MarkH • May 8, 2020 6:34 PM

.
Modeling the Pandemic Long-Term

Two days ago, I observed here that

The overt policy of most states sounds like [aggressively reducing case numbers to a very low level], but because they aren’t suppressing infection enough to make [Test/Trace/Isolate] feasible, their de facto policy will [be to let the infection spread nearly to its natural limits] by fits and starts.

Or in other words, until effective vaccination is available, many countries will be following the policy of drifting into herd immunity … reasonably construed as mass homicide.

This article shows attempts to model what aimlessly drifting toward herd immunity might look like:

https://www.nytimes.com/2020/05/08/health/coronavirus-pandemic-curve-scenarios.html

Although I didn’t see it spelled out in the article, it would seem that the models are for the U.S. Even so, the dynamics of the models probably would apply similarly to many other countries as well.

The second group of models in the article show what engineers call limit-cycle control: relax social distancing, wait for cases to explode to some threshold, and then reimpose social distancing. Politics and psychology being what they are, it’s impossible that things will operate so simply. But what’s interesting, is to consider the duty cycles (a lot more distancing than relaxation in some scenarios).

Those models also show the gradual approach toward a presumed herd immunity percentage of 55% (which is surely at the low end of required percentages) … but don’t come very close to it, even after two years of misery and death.

What they don’t show, is the cost in deaths and lost quality of life. [I’ve been reading a little about the condition of Covid-19 survivors after coming off the ventilator: needing to re-learn how to walk and to speak, suffering cognitive impairments and psychological trauma …]

Hopeful News on Antibodies

https://www.nytimes.com/2020/05/07/health/coronavirus-antibody-prevalence.html

A recent U.S. study applied a SARS-CoV-2 antibody test that’s supposed to have less than 1% false positives, to people who’ve tested positive for the virus and then been recovered at least 14 days. Of 624 tested:

82% showed high levels of antibodies
7% showed low levels
11% showed no antibodies

Even more encouraging, of the 113 subjects who measured at low levels or no antibodies, they were able to get 64 to return a week later for a follow-up antibody test: only 3 still showed no antibodies.

Inferences:

• a high proportion of recovered Covid patients show high levels of antibodies

• almost all recovered Covid patients have at least some antibodies

• the build-up of antibodies seems to be slow, perhaps requiring about a month to level off

It’s very important to remember that the presence of antibodies by itself tells us nothing about how immune people might be, or how long such acquired immunity will persist.

It’s Time to Put the Bull$hit about Sweden to Rest

In reported Covid-19 deaths per population, Sweden has just surpassed the Netherlands … is continuing at high rates of new cases and deaths (with slight deceleration) … and seems likely to soon overtake France among the states with the worst rates of pandemic death. [In recent weeks, France has done remarkably well at suppressing spread of the virus.]

Denmark has many cultural and sociological characteristics in common with its larger neighbor. These countries are so near, that you can travel between them by driving your car across the Øresund Bridge.

Denmark has only about 30% as many deaths per unit of population as Sweden (and that percentage will shrink, as Sweden’s carnage grows). But, sputter Sweden’s defenders, the economy! The economy! Sweden is not paying the awful cost of lockdown!!!

… except that present economic forecasts predict Denmark to do a little better than Sweden in 2020, taking account of pandemic impacts.

There seems to be a fairly strong consensus among economists that economic growth vs. saving lives is a false dichotomy: countries that would be prosperous, had best protect their populations.

MarkH • May 9, 2020 4:51 AM

@JonKnowsNothing:

Whether or not publicly documented … do you suppose that such diagnostics are implemented in released device drivers?

If Mossad is after you, they might well find a way to swap drivers on you. But depending on the operating system, replacing a device driver may not be practical as a part of “app” installation.

Again, the lead comment on this topic was about businesses vacuuming commercial data, not state-level intelligence operations.

Many millions now have continuous streaming of microphone audio to remote servers for word identification, whether from phone, notebook or “hockey puck” device.

MarkH • May 9, 2020 4:57 PM

@Clive, Jon:

I’ve been looking at the datasheet for an Analog Devices chip typical of the family used in my antique computers … Clive doesn’t have a monopoly on old hardware 😉

The datasheet proudly proclaims the chip to have “AC’97 2.3 compatible features”.

From my examination, I note the following:

1. None of the ADC input paths shows any connection path to any audio output. [For mixing purpose, some of the signal paths to the outputs can be routed to ADCs, but those paths are on the driving end of amplifiers which connect to the output pins through mute or Hi-Z switches.]
2. The “jack sense” features seem to be limited to
   • programmable control of output muting
   • programmable selection of output source
   • detection by software
3. The “high power” output has a maximum capacity of 30 mW — fine for headphones, but rather wretched for speakers. I presume, therefore, that typical computer designs interpose audio amplifiers. That would mean two amplifiers pointed the wrong way, between the speaker terminals and the sound chip ADCs.

There’s a variety of tricks which can be played in the off-chip schematic. My old machines have separate headphone and microphone jacks. If I did the design, I’d connect the high-power output to the headphone jack, and drive the speakers through an audio amplifier chip from the line out pins. This would allow the possibility of automatically muting the speakers when headphones are plugged in.

If the sound card schematic connects unused audio inputs to the speaker terminals — and the power amplifier chips either have an output impedance that isn’t too low, or they can be disabled — then the speakers can indeed be used as microphones. Otherwise, I don’t see how the stunt could be accomplished.

If anybody has a concrete, real-world example of doing this on a mass-produced computer with unmodified hardware, please do tell!

MarkH • May 10, 2020 5:41 AM

@etv:

Thanks much! To me, a few grams of demonstrated exploit outweighs a hundred kilos of speculation.

@JonKnowsNothing, etv, Clive:

For convenience, here’s a link to the write-up of the headphone exploit made at Ben-Gurion University of the Negev:

https://arxiv.org/pdf/1611.07350.pdf

Some observations concerning this paper:

1. The attack makes use of a “value-added feature” rather than some obscure diagnostic mode, and so is both plainly documented in the datasheet, and implemented in standard device drivers.

In the specimen datasheet I examined (for Realtek ALC892), the signal path from audio output pins to the ADCs is as clear and obvious, as is the lack of such signal path in the datasheet for the Analog Devices AD1888 Soundmax chip I looked at yesterday.

So, as any of us would expect, the accessibility of the attack depends on the particular hardware.

1. The paper is deafeningly silent on the question of built-in (internal) laptop speakers, and refers with great explicitness to jack connections for external audio devices.

Now, why is that? Could it be that the authors failed to consider the possibility, or couldn’t afford a laptop for experimentation? My reading of the Realtek chip is that every output pin — including whichever outputs the design would allocate to internal speakers — can also be used as an audio input.

My interpretation is that the authors were neither stupid nor broke, but rather determined that even though the pins used to send audio signals to the internal speakers can be turned around as inputs, that capability is not useful … because there are external power amplifiers between the sound chip and the speakers. I think it likely that the overwhelming majority of laptops with built-in speakers have such power amplifiers.

If the Ben-Gurion team could have demonstrated eavesdropping via laptop internal speakers, surely they would have. It would have been a more dramatic exploit gaining a lot more publicity: a fair percentage of laptops have no headphones connected a fair percentage of the time, but almost all laptops have internal speakers connected all of the time.

Now, all of this being said, if a sound card is designed by Germanic engineers who love self-test and diagnostics, and there are input-capable pins on the sound chip not needed for other purposes, there’s nothing to prevent them from connecting the audio amplifier outputs to those spare inputs.

In such a sound card design, the speakers would be massively effective as microphones. It would be ideal if the audio amplifiers can be shutdown, but even if they can’t, the resulting attenuation would probably still allow plenty of eavesdropping.

MarkH • May 10, 2020 1:21 PM

@Phaete:

It is not a hack anymore but a simple software function.

I guess that one definition of “hack” for infosec purposes, would be an unanticipated software function, or a known function turned to an unexpected use …

For example, suppose that a notebook computer has a lamp next to the video camera, and that users have been instructed that when the camera is enabled, the lamp is also on.

If someone examines the documentation for the computer, and finds out that control of the lamp is independent of enabling the camera, they might use their knowledge to enable the camera while keeping the lamp dark. Whether or not that’s a hack, it’s a potential attack.

The people who invented “pin re-tasking” were imagining how it would make their products more useful. Did any of them anticipate that wired headphones might be “run backward” for snooping purposes?

Even if users of such computers know about pin re-tasking AKA jack detection (and I guess, most of them don’t), would they imagine that the machine intended to automatically recognize their headphones as an output device, would maliciously operate them as an input instead?

Thinking about how people use “hack” informally (not necessarily in a security context), I suggest that hacking is the use of knowledge and understanding to use apply resources in a manner very different — often startlingly different — from their usual application.

MarkH • May 10, 2020 2:55 PM

@Sherman Jay:

I think that the significance of the Ben-Gurion headphone attack is that it doesn’t require physical access.

Malware delivered to the computer by some typical remote attack vector, can then alter the sound chip settings without the user being aware.

Although it’s perhaps an “unfair” example, I once wired a compact “Hi Fi” speaker assembly to a mic preamp. I was amazed how well it worked.

I wasn’t surprised that the signal level (sensitivity) was very high, because the loudspeaker elements have a much larger “piston area” than a normal microphone diaphragm. I think it would have worked OK even with a line-level input.

But the clarity was magnificent. By dint of size, loudspeakers will be more directional than typical purpose-built microphones … though in a typical indoor environment, that’s no problem (and in fact may be desirable).

Obviously, such speakers aren’t well suited for typical microphone applications. But for eavesdropping on conversation, they function very well indeed.

MarkH • May 13, 2020 6:05 AM

.
For Those Who Still Believe that Unchecked Spread of Covid-19 is Good Policy

The combination of vast numbers of people getting sick with Covid-19, and the lapse of weeks and months, has provided the opportunity for the medical profession to form a picture of recovery for those who survive the illness. Parts of this picture are based on direct Covid data, and others are projections based on experience with similar respiratory viruses, or experience with similar kinds of tissue damage.

This picture looks very disturbing.

https://www.vox.com/2020/5/8/21251899/coronavirus-long-term-effects-symptoms

[You can also find articles on this subject in other journalism sites.]

The primary focus of attention — especially at first — has been deaths, and the pneumonia which is the most common way Covid-19 kills people.

However, the virus can attack many organs and tissues … and people who aren’t killed by it, may nonetheless suffer badly.

Some of the worst effects on survivors appear to be quite frequent, affecting between 30 and 50 percent of patients who’ve recovered from the acute phase of Covid-19. Some of the tissue damage is observable on people who had mild illness, or perhaps didn’t feel ill at all.

After-effects include lung scarring, heart damage, and neurological impairment. Some patients may need years to recover. Many of these lesions may never fully heal, and be significant enough to impair ordinary functioning, and quality of life.

Although it’s mercifully infrequent, it now appears that young children (who rarely die from Covid-19) sometimes develop severe inflammation of the heart and coronary arteries. A few have died; the long-term consequences for the rest are unknown.

Probably, many young adults have felt relatively confident, because Covid-19 mortality is so highly age correlated. However, there’s reason to worry that one after-effect may be infertility in men. For young men who’ve decided to attend “Covid parties,” one might visualize a sort of Darwinian selection in progress.

For me, two clear implications:

1. Protecting yourself and your loved ones is very important, because even if your risk of death is low, your risk of a terrible loss of vitality and health may be many times higher.
2. States which decide it’s a good idea to allow the virus to spread to its natural limit may find themselves not only losing thousands of people, but also with hundreds of thousands or even millions of survivors suffering, traumatized, disabled to varying degrees, and perhaps doomed to shortened lifespans.

The negligence of governments that allowed dreadful magnitudes of transmission (including Clive’s government, and mine), is madness.

To allow transmission by deliberate policy, is madness on stilts.

MarkH • May 15, 2020 5:37 AM

@SpaceLifeForm:

… if you fail to vote, you may regret it.

Who wins in some upcoming elections (not only in the U.S., I suppose) will surely have life-and-death consequences.

For the record, I

(a) cited an article by David L. Katz proposing the “herd immunity policy,” and explained why the logic made sense to me, and why I thought it was worth considering;

(b) in the same thread, observed that the Dr Katz argument was predicated on about 99% of infections needing no special medical attention, which was not supported by data either then or now; and

(c) pushed back on provably false statements about herd immunity.

It seems to me that for the most part, I have discussed policy proposals without “taking a stand” on what’s the best thing to do. This would require a Solomonaic wisdom I don’t find in myself.

For example, I’ve seen new projections of how many of the poorest in the human family are expected to be at risk of death from starvation, in consequence of the global economic contraction.

That number may exceed the total deaths expected if no effort were made to check the spread of the pandemic.

What is the most moral course of action? The answer is far from clear to me.

In contrast, what so many countries (including mine) are doing is incurring enormous costs from counter-spread measures, without making them comprehensive enough to really control the disease.

Surely that is wrong: it’s the worst of both worlds.

I often think of words attributed to Winston Churchill, “there’s something to be said for making war on the Bolsheviks, and something to be said for making peace with the Bolsheviks … but nothing to said for the present policy.”

Which I suppose brings us back to the start: in most of the world, the hideous wrong steps have been taken, and the best opportunities lost. There’s no power on heaven or Earth that can change that now.

The best hope is for governments which will assemble the best talent, take strong and decisive action to marshal their resources jointly with private entities, and be guided by data and science.

Let’s hope that enough voters will understand this.