[VulnDiscuss] Re[2]: Opentype font file causes Windows to restart.

The strings found in the file are standard table names, and
'restarter' is just what I called the font. It is completely unrelated
to the 'restarter' trojan you mention (which is an executable file,
not a font file).

Some further information on this for the people that have asked; I
discovered this issue a while ago while working on a basic font
creation tool, which was pretty buggy at the time and produced some
rather bad fonts. The issue is related to the actual font definition data, ie the lines
& curves that define characters.  I'm not sure if the font could be modified to
produce different behaviour, but several different variations all
restarted Windows. Non executable files should theoretically be safe
-- how many different filetypes do we now have to be wary of?

-Andrew

Tuesday, January 7, 2003, 12:13:11 PM, you wrote:

TAM> quoth Andrew on this day of Our Lord:
TAM> | 
TAM> | The attached OpenType font file will cause Windows to restart
TAM> | immediately when the file is opened by the default viewer (fontview).
TAM> | I doubt anyone would suspect a "harmless" little font file of being
TAM> | able to cause such a thing to happen!
 
TAM>  I ran strings over it:

TAM> OTTO
TAM> CFF D@
TAM> eOS/2^^\
TAM> `cmap
TAM> $head
TAM> 6hhea
TAM> $hmtx
TAM> maxp
TAM> name
TAM> post
TAM> restarter
TAM> restarter
TAM> NONE
TAM> Copyright 2003. All rights reserved.restarterRegular1.000;NONE;restarterOTF 1.000;PS 001.001;Core 1.0.29Please refer to the Copyright section for the font trademark attribution notices.

TAM>  and then entered 'restarter' into Google, which returned information on a
TAM>  trojan called restarter that does just that. Sophos and Symantec have
TAM>  descriptions of somewhat different versions of the trojan.

TAM>  godspeed,

TAM>  Tiina Muukkonen
TAM>  System Administrator, CSE, UNSW