Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1106475" data-attributes="member: 32260">Two examples were already posted.1. Comodo challenge.2. DLL hijacking used in the bypass. It was not contained and allowed to run TDSSKiller. So, DLL hijacking vector is not sufficiently covered by Comodo.No offence. By writing that many fileless exploits/malware can bypass Comodo (also in your settings), I did mean the attackers who are motivated to target Comodo users. It does not mean that Comodo is routinely bypassed in the wild, but rather that is not so strong to use the reg tweak that disables LUA. This is probably the reason that Comodo does not use this tweak, and it was not recommended by the Comodo staff - even if it could improve the containment.If I correctly recall, your settings do not use HIPS and you do not tweak the Script Analysis Settings. So, many fileless attacks will not be contained, as in the case of Comodo challenge. After applying HIPS and Script Analysis Settings, Comodo can probably block most of the fileless attacks (like some variants of Comodo challenge), but loses much of its usefulness.</blockquote>

[QUOTE="Andy Ful, post: 1106475, member: 32260"] Two examples were already posted. 1. Comodo challenge. 2. DLL hijacking used in the bypass. It was not contained and allowed to run TDSSKiller. So, DLL hijacking vector is not sufficiently covered by Comodo. No offence. By writing that many fileless exploits/malware can bypass Comodo (also in your settings), I did mean the attackers who are motivated to target Comodo users. It does not mean that Comodo is routinely bypassed in the wild, but rather that is not so strong to use the reg tweak that disables LUA. This is probably the reason that Comodo does not use this tweak, and it was not recommended by the Comodo staff - even if it could improve the containment. If I correctly recall, your settings do not use HIPS and you do not tweak the Script Analysis Settings. So, many fileless attacks will not be contained, as in the case of Comodo challenge. After applying HIPS and Script Analysis Settings, Comodo can probably block most of the fileless attacks (like some variants of Comodo challenge), but loses much of its usefulness. [/QUOTE]

Verification