You can ask the moderator about it. Some moderators may know interesting details about CIS.
COMODO Internet Security Pro 2027
- Thread starter Shadowra
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
You can ask the moderator about it. Some moderators may know interesting details about CIS.
There are some other ways to abuse Trusted executables to bypass auto-containment in CIS.
For example, the LOLBas project shows many LOLBins that can run DLLs. Some of them, like rundll32.exe or regasm.exe, can be hardened via Comodo Script Analysis, but most are not included, and some can be used to bypass CIS via a malicious MSI installation that runs one of those LOLBins + a malicious DLL.
In this scenario, the DLL does not have to be a false negative.
However, this could possibly happen in a highly targeted attack (no worry for home users).
For example, the LOLBas project shows many LOLBins that can run DLLs. Some of them, like rundll32.exe or regasm.exe, can be hardened via Comodo Script Analysis, but most are not included, and some can be used to bypass CIS via a malicious MSI installation that runs one of those LOLBins + a malicious DLL.
In this scenario, the DLL does not have to be a false negative.
However, this could possibly happen in a highly targeted attack (no worry for home users).
Last edited:
I doubt Comodo will have DLL hijacking protection; they had it and removed it a long time ago, including the manual tweak.
I should write some good words about CIS.
In the case of a non-targeted attack against home users, the WiseConnect malware is rare. Furthermore, even if the connection to a malicious C2 server is established, the remote attacker can have a hard time doing anything dangerous. Simply, popular LOLBins and scripts are well restricted by Comodo Script Analysis settings.
In the case of a non-targeted attack against home users, the WiseConnect malware is rare. Furthermore, even if the connection to a malicious C2 server is established, the remote attacker can have a hard time doing anything dangerous. Simply, popular LOLBins and scripts are well restricted by Comodo Script Analysis settings.
It is true, of course. I already used it in my POC (you can see it in my video). However, the WiseConnect bypass here is unrelated to DLL hijacking.
CIS can see the difference because the LOLBin rundll32.exe is restricted by Script Analysis.
DLL hijacking abuses one of thousands of vulnerable but Trusted executables to load a malicious DLL instead of a dedicated DLL.
In this thread, the attacker uses a LOLBin (rundll32.exe) that is not vulnerable in any way, but it is generally intended to execute functions from DLLs (that is why it is restricted).
When using rundll32.exe, you must use a CmdLine that includes the concrete DLL.
In DLL hijacking, the Trusted vulnerable executable can be executed without a CmdLine (just double-click the executable in Explorer), and the DLL is loaded silently.
Last edited:
Hello Shadowra,
Which version did you test?
Comodo Internet Security 2027 V12.4.0.8170 or
Comodo Internet Security 2027 V12.3.4.8162
Which version did you test?
Comodo Internet Security 2027 V12.4.0.8170 or
Comodo Internet Security 2027 V12.3.4.8162
Do you think it really would have mattered, regarding the results?
It’s just a question, Jonny Quest,and not a criticism of the test.
The one that was available right when it came out, when a member wrote about it here
Oh, I know, I just wasn't sure that an incremental update for a newer 2027 release would have changed the results?
Cheers
You may also like...
-
Malwarebytes Anti-Malware Premium Re-Test- Started by Shadowra
- Replies: 22
-
-
Qihoo 360 Total Security 2026 Free
- Started by Shadowra
- Replies: 16
-
-
Trendmicro Maximum Security 2026
- Started by Shadowra
- Replies: 19