Actually this video is an exploit caused by Microsoft DDE feature. Which most Antivirus had to cover (but most did not) when Microsoft Windows Defender fail to cover...well, I heard about Windows Defender ATP can protect from such exploit..but yeay...its Microsoft Fault...not the AV.
Talking about ETHICAL, I did not wish to post videos on this, but when one COMODO user curiously asked me to try bypass, and I did, I did not expect to get bashed. So its my fault ? LOL. I better advice these users, to test it for themselves rather than depending on videos alone. Sometimes it proves nothing to download samples and just double click which means nothing to me. To really test the limit of an antivirus is to penetrate and go against the will of the Antivirus in any WORST situation and configurations. I did that to my own Antivirus and it failed miserably. Notified my AV vendor and they improve the detection. Few months later, tested again, found another loopholes. I need to do this because I must make sure that my AV are up to date and ready to take on the modern and advanced malware. So if you guys need my help to test, I will but if I know you are going to bash me, I'd better tell you to do it yourself. I dont do videos to get bashed. That COMODO user might have already notified COMODO which is good. Else, he will always believe that COMODO AV is the best and will never get breached due to the HIPS and Containment technology (FALSE SENSE OF SECURITY). I myself IMPRESSED with the technology exist in COMODO AV, but again, we must not underestimate how hackers, malware and ransomware authors are updating themselves with state of the art bypassing and maintaining persistence techniques. Just look at the latest ESCAPE TECHNIQUE from sandboxing technology. Now is even worst, escaping VMs and attack the physical host in which I am exploring that right now. I realized I need to make videos to raise the awareness you have the right to demand from your AV vendors especially for the paid services and subscriptions. My videos might not have the best example of "phishing" to trick users to click, because I am not focusing on that. But the tricks that I know might be used by threat actors to send "powerful" and "convincing" email or through websites to trick users to download and click and eventually bypassed your AV. In real world, you might have HIPS and ANTI-EXE configured to PARANOID mode, but you will also still need to allow MS Word to run. Yep, it might catches the executables download from VBA scriptings, powershell, JS...but how does it handles scripts that contains only COPY-PASTE instructions that copies all your saved credentials from Chrome, Opera, MS Edge, Firefox - copied to a pendrive silently? Bet you have never though of this...so I did get a working scripts just to do that...and none of the AV can detect it..bcoz it does not contain malicious codes...just COPY and PASTE. i tried it on my own favorite AV...faile...Kaspersky - FAIL. Whatever paranoid mode, it is invisible. paranoid mode does not prompts a user when someone right click - copy and paste.
