Comodo Internet Security's Auto-Sandbox (Containment) & HIPS interaction explanation

[Deleted member 178]

INTRODUCTION

As you know CIS, since v6, has an Auto-Sandbox (called behavior Blocker on v8, and now on v10 it is called "Containment" ) and an HIPS.


On the settings, HIPS can be "disabled" , about searching on Comodo Forum, "disabling" is not "turning-off" the HIPS, just "hidding" it

THEORY

1- HIPS disabled

the Autosandbox will do the prevention job running the process in a restricted mode (set by the user) , unless the "full virtualization" is enabled, in this case the process is totally functional but will not harm the system.

The HIPS will activate only on unrecognized files that do not enter in the BB rules.

2- HIPS enabled

The BB is still active, and still acting depending its rules (as above).

The HIPS is now "woke up" and every actions of the process generate an alert from the HIPS regardless of the BB actions.
The HIPS will have priority, it is why Comodo developers suggest to average users to choose either the HIPS or the Autosandbox , using both is for advanced users who want total control of CIS

TEST

For the test i will use a "safe" keygen.
CIS' Autosandbox is set to full virtualization so the keygen will run as if in my real system


1- Autosandbox enabled / HIPS disabled

As you can see no reaction from the HIPS, the Autosandbox had priority

2- Autosandbox Enabled/HIPS enabled

a- HIPS popup appears, if user allow, (then the Autosandbox take the relay as shown above)

if user block :

3- Autosandbox disabled/HIPS enabled

only the HIPS will generate alerts, one alert for each modifications on the system.



This is all i know for the moment, i will update when i will discover new elements.

 

[Mundungas]

Very nice! I'll spread the word about this one

 

[MalwareVirus]

Very nice and clear info
Thanks

 

[Deleted member 178]

Thanks

 

[Amiga500]

Thank you umbra.much appreciated.

 

[Deleted member 178]

this thread should be pinned

 

[Littlebits]

this thread should be pinned

It's done.

Enjoy!!

 

[Moose]

Are you using the Free Version?

> I have using for the Free Comodo Firewall.
> Putting my browser within the SandBox.
> Also, with Emsisoft Anti-Malware Current version.
> Run quick with no slow down!

 

[Deleted member 178]

why pay when it is free ^^

 

[Amiga500]

the only issue i have with using the comodo sandboxed browser is that it shows intrusions on the GUI when it is used.Its a very solid sandbox but is there any way of stopping the intrusion counter.

 

[illumination]

the only issue i have with using the comodo sandboxed browser is that it shows intrusions on the GUI when it is used.Its a very solid sandbox but is there any way of stopping the intrusion counter.

If it is accessing memory, it will show. There used to be a way to exclude these in v5, not sure with v6 if that option is still available, but would assume so..

 

[dragonmew]

so whats the best setting for behaviour blocker as mine is set at default

 

[Deleted member 178]

Untrusted or restricted, full virtualization if you know what you do

 

[(BlackBox) Hacker]

WOW nice stuff mate!!!

INTRODUCTION

As you know CIS v6 has a Behavior Blocker ( previously called the Auto-Sandbox, but improved) and an HIPS.

On the settings, HIPS can be "disabled" , about searching on Comodo Forum, "disabling" is not "turning-off" the HIPS, just "hidding" it

THEORY

1- HIPS disabled

the BB will do the prevention job running the process in a restricted mode (set by the user) , unless the "full virtualization" is enabled, in this case the process is totally functional but will not harm the system.

The HIPS will activate only on unrecognized files that do not enter in the BB rules.

2- HIPS enabled

The BB is still active, and still acting depending its rules (as above).

The HIPS is now "woke up" and every actions of the process generate an alert from the HIPS regardless of the BB actions.
The HIPS will have priority, it is why Comodo developers suggest to average users to choose either the HIPS or the BB , using both is for advanced users who want total control of CIS

TEST

For the test i will use a "safe" keygen.
CIS' Behavior Blocker is set to full virtualization so the keygen will run as if in my real system


1- BB enabled / HIPS disabled

As you can see no reaction from the HIPS, the BB had priority

2- BB Enabled/HIPS enabled

a- HIPS popup appears, if user allow, (then the BB take the relay as shown above)

if user block :

3- BB disabled/HIPS enabled

only the HIPS will generate alerts, one alert for each modifications on the system.



This is all i know for the moment, i will update when i will discover new elements.

 

[Ulikedat]

My fav HIPS/Behaviour Blockers of all time: CyberHawk (now owned by Shitmantec?), Sana Identity Protect (Also owned by Shitmantec i think) and ProSecurity (Now owned by Comodo). These were actually great against zero day malware! Especially ProSecurity was pretty much bulletproof! Why do you think Comodo does so well at Matousec That's not inhouse tech. There were a few more outstanding ones but i can't recall them. Sorry for looking back in time, i'm old school like dat <3

 

[Davidov]

It works well CIS8 when setting off HIPS and full virtualization sandbox as the first commentary ??? Thanks all. http://i.imgur.com/OcT1J.jpg