I have heard that it is possible to create a TrueType font that can cause a crash (because it contains invalid data), but I don't think a virus can be embedded in a font. I think it is possible for a virus to disguise itself as a font, the same way they can be disguised as other kinds of files.

Is there a way to check whats inside the ttf file or would norton pick up the hoax file that will make the system crash?

Because the font that i downloaded was legitimate as far as me beng able to use it but the next day i found a trojan backdoor virus on windows xp with a file it had created called FNTCache.dat.

That I don't know. Presumably, Norton would keep up on things like that. Maybe someone with more Windows experience than me should field this question.

(I'm Mac-based, but I've got a Windows box for testing fonts and other things. The thing I use it the most for is downloading virus definition updates. At least that's how it seems.)

It is possible but very, very unlikely that a trojan font could exploit a bug in a font renderer and propagate itself that way, but I think you probably got hit by something else. Viruses spreading via fonts would be sufficiently exotic to hit BUGTRAQ or vuln-dev, and I haven't ever seen talk of anything other than the OpenType crasher on Windows to which Mark alludes, and that bug has subsequently been fixed.

The FNTCache.dat is merely camouflage, and has nothing to do with fonts (necessarily). Font caches are common system files, and using them as a place to store viruses or virus data is just a little bit of social engineering on the virus-writer's part to keep you from noticing they're there. Update your virus definitions and see what your virus checker tells you.

Or get a mac.

I was thinking about where one might go looking for exploitable bugs in type renderers during dinner just now, and I assure you, none of the specific attack vectors I was thinking of were Windows or x86-specific. OpenType is a complicated, new technology that contains a lot of other complicated technologies (like, say, TrueType hinting), and everybody's got about the same level of experience implementing support for it. It's just as likely that Apple's overlooked a few boneheaded programming errors as Microsoft has -- or that the Freetype team on Linux / *BSD have.

So, in other words, settle down there, buster. Just because the only high-profile OpenType crasher found so far was on Windows doesn't mean that somebody might not find a bug somewhere else next. There's a time and a place for OS-bashing, but in this particular fight, it's those of us who don't want viruses against those who want to give them to us, and other concerns are secondary.

> Or get a mac.

Or become a hermit?

hhp

Or dust off the brushes, pens, fixogum, process camera, and pantograph!

>> Or get a mac.

>Or become a hermit?

?

>So, in other words, settle down there, buster.

nobody's getting excited ...

One way to check the authenticity of a TrueType font in Windows is to download Microsoft's free Font Properties Editor, which allows you to access a lot more information (several tabs worth) about the font when you right-click the .ttf file and select "Properties." If, indeed, you have a real TrueType font, you will see that information; if it's not really a font, the Properties dialogue box will probably be seriously confused.

Unfortunately, "get a Mac" is not the ideal solution either.

It's good to know we have a sense of humor.