Comodo fully virtualized sandbox bypassed!

  • Thread starter Thread starter ZeroDay
  • Start date Start date
Status
Not open for further replies.
Z

ZeroDay

Thread author
Hi,

I found this video on vimeo http://vimeo.com/61281886
Shows short test of Comodo CIS 6.0.264710.2708 in action.
It looks like a huge sandbox hole and I hope this is disgusting joke.
Click to expand...

UPDATE INFO March 09, 2013, 10:41:47 AM:
After my tests I confirm this critical security vulnerability in CIS sandbox (in both cases: contextual menu "Run in COMODO Sandbox" and in Virtual Kiosk)

Best wishes,
bazolo
Click to expand...

Comodo thread

[video=vimeo]http://vimeo.com/61281886[/video]
 
As I have said before software level of security can be bypassed much easier than OS level security. That's why UAC is much better than HIPS, behavior blocking and sandboxing, etc. Just make sure you have UAC enable at defaults and utilize its protection, avoid downloading suspicious files and visiting unknown sites. Pay attention to Windows digital file warnings when running files and you should be safe.

Thanks.:D
 
  • Like
Reactions: Kent
It was only a couple of days ago there was an article about UAC getting bypassed. Plus if you can provide a link that shows sandboxie getting bypassed I'd be most gratefull, just 1 link proving sandboxie being bypassed wiil do.

Thanks :)
 
Sorry I know you didn't imply anything had bypassed sandboxie, I just meant that sandboxies sanbox is as solid, if not more so than uac.
 
v6 is more vulnerable than v5 at the moment; so i am not so surprised if it is true.
 
ZeroDay said:
It was only a couple of days ago there was an article about UAC getting bypassed. Plus if you can provide a link that shows sandboxie getting bypassed I'd be most gratefull, just 1 link proving sandboxie being bypassed wiil do.

Thanks :)
Click to expand...

There is not a single type of security protection that can't get bypassed.
However software level is the most easier for malware to bypass, next OS level then last BIOS level which is most secure.

There has been malware known to bypass all levels but not as common and widespread.

Sanboxie has been bypassed before in the past but I believe the issue was fixed by the developer. Sandboxie is the best in its category but all software has vulnerabilities and malware writers look for them and eventually will find them and exploit them. Even though UAC and Windows OS has had vulnerabilities as well, it is much more difficult for malware writers to find a way to exploit them. Even system BIOS has vulnerabilities but it is so hard for malware writers to find a way to get exploit them which makes them extremely rare. They are usually used as attacks on large businesses.

Malware that is most common for home users doesn't even use vulnerabilities just simple fake alert sites that trick users into manually running infected files.

Enjoy!!:D
 
Cool video, wouldn't mind an explanation when Comodo release a patch for the security hole.

See, no software can provide 100% protection, because there are always bugs in coding.
 
Those events are really mattered to be a rare case and eventually sandbox is still on a good pace when dealing from common effects of vector so vulnerability that made on video is just a key to make the product more improved.
 
The issue has been reproduced, so the hole does exist, lets hope for a patch soon..
 
Gnosis said:
If something like this were ever to happen with Sandboxie, hopefully TF L5 will pick up the slack.
Click to expand...

Exactly why i use the HIPS/BB/AV along with virtualization! :D
None of them will ever be 100% effective 100% of the time with people out there looking for ways to break through them on a constant basis.
 
illumination said:
Gnosis said:
If something like this were ever to happen with Sandboxie, hopefully TF L5 will pick up the slack.
Click to expand...

Exactly why i use the HIPS/BB/AV along with virtualization! :D
None of them will ever be 100% effective 100% of the time with people out there looking for ways to break through them on a constant basis.
Click to expand...

thats true i won't leave a product because it was bypassed once infact this is a way to improve,everything get bypass,no security product can be 100% secure even microsoft os get compromise with vulnerabilities like earth mentioned their will always be vulnerability in codings,hackers will look after small loophole to take advantages thanks for the share
 
Status
Not open for further replies.

You may also like...