Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1109152" data-attributes="member: 32260">Bring Your Own Vulnerable Driver attack - CIS case.Most readers can skip the part of the video from 1:34 to 7:18, which is about the CIS settings.[MEDIA=youtube]wU-BcQOPSkA[/MEDIA]This video is an example of targeted attack on the AV via vulnerable driver + external LOLBin + UAC bypass.That attack silently compromises the system and will dismantle the AV protection after Windows restart.The method used is well known and I used Comodo Internet Security 2025 (CIS) as an AV example.The information needed to perform such attacks is publicly available on the web.Attack flow:ISO file ---&gt; user opens it and runs the content ---&gt; system silently compromisedNo UAC prompt, no Comodo alerts.The user can see that something is wrong only after restarting Windows.A similar type of attack can be done against any AV. It is different from &quot;AV challenge&quot; POCs used by me in theseries of videos on the MalwareTips forum to dismantle the AVs protection.Edit.The attack is different from Kill-floor malware (different execution method and driver):[URL unfurl=&quot;true&quot;]https://www.bleepingcomputer.com/news/security/hackers-abuse-avast-anti-rootkit-driver-to-disable-defenses/[/URL]The Kill-floor malware can be easily contained by Comodo, so no Comodo products are on the target list of that malware. Bypassing Comodo requires non-standard execution methods to bypass auto-containment and Script Analysis.</blockquote>

[QUOTE="Andy Ful, post: 1109152, member: 32260"] [B]Bring Your Own Vulnerable Driver attack - CIS case. [COLOR=rgb(0, 168, 133)]Most readers can skip the part of the video from 1:34 to 7:18, which is about the CIS settings.[/COLOR][/B] [MEDIA=youtube]wU-BcQOPSkA[/MEDIA] This video is an example of targeted attack on the AV via vulnerable driver + external LOLBin + UAC bypass. That attack silently compromises the system and will dismantle the AV protection after Windows restart. The method used is well known and I used Comodo Internet Security 2025 (CIS) as an AV example. The information needed to perform such attacks is publicly available on the web. Attack flow: ISO file ---> user opens it and runs the content ---> system silently compromised No UAC prompt, no Comodo alerts. The user can see that something is wrong only after restarting Windows. A similar type of attack can be done against any AV. It is different from "AV challenge" POCs used by me in the series of videos on the MalwareTips forum to dismantle the AVs protection. Edit. The attack is different from Kill-floor malware (different execution method and driver): [URL unfurl="true"]https://www.bleepingcomputer.com/news/security/hackers-abuse-avast-anti-rootkit-driver-to-disable-defenses/[/URL] The Kill-floor malware can be easily contained by Comodo, so no Comodo products are on the target list of that malware. Bypassing Comodo requires non-standard execution methods to bypass auto-containment and Script Analysis. [/QUOTE]

Verification