In an attempt to add some clarity to the Comodo Containment/Firewall discussion, please consider:
1). An unknown file is run with the ability to gather information (password stealer, keylogger, Coinminer, RAT, etc) as well as transmit the information out. For the majority of these, once plopped into Containment the malware will not have the ability to acquire data, but more importantly the transmission of this data will be detected and blocked. An example of this could be seen in my last Comodo vs RAT video.
2). Another example can be seen with the legitimate SeaMonkey browser. Although distributed by the Mozilla organization, it for many years has not been signed (and thus always deemed Untrusted by CF). However recently it did get a valid certificate with an equally valid Countersignature; but even so as this was the initial application with this certificate before Comodo will trust these new builds of SeaMonkey the application must first be vetted by C. As this has not been done yet upon running the installer it will be automatically contained. Further, even when launching the installer and directing that the installer be trusted (at the initial popup) and accomplishing the install upon first run one will still be presented with a Firewall popup.
This last point may seem trivial but it is actually of extreme importance. In the bad old days I was employed by a company that was called in to do a postmortem breach analysis for a major retailer that used an extremely popular Enterprise Security program. It was finally determined that a true zero-day targeted trojan was installed on their systems that was pulse transmitting stolen data packages out (actually discovered by a new employee who, when delving through firewall logs, found it curious that stuff was being sent to Kazakhstan).
As lead in the investigation I was able to acquire the malware and for giggles tried it out on a Comodo protected system. CF alerted at the first peep and this detection would have saved the victimized organization many, many millions in damages (but costing me a substantial bonus, so I guess I'm glad they went with the Enterprise product instead).
3). I hope on reflection that it's intuitively obvious that the use or non use of a VPN won't have a bearing on this sort of malicious mechanism.
his Melihness should buy CruelsSister a set of priceless diamonds
Emeralds would preferable as they are a better match for my eyes...
