# 95-05


Contents


        Sympathy for the Devil -- SATAN in Context
        VB'95
        How Many HTTPs Can You Handle on the SuperHighway?
        FolderBolt-Pro
        nVir Check -- Disinfectant Checkmate and Game 


1.  Initial SATAN runs at my location reaffirm numerous postings to various
Internet newsgroups and forums:  specifically, if you have competent
system administrators who have conscientiously applied all known patches
to their particular configuration you need not become paranoid over SATAN.
CERT, CIAC and COAST have echoed, if not set the foundation, for this
conclusion.  In the tradition of the Michelangelo virus hype, the conventional
news media and several trade publications, whom I thought should have known
better, had their fifteen minutes of publicity.  While some commentators
have proposed that the hype has done a "service" in raising the level of
security awareness, I have a personal prejudice against the "fear" argument.
I found extremely disappointing as well the venom which Dan Farmer received.
Maybe there really is something sinister about putting floride in the water
supply!

2.  Virus Bulletin will host VB'95 in Boston, MA, 20--22 September 1995.  The
conference fee is a bit stiff at $895 for a standard registration and $820
for Virus Bulletin subscribers.  The initial flyer does not provide a
listing of the papers or speakers, but does indicate the program will have
three parallel tracks of technical and non-technical presentations.  The US
office telephone number for further information is 203-431-8720 or fax 203-
431-8165.

3.  The April 1995 edition of the Communications of the ACM has a series of
articles on digital libraries with a plethora of http addresses for the
adventurous.  There is also a wonderful column by Peter Denning, "Information
Superhighway 2015".  One brief excerpt follows:  "Cyber-Songs, by Al Gore.  A
delightful compendium of ditties all rendered in bits and bytes that play your
computer.  The author calls them 'Al Gore Rhythms'".

4.  Kent Marsh Ltd has announced FolderBolt-Pro.  The program now incorporates
another Kent Marsh product CryptoMactic, to include a sanitization routine.
(reference Product Test 35, June 1992 for FolderBolt and Product Test 76,
February 1995 for CryptoMactic).

5.  A strain of the nVir virus has appeared which the unknown author(s)
apparently designed to avoid detection by Disinfectant.  Representatives
for VirusDetective, RIVAL, SAM and VIREX have stated their current versions
detect the strain.  As a registered user of all four programs, I can state
that this is absolutely true based upon tests against several test samples. 
The author of Disinfectant, John Norstad, has as of 7 Apr 95 released version
3.6 which now identifies this strain.  In the history of Macintosh viruses
this is not the first occasion in which a viral author has attempted to
target a specific anti-viral program.  Historically this phenomenon is 
more prevalent in the MS-DOS environment.


[Disclaimer:  Information Systems Security Updates represent the
opinions and views of the author, not his employer.  Recipients
are free to quote all/parts of the ISSU with credit/blame to the
author.]