App Review Comodo Internet Security vs targeted ransomware attack.

[Andy Ful]

The Advanced Threat Protection tests included in my previous post were slightly outdated.
So, I inspected the attack vectors included in newer tests (do not include CIS/CCS/Xcitium).

Spoiler: Links

ATP Test: How easily Windows can be tricked by malware

Many users have known for a long time that they always need to keep their Windows up to date so that cyberattackers will have as few opportunities as possible to launch an assault. But Windows itself has a number of vulnerabilities that only security software can mitigate. Interesting fact...

www.av-test.org

ATP test: defending against attacks by ransomware and info stealers

They are the leading vectors for attacks: ransomware and info stealers. If attacks are successful, what follows is extortion for ransom, the data ends up for sale on the Internet, or both. None of this happens if good protection software thwarts the attacks immediately. But is the software...

www.av-test.org

ATP test: Keeping data thieves and encryptors at bay

Attackers are constantly developing new tools and tactics in order to launch attacks on Windows systems. The actual attack generally takes place through ransomware or an infostealer. In our latest Advanced Threat Protection test – or ATP test, for short – the AV-TEST team checked whether...

www.av-test.org

Cybersecurity: Defense Against the Latest Attacking Techniques in the ATP Test

In an ongoing race against cybercriminals, security vendors need to constantly maintain the upper hand in order to sustainably guarantee the security of data for both consumer users and corporate users. The Advanced Threat Protection test from AV-TEST relies on detailed individual tests to...

www.av-test.org

ATP: live test against data theft and encryption malware

For consumer users, all their vacation photos and other memories are often lost – for corporate users, the entire future of the company may be at stake. When info stealers or ransomware attackers strike, data ends up in the hands of strangers or is professionally encrypted to a large degree...

www.av-test.org

Prevention against ransomware and info stealers: 20 security solutions in the ATP test

Take a look at any study on the subject of malware: ransomware and info stealers have consistently been on the front line of cybersecurity threats for years now. Good protection software detects attackers before they wreak devastation. But what happens if the attackers are not readily detected...

www.av-test.org

ATP TEST: 26 security packages fend off ransomware and info stealers

In 2024, there was a steady flow of IT security news reporting on how ransomware and info stealers attacked PCs and servers, and encrypted or extracted data. No matter how they ensued, they always ended up with a ransom demand. But could the attacks have been prevented? Can security software...

www.av-test.org

The newer tests include some of the methods that might bypass CIS (such as DLL hijacking). However, the required methods are applied at the later infection stages, when the attack is already contained. For example (the red part of the attack can be auto-contained):

Email with attachment ---> EXE or script file in the archive ----> EXE or script file unpacked/executed ----> ... ----> DLL hijacking

It is rather clear that the used attack vectors are prepared to bypass NextGen solutions and do not bother to bypass Comodo.

 

[Andy Ful]

AV-Comparatives Advanced Threat Protection tests.

Spoiler: Links

ATP - Advanced Threat Protection Tests Archives

The Advanced Threat Protection (ATP) Test, aka Enhanced Real-World Test, uses hacking and penetration techniques that allow attackers to target specific external computer systems, and evaluates how well security products protect against such attacks. This test checks protection against targeted...

av-comparatives.org

One of the scenarios used in the tests can bypass CIS (as I mentioned in my previous posts).
Advanced Threat Protection Test 2022 - Enterprise

15. This threat is introduced via Removable Media. A malicious office document injects into another user-space process and opens a C2 channel to a commercial C2 framework via https.

Documents on infected removable media do not have Mark of the Web, so macros are not blocked by default in MS Office. The attacker can use VBA code that applies PE injection. The code is well known and effective against CIS (I tested it some time ago). In this case, the VBA macro does not invoke PowerShell, Windows Script Host, or anything that Comodo Script Analysis could block. Other security solutions can use AMSI-based detections to prevent the attack.

 

[Andy Ful]

Some notes about the risk of using trojanized NPM packages at home.

Trojanized NPM package ---> malicious Node addon loaded ---> malware executed filelessly in the memory of the Node executable

In theory, such addons might be detected by Comodo via signatures or Viruscope. However, I would not place much hope in these protection layers for protection against new threats.

On the other side, such attacks require installing the Node.js runtime, which is probably rare at home (except for software developers or tech hobbyists).
Anyway, there were some in-the-wild examples of using portable/archived versions of Node.js environment. I must research those examples to get some insight.

Update.
The known attacks with portable/archived Node.js runtime were mainly initiated via PowerShell, so they could be auto-contained by CIS.
The attackers would have to use another Trusted script interpreter (unrestricted by Comodo Script Analysis) to bypass CIS. This is improbable, except for a highly targeted attack.