App Review Comodo Cloud AV - Autosandbox only - petya bypassed

[Wave]

Thanks for sharing!

you think Petya is able to bypass SD and encrypt host machine?

No, it can't.

In fact, Petya itself contains no functionality to bypass sandbox mechanisms/virtual environments to attack the host system - it targets the Master Boot Record and overwrites it, therefore if the security product does not isolate the sample so it cannot access the boot sector (or monitors attempts for write requests to it and blocks them for the sample as it's running dynamically) then the system will become compromised.

Therefore, even though Petya was not blocked in the first video, the Petya sample itself did not "bypass" Comodo Sandbox - nothing like this occurred. It was the fault of Comodo.

 

[Ink]

Thanks for the quality demonstration. If CCAV is in fact inferior to their original Comodo suite, I'll consider something else for one of the other systems.

 

[erreale]

if you are using GPT drive, don't worry about petya

certainly, I use GPT drive, but it is fascinating and scary at the same time its operation.

 

[cruelsister]

Spawm- CCAV is totally inferior to the other Comodo products. With it, they are just pandering to the masses who are hung up on the antiquated "Anti-Virus" method of protection. CF is much more elegant and will provide superior protection.

Just my opinion, but I am always correct...

 

[Wave]

Just my opinion, but I am always correct...

Nope, not an opinion, you stated a fact because you're correct like you said!

 

[cruelsister]

I don't use CCAV at all, but did give it a try in the past and the sandbox seemed fine. I can, however, confirm Evjl's findings- I just tried Petya Green and it got right past.

But no real issue as no one should consider using this product anyway.

 

[shmu26]

what will happen if you set the CCAV sandbox to block unknowns, rather than virtualize them? Will it then protect the system properly?

EDIT: the advantage to CCAV is that you can combo it much more freely, because no HIPS. For instance, you can combo it with KIS.

 

[Deleted member 2913]

@Evjl's Rain

Thank You for the videos/tests.

Some has posted the test link in Comodo forum.

By the way, chkdsk couldn't revive the system?

 

[Evjl's Rain]

@Evjl's Rain

Thank You for the videos/tests.

Some has posted the test link in Comodo forum.

By the way, chkdsk couldn't revive the system?

that's the sign of petya. It fakes chkdsk. After the chkdsk , there will be a red skull

 

[Deleted member 2913]

what will happen if you set the CCAV sandbox to block unknowns, rather than virtualize them? Will it then protect the system properly?

EDIT: the advantage to CCAV is that you can combo it much more freely, because no HIPS. For instance, you can combo it with KIS.

I think sandbox set to block unknown should protect the system as the sample would be blocked/stopped from running...Evjl's Rain & cruelsister?

 

[Deleted member 2913]

that's the sign of petya. It fakes chkdsk. After the chkdsk , there will be a red skull

Ohk...I thought was real chkdsk...

Its mentioned in Comodo forum, lets see what Devs say...

 

[Evjl's Rain]

I think sandbox set to block unknown should protect the system as the sample would be blocked/stopped from running...Evjl's Rain & cruelsister?

there is no option to block unknown app in CCAV
perhaps CF has but this is a very risky option. and may cause an unbootable system, break usability

 

[Deleted member 2913]

there is no option to block unknown app in CCAV
perhaps CF has but this is a very risky option. and may cause an unbootable system, break usability

Sandbox setting has an option to block unknown i.e "Run only safe programs" in CCAV.

 

[Evjl's Rain]

Sandbox setting has an option to block unknown i.e "Run only safe programs" in CCAV.

thanks, I missed that. I'm not a comodo user

if comodo devs don't believe you, you can send them this video

 

[shmu26]

perhaps CF has but this is a very risky option. and may cause an unbootable system, break usability

once you get yourself settled in with CCAV, and all your important files are already recognized and trusted, then you could try switching to block unknowns, because at that point, it is kind of unlikely that you will get a new critical boot file that is unsigned by microsoft or your graphics vendor.

but it could happen, theoretically. Then you would have to boot into safe mode, start up CCAV, and mark the new file as trusted.

 

[Deleted member 2913]

I wonder if ViruScope would have kicked in & protect the system if it was enabled as ViruScope is better than its early days & now also have ransomware recognizers?

 

[AtlBo]

Thanks for helpful test videos again.

I question why the sandbox functions differently in CCAV that CFW. I feel this shouldn't be the case.

On the topic of MBR protection, does HIPs monitoring of "Protected Objects" (see pic) protect against MBR alterations/protect the master file table?

This is a question I have had for about two weeks I guess. Haven't had an opportunity to inquire, so maybe now is the best time or I hope so . Don't want to confuse any CCAV users!

 

[shmu26]

Thanks for helpful test videos again.

I question why the sandbox functions differently in CCAV that CFW. I feel this shouldn't be the case.

On the topic of MBR protection, does HIPs monitoring of "Protected Objects" (see pic) protect against MBR alterations/protect the master file table?

View attachment 133786

This is a question I have had for about two weeks I guess. Haven't had an opportunity to inquire, so maybe now is the best time or I hope so . Don't want to confuse any CCAV users!

the heading your screenshot falls under is "protected files". I kinda think the COM interfaces heading is where the MBR protection is at, but I must admit that I am just guessing.
I wouldn't mind at all if someone who really knows can enlighten us...

 

[Wave]

the heading your screenshot falls under is "protected files". I kinda think the COM interfaces heading is where the MBR protection is at, but I must admit that I am just guessing.
I wouldn't mind at all if someone who really knows can enlighten us...

Not sure why COM would be related to the Master Boot Record - the MBR is the first sector on the disk, it's not even 32-bit/64-bit (but it would be 16-bit ASM since the OS hasn't even loaded yet so the memory is even more limited and the processor can only make use of 16-bit registers)... It's also essential that it's exactly 512 bytes in size and has the boot signature at the end of it (55AA).

All Comodo need to do is use a device driver to restrict access to write to the MBR for the isolated program, problem solved. I'm surprised they didn't do it already for CCAV? Does it protect against MBR modifications in the sandbox from the firewall version?

Or they can just trick programs modifying it into believing they did when it didn't change anything.

 

[shmu26]

Thanks for helpful test videos again.

I question why the sandbox functions differently in CCAV that CFW. I feel this shouldn't be the case.

On the topic of MBR protection, does HIPs monitoring of "Protected Objects" (see pic) protect against MBR alterations/protect the master file table?

View attachment 133786

This is a question I have had for about two weeks I guess. Haven't had an opportunity to inquire, so maybe now is the best time or I hope so . Don't want to confuse any CCAV users!

@AtlBo, that black fedora hat in your avatar looks a lot like one I wear in real life.
You too?