[discostu]

i don't deny that there are potential security issues in the loop. What I deny is that this was something MS has been hiding from people and only astute investigation by watchdoggers have exposed it. Anybody that ever learned Windows programming from the books MS publishes knows about the loop, it's been well documented since the 16-bit days. What I find shocking is that apparently so many people never heard of it before.

[supercat]

Anybody that ever learned Windows programming from the books MS publishes knows about the loop, it's been well documented since the 16-bit days. What I find shocking is that apparently so many people never heard of it before.

First of all, it's well known that programs like Recorder can send fake keystrokes and other events to applications. Indeed, this ability allows for some useful functionality. The critical details noted in this particular exploit are that the system default handlers allow one application to use events to send any desired amount of data to any desired location within the other process's address space, and then to run the code (again within that other process's address space).