Reply to thread

Message

<blockquote data-quote="Decopi" data-source="post: 1101085" data-attributes="member: 67091">DNS providers (1.1.1.1, 1.0.0.1, whatever) are not direct IP addresses (they are just DNS resolvers). Therefore, at Comodo, any malware can use svchost to connect to any IP, using any DNS resolver. For example, one of your rules is: &quot;C:\Windows\System32\svchost.exe Allow UDP Out Any 1.0.0.1 Any 53 DNS-Cloudflare&quot;... means that in your Comodo a malware using svchost can connect to any IP trough 1.0.0.1At Comodo, the only way to customize svchost is by customizing IPs, not the DNS resolver, but the direct comm between svchost and any specific IP. And that&#039;s impossible to be done, because daily your device uses thousands of different IPs.Again, limiting the port won&#039;t limit any IP.At Comodo, any malware using Windows Services, svchost or any file labeled as &quot;safe&quot;/&quot;trusted&quot;... the malware will have comms to any IP.And again, in this example also you can&#039;t customize IPs at Comodo for Windows Time or for other Windows Service because Microsoft IPs change weekly.I do respect your opinion! But I disagree. IMHO is a major flaw! At Comodo, any malware can exploit a &quot;safe&quot;/&quot;trusted&quot; file, having comms to any IP.Comodo firewall is a placebo.Here is not the right thread, but I ensure you that Windows Firewall and several other third-party firewall, they not just have a better GUI than Comodo, but they allow the complete customization of any file (including Windows Services, svchost, etc etc etc).Again, with all due respect, I disagree.Comodo is built in modules. And you and me are talking specifically about Firewall. And Comodo Firewall has dangerous breaches. It&#039;s unacceptable to justify or to minimize or to omit any security breach in Comodo Firewall by pointing to another module.That said, it&#039;s always important to remember that the Comodo Containment module itself has several security breaches.Totally agree with you! Excellent comment.And also it&#039;ll be nice to see Comodo incorporating a strong real antivirus/antimalware, with new modules based in virus/malware detection (not &quot;blocker&quot;, &quot;deny-all&quot;, &quot;zero-trust&quot; blah blah blah).However, based on the past 20 years, it&#039;s easier to discover that The Earth is flat, than to see Comodo fixing bugs or incorporating modern technologies.</blockquote>

[QUOTE="Decopi, post: 1101085, member: 67091"] DNS providers (1.1.1.1, 1.0.0.1, whatever) are not direct IP addresses (they are just DNS resolvers). Therefore, at Comodo, any malware can use svchost to connect to any IP, using any DNS resolver. For example, one of your rules is: "[B][I]C:\Windows\System32\svchost.exe Allow UDP Out Any 1.0.0.1 Any 53 DNS-Cloudflare[/I][/B]"... means that in your Comodo a malware using svchost can connect to any IP trough 1.0.0.1 At Comodo, the only way to customize svchost is by customizing IPs, not the DNS resolver, but the direct comm between svchost and any specific IP. And that's impossible to be done, because daily your device uses thousands of different IPs. Again, limiting the port won't limit any IP. At Comodo, any malware using Windows Services, svchost or any file labeled as "safe"/"trusted"... the malware will have comms to any IP. And again, in this example also you can't customize IPs at Comodo for Windows Time or for other Windows Service because Microsoft IPs change weekly. I do respect your opinion! But I disagree. IMHO is a major flaw! At Comodo, any malware can exploit a "safe"/"trusted" file, having comms to any IP. Comodo firewall is a placebo. Here is not the right thread, but I ensure you that Windows Firewall and several other third-party firewall, they not just have a better GUI than Comodo, but they allow the complete customization of any file (including Windows Services, svchost, etc etc etc). Again, with all due respect, I disagree. Comodo is built in modules. And you and me are talking specifically about Firewall. And Comodo Firewall has dangerous breaches. It's unacceptable to justify or to minimize or to omit any security breach in Comodo Firewall by pointing to another module. That said, it's always important to remember that the Comodo Containment module itself has several security breaches. Totally agree with you! Excellent comment. And also it'll be nice to see Comodo incorporating a strong real antivirus/antimalware, with new modules based in virus/malware detection (not "blocker", "deny-all", "zero-trust" blah blah blah). However, based on the past 20 years, it's easier to discover that The Earth is flat, than to see Comodo fixing bugs or incorporating modern technologies. [/QUOTE]

Verification