New Update Introducing Comodo Internet Security 2027 V12.4.0.8170

[Digmor Crusher]

A next-gen reply.

Ok, now tell me what next- gen is.

 

[Andy Ful]

For now, the new version of CIS is only advertising EDR by old HIPS. Let's hope that this is the beginning of true changes.
The free version has an option to install only Comodo Firewall:

https://download.comodo.com/cis/download/installs/9090/standalone/cispremium_installer.exe

 

[vitao]

Nope.

Regards Eck

ok then..

 

[vitao]

Guys, just pay attention to the release notes the developer posted on the forum. He made it clear that the only changes are: swapping the word "HIPS" for "EDR," and changing the product name and version to CIS 2027 vxxx.xx.xx.xx.xx. Nothing else was modified beyond those two aspects.

In other words, all the 50+ bugs the community has been reporting for (at least) five years remain unresolved. All published CVEs remain unaddressed. The flaw allowing the auto-containment feature to be bypassed is still there, etc.

I’m going to test this "new" CIS live on my channel. Probably tonight at 10:30 PM (Brazil time). I plan to run two tests:

1) Discuss the so-called "new features" of this edition, perform the installation, check for any different options or changes in CIS, and test this new version against that old PoC that bypasses auto-containment and executes ransomware;

2) Download a bunch of zero-day malware samples, test the CIS antivirus module (just the AV—no auto-containment or firewall) against them, and then rerun the same test with the same malware, but this time using the firewall and auto-containment, without the AV module.

Before anyone starts hassling me: the PoC test will be done in two ways. First, I'll leave CIS at default settings (it should flag the PoC as malware). Then, I'll disable all CIS modules except auto-containment to see if the PoC executes or gets automatically isolated, prompting the user to decide whether to allow execution.

 

[Divine_Barakah]

Ok, now tell me what next- gen is.

Advertising updated terminology as a new big change.

 

[Divine_Barakah]

For now, the new version of CIS is only advertising EDR by old HIPS. Let's hope that this is the beginning of true changes.
The free version has an option to install only Comodo Firewall:

https://download.comodo.com/cis/download/installs/9090/standalone/cispremium_installer.exe

I've seen people installing the firewall alongside MD, but benefit that would bring over using hardened MD and a hardened OS using one of your tools?

 

[RoboMan]

Why are bugs not attended? Is the software so terribly coded that these serious bugs are unresolvable?

 

[Behold Eck]

Yea using a security product with legacy code is a great idea especially when it took them month to fix compatibility issues. They're just keeping Comodo "alive". They redirected to resources to Xcitium while sparing the bare minimum to " Maintain"CIS to "please" the fanboys.

Well at least it`s getting some sort of support if somewhat sparse at times but I`m not really too bothered so long as it works as intended,

Regards Eck

 

[Parkinsond]

I've seen people installing the firewall alongside MD, but benefit that would bring over using hardened MD and a hardened OS using one of your tools?

For me, any firewall which prompts before establishsing connection is better than W firewall with no notifications.
An alternative it to set rules for each potential exe or process which might be abused, but I find it less tight than prompts.

 

[Andy Ful]

I've seen people installing the firewall alongside MD, but benefit that would bring over using hardened MD and a hardened OS using one of your tools?

Some users prefer sandboxing over blocking.

 

[Shadowra]

I just finished editing the video. There's a lot to say about this version!
I won't say any more—see you tomorrow when it's posted!

 

[Harputlu]

I just finished editing the video. There's a lot to say about this version!
I won't say any more—see you tomorrow when it's posted!

At least give me a hint—is it good or bad?

 

[lokamoka820]

At least give me a hint—is it good or bad?

Please ask him via direct message; don't ruin the show.

 

[Zero Knowledge]

and what does this have to do with cis?

Something something drinking too much of the kool aid and fanboism. Read what I said not what I didn't.

Anyway if you like Comodo then cool, if you don't then cool but isn't this why we are on this forum is to talk a bout and debate security software and services?

If it's done in a civil way then cool, but if it's the and trolling that happened in the past then leave it be.

 

[Divine_Barakah]

Some users prefer sandboxing over blocking.

But as far as I understand, sandboxing won't help against data theft?

Edit:

But I believe Comodo does isolate the unknown process so that they cannot access real files, right? And that is different from Sandboxies for example where if you run an infostealer in the same session with let's say a browser, that would allow the info stealer

 

[Loyisa]

Still, you don't need to escape the containment, DLL hijacking Is All You Need.

 

[Divine_Barakah]

Still, you don't need to escape the containment, DLL hijacking Is All You Need.
View attachment 299022

So in this case the DLL was not auto contained?

 

[Loyisa]

So in this case the DLL was not auto contained?

DLL is basically not sandboxable

 

[Divine_Barakah]

So in this case the DLL was not auto contained?

Upon some research it seems that Comodo containment is triggered by excutables? Since the exe is digitally signed and trusted by Comodo it was allowed to run and then load the malicious DLL in its own memory space?

 

[Loyisa]

Upon some research it seems that Comodo containment is triggered by excutables? Since the exe is digitally signed and trusted by Comodo it was allowed to run and then load the malicious DLL in its own memory space?

Yes