13 posts
How do I know a font does not have a virus?
I'm just worried.
Downloading it always from DaFont...

not from other crappy sites...

Édité le 19/02/2013 à 01:41 par rocamaco

not from ♦
other♦ crappy sites...

which implies ...

To be active, a virus need to be executed, from an exacutable file, a file that include program or macro or the boot of a file system.
Font don't include this possiblities.
To my knowledge, font can't be infected with a virus (like all files) but can't transmit a virus because this virus can't be activate.
If you're that worried, have an antivirus software check your files.
Menhir a dit 
To be active, a virus need to be executed, from an executable file, a file that include program or macro or the boot of a file system.
Font don't include this possiblities.
To my knowledge, font can't be infected with a virus (like all files) but can't transmit a virus because this virus can't be activate.
Ah, actually, a true type font can contain a virus and one that directly exploits vulnerabilities in the Windows Kernel. Take a look at
https://threatpost.com/of-truetype-font-vulnerabilities-and-the-windows-kernel/101263/ which states:
"Attacks like these are executed via an embedded malicious font file dropped into an Office document, such as a Word file. Once the user opens the malicious file—delivered either via a spear phishing email or over the Web—the exploit targets a vulnerability in kernel-mode drivers that improperly handle malicious TrueType font files."
So the question remains for dafont: Do you actively inspect your fonts for malicious code in your fonts?
G.
Just to make sure I understand this correctly (because it's still early and the coffee hasn't kicked in yet) it concerns the case where someone embeds a corrupt font into an Office document, and hopes for someone else to open the document, am I right? So, it means that the font file itself won't work correctly if some lines of malicious code are being added to "it", right?
gstunts a dit 
"Attacks like these are executed via an embedded malicious font file dropped into an Office document, such as a Word file. Once the user opens the malicious file—delivered either via a spear phishing email or over the Web—the exploit targets a vulnerability in kernel-mode drivers that improperly handle malicious TrueType font files."
Said the virus is in the Word file, not in the TTF or OTF.
So, I confirm : a virus can't be in a font file because a font file is not executed (it' only read) and a virus can be activated.
A TTF file can only be damaged by a virus but not transmit a virus.

Édité le 14/01/2016 à 15:45 par drf_bot
As Menhir already wrote 3 years ago, a font file can not contain a virus as a font file is a passive file.
A virus can only activate itself when included in an executable (exe) file.
It is always worthwhile to read before asking the same thing all over again.
usually with avasy you know if there is a virus or not
gstunts is correct. don't shoot.

koeiekat a dit 
As Menhir already wrote 3 years ago, a font file can not contain a virus as a font file is a passive file.
A virus can only activate itself when included in an executable (exe) file.
https://security.stackexchange.com/questions/123131/how-to-detect-suspicious-content-in-a-truetype-font-ttf-font-file
TTF format includes executable "hinting" code. <sarcasm>Of course! Microsoft invented the format.</sarcasm>
Simply displaying the font executes the code. You could strip all the hinting code - but then it would likely not be any good.
Yeah it totally depends on what happens with this font, if the OS has a vulnerable component that just happens to "preview" the font to you and the font is designed to exploit that "feature"...well bad things can happen.
Édité le 27/11/2022 à 23:59 par frd
Fuseau horaire : CEST. Il est actuellement 13:14