App Review Comodo's killer.

[rashmi]

The below list includes three applications currently blocked (but allowed with 1-day time limit and ignored *.tmp files). The executables are parts of applications installed via UniGetUI.

Example of the block for the uninstall.exe included in the Plex installation Folder in Program FIles.

I tried again, and yes, Comodo blocked the unknown files from Program Files.

What is the difference between applying an "Ignore" action to the application and not doing this?

When Comodo Auto-containment is set to "Ignore" a particular application, all its actions are ignored too (including possible exploits, *.tmp files, etc.). This is very usable, but not always safe.

Yes, one should use the "ignore" option for troublesome software or issues.

Not anything, but most of the unknowns.
Which configuration do you propose?
It does not contain/block the unknown DLLs loaded by applications (except for some LOLBins included in the Script Analysis panel).
However, the main problem is with Comodo's alerts. Most children should not be allowed to interact with containment alerts, because they tend to bypass the restrictions.
It is hard to configure CIS/Xcitium to be silent and very strong, without problems with software.
So yes, CIS/Xcitium can be really good for children, but not optimal for parents who must solve problems with silently blocked/contained software.

On our kids' system, I simply use Comodo Firewall proactive security with the containment/firewall set to block unknown programs.

Have you looked into data protection from ransomware with Comodo?

 

[oldschool]

defender is a good combination to comodo and since comodo itself can block majority of malware (those not launched by a trusted process ) it should boost the security of the system a lot

@cruelsister has often recommended this combo in the past.

 

[Halp2001]

Hello everyone! I would like someone who is more expert than me on the subject, to test Comodo firewall by activating “hips” and selecting the option “Do not show popup alerts / Block requests” and in the Sandbox module “Do NOT show privilege escalation alerts / Block” to know if this would increase protection against unknown malware, POC, etc. Thanks and best regards

 

[Vitali Ortzi]

@cruelsister has often recommended this combo in the past.

Pretty sure she has defender enabled on her system

Another av she recommended to those looking for an av to combine (those that asked )
Was Kaspersky but anyway she trusts comodo alone and unfortunately looking how easy a dll hijack I personally don't trust it as much
But she's an actual security expert at least judging by her knowledge so I'm not saying she's wrong but really hope she will come back and share some more of her knowledge

 

[Vitali Ortzi]

Hello everyone! I would like someone who is more expert than me on the subject, to test Comodo firewall by activating “hips” and selecting the option “Do not show popup alerts / Block requests” and in the Sandbox module “Do NOT show privilege escalation alerts / Block” to know if this would increase protection against unknown malware, POC, etc. Thanks and best regards

Pretty sure it allows it even with hips because it's trusted but probably you can write rules to use hips to monitor at least some actions in trusted executables to prevent a dll hijacking or at least give an alert about that action



Btw it having a flaw doesn't mean I don't recommend and use it on every PC I own and my family's PC
It's excellent at blocking a lot of threats av software have a hard time dealing with and cruel sister countless times showed how different APT threats got restricted with her config and even cia according to vault 7 had a hard time with comodo when it was far more aggressive even blocking system processes they dropped payloads into


What changed is comodo is trying to balance security and usability and to make comodo great against certain methods has a usability cost of false positives

 

[rashmi]

Hello everyone! I would like someone who is more expert than me on the subject, to test Comodo firewall by activating “hips” and selecting the option “Do not show popup alerts / Block requests” and in the Sandbox module “Do NOT show privilege escalation alerts / Block” to know if this would increase protection against unknown malware, POC, etc. Thanks and best regards

Comodo's protection is ineffective against malware exploiting programs or services in Comodo trust or whitelist databases, a vulnerability for Comodo users.

 

[Vitali Ortzi]

Comodo's protection is ineffective against malware exploiting programs or services in Comodo trust or whitelist databases, a vulnerability for Comodo users.

Wasn't the case in comodo 5.0 at least according to cia but over time comodo has decided for the better to increase usability even having trusted vendors in recent years and this is the cost
if I gone back to old comodo it would have been to unusable because of false positives , possible bsod etc
So Comodo has has to find some solution that isn't too aggressive but should give recommendations for enterprises , advanced users how to workaround this issue meanwhile even if it's aggressive

 

[oldschool]

But she's an actual security expert

CIA.

 

[oldschool]

CIA.

@Vitali Ortzi I'm serious.

 

[Vitali Ortzi]

CIA.

That's a great conspiracy
XD made me laugh so hard
As authorities are known to leave a backdoor
Personally I don't think she is and even if she is cruel sister genuinely wants everyone more secure

 

[Vitali Ortzi]

@Vitali Ortzi I'm serious.

Proof is that her configs even using older versions(of dates when the nsa actually used the toolkits) have blocked a variety of nsa malware she shown in her videos (older versions for the time the malware was actually used should block it too )

 

[Vitali Ortzi]

Comodo's protection is ineffective against malware exploiting programs or services in Comodo trust or whitelist databases, a vulnerability for Comodo users.

But it's containment technology itself is great although not perfect (check project zero research to see its issues that were fixed but probably just partially and generally how it works )

Was able to block a ton of apt threats and is remarkable


Some benefits is that their solution has much lower performance usage then hypervisors , vms

 

[ErzCrz]

Topic unfollowed. Just getting a bit much. There is some useful discussion here but I'll come back to it when there are more conclusions.

 

[Vitali Ortzi]

Comodo's protection is ineffective against malware exploiting programs or services in Comodo trust or whitelist databases, a vulnerability for Comodo users.

Script analysis reduces the tricks that can be used but still some like dll hijacking is still an issue till they come up with some solution and I'm sure they eventually will

 

[rashmi]

I think cruel sister settings are not too bad on usability as you can install a fair amount of popular games , popular piracy with not too many false positives although some here and there

CruelSister's settings do not affect Comodo's usability or security. Her settings only restrict certain actions for contained programs, providing optional protection. However, they do not enhance Comodo's core protection outside the containment or address any vulnerabilities in Comodo. The claim that her settings block connections from unrecognized programs is also incorrect.

 

[rashmi]

Wasn't the case in comodo 5.0 at least according to cia but over time comodo has decided for the better to increase usability

Comodo Defense+ prioritized security.

 

[Vitali Ortzi]

CruelSister's settings do not affect Comodo's usability or security. Her settings only restrict certain actions for contained programs, providing optional protection. However, they do not enhance Comodo's core protection outside the containment or address any vulnerabilities in Comodo. The claim that her settings block connections from unrecognized programs is also incorrect.

It seems to have blocked connection in her videos at what cases it wouldn't block the command and control connection of unrecognized software?

 

[Andy Ful]

The claim that her settings block connections from unrecognized programs is also incorrect.

She probably had in mind the contained/blocked applications.

If an Unrecognized application is not contained (like DLL), this restriction does not work.

 

[Andy Ful]

There is some useful discussion here but I'll come back to it when there are more conclusions.

You have already read one:
https://malwaretips.com/threads/comodos-killer.133558/post-1115213

 

[ErzCrz]

You have already read one:
https://malwaretips.com/threads/comodos-killer.133558/post-1115213

Thanks. Will safe that to my notes