App Review Comodo Firewall Bypassing a Bypass

[Andy Ful]

With UAC enabled and a person blocking everything that resulted in a UAC popup may make one "Feel Good" but won't add very much to overall security especially as UAC can be easily bypassed (I'm sure I made a couple of videos on this in the past).

The UAC bypasses usually happen when the security does not use strong containment. In the case of Comodo with containment set to Restricted or Untrusted, bypassing UAC would be much harder. I cannot recall any example of bypassing UAC in such containment.

 

[Andy Ful]

@Andy Ful @cruelsister Does Silent Mode with the firewall set to block popup requests obviate the need to disable UAC?

You probably had in mind disabling LUA by using the reg tweak or GPO. This makes the Comodo sandbox fully functional. But, at the same time, anything running outside the sandbox is more vulnerable. The malware/exploit does not need to use privilege escalation or UAC bypass.

Second, if it does not, would disabling UAC after setting to always notify stop this exploit?

It does and disabling LUA can stop that exploit too.
By the way, if you disable LUA then UAC is automatically set to "Never notify."
But, when LUA is enabled and you set UAC to "Never notify", this will not change the LUA.

I understand it would cripple run-as and apparently mess with auto containment.

When LUA is disabled, everything executed by the user starts by default as administrator. So, the "Run as administrator" option is not needed anymore.

Third, I saw a brief mention of standard user accounts. What impact does it have to run Cruel CF in silent mode and block popup requests within a standard account, with or without UAC disabled?

That particular exploit will be blocked on SUA independently of the LUA enabled/disabled.
The advantage of using SUA happens when the UAC bypass is not contained by Comodo.

 

[Sephirothnight]

And still would love a single example of a dll-hijacking malware file getting by CF (in the Wild SHA256 old or new would be adequate).

Hi,
thank, good vidéo and Dead Can Dance it's very "big" good.

 

[ebocious]

When LUA is disabled, everything executed by the user starts by default as administrator. So, the "Run as administrator" option is not needed anymore.

In an administrative account, you mean. In SUA, it is, and will hamper installers and applications that require elevated privileges on every execution.

 

[simmerskool]

And even setting the UAC slider to Never Notify will still allow UAC to be enabled, opening up a system to potential issues.

so then do you disable UAC in the registry? please advise.

 

[Andy Ful]

In an administrative account, you mean.

Yes.
On SUA, disabling LUA (EnableLUA = 0) works as setting UAC to "Never notify" and also as setting ConsentPromptBehaviorUser = 0.
But on the Administrator account those settings work differently.

 

[ebocious]

No- please note that UAC (enabled) will prevent CF from reacting (as it normally would) to this attack, so any Comodo setting change after that file is run would be of no consequence. The real question here is if the use of UAC can be justified by anyone, especially as some cutesy cmd line arguments can be added to bring down other AM applications.

With UAC enabled and a person blocking everything that resulted in a UAC popup may make one "Feel Good" but won't add very much to overall security especially as UAC can be easily bypassed (I'm sure I made a couple of videos on this in the past). And even setting the UAC slider to Never Notify will still allow UAC to be enabled, opening up a system to potential issues.

But as always, your system, your choice.

Thank you. I am taking your advice in this instance, as I am of the understanding that a lot of exploits these days are designed to work in user context, in which case I would expect more mileage from Cruel CF than from UAC. I also have a standard account for regular use.

I don't know if you saw a comment I made previously, but I understand that CF is no longer free (only antivirus). The free firewall still gets signature updates, but not version updates. Are you using the paid product now, or sticking with the last free version?

 

[ErzCrz]

Thank you. I am taking your advice in this instance, as I am of the understanding that a lot of exploits these days are designed to work in user context, in which case I would expect more mileage from Cruel CF than from UAC. I also have a standard account for regular use.

I don't know if you saw a comment I made previously, but I understand that CF is no longer free (only antivirus). The free firewall still gets signature updates, but not version updates. Are you using the paid product now, or sticking with the last free version?

CIS / CF is still completely free. You can get CIS/CF Premium (Free) from here: CIS/CF Version 12.3.3.8152 which is the latest version. It's the Premium Version to download and then you can choose with the installer whether to install both Firewall and Antivirus or just one or the other as detailed in @cruelsister 's video: Comodo Firewall 2025 Setup & Commentary. This latest version fixes the recent Certificate issue.

 

[Andy Ful]

Why I do not recommend disabling LUA:

App Review - Comodo's killer.

I created this video as a supplement to the discussion in another thread: https://malwaretips.com/threads/comodo-firewall-bypassing-a-bypass.133411/ The original bypass and Comodo's killer do not work if Core isolation is properly configured on Windows.

malwaretips.com

 

[Andy Ful]

I conducted a simple test with restricted RunDLL32 via Script Analysis and the unknown DLL (other settings like in the Comodo killer).
When the DLL was executed by RunDLL32, it was contained. When the same DLL was loaded via DLL hijacking, it was not contained.
It is not good, because such an attack is very simple and does not require an exploit.
In the standard attacks via LOLBins, the DLL can be contained if the LOLBin that can execute the DLL is restricted.
My DLL was unknown but not harmful, so malicious actions of DLL hijacking can probably be mitigated by HIPS/VirusScope.

Edit.
Added VirusScope.

 

[Vitali Ortzi]

I conducted a simple test with restricted RunDLL32 via Script Analysis and the unknown DLL (other settings like in the Comodo killer).
When the DLL was executed by RunDLL32, it was contained. When the same DLL was loaded via DLL hijacking, it was not contained.
It is not good, because such an attack is very simple and does not require an exploit.
In the standard attacks via LOLBins, the DLL can be contained if the LOLBin that can execute the DLL is restricted.
My DLL was unknown but not harmful, so malicious actions of DLL hijacking can probably be prevented by HIPS.

I wonder if some third party hips like hitman pro alert , intercept x can prevent something like that as it has some mitigations against loading, injection of dll files into protected processes

 

[ebocious]

I wonder if some third party hips like hitman pro alert , intercept x can prevent something like that as it has some mitigations against loading, injection of dll files into protected processes

That would be nice. If there are some types of drive-by downloads that can get through browser protections and Comodo, another layer might be needed.

 

[Andy Ful]

Here is a good recent example of when Comodo containment can be advantageous over modern solutions based on machine learning and detonation in the cloud sandbox:

Babble Babble Babble Babble Babble Babble BabbleLoader

BabbleLoader: the annoyingly clever malware loader that jumbles, scrambles, and evades its way past modern defenses with frustrating ease.

intezer.com

Such malware is prepared to avoid/bypass modern/popular solutions, due to sophisticated techniques developed by MaaS (Malware-as-a-Service). It can be used in massive attacks to infect many users. For non-enterprise users, protection against such malware is currently more important than covering rare Comodo bypasses.

 

[blueblackwow65]

So is Comodo recommended as a av and firewall product to install today?

 

[Vitali Ortzi]

So is Comodo recommended as a av and firewall product to install today?

It's pretty lightweight and when configured with cruelssister settings it doesn't conflict with av software (virus scope , hips disabled)
I would recommend using it as another layer to the av software and I recommend as well adding exclusions and hardening comodo processes with exploit guard

 

[Andy Ful]

I found another Comodo containment bypass (technique known for over 5 years) via VBA macro. That bypass is rarely used in the wild and allows the injection of the EXE file into Excel/Word. Comodo only sees that a trusted application does something (Excel.exe or Word.exe), so the EXE file is not contained.

In the screenshot above we can see the same application "New GUI" executed normally (contained by Comodo) and executed via office macro (not contained).
Even if Comodo uses Paranoid HIPS the user has to be cautious because the HIPS alert informs only that Winword.exe tries to execute Winword.exe.

Anyway, no need to worry if macros are not allowed.

Edit.
I changed the screenshot (Killswitch in English).

 

[Andy Ful]

So is Comodo recommended as a av and firewall product to install today?

It is a product for a special group of users who like Comodo containment.

 

[ErzCrz]

I found another Comodo containment bypass (technique known for over 5 years) via VBA macro. That bypass is rarely used in the wild and allows the injection of the EXE file into Excel/Word. Comodo only sees that a trusted application does something (Excel.exe or Word.exe), so the EXE file is not contained.



In the screenshot above we can see the same application "New GUI" executed normally (contained by Comodo) and executed via office macro (not contained).
Even if Comodo uses Paranoid HIPS the user has to be cautious because the HIPS alert informs only that Winword.exe tries to execute Winword.exe.

Anyway, no need to worry if macros are not allowed.

Edit.
I changed the screenshot (Killswitch in English).

I'm presuming that your Anti-Exploit tool would prevent this or perhaps one of your hardening tools. Is there an in the wild example of this exploit? Was viruscope enabled in the test? Just curious why it hasn't been at least detected or flagged by behaviour analysis.

 

[Andy Ful]

I'm presuming that your Anti-Exploit tool would prevent this or perhaps one of your hardening tools. Is there an in the wild example of this exploit? Was viruscope enabled in the test? Just curious why it hasn't been at least detected or flagged by behaviour analysis.

Any method that blocks macros (also my DocumentsAntiExploit tool) can prevent that attack.
I repeated the test with an enabled Internet connection (I am not sure If VirusScope uses a cloud backend):

Viruscope could not block the containment bypass, but it has some chances to mitigate some malicious actions of the payload. In my test, I used an unknown but benign payload "New GUI". I initially disabled the Internet connections to be sure that Comodo could not add the file to the trusted group.
I used hardened @cruelsister settings (all Script Analysis settings enabled).

Comodo on reasonable settings cannot contain such attacks, but it can detect the payload by signatures or some malicious actions can be blocked by VirusScope/HIPS.
The attack can be contained using a virtual desktop to open the weaponized document.

Edit.
I wrote "containment bypass" but (more precisely) it is an auto-containment bypass.

 

[ErzCrz]

Any method that blocks macros (also my DocumentsAntiExploit tool) can prevent that attack.
I repeated the test with an enabled Internet connection (I am not sure If VirusScope uses a cloud backend):



Viruscope could not block the containment bypass, but it has some chances to mitigate some malicious actions of the payload. In my test, I used an unknown but benign payload "New GUI". I initially disabled the Internet connections to be sure that Comodo could not add the file to the trusted group.
I used hardened @cruelsister settings (all Script Analysis settings enabled).

Comodo on reasonable settings cannot contain such attacks, but Comodo can detect the payload by signatures or some malicious actions can be blocked by VirusScope/HIPS.
The attack can be contained using a virtual desktop to open the weaponized document.

Interesting. Thanks for testing. I'm surprised that the payload itself wasn't contained and therefore any sub procesess. suppose it proves at the very least that computer security is all about layers and best practices.