App Review COMODO Internet Security Pro 2027

[Andy Ful]

I had read it in a moderator's post on the Comodo forum; maybe I misread the post. I tried to find the post but couldn't find it. Thank you for the info and detailed response.

You can ask the moderator about it. Some moderators may know interesting details about CIS.

 

[Andy Ful]

There are some other ways to abuse Trusted executables to bypass auto-containment in CIS.
For example, the LOLBas project shows many LOLBins that can run DLLs. Some of them, like rundll32.exe or regasm.exe, can be hardened via Comodo Script Analysis, but most are not included, and some can be used to bypass CIS via a malicious MSI installation that runs one of those LOLBins + a malicious DLL.
In this scenario, the DLL does not have to be a false negative.
However, this could possibly happen in a highly targeted attack (no worry for home users).

 

[rashmi]

the DLL does not have to be a false negative

I doubt Comodo will have DLL hijacking protection; they had it and removed it a long time ago, including the manual tweak.

 

[Andy Ful]

I should write some good words about CIS.
In the case of a non-targeted attack against home users, the WiseConnect malware is rare. Furthermore, even if the connection to a malicious C2 server is established, the remote attacker can have a hard time doing anything dangerous. Simply, popular LOLBins and scripts are well restricted by Comodo Script Analysis settings.