Reply to thread

Message

<blockquote data-quote="Decopi" data-source="post: 1101268" data-attributes="member: 67091">It&#039;s not the protocol.It&#039;s not the port.It&#039;s the IP!At Comodo, any &quot;safe&quot;/&quot;trusted&quot; file, sandboxed or not, restricted or not, containerized or not etc... regardless the protocol, and regardless the port... Comodo will always allow that file to have comms to tons of IPs.That problem at Comodo has no solution because &quot;safe&quot;/&quot;trusted&quot; files, for example in the case of svchost, it is impossible to customize by IP (hundreds of files use svchost for comms, with thousands of different IPs).At Comodo, the same problem happens with all the files considered &quot;safe&quot;/&quot;trusted&quot;, which includes Windows Services and a long list of other files (not just svchost).Therefore, at Comodo any virus/malware using, for example, svchost, will have comms to tons of IPs, regardless the protocol and the port. At Comodo, a virus/malware using svchost for comms, it can use any protocol and any port, because the virus/malware only cares about the IP... and at Comodo the svchost is free to connect to tons of IPs. Comodo can&#039;t stop comms for a virus/malware using svchost (or any other &quot;safe&quot;/&quot;trusted&quot; file).As a simple illustration, when Comodo is used, Firefox is forced to use svchost for comms. Both, Firefox and svchost are whitelisted by Comodo (both are considered &quot;safe&quot;/&quot;trusted&quot;). Therefore Firefox has free comms through svchost to tons of IPs (just limited by protocol/port). Comodo doesn&#039;t filter Firefox IP comms (through svchost). Now, instead Firefox, let&#039;s place a virus/malware, and the same logic applies, if the virus/malware uses svchost for comms, it&#039;ll have access to tons of IPs (really it doesn&#039;t matter protocol/port, what matters is just the IP).Always good to remember that svchost using DNS resolver (customized IP) doesn&#039;t stop comms to other IPs.This is not a bug. This a design flaw problem, mainly because Comodo never evolved in the last 20 years.Comodo Firewall is a placebo.</blockquote>

[QUOTE="Decopi, post: 1101268, member: 67091"] It's not the protocol. It's not the port. It's the IP! At Comodo, any "safe"/"trusted" file, sandboxed or not, restricted or not, containerized or not etc... regardless the protocol, and regardless the port... Comodo will always allow that file to have comms to tons of IPs. That problem at Comodo has no solution because "safe"/"trusted" files, for example in the case of svchost, it is impossible to customize by IP (hundreds of files use svchost for comms, with thousands of different IPs). At Comodo, the same problem happens with all the files considered "safe"/"trusted", which includes Windows Services and a long list of other files (not just svchost). Therefore, at Comodo any virus/malware using, for example, svchost, will have comms to tons of IPs, regardless the protocol and the port. At Comodo, a virus/malware using svchost for comms, it can use any protocol and any port, because the virus/malware only cares about the IP... and at Comodo the svchost is free to connect to tons of IPs. Comodo can't stop comms for a virus/malware using svchost (or any other "safe"/"trusted" file). As a simple illustration, when Comodo is used, Firefox is forced to use svchost for comms. Both, Firefox and svchost are whitelisted by Comodo (both are considered "safe"/"trusted"). Therefore Firefox has free comms through svchost to tons of IPs (just limited by protocol/port). Comodo doesn't filter Firefox IP comms (through svchost). Now, instead Firefox, let's place a virus/malware, and the same logic applies, if the virus/malware uses svchost for comms, it'll have access to tons of IPs (really it doesn't matter protocol/port, what matters is just the IP). Always good to remember that svchost using DNS resolver (customized IP) doesn't stop comms to other IPs. This is not a bug. This a design flaw problem, mainly because Comodo never evolved in the last 20 years. Comodo Firewall is a placebo. [/QUOTE]

Verification