Software Review COMODO Internet Security Pro 2027

Video Reviews - Security and Privacy
130 Replies 16,449 Views
Reviews reflect the reviewer's setup and methods. Check the evidence and limitations.
Content created by
Shadowra
There are some other ways to abuse Trusted executables to bypass auto-containment in CIS.
For example, the LOLBas project shows many LOLBins that can run DLLs. Some of them, like rundll32.exe or regasm.exe, can be hardened via Comodo Script Analysis, but most are not included, and some can be used to bypass CIS via a malicious MSI installation that runs one of those LOLBins + a malicious DLL.
In this scenario, the DLL does not have to be a false negative.
However, this could possibly happen in a highly targeted attack (no worry for home users).
 
Last edited:
Andy Ful said:
the DLL does not have to be a false negative
Click to expand...
I doubt Comodo will have DLL hijacking protection; they had it and removed it a long time ago, including the manual tweak.

dll.png
 
I should write some good words about CIS.
In the case of a non-targeted attack against home users, the WiseConnect malware is rare. Furthermore, even if the connection to a malicious C2 server is established, the remote attacker can have a hard time doing anything dangerous. Simply, popular LOLBins and scripts are well restricted by Comodo Script Analysis settings.:)
 
rashmi said:
I doubt Comodo will have DLL hijacking protection; they had it and removed it a long time ago, including the manual tweak.

View attachment 299085
Click to expand...

It is true, of course. I already used it in my POC (you can see it in my video). However, the WiseConnect bypass here is unrelated to DLL hijacking.
CIS can see the difference because the LOLBin rundll32.exe is restricted by Script Analysis.
DLL hijacking abuses one of thousands of vulnerable but Trusted executables to load a malicious DLL instead of a dedicated DLL.
In this thread, the attacker uses a LOLBin (rundll32.exe) that is not vulnerable in any way, but it is generally intended to execute functions from DLLs (that is why it is restricted).

When using rundll32.exe, you must use a CmdLine that includes the concrete DLL.
In DLL hijacking, the Trusted vulnerable executable can be executed without a CmdLine (just double-click the executable in Explorer), and the DLL is loaded silently.
 
Last edited:
rashmi said:
Comodo had a bug; it didn't contain MSI installers. I'm unsure if it affected the default or all configs and if they fixed it.
Click to expand...

I must correct my previous answer related to containing MSI files. In the previous post, I forgot to mention the isolation time limit (3 days).
In the default CIS settings, Unrecognized MSI files less than three days old should be auto-contained. I tested this with the actual CIS version, and it worked as intended.
So the scenario from the test shows the CIS reaction related to the MSI malware more than three days old.
We should see a difference if the test was conducted with the Proactive Security configuration (no isolation time limit).
 
Last edited:
@Shadowra,

It seems that the isolation time limit in the CIS default settings can also affect home users.
Could you test the CIS default settings against a few-day-old malware? It may be only a quick signature detection test (not a video) to see the detection improvement.
Many users can run older installers stored on the hard disk. In such a case, the CIS containment will be ineffective.
 
Last edited:
That is absolutely false. Comodo isolates malicious msi files without regard to file creation date. As I tried to explain earlier, things can be coded as either msi or PE32. For the most part the msi won't be allowed to proceed whereas the PE32 will proceed but within Containment; either way it will be stopped.
 
cruelsister said:
That is absolutely false. Comodo isolates malicious msi files without regard to file creation date. As I tried to explain earlier, things can be coded as either msi or PE32. For the most part the msi won't be allowed to proceed whereas the PE32 will proceed but within Containment; either way it will be stopped.
Click to expand...

I have just tested this, and in the CIS default settings, the isolation time limit works as I posted (also for EXE and MSI files).
You can easily test it.
 
In my test, I first executed the older MSI file, which was allowed by CIS. Next, I made a copy of this file. The copy was auto-contained.
If I increase the isolation time limit sufficiently, the older MSI file is auto-contained too.
The time is counted from the moment of dropping the file to the hard disk.

Edit.
The original MSI file was copied a few days ago from the flash drive to the hard disk.
Files downloaded from the Internet or located directly on the Removable Media have no isolation time limit (a special rule is visible in the Auto-containment settings).
So, the danger of skipping auto-containment is very limited. Users who share files via USB drives and copy them to a hard disk can be affected.

Edit1 (9.08.2026).
The test was done in a virtual machine. The results on a real machine can be different:

BAT files created by me on a hard disk were uncontained after 3 days, also on a real machine.
 
Last edited:
I also tested other file types such as PowerShell scripts (.ps1), Windows Script Host scripts (.vbs, .js), batch scripts (.bat), HTA files, and EXE files.
In all cases, files downloaded from the flash drive to created directly on the hard disk could be executed with no containment after the isolation time limit.
However, in most other scenarios (files downloaded from the Internet, files located on the removable media, etc.), the time limit is removed.
So the chances of home users being infected are very low.
Anyway, the isolation time limit can pose some risk in targeted attacks against businesses (lateral movement).

Post corrected.
The issue related to files downloaded from a flash drive occurred in my Virual Machine, but not on real machines.
 
Last edited:
Andy Ful said:
I also tested other file types such as PowerShell scripts (.ps1), Windows Script Host scripts (.vbs, .js), batch scripts (.bat), HTA files, and EXE files.
In all cases, files downloaded from the flash drive to the hard disk could be executed with no containment after the isolation time limit.
However, in most other scenarios (files downloaded from the Internet, files located on the removable media, etc.), the time limit is removed.
So the chances of home users being infected are very low.
Anyway, the isolation time limit can pose some risk in targeted attacks against businesses (lateral movement).
Click to expand...
Interesting. The default doesn't have limit program execution time box ticked. though in my screen below I have restriction set to Restricted and I'm using Proactive Configuration.

1785786549980.png
 
I’ll never get why it’s always such a mess whenever people talk about comodo...Test it like this, test it now, with this, without this... okay... maybe it's a great product, maybe not... people are so divided over it, I've never seen anything like this with any other software.
 
ErzCrz said:
Interesting. The default doesn't have limit program execution time box ticked. though in my screen below I have restriction set to Restricted and I'm using Proactive Configuration.
Click to expand...

Default CIS settings use Internet Security configuration, which uses different Auto-containment rules.
 
KEEP EXPLORING

Similar threads

Another perspective. Your next conversation.

Community
Security tip
Keep your device lock strong. A passkey is usually unlocked through your device's screen lock. Protect that device with a strong PIN or password and do not share it casually.
Back
Top