App Review Comodo Firewall vs a new Data Stealer

[ForgottenSeer 114834]

Pecking order established here lol

 

[wat0114]

Was this test done on the latest Beta or latest stable release? 12.2.2.8012 is latest stable release??

 

[Jonny Quest]

I’m that third, most handsome dog. It is in a need of a trim (I go barbers every week) but still handsome.

And I like the Donald Trump like comb over

 

[Chuck57]

We, or I, have a cat now. She's 19 yrs old. Had her since she was 5 or 6 weeks. I have to take care of her. When my wife passed away last year, that little cat was beside me or in my lap every moment for 2 or 3 months, I guess looking after me. She got me through a tough time, so now it's my turn to help her. Fortunately, still healthy but slowing down.

 

[cruelsister]

Some members commenting took issue with the statement "oblivious to malware" made in the video, an unnecessary statement. Also a incorrect statement because simultaneously there was another thread with products stopping the sample, which ironically enough was not even being tested with real world testing to test the scope of the products abilities.

Although I’d rather not intrude too much on his thread, your point does need clarification. When the video was made, the malware was D+1 with detections made by only a few products. As I was very surprised that VirusScope detected it, I also ran it against ESET which I still had on a VM from previous test. I didn't feel that a second video about it was either needed or appropriate.

ESET at that time (although it detects it now) neither stopped the packaging of the Data nor the transmission of this package out. With this fresh in my mind, that was what prompted the comment made in the video. No implication was intended that no other product would detect it (obvious from the VT results), and no inference should be drawn that other products wouldn’t add future detections.

m

 

[Chuck57]

And I like the Donald Trump like comb over

If he's emulating Trump, how can it be bad? *ducking for cover*

 

[Trident]

If he's emulating Trump, how can it be bad? *ducking for cover*

I’m a very well maintained guy actually.
Some people here have seen me. @Jengo , @Shadowra can see my profile pic on WhatsApp, @Lynx . @SeriousHoax has also heard my voice.

But I would be happy to emulate trump.

 

[ForgottenSeer 114834]

Although I’d rather not intrude too much on his thread, your point does need clarification. When the video was made, the malware was D+1 with detections made by only a few products. As I was very surprised that VirusScope detected it, I also ran it against ESET which I still had on a VM from previous test. I didn't feel that a second video about it was either needed or appropriate.

ESET at that time (although it detects it now) neither stopped the packaging of the Data nor the transmission of this package out. With this fresh in my mind, that was what prompted the comment made in the video. No implication was intended that no other product would detect it (obvious from the VT results), and no inference should be drawn that other products wouldn’t add future detections.

m

VT engines are not kept up to date and refreshed soon enough as should be so how would you know?

Eset was not tested as far as I know with real world testing passing the sample through these modules, so again, how would you know.

So simply avoid making comments about other products and carry yourself in a better way to avoid these issues as stated. I'm not new to testing and you know this. I seen clearly what has taken place and have voiced this directly without being disrespectful.

 

[cruelsister]

Eset was not tested as far as I know with real world testing passing the sample through these modules, so again, how would you know.

ESET at that time (although it detects it now) neither stopped the packaging of the Data nor the transmission of this package out.

 

[ForgottenSeer 114834]

That is from the desktop can it stop it up on entry from the web, can it detect it with this method, did you try this, or did the person you watch attempt to run the sample through those modules?

Eset not only used signatures to check downloads but also heuristic analysis/file structure analysis to examine the internal file structure looking for anomalies, common packing techniques and obfuscation methods. Without running this gauntlet how can anyone claim to have thoroughly tested the product?

 

[monkeylove]

This is the actual reality for most users. Understanding the operating system is just the beginning, then you need to know how the software you are using also interacts with the operating system. It takes extensive knowledge to properly use these type of securities, they are not designed for novice to average users.

I don't see the logic behind designing security programs for experienced users, as the market for the latter can be very small. Maybe they're like beta testers.

 

[Behold Eck]

So simply avoid making comments about other products and carry yourself in a better way to avoid these issues as stated. I'm not new to testing and you know this. I seen clearly what has taken place and have voiced this directly without being disrespectful.

Well you were a tad OTT in your reaction to one flippant remark imo.

Regards Eck

 

[EASTER]

Dang! I remember that SONG before. Been a long time. Stop The Steal With Comodo- and i would add MUCH MORE in between.

I assume the test was on a Windows 10/11 or one of those. My Win 10 sits accumulating cobwebs for Halloween. Strictly Windows 8.1 for me all the way unless 12 shows me some long vacant GRIT and no forced updates. My Windows 8.1 i consider has been upgraded personally by me which i call conveniently Windows 9.

Back on topic, this video has offered me the temptation to reinstall Comodo FW again as i still have the one for my antiquated system and is never failed one single time in numerous salvos of ransomware, stealers or cleverest file infectors as well as MBR dumpers. Just ain't happening with Comodo's superior Containment granite wall.

@cruelsister is fearless. Some malwares used in testing are vicious and sneaky.

 

[Behold Eck]

Dang! I remember that SONG before. Been a long time. Stop The Steal With Comodo- and i would add MUCH MORE in between.

I assume the test was on a Windows 10/11 or one of those. My Win 10 sits accumulating cobwebs for Halloween. Strictly Windows 8.1 for me all the way unless 12 shows me some long vacant GRIT and no forced updates. My Windows 8.1 i consider has been upgraded personally by me which i call conveniently Windows 9.

Back on topic, this video has offered me the temptation to reinstall Comodo FW again as i still have the one for my antiquated system and is never failed one single time in numerous salvos of ransomware, stealers or cleverest file infectors as well as MBR dumpers. Just ain't happening with Comodo's superior Containment granite wall.

@cruelsister is fearless. Some malwares used in testing are vicious and sneaky.

Well said.

Give it a go Easter, CS settings of course.

Regards Eck

 

[tofargone]

hope this doesn't offend anyone or get me booted, but just trying to be a person and not just a photo

 

[Trident]

Ok, but is MalwareTips and the Comodo thread literally the best place to lay all this out?

There is a members introduction and member chat section too.

No offence, just asking…

 

[TuxTalk]

hope this doesn't offend anyone or get me booted, but just trying to be a person and not just a photo

As you can see your post is gone. Pls keep this kind of things personally, we and me are not waiting for your life story. Get some professional help if you want to let people hear you.

 

[Divine_Barakah]

The Desktop is nothing more than a folder on the System. If you use a browser to download file it will be seen either in the Download or Temp folder. Malware on a USB or DVD will also appear in their respective folders on the drive.

Quite simply, Malware, in order to run, mist be initiated from somewhere (anywhere) with no magic or teleportation needed.

Can the same be said about fileless malware?

 

[ForgottenSeer 114834]

Can the same be said about fileless malware?

Thorough evaluation of all security suite components is crucial for verifying its effectiveness. Restricting testing to post-execution behavior could leave critical security gaps unaddressed.

Fileless malware presented in a generalized manner.

Initial Access:

Exploiting Vulnerabilities: Malware can infiltrate a system by exploiting vulnerabilities in software applications, operating systems, or web browsers.

Phishing Attacks: Users are tricked into clicking malicious links or downloading attachments that contain malicious code.

Leveraging Legitimate Tools: Malware can use legitimate tools and scripts like PowerShell, WMI, or VBA to execute malicious commands.

Payload Delivery:

Downloaded Directly into Memory: The malicious code is downloaded and executed directly in the computer's memory, bypassing the file system altogether.

Leveraging Legitimate Applications: Malware can be embedded within legitimate applications or documents, executed when the file is opened.

 

[cruelsister]

Can the same be said about fileless malware?

Yeah- the term fileless is too often though of as being magic. Far from it as such malware operate in traditional ways. In order to infect a system such malware need to get access to the environment in some way (such as downloading and running a Dropper, opening a Document containing a macro, clicking an Email link with Powershell code embedded into it. Even Registry resident malware must be initiated before anything can drop into the registry and persist. A LoLBin (yes, considered Fileless as it needs no additional added code to work) must also be first executed.

So Fileless malware must always be initiated in some way by the user; doing so from the Download folder, from an email link, from Roaming, or from the desktop is of no consequence, and certainly not Magic.