App Review Comodo FW bypass malware the sandbox (sandbox hips off + on) and voodooshield (autopilot)

[cruelsister]

I'd love to test it now with VS installed but I'm about to board a plane back to NYC.

 

[Tony Cole]

Enjoy your flight Cruelsister, maybe you could test this on board to pass the time!

 

[shmu26]

Either way, he should try and test it with only VoodooShield installed. That would get rid all doubts(...or not)


Default deny-people

you can't retest it on VS, because by now, the malware is known, and VS relies on VT.

 

[Deleted member 178]

you can't retest it on VS, because by now, the malware is known, and VS relies on VT.

VT has no importance, the concept in the original video is that VS didn't blocked it when "block" was pressed. Cruelsister just has to put VS on Always ON , she will get the prompt despite the file being rated on VT

 

[shmu26]

VT has no importance, the concept in the original video is that VS didn't blocked it when "block" was pressed.

thanks for pointing that out.
autopilot has a lot of flaws. I stay away from it.

 

[TheMalwareMaster]

Anyone knows which are the three big Ai vendors mentioned by VS developer on wilders?

 

[SHvFl]

Anyone knows which are the three big Ai vendors mentioned by VS developer on wilders?

CrowdStrike Falcon (ML),Invincea and Tencent use machine learning. Qihoo-360 also claims to do that.
VirusTotal Blog: Search results for machine learning

 

[TheMalwareMaster]

Thank you

 

[SHvFl]

Thank you

Edited my reply for more info. Check it.

 

[TheMalwareMaster]

So, basically Voodoooshield is using Crowd strike, Invincea and Tencent machine-Learning technique for Voodoo AI?

 

[SHvFl]

So, basically Voodoooshield is using Crowd strike, Invincea and Tencent machine-Learning technique for Voodoo AI?

No, why do you say that? He just said that the other AI engines also didn't detect the malware.

 

[XhenEd]

So, basically Voodoooshield is using Crowd strike, Invincea and Tencent machine-Learning technique for Voodoo AI?

I don't think so.
I think the dev just meant that it's not only VAi that got the file as "safe" because even those 3 marked the file as safe.

 

[jamescv7]

There so many possible instances that Comodo Sandbox may bypass like:

• Influence of cloud rating
• Signatures
• Behavior pattern

But in such concept, any file no matter if file-less or what so over; once run on sandbox then anything will be intact virtualized thus the traces will not cause leakage.

For sure it can be human error or such mistaken to the configuration. unless I'm wrong.

 

[TheMalwareMaster]

No, why do you say that? He just said that the other AI engines also didn't detect the malware.

I don't think so.
I think the dev just meant that it's not only VAi that got the file as "safe" because even those 3 marked the file as safe.

I thought he was talking about Voodoo AI, instead he was meaning those other AI engines. I understood, thank you

 

[Brahman]

Maybe as Cruelsister stated you cannot run both together, both are similar in their actions, therefore Voodooshield could be blocking Comodo, but you are unaware of it.

I have seen " comodo virtual service manager" getting turned off at times if you install comodo after installing voodoo. I don't know for sure if this is reproducible or is the cause of misbehavior.

 

[shmu26]

I have seen " comodo virtual service manager" getting turned off at times if you install comodo after installing voodoo. I don't know for sure if this is reproducible or is the cause of misbehavior.

I was running a CFW and VS combo at the time that this video was published, and the comodo virtualization worked just fine

 

[Davidov]

voodooshield not already bypassed by malware
1) Large detection VT
2) The suspiciously for UI
3) Maybe Even the developer took Precautions against bypass in cloud UI
These are my guesses
4)Maybe even with Comodo voodooshield together produced a mistake.

Testing the free version (lockdown) with modifications + premium (lockdown)+ autopilot everything clean

Try again later samotny Comodo Firewall .-))

thanks for watching

part1)

After rebooting pc

part2)

 

[shmu26]

comodo has once again shown itself to be buggy and produce unpredictable behavior.
at least voodooshield is trying to learn from mistakes

 

[Davidov]

comodo has once again shown itself to be buggy and produce unpredictable behavior.
at least voodooshield is trying to learn from mistakes

Valkyrie recognize the file as malware, but it still takes commodes FW file as safe (Installer) file? How is it possible.

Well, I tested AutoSandbox it is useless again be infected because the file is safe by Comodo.A sandboxed not like yesterday.

Advanced File Analysis System | Valkyrie

 

[cruelsister]

David- at 22 seconds of the video above (and at 22 seconds of the original video) there is a Sandbox setting in the 3rd position. This is a general setting that had to be created as it is not default. At Default Comodo would only have the General settings in positions 4, 5, and 6.

As a comparison look at the 49 second mark of my video (post 29). You can disregard the first 2 (Ignore) as these are specific to SeaMonkey and Java.

So where did this General Rule on your video come from?