Food and Drug Administration mostly has not: Verifying that 14 coronavirus antibody tests now on the market actually deliver accurate results.

These tests are crucial to reopening the economy, but public health experts have raised urgent concerns about their quality. The new research, completed just days ago and posted online Friday, confirmed some of those fears: Of the 14 tests, only three delivered consistently reliable results. Even the best had some flaws.

The research has not been peer-reviewed and is subject to revision. But the results are already raising difficult questions about the course of the epidemic.

Surveys of residents in the Bay Area, Los Angeles and New York this week found that substantial percentages tested positive for antibodies to SARS-CoV-2, the official name of the new coronavirus. In New York City, the figure was said to be as high as 21 percent. Elsewhere, it was closer to 3 percent.

The idea that many residents in some parts of the country have already been exposed to the virus has wide implications. At the least, the finding could greatly complicate plans to reopen the economy.

Already Americans are scrambling to take antibody tests to see if they might escape lockdowns. Public health experts are wondering if those with positive results might be allowed to return to work.

But these tactics mean nothing if the test results can't be trusted.

In the new research, researchers found that only one of the tests never delivered a so-called false positive—that is, it never mistakenly signaled antibodies in people who did not have them.

Two other tests did not deliver false-positive results 99 percent of the time.

But the converse was not true. Even these three tests detected antibodies in infected people only 90% of the time, at best.

The false-positive metric is particularly important. The result may lead people to believe themselves immune to the virus when they are not, and to put themselves in danger by abandoning social distancing and other protective measures.

It is also the result on which scientists are most divided. […]


Re: Cox email creation policy change I'd missed! (Goldberg, RISKS-31.72)

“John Levine” <johnl@iecc.com>
25 Apr 2020 17:15:59 -0400

That's really pitiful. At Comcast and Spectrum, not only do they still provide e-mail to their customers, but if you move or switch providers, your e-mail keeps working indefinitely, for free.


Re: e-postage, Internet Usage update (PaulE, RISKS-31.72)

“John Levine” <johnl@iecc.com>
25 Apr 2020 17:44:20 -0400

E-postage is a Well Known Bad Idea that just won't go away. Whatever problems you think it will solve, it won't, and even if it were possible to implement, which it isn't, the problems it would create would be worse than the ones it didn't solve.

I wrote a white paper on the topic in 2004. Other than perhaps adding a zero or two to some of the numbers, nothing has changed:

https://www.taugh.com/epostage.pdf


Re: Zoom 5.0 update will bring much-needed security upgrades (Engadget)

“John Levine” <johnl@iecc.com>
25 Apr 2020 17:27:48 -0400

It's actually Zoom 4.6.12 but it has long overdue meeting management features.

The meeting host can turn the waiting room feature on and off, can control whether participants can share their screens, and with a couple of clicks put anyone back in the waiting room or remove them, and lock a meeting so more people can't join.

This is not unlike the set of features that instant messaging and mailing lists have had since approximately forever. Whatever it is that provokes people to be jerks in video meetings is definitely not limited to video calls.


Re: Zoom 5.0 update will bring much-needed security upgrades (Levine)

Monty Solomon <monty@roscom.com>
Sat, 25 Apr 2020 22:11:32 -0400

The TBD version is scheduled for April 27

https://support.zoom.us/hc/en-us/articles/201361953-New-updates-for-Windows https://support.zoom.us/hc/en-us/articles/205759689-New-updates-for-Linux https://support.zoom.us/hc/en-us/articles/201361973-New-updates-for-Android https://support.zoom.us/hc/en-us/articles/201361943-New-updates-for-iOS https://support.zoom.us/hc/en-us/articles/201361963-New-updates-for-macOS

Added notes:

I have 4.6.12 installed on my Mac now and it has the features I described. I can believe that they will add more stuff next week.

Some of the features described in the article are scheduled for the upcoming release. The article ends with “The company's download page still only offers Zoom 4.6.12, but 5.0 should be out sometime this week.”

Please report problems with the web pages to the maintainer

x
Top