App Review Comodo Internet Security 11 Review | Test vs Malware

[cruelsister]

Makes one wonder sometimes about what could get inside of software company and pass on information like this

There have always been (and still are) targeted malware that attempts to steal FTP credentials in order to upload stuff to a Vendor site. And you would be amazed at the information that can be acquired (ie Credentials) with a Low-Cut blouse and a 10K bribe. And the Piriform fiasco may still be valid if the Blackhat would have the sense to pulse the connection (once a week) instead of always on.

 

[Dave Russo]

There have always been (and still are) targeted malware that attempts to steal FTP credentials in order to upload stuff to a Vendor site. And you would be amazed at the information that can be acquired (ie Credentials) with a Low-Cut blouse and a 10K bribe. And the Piriform fiasco may still be valid if the Blackhat would have the sense to pulse the connection (once a week) instead of always on.

 

[RoboMan]

I wonder... With CS settings, why does HIPS become redundant? Imagine a whitelisted vendor gets their servers compromised, wouldn't HIPS module help you showing you that a very basic software like e.g CCleaner wants to access specific weird sectors of the OS? I believe auto-containment does not apply for trusted vendors software...

 

[Deleted member 178]

I wonder... With CS settings, why does HIPS become redundant? Imagine a whitelisted vendor gets their servers compromised, wouldn't HIPS module help you showing you that a very basic software like e.g CCleaner wants to access specific weird sectors of the OS? I believe auto-containment does not apply for trusted vendors software...

CS settings is without HIPS not because the HIPS is useless or not, but just because CS hates HIPS and anti-exe thingies.
Remember CS settings are her personal settings that fit her needs and her taste, it is not a setting that was recommended by Comodo or any of their staff.

 

[ZeroDay]

CS settings are to make CF usable for everyone even the average Joe. With CS settings Comodo won't bother you much at all and it will offer extremely good protection. It's a very good balance between usability and protection.

 

[RoboMan]

Thank you! I've realised the only way to make HIPS not redundant with CS Settings is to set it at paranoid mode. Else it will just show HIPS alerts for unknown software, which is already contained automatically by sandbox... And Paranoid mode is really great but holy moly is that an alert for explorer.exe trying to communicate with explorer.exe LOL that gets me nervous

 

[Deleted member 178]

And Paranoid mode is really great but holy moly is that an alert for explorer.exe trying to communicate with explorer.exe LOL that gets me nervous

indeed, i dont even consider Comodo without paranoid.
When you use Paranoid Mode, you must play with rules to reduce the amount of alerts.

 

[509322]

COMODO HIPS is good learning tool. SpyShelter HIPS is even better. Kaspersky, ESET, other HIPS... too many problems. However, almost no one bothers to learn using a HIPS. Shame. It is one of the best learning tools\methods.

 

[cruelsister]

Robo- With an elevated sandbox settings the HIPS is essentially unneeded. At one time the HIPS did indeed add something to system security (this was for a particular RAT, which I did a video on a few years ago); however this hole in Containment was plugged, and now having the HIPS on with my settings adds nothing but popups.

For those (not mentioning any names) that say Paranoid Mode should be used, please dazzle us with some malware file that would be prevented by Paranoid Mode + Cruel Comodo that would NOT be prevented by the Cruel settings alone.

(Hear the Crickets....).

 

[Deleted member 178]

For those (not mentioning any names) that say Paranoid Mode should be used, please dazzle us with some malware file that would be prevented by Paranoid Mode + Cruel Comodo that would NOT be prevented by the Cruel settings alone.

ummmmm.....ummmmmm..... ah i have it at the tip of my tongue.....aaaaaaaaaaahh so hard to remember......

AH YES ! the stupidly (2 times) whitelisted malware.

thanks bye.

 

[simmerskool]

CS settings is without HIPS not because the HIPS is useless or not, but just because CS hates HIPS and anti-exe thingies.
Remember CS settings are her personal settings that fit her needs and her taste, it is not a setting that was recommended by Comodo or any of their staff.

so your saying that comodo default settings are sufficient to protect your pc

 

[128BPM]

COMODO HIPS is good learning tool.

Amen

 

[RoboMan]

For those (not mentioning any names) that say Paranoid Mode should be used, please dazzle us with some malware file that would be prevented by Paranoid Mode + Cruel Comodo that would NOT be prevented by the Cruel settings alone.

(Hear the Crickets....).

What about a signed malware from a trusted vendor? (infected installer from the vendor's original legit server). If the vendor's app auto-updates or offers an update that is accepted by the user, and requires no extra payload download, since the downloaded installer is modified with the needed intructions and commands, would Comodo catch it with CS settings?

 

[509322]

What about a signed malware from a trusted vendor? (infected installer from the vendor's original legit server). If the vendor's app auto-updates or offers an update that is accepted by the user, and requires no extra payload download, since the downloaded installer is modified with the needed intructions and commands, would Comodo catch it with CS settings?

No... not likely at all... it's not gong to be blocked by any security soft. Malicious code embedded inside a trusted digitally signed file. Nope.

 

[Nightwalker]

What about a signed malware from a trusted vendor? (infected installer from the vendor's original legit server). If the vendor's app auto-updates or offers an update that is accepted by the user, and requires no extra payload download, since the downloaded installer is modified with the needed intructions and commands, would Comodo catch it with CS settings?

I guess it depends on the kind of certificate that was used, most certificates used to sign malware are very quickly revogated or are the kind that are "ignored" by most security solutions.

But if someone ever cross with a malware signed by something like a Adobe certificate I am almost sure that the all hell breaks loose.

 

[Deleted member 178]

so your saying that comodo default settings are sufficient to protect your pc

If you know my history with Comodo or visited the Comodo section, you would know the answer, which is NO WAY !
I promote Paranoid Mode (but only for those who can handle it) because you can't fully trust Comodo's TVL or Cloud rep.

 

[cruelsister]

What about a signed malware from a trusted vendor?

R- These (a Trusted File from a Trusted Vendor) are rare as Hen's teeth and are not wasted on peasants like us (but instead will be targeted)- they are VERY difficult and EXPENSIVE to acquire. However note that a High Quality stolen certificate (like from Adobe) will get by EVERYTHING (I did a couple of videos on this a few years ago).

Note that the bulk of signed malware will be from some inconsequential publisher that will be from some fly-by-night Mook and would NEVER (never ever) make it to any TVL list.

 

[RoboMan]

R- These (a Trusted File from a Trusted Vendor) are rare as Hen's teeth and are not wasted on peasants like us (but instead will be targeted)- they are VERY difficult and EXPENSIVE to acquire. However note that a High Quality stolen certificate (like from Adobe) will get by EVERYTHING (I did a couple of videos on this a few years ago).

Note that the bulk of signed malware will be from some inconsequential publisher that will be from some fly-by-night Mook and would NEVER (never ever) make it to any TVL list.

Thank you and thanks everybody for your kind answers

 

[Mahesh Sudula]

Thank you and thanks everybody for your kind answers

However i agree most of the vendors give it a clean sheet bindly by seeing at its Signature..
But pro active modules like EXpolit and Behaviour blockers will kick in after execution if any nasty work is going on under ground
Statically -YES , but no dynamically
Since modules work on behaviour interception not on Hash, or signature verification..HIPS and BB are 2 two different topics
I have seen a dozen times AV's like F secure, Avast, Bit defender, G data, Kaspersky , Eset (Modified) intercepting the attack after execution
Vendors like Comodo, and others who work on hashes scanning however lose the battle
AVIRA (Cloud) works in similar way (triggers only for unknown hash and signature)..witha naked trusted signature you can bypass it

 

[509322]

But pro active modules like EXpolit and Behaviour blockers will kick in after execution if any nasty work is going on under ground

Nope. It doesn't work that way. Once it is white listed, it is white listed.

The exception to this is when the user has configured settings to alert to or block "All" or everything = the user isn't trusting anything.

NOTE: I am not talking about child processes, the abuse of Windows processes, etc.