Comodo fully virtualized sandbox bypassed!

[ZeroDay]

Hi,

I found this video on vimeo http://vimeo.com/61281886
Shows short test of Comodo CIS 6.0.264710.2708 in action.
It looks like a huge sandbox hole and I hope this is disgusting joke.

UPDATE INFO March 09, 2013, 10:41:47 AM:
After my tests I confirm this critical security vulnerability in CIS sandbox (in both cases: contextual menu "Run in COMODO Sandbox" and in Virtual Kiosk)

Best wishes,
bazolo

Comodo thread

[video=vimeo]http://vimeo.com/61281886[/video]

 

[Littlebits]

The video looks real to me but could have been faked to bash Comodo.

I wouldn't give it full credits until someone else can verify the bypass.

Thanks.

 

[ZeroDay]

Comodo mods are checking it now.

 

[Gnosis]

The suspense is making me sick. lol
Comodo >

 

[ZeroDay]

The suspense is making me sick. lol
Comodo >

Haha you and I both Gnosis.

 

[Littlebits]

As I have said before software level of security can be bypassed much easier than OS level security. That's why UAC is much better than HIPS, behavior blocking and sandboxing, etc. Just make sure you have UAC enable at defaults and utilize its protection, avoid downloading suspicious files and visiting unknown sites. Pay attention to Windows digital file warnings when running files and you should be safe.

Thanks.

 

[ZeroDay]

It was only a couple of days ago there was an article about UAC getting bypassed. Plus if you can provide a link that shows sandboxie getting bypassed I'd be most gratefull, just 1 link proving sandboxie being bypassed wiil do.

Thanks

 

[ZeroDay]

Sorry I know you didn't imply anything had bypassed sandboxie, I just meant that sandboxies sanbox is as solid, if not more so than uac.

 

[Deleted member 178]

v6 is more vulnerable than v5 at the moment; so i am not so surprised if it is true.

 

[ZeroDay]

I may be following you down the Emsisoft path soon.

 

[Littlebits]

It was only a couple of days ago there was an article about UAC getting bypassed. Plus if you can provide a link that shows sandboxie getting bypassed I'd be most gratefull, just 1 link proving sandboxie being bypassed wiil do.

Thanks

There is not a single type of security protection that can't get bypassed.
However software level is the most easier for malware to bypass, next OS level then last BIOS level which is most secure.

There has been malware known to bypass all levels but not as common and widespread.

Sanboxie has been bypassed before in the past but I believe the issue was fixed by the developer. Sandboxie is the best in its category but all software has vulnerabilities and malware writers look for them and eventually will find them and exploit them. Even though UAC and Windows OS has had vulnerabilities as well, it is much more difficult for malware writers to find a way to exploit them. Even system BIOS has vulnerabilities but it is so hard for malware writers to find a way to get exploit them which makes them extremely rare. They are usually used as attacks on large businesses.

Malware that is most common for home users doesn't even use vulnerabilities just simple fake alert sites that trick users into manually running infected files.

Enjoy!!

 

[ZeroDay]

Thanks for the info Littlebits

 

[Ink]

Cool video, wouldn't mind an explanation when Comodo release a patch for the security hole.

See, no software can provide 100% protection, because there are always bugs in coding.

 

[jamescv7]

Those events are really mattered to be a rare case and eventually sandbox is still on a good pace when dealing from common effects of vector so vulnerability that made on video is just a key to make the product more improved.

 

[illumination]

The issue has been reproduced, so the hole does exist, lets hope for a patch soon..

 

[Gnosis]

If something like this were ever to happen with Sandboxie, hopefully TF L5 will pick up the slack.

 

[illumination]

If something like this were ever to happen with Sandboxie, hopefully TF L5 will pick up the slack.

Exactly why i use the HIPS/BB/AV along with virtualization!
None of them will ever be 100% effective 100% of the time with people out there looking for ways to break through them on a constant basis.

 

[House_maniac]

If something like this were ever to happen with Sandboxie, hopefully TF L5 will pick up the slack.

Exactly why i use the HIPS/BB/AV along with virtualization!
None of them will ever be 100% effective 100% of the time with people out there looking for ways to break through them on a constant basis.

thats true i won't leave a product because it was bypassed once infact this is a way to improve,everything get bypass,no security product can be 100% secure even microsoft os get compromise with vulnerabilities like earth mentioned their will always be vulnerability in codings,hackers will look after small loophole to take advantages thanks for the share

 

[HeffeD]

If something like this were ever to happen with Sandboxie, hopefully TF L5 will pick up the slack.

Has this been tested with Sandboxie?

 

[Gnosis]

Has this been tested with Sandboxie?

Not that I know of.
I was speaking hypothetically.
Makes me curious though.