UNCLASS PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER {ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE MANAGER {IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS SUBJECT: PROBLEM IN MACINTOSH HYPERCARD STACK PROGRAM {AUTOMATED SYSTEM SECURITY INCIDENT SUPPORT TEAM {ASSIST} BULLETIN 92-69}. 1. THIS BULLETIN ADDRESSES A PROBLEM THAT EXISTS WITH A HYPERCARD STACK PROGRAM FOR MACINTOSH COMPUTERS. THIS PROBLEM IS NOT DIRECTLY RELATED TO SYSTEM SECURITY, BUT IT DOES CREATE THE POSSIBILITY FOR SIGNIFICANT AMOUNTS OF ACCIDENTAL DATA LOSS ON MACINTOSH COMPUTER SYSTEMS. 2. ASSIST HAS RECEIVED A REPORT ABOUT A HYPERCARD STACK PROGRAM FOR MACINTOSH COMPUTERS THAT MAY CONTAIN FLAWS. THE STACK IS NAMED "HERMES OPTIMIZER 1.1" AND WAS REPORTEDLY INITIALLY DISTRIBUTED THROUGH THE OLYMPUS BBS, ALTHOUGH BY NOW THE DISTRIBUTION BASE MAY HAVE EXPANDED. ACCORDING TO THE REPORT, THE "ABOUT" MESSAGE SHOWS THE AUTHOR OF THE PROGRAM AS 70142,210 (COMPUSERVE) AND FARRADAY1 (APPLELINK). 3. ACCORDING TO THE AUTHOR, THE PROGRAM WILL REDUCE FRAGMENTATION IN HERMES SHARED FILES. ASSIST HAS LEARNED, HOWEVER, THAT USE OF THE PROGRAM MAY CAUSE SUBSTANTIAL DATA LOSS ON THE HARD DISK. 4. ANALYSIS OF THIS PROGRAM HAS NOT YET BEEN COMPLETED, BUT IT IS IMPORTANT TO WARN YOUR USERS NOT TO RUN THIS STACK PROGRAM IF THEY FIND IT. IF A USER DOES FIND HERMES OPTIMIZER 1.1, ASSIST REQUESTS THAT YOU FORWARD A COPY TO ASSIST ASAP FOR FURTHER ANALYSIS. 5. POINT OF CONTACT: ASSIST POINT OF CONTACT FOR THIS MATTER IS MIKE HIGGINS, COMM {703} 696-1904 OR DSN 226-1904. ASSIST CAN BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE {800-759- 7243}, PIN NUMBER 2133937. WHEN CALLING THE PAGER SERVICE, FOLLOW THE AUTOMATED VOICE INSTRUCTIONS AND ENTER THE CALL BACK NUMBER AFTER THE PROMPT. THE ASSIST DUTY OFFICER WILL CALL YOU BACK WITHIN 30 MINUTES. IF FASTER SERVICE IS REQUIRED, PREFIX YOUR TELEPHONE NUMBER WITH "999", AND THE ASSIST DUTY OFFICER WILL CALL BACK WITHIN 5 MINUTES. ASSIST CAN BE REACHED VIA E-MAIL AT "DOD-CERT{AT-SIGN}DDN- CONUS.DDN.MIL". BT