App Review Comodo's killer.

[rashmi]

She probably had in mind the contained/blocked applications.

If an Unrecognized application is not contained (like DLL), this restriction does not work.

I didn't mean it was CruelSister's claim, as she's already addressed it in this thread.

Serious Discussion - Comodo Containment "Restricted" Restriction Level

For Containment, some Comodo users opt for @cruelsister's configuration, which primarily includes Proactive Configuration + Restricted (Restriction Level). According to @cruelsister, the "restricted" level prevents network connections from contained programs. Comodo users who use CruelConfig...

malwaretips.com

 

[Andy Ful]

I did not name my "conclusion" post the conclusion, so I do it now more clearly.

Suggestions for MT members who want to use CIS on their computers.

1. It is OK to use the @cruelsister settings but be cautious when opening documents with macros or files from disk images, flash drives, and archives. Those files are common attack vectors for abusing Trusted applications and bypassing CIS protection.
2. One can maximize the protection against abusing Trusted applications by:
   - using the 7-Zip trick for disk images and archives,
   - disabling execution from flash drives,
   - disabling macros in office applications,
   - tweaking Comodo's Script Analysis settings.

Administrators in organizations (small businesses) can consider

• using SUA,
• disabling macros in office documents,
• tweaking Comodo's Script Analysis settings,
• applying the @cruelsister settings (silent setup) with disabled cloud lookup and reduced Trusted Vendors list.
  Only selected signed (also self-signed) applications will be allowed when the vendors are included on the reduced Trusted Vendors list.
  Other applications will be contained. Such vendors like Microsoft and Comodo must be included on that list.

 

[Nikola Milanovic]

I did not name my "conclusion" post the conclusion, so I do it now more clearly.

Suggestions for MT members who want to use CIS on their computers.

1. It is OK to use the @cruelsister settings but be cautious when opening documents with macros or files from disk images, flash drives, and archives. Those files are common attack vectors for abusing Trusted applications and bypassing CIS protection.
2. One can maximize the protection against abusing Trusted applications by:
   - using the 7-Zip trick for disk images and archives,
   - disabling execution from flash drives,
   - disabling macros in office applications,
   - tweaking Comodo's Script Analysis settings.

Administrators in organizations (small businesses) can consider

• using SUA,
• disabling macros in office documents,
• tweaking Comodo's Script Analysis settings,
• applying the @cruelsister settings (silent setup) with disabled cloud lookup and reduced Trusted Vendors list.
  Only selected signed (also self-signed) applications will be allowed when the vendors are included on the reduced Trusted Vendors list.
  Other applications will be contained. Such vendors like Microsoft and Comodo must be included on that list.

If u disable Cloud then how will Xcitium rate the files as Malicious or Safe?
Will it be Unknown forever?