Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1106507" data-attributes="member: 32260">Here is the original attack flow:Run POC -&gt; POC can create services outside containment through magic -&gt; Use service(to run curl.exe) to download the payloads -&gt;-&gt; Use service to run a file trusted by Comodo and do dll hijacking(the bad dll released escaped.txt) -&gt; Run tdsskiller -&gt; Comodo deadAs we can see Comodo did not detect or contain DLL hijacking with bad DLL. It is also common for other AVs, so DLL hijacking popularity is growing.The modified attack flow:Exploit (system or benign application) -----&gt; Buffer overflow -----&gt; run shell code -----&gt; create service ----&gt; use service to download the payloads ----&gt; DLL hijacking&nbsp; (ransomware, info stealer, etc.)In the modified attack, the malicious code is in the DLL (no other file is used to avoid detection/containment).Such attack can bypass Comodo without triggering containment, especially when HIPS is disabled or in Safe Mode. The attack is much easier with disabled LUA, because the shell code runs with high privileges. Without this tweak, the exploit needs also another exploit (privilege escalation) to create the service. Exploits without privilege escalation are common. Exploits with privilege escalation are rare and quickly patched.You are an active member on the Comodo forum, so it would be interesting to ask the Comodo staff why they do not disable LUA to improve the containment in Limited, Restricted, and Untrusted settings.</blockquote>

[QUOTE="Andy Ful, post: 1106507, member: 32260"] Here is the original attack flow: Run POC -> POC can create services outside containment through magic -> Use service(to run curl.exe) to download the payloads -> -> Use service to run a file trusted by Comodo and do dll hijacking(the bad dll released escaped.txt) -> Run tdsskiller -> Comodo dead As we can see Comodo did not detect or contain DLL hijacking with bad DLL. It is also common for other AVs, so DLL hijacking popularity is growing. The modified attack flow: Exploit (system or benign application) -----> Buffer overflow -----> run shell code -----> [B][COLOR=rgb(184, 49, 47)]create service[/COLOR][/B] ----> use service to download the payloads ----> DLL hijacking (ransomware, info stealer, etc.) In the modified attack, the malicious code is in the DLL (no other file is used to avoid detection/containment). Such attack can bypass Comodo without triggering containment, especially when HIPS is disabled or in Safe Mode. The attack is much easier with disabled LUA, because the shell code runs with high privileges. Without this tweak, the exploit needs also another exploit (privilege escalation) to create the service. Exploits without privilege escalation are common. Exploits with privilege escalation are rare and quickly patched. You are an active member on the Comodo forum, so it would be interesting to ask the Comodo staff why they do not disable LUA to improve the containment in Limited, Restricted, and Untrusted settings. [/QUOTE]

Verification