Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

There is a newish piece of malware out there called Gauss. One thing it does is attack computers in the Middle East. Another thing it apparently does is install a font named Palida Narrow. Speculation involves the way that specially crafted web pages can get the browser to request the font or expose the font in the list of available fonts via JavaScript. Fascinating stuff, etc, etc.

Curious people want to know:

  • Is Palida Narrow a real font?
  • Is it ever found in the wild outside of this malware?
  • What does it look like?
  • Can it be downloaded and installed? (without getting infected, obviously)

If nothing else, an installation of Palida Narrow could always be used to test web apps designed to detect Gauss, and realism in a test never hurt (except when it did). :)

share|improve this question
While the font is bundled with a piece of malware, this question is very offtopic. – Rory Alsop♦ Aug 16 '12 at 18:20
If I wanted a copy to add a Gauss-malware detection script to a webpage (and functionally test it), would that be enough to bring it on topic?) – fennec Aug 16 '12 at 19:07
Of the various questions you posted, none would really be on topic. Even asking where to download it would be voted as too localised. In any case, googling to find gauss might be a better (if relatively unsafe bet) as download locations will change over time. – Rory Alsop♦ Aug 16 '12 at 19:11
While it was previously unknown and has a fake copyright notice, it is a real font that doesn't appear to be comprised of malware. This page has an image of the font: news.softpedia.com/news/… No way to figure out why the font was installed along with the malware; possibly to make it easier to determine if a machine is infected (check for the font; which can be done when you go to a webpage) or only spread to machines that don't have this font already installed. – dr jimbob Aug 16 '12 at 19:24
3  
Looks like a renamed Lucida Bright Demibold to me. – bobince Aug 16 '12 at 21:33
show 5 more comments

closed as off topic by Rory Alsop♦ Aug 16 '12 at 18:19

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

Browse other questions tagged or ask your own question.