Serious Discussion Comodo Internet Security 2025 was obliterated by an exploit!

[Andy Ful]

So how many solutions are actually zero trust

There are some leaders:

 

[vitao]

Understand. I mentioned this script because it is most probably not a false positive. Kaspersky correctly detected it as malicious. This script may also be an artifact after running the EXE (detected by Kaspersky). So, those two files can be related to one malware that was mitigated by Comodo Script Analysis.
You can check this possibility by deleting the content of "C:\ProgramData\Comodo\Cis\tempscript folder" and running only that EXE sample. If Comodo does not create the PS1 script, those files are unrelated.

Edit.
It seems that the EXE sample was a downloader, but the domain with the final payload did not respond (dead sample). The payload (exe.exe) would be most probably contained by Comodo.

Malware analysis SoftwareInstaller.exe Malicious activity | ANY.RUN - Malware Sandbox Online

Online sandbox report for SoftwareInstaller.exe, verdict: Malicious activity

any.run

Analysis SoftwareInstaller.exe (MD5: 9CF40A8B46C9552148565D43C3D92465) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

i understand. so this is a half malware well, cis didnt contain it.

 

[vitao]

This is not good news for Enterprise users.

yep. i see comodo mods and some users saying that "now that the problem is solved there is only the malware to be sent to camas/valkyrie", etc., but they seem to have the need of ignoring that latest cis solved "nothing". the same poc still runs and the same ransomware still runs.

edit.: videos recorded. ill try to edit and public one tomorrow and the second the day after. if all goes well...

 

[bazang]

It's a paid product sold to enterprise and the consumer comodo is based on the same client they sell to enterprises

Xcitium product earns very little revenue. Not enough to justify dedicating a development team to it.

The basic formula in software development is that a software must generate 750,000 Euros in revenue to support 3 employees with a salary of less than 60,000 Euros on the payroll.

Xcitium very likely generates less than 300,000 Euros per year in revenue. That is not nearly enough to even support 1 dedicated development employee. Unless Melih hires developers from poor 2nd and 3rd world nations. He can hire an army of programmers in Zimbabwe or Vietnam for only 100,000 Euros.

The main product is an enterprise one sold with claims that zerodwell(container ) can stop 100% etc

The marketing can say whatever it wants.

The EULA however states that the buyer/end user assumes all risk and the product is sold "AS IS" with no warranty of fitness of purpose. The product is not guaranteed to provide any protection and upon installation the end user agrees to these terms.

What that means is this: "You use this product and if it is bypassed then it is on you, and not on Xcitium or Comodo."

Nowadays, the recommended solution is the Zero Trust Model, where AV/EDR is only a part of the solution.

A true Zero Trust protection begins at the physical layer and goes all the way to the application layer in the network stack. Then on the operating system it is from the physical layer to the application layer. Then in the non-digital security realm, Zero Trust includes physical and personnel security. Next, Zero Trust includes very robust Governance, Risk Management and Compliance (GRC). All of these are combined.

I don't know how many times an enterprise has stated to me "We purchased Product XYZ marketed as Zero Trust and thereby implemented a Zero Trust Protection Model throughout our organization." They are extremely disappointed when I tell them they don't understand Zero Trust and that they need to spend another 5,000,000 Euros to get there.

Very, very few service providers know how to properly implement true Zero Trust and even fewer enterprises and governments can do it themselves. I don't know how many times a government has said to me "We air gap these high sensitivity machines. They are Zero Trust."

It takes a lot of time, resources, patience, knowledge, experience, and money to do Zero Trust the right way. It can be done - and done very well - using 100% Microsoft security. Why is this? Because Microsoft does adhere fully to the first principle of security: "Security is not software. It is a process." Plus it works so closely with the U.S. Government that it integrates many of the capabilities developed by NIST Special Publications that inform & guide virtually 100% of global enterprise security practices.

Lots of people and organizations think "Zero Trust implementation is purchase Zero Trust software and deploy it."

Meanwhile, for a small company, a correct Zero Trust security implementation is a 2 to 3 year process requiring an army of SMEs and implementers. And that usually only happens in very highly regulated industries where serious negative consequences can happen. It is not at all unusual for a financial transaction processor to take a couple of years fully implementing PCI DSS. And that is just the beginning of the security requirements and regulations that are applicable to their operations.

Most every Zero Trust product out there just exploits the words "Zero Trust." Why? Because people have no idea what Zero Trust really is.

Many organizations fail Zero Trust assessments and audits.

 

[vitao]

If anyone wants to see, I created a new topic for it: COMODO Internet Security 2025 v12.3.4.8162 against ONE Malware = Not Contained

 

[Digmor Crusher]

Xcitium product earns very little revenue. Not enough to justify dedicating a development team to it.

The basic formula in software development is that a software must generate 750,000 Euros in revenue to support 3 employees with a salary of less than 60,000 Euros on the payroll.

Xcitium very likely generates less than 300,000 Euros per year in revenue. That is not nearly enough to even support 1 dedicated development employee. Unless Melih hires developers from poor 2nd and 3rd world nations. He can hire an army of programmers in Zimbabwe or Vietnam for only 100,000 Euros.



The marketing can say whatever it wants.

The EULA however states that the buyer/end user assumes all risk and the product is sold "AS IS" with no warranty of fitness of purpose. The product is not guaranteed to provide any protection and upon installation the end user agrees to these terms.

What that means is this: "You use this product and if it is bypassed then it is on you, and not on Xcitium or Comodo."



A true Zero Trust protection begins at the physical layer and goes all the way to the application layer in the network stack. Then on the operating system it is from the physical layer to the application layer. Then in the non-digital security realm, Zero Trust includes physical and personnel security. Next, Zero Trust includes very robust Governance, Risk Management and Compliance (GRC). All of these are combined.

I don't know how many times an enterprise has stated to me "We purchased Product XYZ marketed as Zero Trust and thereby implemented a Zero Trust Protection Model throughout our organization." They are extremely disappointed when I tell them they don't understand Zero Trust and that they need to spend another 5,000,000 Euros to get there.

Very, very few service providers know how to properly implement true Zero Trust and even fewer enterprises and governments can do it themselves. I don't know how many times a government has said to me "We air gap these high sensitivity machines. They are Zero Trust."

It takes a lot of time, resources, patience, knowledge, experience, and money to do Zero Trust the right way. It can be done - and done very well - using 100% Microsoft security. Why is this? Because Microsoft does adhere fully to the first principle of security: "Security is not software. It is a process." Plus it works so closely with the U.S. Government that it integrates many of the capabilities developed by NIST Special Publications that inform & guide virtually 100% of global enterprise security practices.

Lots of people and organizations think "Zero Trust implementation is purchase Zero Trust software and deploy it."

Meanwhile, for a small company, a correct Zero Trust security implementation is a 2 to 3 year process requiring an army of SMEs and implementers. And that usually only happens in very highly regulated industries where serious negative consequences can happen. It is not at all unusual for a financial transaction processor to take a couple of years fully implementing PCI DSS. And that is just the beginning of the security requirements and regulations that are applicable to their operations.

Most every Zero Trust product out there just exploits the words "Zero Trust." Why? Because people have no idea what Zero Trust really is.

Many organizations fail Zero Trust assessments and audits.

Please stop. Every time some posts something about Comodo you go off on a rant saying the same things over and over. We know, you hate Comodo, but we don't have to be reminded of it every 5 minutes.

 

[Andy Ful]

It takes a lot of time, resources, patience, knowledge, experience, and money to do Zero Trust the right way....

Meanwhile, for a small company, a correct Zero Trust security implementation is a 2 to 3 year process requiring an army of SMEs and implementers....

Many organizations fail Zero Trust assessments and audits.

 

[Behold Eck]

If anyone wants to see, I created a new topic for it: COMODO Internet Security 2025 v12.3.4.8162 against ONE Malware = Not Contained

I wouldn`t bother as it`s a very long ad for some product which apparently was a mistake and the new link takes nearly half an hour to load.

Regards Eck

 

[vitao]

I wouldn`t bother as it`s a very long ad for some product which apparently was a mistake and the new link takes nearly half an hour to load.

Regards Eck

dont be like that...

 

[Behold Eck]

dont be like that...

I don`t mean to be mean(if you know what I mean?) but it`s just that some people don`t have the time to waste.

Regards Eck

 

[simmerskool]

Sorry for making reading very inconvenient.
As I'm not really the most intelligent guy , and unsure when to use commas and periods , and haven't really forced myself ever to try and improve my grammar.
(Hopefully this is correct usage ,but uncertain if what I'm currently writing is even correct usage of comma and period.)


(if anyone has some good site to practice , and learn you can send me a private message, and or anything to improve grammar , writing skills.)

you do fine imho

 

[simmerskool]

If anyone wants to see, I created a new topic for it: COMODO Internet Security 2025 v12.3.4.8162 against ONE Malware = Not Contained

I ran a VM with CF yesterday to update all software on VM and CF updated to 12.3.3.8140... & today several online souces say the current version is 12.3.3.8152. where can I DL 12.3.4.8162
EDIT correction I do now see a link to 12.3.4.8162. it was more buried.

 

[vaccineboy]

ow... sorry dude. not my intend dont get me wrong. english is not my primary language. some expressions this word have more sense of power and meaning in my language. this word can describes better some thing i want to say. as i dont have any problems with this word, i dont see any problem using it. if you have any problem with it, im sorry, ok? but some language costumes are hard to change. a better solution would be you marking my profile to be ignored, or hyde me, something like that. atleast until i can become able to pay more attention to your feelings.

Uhm you say English is not your native language as an excuse, yet you clearly know the unpleasant meaning of it, hence the masking. You say you don't have any problem with the word, yet you went out of your way to mask it in different manners. Be a man. If you want to say it, then say it.

The way I see it, you personify a software as a helpless woman and derive pleasure from perpetrating sexual assault unto that woman. That's highly obsessed and a bit sick in the head.

Let me remind you, Comodo is named after a lizard, unless that's in fact what you want to seek sexual pleasure from.

 

[vitao]

Uhm you say English is not your native language as an excuse, yet you clearly know the unpleasant meaning of it, hence the masking. You say you don't have any problem with the word, yet you went out of your way to mask it in different manners. Be a man. If you want to say it, then say it.

The way I see it, you personify a software as a helpless woman and derive pleasure from perpetrating sexual assault unto that woman. That's highly obsessed and a bit sick in the head.

Let me remind you, Comodo is named after a lizard, unless that's in fact what you want to seek sexual pleasure from.

it seems you have serious issues regardless the word r@pe. do you need any help bro? just say and we can try to figure a way to help you...

 

[vitao]

I don`t mean to be mean(if you know what I mean?) but it`s just that some people don`t have the time to waste.

Regards Eck

so instead of saying things like that, nonsense, show whats wrong and what can be donne to make it right!

 

[ErzCrz]

@vitao Please stop using that word and re-read through the Forum Policy rules. That language pretty much everyone here would deem it inappropriate: Forum Rules - Language

 

[vitao]

@vitao Please stop using that word and re-read through the Forum Policy rules. That language pretty much everyone here would deem it inappropriate: Forum Rules - Language

I was reading it. I understand and agree. From now on when i use this word ill change it to something not inappropriate. the meaning of it will not change as its part of the way of expressing myself on some cases. if that is not allowed, free expression, than its a problem. i dont think its by the forum rules to censure its users.

 

[outlawxtorn]

I'm with @ErzCrz on this one. You should not be using that word in any facet of your life and not here.

 

[vitao]

I'm with @ErzCrz on this one. You should not be using that word in any facet of your life and not here.

sorry man but people have no word on what i use or not for talkings and things on this matter. sure, we are in a forum and as some asked polited, and there are rules, ill comply to these rules and not use the word one dude had bad feelings about. ill respect this not for what that user said but for the rules of the forum, but i can not agree with this thing some are trying to force. and its funny how one topic about some security software somene came crying and offtopic about personal feelings.... anyway... right? lets get back to the topic?

 

[vitao]

If anyone is interested. Here is the new topic about the new cis release against the loyisa exploit/poc.