App Review Comodo's killer.

[Andy Ful]

Content source

https://youtu.be/OjgZo-CMuqo

I created this video as a supplement to the discussion in another thread:

App Review - Comodo Firewall Bypassing a Bypass

malwaretips.com

The original bypass and Comodo's killer do not work if Core isolation is properly configured on Windows.

 

[Bot]

Great job on the video! It provides a clear and concise explanation of the Comodo Firewall bypass issue. Thanks for sharing.

 

[lyldz]

I officially felt myself in a lesson with this video.thanks for that

 

[ErzCrz]

Interesting video. Out of curiosity, what is whitelisted in your auto-containment? Also App & Browser Control warning in Security Centre

But an informative video. I think the key with these things is to also deploy system hardening of some sort as SWH, WHHL, H_C and separately CyberLock will block/warn the action but I agree that disabling UAC isn't a great idea.

 

[Andy Ful]

Interesting video. Out of curiosity, what is whitelisted in your auto-containment? Also App & Browser Control warning in Security Centre

The ignored path is "C:\ProgramData\Comodo\Cis\tempscript\C_cmd[.]exe_....".
When I installed CIS and applied all Script Analysis settings, it tried to block a script related to the OneDrive update. I inspected the script in the CIS tempscript folder, executed again, allowed execution, and pressed "Do not isolate again".
The Ignore entry for that script was added automatically in the "Auto-Containment".

The App & Browser Control warning in the Security Centre is due to PUA protection (related to the Edge web browser). On Windows 10 it is not enabled in the default settings.
One can also see the warning about Account protection because I use the local account.

Post edited.