Security Now 22: The WMF Backdoor

"Steve Gibson has been working with the WMF vulnerability and is now convinced that this is an intentional backdoor into Windows added by Microsoft!"

Steve's website is grc.com. He says he'll know more in a week, but right now, he says the WMV exploit was put into Windows on purpose. Steve suggested that maybe this was put into Windows on purpose so that even if a user has turned off everything they could, Microsoft could still run code on a user's computer.

I think a bad programmer who worked on Windows may have put this one in as his own personal backdoor into Windows. Even if that isn't the case, I bet that's what Microsoft will say even if they admit to this. With that said, Steve does think Microsoft put it in themselves and the discovery was an accident. He's a smart guy. He knows how these things work. He discovered all of this because Microsoft did not provide a fix for older versions of Windows. If they had, he wouldn't have been looking for a fix for those computers himself. And to find a fix, he had to figure out how the exploit worked. And when he did that, he came to the conclusion that it was on purpose by Microsoft.

And just to make me feel better when I do use Windows, when asked if there could be more backdoors in Windows, Steven said, "Yes."

I just had a thought. This is in all versions of Windows. Is it likely that there's a bad programmer who has worked on every version of Windows? That would be Windows 95, 98, 98 SE, Windows Me, Windows 2000, and Windows XP. That's a lot of code. If there are programmers who worked on every version, it's got to be only a handful, right?  ¶ 2:05 AM