The RISKS Digest
Volume 32 Issue 89

Sunday, 3rd October 2021

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…


First death attributed to ransomware
WSJ via Ross Anderson
What Is CoolSculpting?
The New York Times
Tesla owners can now request ‘Full Self-Driving’, prompting criticism from regulators and safety advocates
Chip makers to carmakers: time to get out of the semiconductor Stone Age
Taiwan system update causes accidental loss of student data
Focus Taiwan
Portpass app may have exposed hundreds of thousands of users' personal data
How close is nuclear fusion power?
Sabine Hossenfelder
Troll farms, Russia, YouTube, Facebook
PGN-ed from Lauren Weinstein
Regulators Racing Toward First Major Rules on Cryptocurrency
Elevator-Pitch Privacy
Richard Stein
Vulnerability of locked iPhone with a Visa Card set in Transit Mode
How to have a hard time finding the About page
Dan Jacobson
Save the date! IFIP 60th Anniversary Panel “Autonomous vehicle
Charles B Weinstock
Info on RISKS (comp.risks)

First death attributed to ransomware (WSJ)

Ross Anderson <>
Thu, 30 Sep 2021 19:52:44 +0100
A Hospital Hit by Hackers, a Baby in Distress: The Case of the First
Alleged Ransomware Death: A lawsuit says computer outages from a
cyberattack led staff to miss troubling signs, resulting in the baby’s
death, allegations the hospital denies

What Is CoolSculpting? (New York Times)

"Richard Stein" <>
Sun, 26 Sep 2021 11:21:03 +0800

"The fat-freezing procedure left supermodel Linda Evangelista 'disfigured.'
Here's what experts say it is supposed to do and what the most common side
effects are."

The report contained this statement of interest:

"More than eight million CoolSculpting treatments had been administered in
the U.S. as of 2019, according to the CoolSculpting website. The American
Society for Aesthetic Plastic Surgery reports that board-certified U.S.
plastic surgeons performed 129,686 nonsurgical fat-reducing treatments in
2019, a category that includes CoolSculpting as well as treatments that use
ultrasound to kill fat cells. But those numbers do not reflect CoolSculpting
treatments done by dermatologists, so the real number is probably much

The FDA's Center for Devices and Radiological Health collects and reports
adverse events for medical devices, but does not collect, compile, and
report regulated device usage/treatment count information.  The device
usage/treatment count reporting deficit creates opacity that exploits
consumer expectation.
(retrieved on 26SEP2021) itemizes and categorizes these adverse events from
01JAN2016 to 31AUG2021 for product code OOK. One can examine the medical
device reports attributed to device and patient problems for the
CoolSculpting machine.

See this for the 455 patient problem reports attributed to hyperplasia:

A worldwide recall for ~860 CoolSculpting devices has been issued by Deltiq
Aesthetics (see,
retrieved on 26SEP2021).

The recall notice lists what FDA identifies as a software design error.  The
manufacturer's recall justification says, "An incorrect error messaging
system that could potentially lead to: 1) Reporting a thermal event error
causing a user to re-treating the affected anatomic area within 24 hours, 2)
Not reporting a thermal event or any other error codes causing a user to
continue treating without being aware that a thermal event has occurred."

Why did a celebrity's treatment-induced hyperplasia event and subsequent
law suit apparently initiate the device recall when more than 400 prior
reports probably preceded it?

Risk: Cosmetic therapy medical device software.

Tesla owners can now request ‘Full Self-Driving’, prompting criticism from regulators and safety advocates (MSN)

geoff goodfellow <>
Sat, 25 Sep 2021 09:00:25 -1000
Tesla began letting owners request its “Full Self-Driving” software early
Saturday, opening up for wide release its most advanced driver-assistance
suite and signaling that thousands of drivers will soon be on the road with
the unregulated and largely untested features.

It’s the first time the company has let typical owners upgrade to the
software it terms self-driving, although the name itself is an exaggeration
by industry and regulatory standards. Tesla chief executive Elon Musk had
said owners would be able to request this weekend the upgraded suite of
advanced driver-assistance features, which Tesla says is a beta, although
they wouldn’t receive the capabilities right away.

Owners will have to agree to let Tesla monitor their driving behavior
through the company insurance calculator. Tesla issued a detailed guide
specifying the criteria under which drivers would be graded. If their
driving is deemed to be “good” over a seven-day period, Musk said on
Twitter, “beta access will be granted.”

It’s the latest twist in a saga that has regulators, safety advocates and
relatives of Tesla crash victims up in arms because of the potential for
chaos as the technology is unleashed on real-world roads. Until now,
roughly 2,000 beta testers have had access to the technology.  [...]

  [Reply from Jay Fenello <>:
  This is very dangerous given Tesla's decision to *not* use any type of
  distance measuring technology (sonar, radar, lidar) other than cameras and
  AI.  PGN]

Chip makers to carmakers: time to get out of the semiconductor Stone Age (Fortune)

"Gabe Goldberg" <>
Sat, 25 Sep 2021 23:13:45 -0400
When it comes to the electronic circuits that power our everyday lives,
the automobile is simultaneously the world’s most expensive consumer
good and the one that runs on the cheapest possible semiconductor chips.

Moore’s law of ever-increasing miniaturization seemingly never reached
the automotive industry. Dozens of chips found in everything from
electronic brake systems to airbag control units tend to rely on
obsolete technology often well over a decade old. These employ
comparatively simple transistors that can be anywhere from 45 nanometers
to as much as 90 nanometers in size, far too large”and too primitive”to
be suitable for today’s smartphones.

When the pandemic hit, replacement demand for big-ticket items like new
cars was pushed back while sales of all kinds of home devices soared.
When the car market roared back months later, chipmakers had already
reallocated their capacity.

Now these processors are in short supply, and chipmakers are telling car
companies to wake up and finally join the 2010s.

Taiwan system update causes accidental loss of student data

"積丹尼 Dan Jacobson" <>
Mon, 27 Sep 2021 22:30:37 +0800
"When the team transferred the files onto the new workstation, it seems to
have used a wrong setting, causing the data to be deleted instead of being
stored permanently after a recent system update..."

Portpass app may have exposed hundreds of thousands of users' personal data (CBC)

"Jonathan Levine" <>
Wed, 29 Sep 2021 08:50:40 -0600
Alberta's premier, Jason Kenney, has steadfastly refused to implement any
sort of COVID vaccine "passport" (air bunnies because I find the term
muddled) out of some kind of misplaced sense of libertarianism.  So, along
with an explosion of Delta infections—mostly among the unvaccinated, of
course—worthy of the American south, here's what we get:

The RISK: Where governments abdicate their responsibility to take reasonable
and necessary measures, incompetent opportunists will surely step into the

How close is nuclear fusion power? (Sabine Hossenfelder)

geoff goodfellow <>
Sat, 2 Oct 2021 11:53:01 -1000
How close is nuclear fusion to break-even? If you trust the headlines we're
getting close and the international project ITER is going to be the first to
produce energy from fusion power. But not so fast. Scientists have,
accidentally or deliberately, come to use a very misleading quantity to
measure their progress. Unfortunately we're much farther away from
generating fusion power than the headlines suggest...'‡

Troll farms, Russia, YouTube, Facebook (PGN-ed)

Lauren Weinstein <>
Tue, 28 Sep 2021 16:13:10 -0700
In 2019, Almost All of Facebook's Top Christian Pages Were Run By
Foreign Troll Farms

Troll farms reached 140 million Americans a month on Facebook before 2020
election, internal report shows

Russia threatens to block YouTube unless it permits vaccine misinformation
Russia threatens YouTube ban for deleting RT channels

Leaked Facebook Docs Depict Kids as 'Untapped' Wealth and other sagas

CNN restricts access to its Facebook pages in Australia

Regulators Racing Toward First Major Rules on Cryptocurrency (NYTimes)

"Gabe Goldberg" <>
Sat, 25 Sep 2021 23:12:56 -0400
Concerned about the potential for a digital-era bank run, the Treasury
Department is working on an oversight framework for the fast-growing sector.

How sustainable altcoins aim to challenge Bitcoin's dominance

“It’s becoming pretty clear that Bitcoin is either ignoring or making
excuses for the environmental issues it’s having,” Jameson, who now heads up
operations at Flashbots, told Fortune.

Over the past dozen years, the cryptocurrency community has largely hummed
along to the deafening sounds of mining rigs while Bitcoin’s energy usage
has ballooned along with its price. The original cryptocurrency now uses
about the same amount of electricity in a year as Poland, with a carbon
footprint comparable to that of Oman, according to Digiconomist, which
tracks Bitcoin’s energy consumption.  [...\

“We will do for sustainability what Robinhood did for equities in that we
will create access for millions of people who want to put their own
discretionary investment income into investment opportunities that have a
market rate of return and that align with their values,” Carver said.

Elevator-Pitch Privacy

"Richard Stein" <>
Fri, 1 Oct 2021 12:39:45 +0800
A friend reports that his father was ascending a retirement community's
elevator when a mechanical-sounding voice surprisingly intoned that "your
warranty has expired." After initially thinking this was about the elevator
warranty, his father remembered hearing those exact words and tone and
surmised that it was a robocall for a vehicle maintenance extension sales
pitch. He relates that at least one retirement community employee, who
reported a similar incident, was chided by supervisors and colleagues who
didn't believe her claims that the elevator spoke.

Elevators in the U.S. must possess emergency communication devices, often
telephony-based. Authorized elevator maintenance personnel likely use them
to perform remote status inquiries. In this case, a robocaller sequence
reached the elevator's unpublished emergency phone number to promote
warranty extensions.

An elevator's emergency phone answers automatically and silently to
establish a two-way communications link and to allow quick audio evaluation
of conditions after a potential emergency, when occupants may be unable to
speak. A web search for "elevator telephone products" reveals numerous 3rd
party offerings. Your lift might be listening, possibly matching voice
prints for law enforcement, surveillance, or monetizing the conversation.

Risk: Elevator-pitch privacy and potential disruption of true emergency

It is unknown whether or not elevator controls, sensors, displays are
accessible/exploitable through the emergency telephone.  Hopefully not!

Vulnerability of locked iPhone with a Visa Card set in Transit Mode (BBC)

"Anthony Thorn" <>
Thu, 30 Sep 2021 09:56:01 +0200

Reported by BBC ( and many UK

"Apple told the BBC: "We take any threat to users' security very
seriously. This is a concern with a Visa system but Visa does not believe
this kind of fraud is likely to take place in the real world given the
multiple layers of security in place"

The biggest risk applies to stolen iPhones with a Visa Card set in Transit

How to have a hard time finding the About page

"積丹尼 Dan Jacobson" <>
Mon, 27 Sep 2021 22:22:09 +0800
"About “"
Looks like a menu with one item below it, "Testimonials".
But it is actually a link itself too if you press it.
That's why people have a hard time finding the About page on sites using
this theme.

Save the date! IFIP 60th Anniversary Panel “Autonomous vehicle safety and security: An information processing imperative

"Charles B Weinstock" <>
Mon, 27 Sep 2021 13:20:59 +0000
Dear colleagues, We invite you to attend a virtual panel session “Autonomous
vehicle safety and security: An information processing imperative."  The
session is organized by leaders of the “Intelligent Vehicle Dependability
and Security” project within IFIP Working Group 10.4 on Dependable Computing
and Fault Tolerance.  It is one of 10 panel events being hosted by IFIP,
selected from a pool of proposals to celebrate their 60th anniversary.
[Graphical user interface, application Description automatically generated]

The panelists are internationally recognized experts in diverse aspects of
road vehicle autonomy, with a shared interest in the safety and security
focus of the workshop.  The panel will be held October 18, 2021 from 15:00
to 16:15 CET (9:00 to 10:15 AM ET).  A description of the panel and the
registration link are here: Short bios
of the panelists and moderator can be found on the registration page.

IFP60 Panel VI Organizers

Please report problems with the web pages to the maintainer