Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 760315" data-attributes="member: 32547">If I may.&nbsp; So in the Leo video, the activity is sandboxed version of the file spawning and then running to run its twin outside the box?&nbsp; The twin then asks for permissions it would not have been able to request in the sandbox (game over when this is able to execute).&nbsp; I feel like straight up this is a bypass now that [USER=37647]@shmu26[/USER] brings this into view and the facts on the file status have been revealed.&nbsp; It would take HIPS to catch this and then on Paranoid Mode.If this a bypass, should it be classified another instance of the Comodo Cloud assigning incorrect trust to the file?Reading all of the posts, I am struck by the data that is available to Comodo for keeping file statuses updated.&nbsp; They are doing the reputation work, but it seems that changes that could easily be autiomated (and happen very quickly) are languishing for ages (2010 or 2014).&nbsp; Wondering out loud here, but I wonder if something in the Comodo Cloud data crunching datasets sort of made the determination to care less about this file...maybe based on a low harmfulness rating or something?&nbsp; This is all I can come up with.&nbsp; Still, had this been a serious thing, it would have been a big problem if I understand the situation correctly.One thing this video and discussion maybe can do is help highlight the differences between the versions.&nbsp; There are serious differences in the way the programs affect or issue trust to a file.&nbsp; CF is I feel less a reputation service than CIS or CCAV, because it doesn&#039;t (seems to me at least) rely heavily on the cloud.&nbsp; It&#039;s the simplest of the 3.&nbsp; I hear the other differences too, for example, the alerts from CCAV each with an opportunity to bork the sacred trust rating and wreck the system.&nbsp; All this brings me back to the simple settings for Comodo that do work for getting unvalidated (by proper digital signature) into a sandbox.&nbsp; This is further limited some by the TVL.&nbsp; It&#039;s actually pretty good even if long.&nbsp; Also, HIPS can help identify what the application wants to do if a user cares to know.&nbsp; CF is at least good for this, if maybe prone to a cloud mistake here or there-&gt;DEFINITELY a BIG problem if so that must be addressed.&nbsp; Just not sure I have all the pieces put together yet to say that this is 100% sorriness.&nbsp; I mean it could be at least a significant portion of &quot;try hard with a little bit of cunning mixed in&quot; (translated &quot;ignore pulling together our facts on older and non-serious threats until we get caught up&quot;).Anyway, CF is free and simple and it rarely takes a hit.&nbsp; Interesting it did here and in Leo&#039;s video of all things...</blockquote>

[QUOTE="AtlBo, post: 760315, member: 32547"] If I may. So in the Leo video, the activity is sandboxed version of the file spawning and then running to run its twin outside the box? The twin then asks for permissions it would not have been able to request in the sandbox (game over when this is able to execute). I feel like straight up this is a bypass now that [USER=37647]@shmu26[/USER] brings this into view and the facts on the file status have been revealed. It would take HIPS to catch this and then on Paranoid Mode. If this a bypass, should it be classified another instance of the Comodo Cloud assigning incorrect trust to the file? Reading all of the posts, I am struck by the data that is available to Comodo for keeping file statuses updated. They are doing the reputation work, but it seems that changes that could easily be autiomated (and happen very quickly) are languishing for ages (2010 or 2014). Wondering out loud here, but I wonder if something in the Comodo Cloud data crunching datasets sort of made the determination to care less about this file...maybe based on a low harmfulness rating or something? This is all I can come up with. Still, had this been a serious thing, it would have been a big problem if I understand the situation correctly. One thing this video and discussion maybe can do is help highlight the differences between the versions. There are serious differences in the way the programs affect or issue trust to a file. CF is I feel less a reputation service than CIS or CCAV, because it doesn't (seems to me at least) rely heavily on the cloud. It's the simplest of the 3. I hear the other differences too, for example, the alerts from CCAV each with an opportunity to bork the sacred trust rating and wreck the system. All this brings me back to the simple settings for Comodo that do work for getting unvalidated (by proper digital signature) into a sandbox. This is further limited some by the TVL. It's actually pretty good even if long. Also, HIPS can help identify what the application wants to do if a user cares to know. CF is at least good for this, if maybe prone to a cloud mistake here or there->DEFINITELY a BIG problem if so that must be addressed. Just not sure I have all the pieces put together yet to say that this is 100% sorriness. I mean it could be at least a significant portion of "try hard with a little bit of cunning mixed in" (translated "ignore pulling together our facts on older and non-serious threats until we get caught up"). Anyway, CF is free and simple and it rarely takes a hit. Interesting it did here and in Leo's video of all things... [/QUOTE]

Verification