Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1112880" data-attributes="member: 32260">Disabling cloud lookup significantly reduces the possibility of using by the attackers the Trusted (but vulnerable) EXE files to avoid auto-containment. This approach is similar to WDAC or AppLocker policies (strict default-deny, no cloud app reputation). It can also prevent other attack vectors (different from DLL hijacking) when Trusted files are exploited. The shorter the Trusted Vendors list, the smaller the chances of infection.I do not recommend disabling cloud lookup, except when a &quot;family administrator&quot; has the motivation to protect &quot;computer illiterate&quot; users or when Comodo is used in organizations.I do not use such a setup, so I cannot exclude the possibility that it might be hardly usable in practice. I think that Comodo users can share some thoughts about it in this thread.</blockquote>

[QUOTE="Andy Ful, post: 1112880, member: 32260"] [B][COLOR=rgb(0, 168, 133)]Disabling cloud lookup significantly reduces the possibility of using by the attackers the Trusted (but vulnerable) EXE files to avoid auto-containment. [/COLOR][/B]This approach is similar to WDAC or AppLocker policies (strict default-deny, no cloud app reputation). It can also prevent other attack vectors (different from DLL hijacking) when Trusted files are exploited. The shorter the Trusted Vendors list, the smaller the chances of infection. I do not recommend disabling cloud lookup, except when a "family administrator" has the motivation to protect "computer illiterate" users or when Comodo is used in organizations. [COLOR=rgb(184, 49, 47)][B]I do not use such a setup, so I cannot exclude the possibility that it might be hardly usable in practice.[/B][/COLOR] I think that Comodo users can share some thoughts about it in this thread. [/QUOTE]

Verification