I’ve just been reading Mark Russinovich’s blog posting entitled Inside the WMF Backdoor. From the looks of it, that exploit, the one where graphics files can be used to take over a suitably badly configured Windows PC is actually just bad design. Mark explains the whole thing, so there’s no point in repeating it here. I liked this story because I think Mark expertly explains the situation and calms hysteria – and you probably want to buy his fantastic books on Windows Internals too if you’re interested in learning about the evil enemy in WA (I admit I only use that book as a source for Microsoft-bashing these days).
The story just goes to make one fundamental point. Software is stupid and contains bugs. If you insist on running everything as “Administrator”, “root” or whatever your privileged user account name is actually called, then you deserve precisely everything that is coming to you when one of those bugs is exploited on a webpage you decide to visit. Steve Gibson has been whining for years (shields up! red alert!) – I liked some of the comments about Gibson on that blog, but I’ll let you read them to get the point.
Jon.