Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1109191" data-attributes="member: 32260">Yes.Yes. After reboot, the system is unprotected for a few minutes, until Microsoft Defender is reactivated. The attacker could also add the code to dismantle Microsoft Defender.It is an attack, with a skipped delivery part. The malware can be delivered from a flash drive, local network share, etc. I cannot make a video about malware delivery in the Enterprise environment. It would require the access to the Enterprise network.I could add the delivery part in the non-enterprise environment, but non-enterprise users can hardly be the targets.Anyway, if you are interested, the possible attack flow could be as follows:Email with URL ----&gt; user downloads the password-protected RAR archive&nbsp; ----&gt; user extracts the open_me.iso from the archive&nbsp; ---&gt; the rest is just like in the videoComodo cannot detect files until the open_me.iso is mounted and it follows from the video, that it could not also detect/block what happened next.Of course, the attacker must use the URL that is not blacklisted.</blockquote>

[QUOTE="Andy Ful, post: 1109191, member: 32260"] Yes. Yes. After reboot, the system is unprotected for a few minutes, until Microsoft Defender is reactivated. The attacker could also add the code to dismantle Microsoft Defender. It is an attack, with a skipped delivery part. The malware can be delivered from a flash drive, local network share, etc. I cannot make a video about malware delivery in the Enterprise environment. It would require the access to the Enterprise network. I could add the delivery part in the non-enterprise environment, but non-enterprise users can hardly be the targets. Anyway, if you are interested, the possible attack flow could be as follows: Email with URL ----> user downloads the password-protected RAR archive ----> user extracts the open_me.iso from the archive ---> [COLOR=rgb(0, 168, 133)][B]the rest is just like in the video[/B][/COLOR] Comodo cannot detect files until the open_me.iso is mounted and it follows from the video, that it could not also detect/block what happened next. Of course, the attacker must use the URL that is not blacklisted. [/QUOTE]

Verification