App Review COMODO Internet Security Pro 2027

[Andy Ful]

I had read it in a moderator's post on the Comodo forum; maybe I misread the post. I tried to find the post but couldn't find it. Thank you for the info and detailed response.

You can ask the moderator about it. Some moderators may know interesting details about CIS.

 

[Andy Ful]

There are some other ways to abuse Trusted executables to bypass auto-containment in CIS.
For example, the LOLBas project shows many LOLBins that can run DLLs. Some of them, like rundll32.exe or regasm.exe, can be hardened via Comodo Script Analysis, but most are not included, and some can be used to bypass CIS via a malicious MSI installation that runs one of those LOLBins + a malicious DLL.
In this scenario, the DLL does not have to be a false negative.
However, this could possibly happen in a highly targeted attack (no worry for home users).

 

[rashmi]

the DLL does not have to be a false negative

I doubt Comodo will have DLL hijacking protection; they had it and removed it a long time ago, including the manual tweak.

 

[Andy Ful]

I should write some good words about CIS.
In the case of a non-targeted attack against home users, the WiseConnect malware is rare. Furthermore, even if the connection to a malicious C2 server is established, the remote attacker can have a hard time doing anything dangerous. Simply, popular LOLBins and scripts are well restricted by Comodo Script Analysis settings.

 

[Andy Ful]

I doubt Comodo will have DLL hijacking protection; they had it and removed it a long time ago, including the manual tweak.

View attachment 299085

It is true, of course. I already used it in my POC (you can see it in my video). However, the WiseConnect bypass here is unrelated to DLL hijacking.
CIS can see the difference because the LOLBin rundll32.exe is restricted by Script Analysis.
DLL hijacking abuses one of thousands of vulnerable but Trusted executables to load a malicious DLL instead of a dedicated DLL.
In this thread, the attacker uses a LOLBin (rundll32.exe) that is not vulnerable in any way, but it is generally intended to execute functions from DLLs (that is why it is restricted).

When using rundll32.exe, you must use a CmdLine that includes the concrete DLL.
In DLL hijacking, the Trusted vulnerable executable can be executed without a CmdLine (just double-click the executable in Explorer), and the DLL is loaded silently.

 

[Xtwillight]

Hello Shadowra,
Which version did you test?
Comodo Internet Security 2027 V12.4.0.8170 or
Comodo Internet Security 2027 V12.3.4.8162

 

[Jonny Quest]

Hello Shadowra,
Which version did you test?
Comodo Internet Security 2027 V12.4.0.8170 or
Comodo Internet Security 2027 V12.3.4.8162

Do you think it really would have mattered, regarding the results?

 

[Xtwillight]

It’s just a question, Jonny Quest,and not a criticism of the test.

 

[Shadowra]

Hello Shadowra,
Which version did you test?
Comodo Internet Security 2027 V12.4.0.8170 or
Comodo Internet Security 2027 V12.3.4.8162

The one that was available right when it came out, when a member wrote about it here

 

[Jonny Quest]

It’s just a question, Jonny Quest,and not a criticism of the test.

Oh, I know, I just wasn't sure that an incremental update for a newer 2027 release would have changed the results?

Cheers

 

[Andy Ful]

Comodo had a bug; it didn't contain MSI installers. I'm unsure if it affected the default or all configs and if they fixed it.

I must correct my previous answer related to containing MSI files. In the previous post, I forgot to mention the isolation time limit (3 days).
In the default CIS settings, Unrecognized MSI files less than three days old should be auto-contained. I tested this with the actual CIS version, and it worked as intended.
So the scenario from the test shows the CIS reaction related to the MSI malware more than three days old.
We should see a difference if the test was conducted with the Proactive Security configuration (no isolation time limit).

 

[Andy Ful]

@Shadowra,

It seems that the isolation time limit in the CIS default settings can also affect home users.
Could you test the CIS default settings against a few-day-old malware? It may be only a quick signature detection test (not a video) to see the detection improvement.
Many users can run older installers stored on the hard disk. In such a case, the CIS containment will be ineffective.

 

[cruelsister]

That is absolutely false. Comodo isolates malicious msi files without regard to file creation date. As I tried to explain earlier, things can be coded as either msi or PE32. For the most part the msi won't be allowed to proceed whereas the PE32 will proceed but within Containment; either way it will be stopped.

 

[Andy Ful]

That is absolutely false. Comodo isolates malicious msi files without regard to file creation date. As I tried to explain earlier, things can be coded as either msi or PE32. For the most part the msi won't be allowed to proceed whereas the PE32 will proceed but within Containment; either way it will be stopped.

I have just tested this, and in the CIS default settings, the isolation time limit works as I posted (also for EXE and MSI files).
You can easily test it.

 

[Shadowra]

I have just tested this, and in the CIS default settings, the isolation time limit works as I posted (also for EXE and MSI files).
You can easily test it.

 

[Andy Ful]

In my test, I first executed the older MSI file, which was allowed by CIS. Next, I made a copy of this file. The copy was auto-contained.
If I increase the isolation time limit sufficiently, the older MSI file is auto-contained too.
The time is counted from the moment of dropping the file to the hard disk.

Edit.
The original MSI file was copied a few days ago from the flash drive to the hard disk.
Files downloaded from the Internet or located directly on the Removable Media have no isolation time limit (a special rule is visible in the Auto-containment settings).
So, the danger of skipping auto-containment is very limited. Users who share files via USB drives and copy them to a hard disk can be affected.

 

[Andy Ful]

I also tested other file types such as PowerShell scripts (.ps1), Windows Script Host scripts (.vbs, .js), batch scripts (.bat), HTA files, and EXE files.
In all cases, files downloaded from the flash drive to the hard disk could be executed with no containment after the isolation time limit.
However, in most other scenarios (files downloaded from the Internet, files located on the removable media, etc.), the time limit is removed.
So the chances of home users being infected are very low.
Anyway, the isolation time limit can pose some risk in targeted attacks against businesses (lateral movement).

 

[ErzCrz]

I also tested other file types such as PowerShell scripts (.ps1), Windows Script Host scripts (.vbs, .js), batch scripts (.bat), HTA files, and EXE files.
In all cases, files downloaded from the flash drive to the hard disk could be executed with no containment after the isolation time limit.
However, in most other scenarios (files downloaded from the Internet, files located on the removable media, etc.), the time limit is removed.
So the chances of home users being infected are very low.
Anyway, the isolation time limit can pose some risk in targeted attacks against businesses (lateral movement).

Interesting. The default doesn't have limit program execution time box ticked. though in my screen below I have restriction set to Restricted and I'm using Proactive Configuration.

Spoiler: Containment defaults

 

[Popolitus]

I’ll never get why it’s always such a mess whenever people talk about comodo...Test it like this, test it now, with this, without this... okay... maybe it's a great product, maybe not... people are so divided over it, I've never seen anything like this with any other software.

 

[Andy Ful]

Interesting. The default doesn't have limit program execution time box ticked. though in my screen below I have restriction set to Restricted and I'm using Proactive Configuration.

Default CIS settings use Internet Security configuration, which uses different Auto-containment rules.