App Review The Comodo's challenge.

[Andy Ful]

It's somewhat paradoxical that the attack without the UAC bypass might be easier to execute against home users. Most home users would kindly ignore the UAC prompt and run the file. Anyway, several more popular attacks make this particular one unlikely at home.

 

[PALTO01]

Comodo is blocking users from there forums who is trying to give suggestions and feedbacks for the improvement of the antivirus engine and realtime protection and overall protections for there upcoming CIS 2024 stable release, really concerning and not good at all. Recently some of my friends got blocked. They are arguing a lot when suggestions were given to them for improving the antivirus and then banning .

 

[Sandbox Breaker]

Comodo is blocking users from there forums who is trying to give suggestions and feedbacks for the improvement of the antivirus engine and realtime protection and overall protections for there upcoming CIS 2024 stable release, really concerning and not good at all. Recently some of my friends got blocked. They are arguing a lot when suggestions were given to them for improving the antivirus and then banning .

They probably want users to think it's all good lol

 

[rashmi]

It's good they are removing spam and banning spammers. Some were polluting the beta thread with unrelated stuff, while others were repeating their nonsense.

 

[PALTO01]

They probably want users to think it's all good lol

Which is not the case in real world as we all have seen how miserably comodo antivirus failing in terms of the antivirus engine and signatures in various tests, also they don't have any proper web and url filtering protection and the firewall component too lacks the presence of a proper network intrusion detection/prevention module and the firewall component itself hasn't been updated for ages which is very very important thing and is present in almost all major security software vendors be it kaspersky or norton or eset or avast or avg that's that. And when someone highlights this critical points to them on there forum they blocks that user, this kind of behaviour looks extremely weird and strange itself from there end.

 

[Andy Ful]

Guys,

This thread is not about several possible Comodo issues, but about tampering with antimalware drivers and protected services.
Please, we should not stray from the subject too much.

 

[PALTO01]

Guys,

This thread is not about several possible Comodo issues, but about tampering with antimalware drivers and protected services.
Please, we should not stray from the subject too much.

ok

 

[Sephirothnight]

Bonjour,

Rien de nouveau sur la censure du forum comodo et ses pratiques forcément très "politiquement correctes", une histoire avec un ancien Admin "Shaoran" de mémoire, qui avait démontré avec très peu de lignes de code, la fermeture de comodo et l'infection, ça faisait longtemps, comodo version 4 Je pense, en tout cas... L'équipe de comodo a-t-elle vu ce test d'Andy Ful et envisage-t-elle de faire quelque chose ? Merci.

 

[vitao]

Can Comodo's Auto-Containment be bypassed?

Hello Andy.

Would You mind sharing the files so I can test it and maybe do it live on my channel? im curious as im always trying to find something that could bypass cis containment but i always fail on it. If You dont see any problems it would be kind of You to share it. Maybe in private msg if You prefer?

 

[Andy Ful]

Hello Andy.

Would You mind sharing the files so I can test it and maybe do it live on my channel? im curious as im always trying to find something that could bypass cis containment but i always fail on it. If You dont see any problems it would be kind of You to share it. Maybe in private msg if You prefer?

Hi @vitao,
I shared the attack method only with the AV vendors (Kaspersky, Microsoft, etc.).
I do not plan to share it further except if it will be seen in the wild.
I do not think that this method can become popular in attacks on home users. The gain of using it is related to Enterprises.

 

[Vitali Ortzi]

Hi @vitao,
I shared the attack method only with the AV vendors (Kaspersky, Microsoft, etc.).
I do not plan to share it further except if it will be seen in the wild.
I do not think that this method can become popular in attacks on home users. The gain of using it is related to Enterprises.

It worked on comodo set to restricted too ? Or just untrusted?

 

[rashmi]

It worked on comodo set to restricted too ? Or just untrusted?

Response of @ozer.metin (Comodo Staff- Chief Innovation and Technology Officer)
https://malwaretips.com/threads/the-comodos-challenge.129472/post-1078569

 

[Andy Ful]

Response of @ozer.metin (Comodo Staff- Chief Innovation and Technology Officer)
App Review - The Comodo's challenge.

The response is related to one of many possible variants only. Slightly modified variants do not use anything that could be blocked by HIPS:

App Review - Comodo's challenge part 2.

This video is a continuation of the previous one. I used the default settings of Internet Security configuration + enabled HIPS + most restrictive Auto-Containment for all Unrecognized files. I also confirmed that the Comodo Firewall cannot be fixed and the stopped Comodo's service does not work...

malwaretips.com

 

[Andy Ful]

It worked on comodo set to restricted too ? Or just untrusted?

It does not matter because nothing was contained. The attack uses only legitimate executables.

 

[Vitali Ortzi]

It does not matter because nothing was contained. The attack uses only legitimate executables.

I'm not sure how it works but is there anything you can do like setting exploit guard to comodo core components (no idea how it works so unsure if any harding by exploit guard might help )
Or maybe some srp rule
Like is there anything someone can do without a vendor patch to deal with this bypass of the driver ?
And what vendors do you believe cam protect against this and maybe future variants are at least responsive enough to care about an advanced attack vector like shown here

 

[Andy Ful]

I'm not sure how it works but is there anything you can do like setting exploit guard to comodo core components (no idea how it works so unsure if any harding by exploit guard might help )
Or maybe some srp rule

You can use SRP to block shortcuts in UserSpace (like in H_C, WHHLight, or SWH). But, most AVs can be bypassed also without using shortcuts.
Anyway, it would be much harder to bypass Comodo without using a shortcut.

 

[Vitali Ortzi]

You can use SRP to block shortcuts in UserSpace (like in H_C, WHHLight, or SWH). But, most AVs can be bypassed also without using shortcuts.
Anyway, it would be much harder to bypass Comodo without using a shortcut.

Is there any vendors that hardened the driver to be able to deal with this attack or does Microsoft need to create some SDK to allow further hardening to allow av software drivers to be protected against some of these advanced attacks

Although this is only a specific it would be interesting to know which vendors could deal with this attack

 

[ErzCrz]

It wasn't blocked because cmd embedded code detection under Script Analysis is toggled off by default due to quite a few FPs. Thankfully, you can harden your system with @Andy Ful 's tools along side CIS/CF but that's overkill. CyberLock blocked the action which I bought this year. I'm on a CIS/CF hiatus waiting on Certificate issue to be resolved.

 

[Andy Ful]

Is there any vendors that hardened the driver to be able to deal with this attack or does Microsoft need to create some SDK to allow further hardening to allow av software drivers to be protected against some of these advanced attacks

Although this is only a specific it would be interesting to know which vendors could deal with this attack

The driver cannot be hardened to avoid the attack. I cannot give more details.

 

[Andy Ful]

It wasn't blocked because cmd embedded code detection under Script Analysis is toggled off by default due to quite a few FPs.

Although I used CMD in one particular variant, the modified attack can bypass Comodo with all options related to embedded code detection.

App Review - Comodo's challenge part 2.

Comodo HIPS can be a strong protection, but such strong protection layers are hardly tolerated by the OS in Windows 11 , and sometimes even in Windows 10.

malwaretips.com