App Review Comodo's killer.

[rashmi]

She probably had in mind the contained/blocked applications.

If an Unrecognized application is not contained (like DLL), this restriction does not work.

I didn't mean it was CruelSister's claim, as she's already addressed it in this thread.

Serious Discussion - Comodo Containment "Restricted" Restriction Level

For Containment, some Comodo users opt for @cruelsister's configuration, which primarily includes Proactive Configuration + Restricted (Restriction Level). According to @cruelsister, the "restricted" level prevents network connections from contained programs. Comodo users who use CruelConfig...

malwaretips.com

 

[Andy Ful]

I did not name my "conclusion" post the conclusion, so I do it now more clearly.

Suggestions for MT members who want to use CIS on their computers.

1. It is OK to use the @cruelsister settings but be cautious when opening documents with macros or files from disk images, flash drives, and archives. Those files are common attack vectors for abusing Trusted applications and bypassing CIS protection.
2. One can maximize the protection against abusing Trusted applications by:
   - using the 7-Zip trick for disk images and archives,
   - disabling execution from flash drives,
   - disabling macros in office applications,
   - tweaking Comodo's Script Analysis settings.

Administrators in organizations (small businesses) can consider

• using SUA,
• disabling macros in office documents,
• tweaking Comodo's Script Analysis settings,
• applying the @cruelsister settings (silent setup) with disabled cloud lookup and reduced Trusted Vendors list.
  Only selected signed (also self-signed) applications will be allowed when the vendors are included on the reduced Trusted Vendors list.
  Other applications will be contained. Such vendors like Microsoft and Comodo must be included on that list.

Edit.
Of course, Administrators in organizations, should not forget about Microsoft Administrative Templates to adjust more restrictions.

 

[Nikola Milanovic]

I did not name my "conclusion" post the conclusion, so I do it now more clearly.

Suggestions for MT members who want to use CIS on their computers.

1. It is OK to use the @cruelsister settings but be cautious when opening documents with macros or files from disk images, flash drives, and archives. Those files are common attack vectors for abusing Trusted applications and bypassing CIS protection.
2. One can maximize the protection against abusing Trusted applications by:
   - using the 7-Zip trick for disk images and archives,
   - disabling execution from flash drives,
   - disabling macros in office applications,
   - tweaking Comodo's Script Analysis settings.

Administrators in organizations (small businesses) can consider

• using SUA,
• disabling macros in office documents,
• tweaking Comodo's Script Analysis settings,
• applying the @cruelsister settings (silent setup) with disabled cloud lookup and reduced Trusted Vendors list.
  Only selected signed (also self-signed) applications will be allowed when the vendors are included on the reduced Trusted Vendors list.
  Other applications will be contained. Such vendors like Microsoft and Comodo must be included on that list.

If u disable Cloud then how will Xcitium rate the files as Malicious or Safe?
Will it be Unknown forever?

 

[simmerskool]

interject question: my apology if asked & answered or if obvious... Can / should @Andy Ful FWH be run with CF 12.3.4.8162 (@cruelsister settings), fully compatible?, and if yes, does FWH add anything not covered by CF? Running CF with MS Defender.

 

[Andy Ful]

If u disable Cloud then how will Xcitium rate the files as Malicious or Safe?

The signature detection still works, so malicious files are detected. All other files will be Unrecognized for Comodo, except files Trusted by the user or Trusted Vendor.
Such a setup is common in Enterprises where AppLocker or Windows Defender Application Control is applied.

Will it be Unknown forever?

Yes, except when the user adds the vendor to the Trusted Vendors or Trusted files.
Of course, the user can enable Cloud Lookup from time to time if necessary.

 

[Andy Ful]

Can / should @Andy Ful FWH be run with CF 12.3.4.8162 (@cruelsister settings), fully compatible?

FirewallHardening can be used with CF (any configuration).

, and if yes, does FWH add anything not covered by CF? Running CF with MS Defender.

Yes.
However, the user can manually add (with some effort) similar rules to Comodo and skip FirewallHardening tool.

 

[Nikola Milanovic]

The signature detection still works, so malicious files are detected. All other files will be Unrecognized for Comodo, except files Trusted by the user or Trusted Vendor.
Such a setup is common in Enterprises where AppLocker or Windows Defender Application Control is applied.



Yes, except when the user adds the vendor to the Trusted Vendors or Trusted files.
Of course, the user can enable Cloud Lookup from time to time if necessary.

i keep Cloud on everytime because i like Xcitium to rate files as Malicious or Trusted

 

[Andy Ful]

i keep Cloud on everytime because i like Xcitium to rate files as Malicious or Trusted

There is always a trade between usability and security.

 

[bazang]

- using the 7-Zip trick for disk images and archives,
- disabling execution from flash drives,
- disabling macros in office applications,

These should be used by default on Windows no matter what AV is used.

Enterprises and governments are 99% of the office macro users in the world today; consumers do not need macro capabilities built-in to Office and Microsoft should remove them and make macros a separate application plug-in or module. But it won't because even Microsoft has admitted the office code is one crap layer on top of another. Security has been bandaided onto Office.

Of course, Administrators in organizations, should not forget about Microsoft Administrative Templates to adjust more restrictions.

Once the current batch of Administrators dies off, there will not be anyone around to know what Microsoft Administrative Templates are.

Microsoft CoPilot will run peoples' online lives (and security).

 

[Andy Ful]

Once the current batch of Administrators dies off, there will not be anyone around to know what Microsoft Administrative Templates are.

This can take some time.

 

[rashmi]

The signature detection still works, so malicious files are detected.

Comodo Cloud Antivirus detection relies on Cloud Lookup, if I remember well.

 

[bazang]

This can take some time.

The last real Administrator was born on December 31st, 1999.

By 2075 either AI runs the world's IT infrastructure or else there won't be enough Admins to even figure out how to connect the power chord into the power socket.

Heck, people will not even have to go to school anymore. When someone asks them a question they can just have that person ask their personal phone - which the AI on it will provide the correct answer to the person asking the question.

AI will talk to AI and just cut-out the real nuisance - the people.

I really do think people (the world, humanity, whatever you want to call them) are stupid enough that this is the sort of future dystopia the world is headed towards. That's if the hoomans don't kill each other first.

 

[Andy Ful]

Comodo Cloud Antivirus detection relies on Cloud Lookup, if I remember well.

If local signatures do not detect the file, it is checked against the cloud backend (cloud lookup). To maximize the detection with disabled cloud lookup, it might be necessary to use the full signatures locally.

 

[Andy Ful]

The last real Administrator was born on December 31st, 1999.

By 2075 either AI runs the world's IT infrastructure or else there won't be enough Admins to even figure out how to connect the power chord into the power socket.

Heck, people will not even have to go to school anymore. When someone asks them a question they can just have that person ask their personal phone - which the AI on it will provide the correct answer to the person asking the question.

AI will talk to AI and just cut-out the real nuisance - the people.

I really do think people (the world, humanity, whatever you want to call them) are stupid enough that this is the sort of future dystopia the world is headed towards. That's if the hoomans don't kill each other first.

Predicting the future for the next 50 years is virtually impossible.
One cannot be certain that there will be any future after 40 years. Let's hope for the opposite.

 

[Nikola Milanovic]

Static Analysis: Malware
Behaviour
Kill Chain Report(Red circle right up)
Link: Valkyrie Verdict

 

[Andy Ful]

@Nikola Milanovic,

It is not necessary to post examples of malware detected by Comodo. We already know that it can detect many malware.
By the way, your example cannot convince anyone that Comodo has a good singnature detection.

We can see the detection from 7 hours ago (3 days after the sample was first seen in the wild ).



(.....) skipped AVs that detected the sample. The below AVs missed the sample:

 

[Nikola Milanovic]

@Nikola Milanovic,

It is not necessary to post examples of malware detected by Comodo. We already know that it can detect many malware.
By the way, your example cannot convince anyone that Comodo has a good singnature detection.

We can see the detection from 7 hours ago (3 days after the sample was first seen in the wild ).

View attachment 287223
(.....) skipped AVs that detected the sample. The below AVs missed the sample:
View attachment 287224

Still Xcitium 95% of the time returns a verdict in under 45 seconds

 

[bazang]

Predicting the future for the next 50 years is virtually impossible.
One cannot be certain that there will be any future after 40 years. Let's hope for the opposite.

The future will be worse than today. It is not very difficult to make that determination.

 

[vitao]

If local signatures do not detect the file, it is checked against the cloud backend (cloud lookup). To maximize the detection with disabled cloud lookup, it might be necessary to use the full signatures locally.

but this will not bring any difference in detection, as anybody can see here:



Edit.: If somebody need, please, say so and I can create subtitles for this video, instead of you guys using the automatic ones...

 

[Andy Ful]

but this will not bring any difference in detection, as anybody can see here:



Edit.: If somebody need, please, say so and I can create subtitles for this video, instead of you guys using the automatic ones...

In your video, you showed, that for a few-day-old malware samples, the difference can be small. But, that is how the reduced set of signatures is selected. It probably does not contain less than few-hour-old and more than few-month-old malware.