App Review Comodo Firewall vs a new Data Stealer

[Behold Eck]

So I do not agree that only Comodo dealt with the malware or the way of dealing was in any way superior.

Never said that Comodo was the only one that would detect itseeing that it was detected by viruscope making detection by others very likely.

Comodo`s more foolproof than superior which helps fools like me have a nice warm fuzzy feeling deep down inside.

Regards Eck

 

[cartaphilus]

What triggers the detection here for most software is the abuse of the name svchost.exe. No useful software has any genuine reason to doppelgäng a native Windows executable.

Yes, the launch of high number of LOLBins is also highly suspicious. In Harmony, we saw that not only that the malware was blocked, but it was also correctly identified as Nova Stealer.

Many other products that we didn’t test would have also blocked the malware.

Harmony blocked a part of War thunder update yesterday and marked a file as malware with confidence of high. . First time it started doing that. So whatever update they did recently upped their sensitivity.

It also blocked sniper elite 5 as malware with high confidence; that I understand do to Denuvo encryption/ copy protection which is basically a rootkit. Just fyi that whatever update it got. It became more zealous. Lots hope it doesn't go CrowdStrike on us.

 

[Trident]

Harmony blocked a part of War thunder update yesterday and marked a file as malware with confidence of high. . First time it started doing that. So whatever update they did recently upped their sensitivity.

It also blocked sniper elite 5 as malware with high confidence; that I understand do to Denuvo encryption/ copy protection which is basically a rootkit. Just fyi that whatever update it got. It became more zealous. Lots hope it doesn't go CrowdStrike on us.

You’ll need to open a service request here and report your findings.

https://www.checkpoint.com/support-services/contact-support/

For business products it is normal not to cope too well with game updates, they haven’t got many customers updating games so these executables remain unknown for a prolonged period of time.

As to CrowdStrike, they update internal behavioural monitoring logics daily. Check Point does not do that. The EFR monitoring and capturing logics are updated as part of a product update. If you are worried about CrowdStrike situation, you can stay one version behind, or use the recommended client version.

 

[Trident]

These are typically bolstered in many products but rarely tested. It's fine to test separate modules to see how they perform but not fine to state a product is unable if you do not test it fully. I'm not sure why that can not be understood here but by a few.

The malware distribution method must always be taken into account. Majority of malware does not just come like that, out of the blue. It needs to be downloaded or saved from an email. Very few malware families possess automatic spreading mechanisms (such as the Dinihou worm that used to replace files on flash drive with malicious shortcut to these files and installed NJRAT).

Whilst any other test may be interesting to geeks, you cannot state that a product is “oblivious to malware” when you did not test products using the realistic distribution method.

 

[cartaphilus]

You’ll need to open a service request here and report your findings.

https://www.checkpoint.com/support-services/contact-support/

For business products it is normal not to cope too well with game updates, they haven’t got many customers updating games so these executables remain unknown for a prolonged period of time.

As to CrowdStrike, they update internal behavioural monitoring logics daily. Check Point does not do that. The EFR monitoring and capturing logics are updated as part of a product update. If you are worried about CrowdStrike situation, you can stay one version behind, or use the recommended client version.

Will do but honestly been gaming up with it for the past 1.5 years and this is basically the first time it detected two legit game files (I double checked them and they were all signed by respective companies). In the past it picked up a trainer or a memory value scanner which was totally understandable since neither one of those files were signed and the functions they performed (patch memory of another process) are part of the MiTRE attack framework.

And honestly they xan crowdstrike my system away. At least maybe I can act as a warning beacon (due to my unusual use case) for them to investigate before major infrastructure gets affected. So I do not worry about it going all bottoms up on me (daily backups).

 

[rashmi]

Personally I was only fulfilling a request by @rashmi who seemed to be bored with the lack of entertainment here now days.

I've set an alarm, tied a string around my finger, and even hired my girlfriend, just to make sure I don't miss a single episode of this new Comodo season - it's pure gold! Thank you for the exclusive access, @Lynx!

 

[Trident]

I've set an alarm, tied a string around my finger, and even hired my girlfriend, just to make sure I don't miss a single episode of this new Comodo season - it's pure gold! Thank you for the exclusive access, @Lynx!

I see a lot of tension and love here. Am I still on MalwareTips?

 

[tofargone]

I'm always confused by the fight that exists between good and evil.

One one side we have the evil intention of infecting a server or PC. This then is the bad person.

One the other side is the vendor / business, who creates a solution to protect the server or PC, while seeking a profit for his efforts. This is the good person.

Sadly with ALL the companies, who must be counted in the multitudes, we don't have even one, that all the great minds here at MWT's can proclaim to be a winner, the best at his craft.

You would think the winner would be the one with the most revenue, or customer base, maybe Norton, or Microsoft. But that isn't true.

Even AI has been able to make a virus that can't be detected, can they not make a solution that can win at every turn? Can't someone make a tool that can overcome.?

I'm sure we would all use it.

 

[Trident]

You would think the winner would be the one with the most revenue, or customer base, maybe Norton, or Microsoft. But that isn't true.

They are the true winners because end of the day, they’ve invested in R&D, they’ve established what’s hot on the market, they’ve developed it and paid to market it. They then extract sweet profits out of it and couldn’t care less who will be proclaimed a winner and where.

Now, getting on to what’s hot on the market, users like convenience and automation and for that, they are ready to pay. This has been proven times and times again, this has been the business model historically of many companies and products and generates billions.

The “let me ask the user” approach is not preferred. Majority of users don’t care whether or not wuaclt.exe will inject a module into svchost.exe.
This approach works only for a very small audience and it is up to a vendor to decide whether they want to cater for a football game in a Dutch village or for the UEFA final game (Hopefully at Wembley Stadium one day).

Vendors have developed automated and layered solutions that provide sufficient security to real people, encountering real-life situations. This method has not been proven to not work.

I invite everyone who believes that asking the user is better than automation, to go and do their laundry at the river as well, with the laundry soap. This is more “effective” than using a washer. But does more effective always equal better? I’ll let you answer that for yourself.

 

[lokamoka820]

So in the end, Comodo Firewall will block it, or it will be user dependent?

 

[rashmi]

I'm always confused by the fight that exists between good and evil.

can they not make a solution that can win at every turn?

They created it with their bare hands... "COMODO!" The birth of Comodo marked the beginning of an epic clash between the forces of good and evil - a clash as legendary as the creation itself!

 

[rashmi]

So in the end, Comodo Firewall will block it, or it will be user dependent?

Comodo Firewall will run it in containment. The firewall alert will depend on your settings. According to @cruelsister and some users in different discussions, her suggested "restricted" setting prevents network connections. However, I haven't tested it, and the help files don't mention it.

 

[cartaphilus]

They are the true winners because end of the day, they’ve invested in R&D, they’ve established what’s hot on the market, they’ve developed it and paid to market it. They then extract sweet profits out of it and couldn’t care less who will be proclaimed a winner and where.

Now, getting on to what’s hot on the market, users like convenience and automation and for that, they are ready to pay. This has been proven times and times again, this has been the business model historically of many companies and products and generates billions.

The “let me ask the user” approach is not preferred. Majority of users don’t care whether or not wuaclt.exe will inject a module into svchost.exe.
This approach works only for a very small audience and it is up to a vendor to decide whether they want to cater for a football game in a Dutch village or for the UEFA final game (Hopefully at Wembley Stadium one day).

Vendors have developed automated and layered solutions that provide sufficient security to real people, encountering real-life situations. This method has not been proven to not work.

I invite everyone who believes that asking the user is better than automation, to go and do their laundry at the river as well, with the laundry soap. This is more “effective” than using a washer. But does more effective always equal better? I’ll let you answer that for yourself.

It's all well and good but what if svchost.exe doesn't want to be injected by wuaclt.exe? I mean fine you both live in the same environment but did wuaclt.exe buy svchost.exe dinner first?!!! You can't just willy nilly go around and injecting yourself into strange processes without their consent that just plain rude!

 

[n8chavez]

Sorry for the dense question. Today's not been a good day. That "stealer" CPF was tested against was correctly signed, was it not? If that was the case, then apps like Cyberlock, Spyshelter, etc., which rely on signing verification will be of little to no use here. Am I right? Maybe it's time to look elsewhere if they can be circumvented so easily.

 

[danb]

Sorry for the dense question. Today's not been a good day. That "stealer" CPF was tested against was correctly signed, was it not? If that was the case, then apps like Cyberlock, Spyshelter, etc., which rely on signing verification will be of little to no use here. Am I right? Maybe it's time to look elsewhere if they can be circumvented so easily.

CyberLock does not rely on digital signatures, rather it uses digital signatures for file insight to provide to the end-user. CyberLock would easily block this attack.

 

[rashmi]

Sorry for the dense question. Today's not been a good day. That "stealer" CPF was tested against was correctly signed, was it not? If that was the case, then apps like Cyberlock, Spyshelter, etc., which rely on signing verification will be of little to no use here. Am I right? Maybe it's time to look elsewhere if they can be circumvented so easily.

The malware has invalid digital signatures.

 

[rashmi]

It's all well and good but what if svchost.exe doesn't want to be injected by wuaclt.exe? I mean fine you both live in the same environment but did wuaclt.exe buy svchost.exe dinner first?!!!

This comment has... a love letter and a breakup note rolled into one!

 

[Brahman]

Even AI has been able to make a virus that can't be detected, can they not make a solution that can win at every turn? Can't someone make a tool that can overcome.?

I'm sure we would all use it.

If you are willing to sacrifice some time and effort and if you want a reasonable secure system this thing would be the best bet out there for a non corporate user to have in their disposal.

 

[ForgottenSeer 114834]

I see a lot of tension and love here. Am I still on MalwareTips?

That's because they stammer for truth, but when you hand them truth, they state, no not that truth, please don't shatter my illusions of grandeur. Please don't disrupt my version of reality where I gain fake popularity by misleading users. It's not like they can be harmed by malware or misinformation.

They are the true winners because end of the day, they’ve invested in R&D, they’ve established what’s hot on the market, they’ve developed it and paid to market it. They then extract sweet profits out of it and couldn’t care less who will be proclaimed a winner and where.

Now, getting on to what’s hot on the market, users like convenience and automation and for that, they are ready to pay. This has been proven times and times again, this has been the business model historically of many companies and products and generates billions.

The “let me ask the user” approach is not preferred. Majority of users don’t care whether or not wuaclt.exe will inject a module into svchost.exe.
This approach works only for a very small audience and it is up to a vendor to decide whether they want to cater for a football game in a Dutch village or for the UEFA final game (Hopefully at Wembley Stadium one day).

Vendors have developed automated and layered solutions that provide sufficient security to real people, encountering real-life situations. This method has not been proven to not work.

I invite everyone who believes that asking the user is better than automation, to go and do their laundry at the river as well, with the laundry soap. This is more “effective” than using a washer. But does more effective always equal better? I’ll let you answer that for yourself.

Absolute truth there, most can not handle that type software and leaving security in the hands of uninformed users that have no idea how the operating system works let alone how software should interact with it legitimately is actually idiotic.

 

[simmerskool]

CyberLock does not rely on digital signatures, rather it uses digital signatures for file insight to provide to the end-user. CyberLock would easily block this attack.

yes I "tested" this file (see other thread) with Harmony in win10_vm also running CL, and CL stopped the attack (or that's what it looked like to me)