This whole debacle is wrong on many levels but mainly because it revolves around a dead product. Even the name of the thread is “Comodo may come back from the grave”.
So it becomes quite evident quite quick that we are talking about a software that’s been phased out.
Is it true that defence+ brings business grade features (sandboxing is frequently reserved for enterprise products, albeit being a bit different there) to home users?
Yes, it is. And it does it for free.
Should the product really be deployed and should we all rush to download it from the website?
I don’t think so.
The product not being updated for 2 years means that it contains a collection of outdated drivers and scanning for malware, emulating (if Comodo uses emulation) as well as running malware in an outdated sandbox MAY (bear in mind I am not saying it WILL but exploring a possibility here) provide malware with more access it could normally have, simply being missed by a regular (if that’s a thing) antivirus. Once a malware is able to obtain kernel access, it could bypass a whole stack of defences.
It is wrong to assume that default-deny is the panacea that will sort all your malware problems out as there are ways to go around default-deny, as well as reputation monitoring by using signed malware.
According to a Trend Micro report which can be found below, there is a vast amount of malware being signed.
Using a machine learning system, we analyzed 3 million software downloads, and provide insights in this three-part blog series. In this part of this series, we discuss the problems regarding code signing abuse.
www.trendmicro.com
I also urge readers to have a look at this article about threats to Windows kernel:
It is also wrong to assume that default-deny is something exclusively patented by, and reserved for Comodo. There are various different implementations of default-deny, with the most notable being the App Control by Kaspersky, but products like Avast/AVG with hardened mode, Trend Micro and Norton have light implementations as well.
Antimalware products should be designed carefully, always with security and potential exploits in mind. All third-party libraries MUST be updated as soon as possible and the AV engine must be heavily contained& restricted. Automatically capturing every downloaded file with outdated engines could lead to a 0-click exploit.
Even vendors like Norton have been on the news for not updating libraries:
Symantec security flaws are "as bad as they get," says researcher
And just because nobody has been interested to test Comodo properly and document any security holes, or because 2-3 people on MalwareTips “never had any issues”, doesn’t mean that the product is not plagued with security holes. Or that security holes haven’t been exploited out there. We all remember articles about AV drivers being abused.
Delicately swinging and re-shaping words around in a lawyer-like matter to support a favourite product of choice (E.g. no updates are needed cuz it’s already ahead of its time, nobody said the product is not compatible with Windows 11, there is no evidence of bugs) can’t change the FACTS.
And what are the facts?
1. This is a free product and in today’s inflation, as well as with the costs to develop, manage and distribute a product there is no way you can have a great antivirus when nobody pays for it.
2. This is now an outdated product in a world where threats evolve quickly and other vendors distribute monthly updates/fixes + up-to-the-minute threat intelligence updates.
3. Product offers below minimum support and should absolutely be avoided by novice users who may not know how to handle certain situations.
4. The product was released before Windows 11 was officially distributed by Microsoft. There is no official statement that says “Stop! Do not use on Windows 11!” but there is also no official statement “Yes! We are compatible.”
5. Bugs have been reported for ages. How many of these are true, accurate, widespread, how many can be reproduced is not that important.
Users are facing issues and there is nobody to help.
6. There is no evidence of the design being flawed, but also there is very little information that it is secure.
For example, can anyone supporting Comodo provide any light on whether the AV engine runs with a wrapper around, or whether the drivers used by ViruScope, anti-malware engine and sandboxing are protected by abuse? Comodo has no bug bounty (just saying).
I personally would not recommend, use or condone/support a product of this nature.
