- Content source
- https://youtu.be/2aQS22ZuR8c
Can Comodo's Auto-Containment be bypassed?
The Comodo's challenge.
- Thread starter Andy Ful
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
I made this video to show what most MT already know. If the attacker can get high privileges, then the protection via kernel drivers can be compromised. I intentionally chose Comodo Antivirus with Auto-Containment, because it is a very strong protection. The method used in the video is documented, but I did not see it in the wild. It does not rely on using vulnerable drivers or abusing PPL.
Hi @Andy Ful
not that it's crucial because the damage was already done, but would clicking on the Comodo "Fix It!" alert have aslo restarted the Comodo stopped service, or no?
not that it's crucial because the damage was already done, but would clicking on the Comodo "Fix It!" alert have aslo restarted the Comodo stopped service, or no?
Would it have made any difference if HIPS was enabled?
Would an HIPS alert be generated in this attack to alert the user that some application is tampering with the service?
Would an HIPS alert be generated in this attack to alert the user that some application is tampering with the service?
They are not superior, they are necessary to allow the self-protection to observe kernel-level system calls, as well as suspicious memory manipulations and patching that can allow anything, from unhooking user-mode processes, thus tampering with behavioural blocking, to completely terminating security services.
That being said, Comodo kernel mode self-protection drivers are not receiving the necessary maintenance they need for the application to provide a safe, secure and reliable service. Others may have this flaw but they will fix it quickly, Comodo won’t. God knows how other services are designed, do they use the necessary wrappers and memory integrity settings to keep operation “sanitary” and so on and so on. You wanna use hobby projects — these are your hobby projects. Always trust professionals.
Last edited:
Cruelsister's config, sandbox is set to "Restricted" not "Untrusted". But I don't know if it would make any difference.
Thanks!
Thanks!
Untrusted is the maximum restriction and allows very limited access rights compared to Restricted.
@Andy Ful
1. From memory, some versions of Comodo had issues in VirtualBox. I don't know about the current stable and beta builds.
2. It seems you tested on Windows 11. It would have been better to test the latest beta build, which fully supports Windows 11.
3. I don't remember if Comodo notifies, but the configuration change to Proactive requires a system restart for proper functioning. I hope you restarted the system.
@Andy Ful Nice test of Comodo. It's impressive seeing that the Containment can be disabled by a cmd file.
My thoughts on watching this are that if a unknown file executed a cmd or svchost or any other program that could execute the code to disable the virtualization that both the unknown file an any process or file launched by that unknown file would be Contained. Sure, a user can run that cmd line they create on their own but do we have an example of malware or unknown file executing that code and successfully disabling containment?
I'm guessing most people would have clicked Fix to rectify the Comodo issue but useful to know that it's possible to disable the service and that Comodo doesn't pick this up with it's behaviour features. Hmm.
My thoughts on watching this are that if a unknown file executed a cmd or svchost or any other program that could execute the code to disable the virtualization that both the unknown file an any process or file launched by that unknown file would be Contained. Sure, a user can run that cmd line they create on their own but do we have an example of malware or unknown file executing that code and successfully disabling containment?
I'm guessing most people would have clicked Fix to rectify the Comodo issue but useful to know that it's possible to disable the service and that Comodo doesn't pick this up with it's behaviour features. Hmm.
The demo video looks to be that of a user thinking they are manually installing a legitimate program/app, and they have administrative rights to elevate the malicious file I_am_nice_and_clean.dat (LOL). In this case the auto-containment is bypassed innocently by the user. Maybe there's more to the malicious chain reaction than just the dat file(??), but that was all we can see.
Btw, I'm guessing big box anti-malware products could be bypassed in similar fashion with a customized bypass manually elevated by the user, or am I wrong in this assumption?
F
ForgottenSeer 109138
This POC is no different than Cruelsis examples as she modifies them to bypass other products claiming them to be subpar.
Yes, if HIPS is not configured to allow cmd[.]exe.
No application is tampering with the service. The attack is fileless after Windows restart.
Untrusted is the most restrictive setting.
- The attack works also on the real system.
- The attack works on Windows 10+.
- Yes. Furthermore, you can see 2 system restarts on the video.
I used a shortcut to avoid Comodo's scripting protection.
I did not see this attack vector in the wild. It is probably not dangerous at home, especially for Comodo.
Comodo is still one of the strongest protections, especially in the tested settings. This attack vector does not change my opinion.
I think so. But as with many such attacks, this attack vector can be stopped via behavior-based detections after the first successful campaign.
Xcitium is the best AVI think so. But as with many such attacks, this attack vector can be stopped via behavior-based detections after the first successful campaign.
It was not my intention to show a real attack in the video. It is also improbable that the in-te-wild attack would look like in the video.
Of course, the attacker could use social engineering methods to convince & instruct the user, similarly to the attacks via documents with macros.
But it is more probable that this attack vector could be a part of a multistage attack in the Enterprises.
Was the service stopped prior the reboot by the fileless attack (a pending service stop operation) or stopped by the fileless attack after the reboot? How would the fileless attack survive the reboot?
If you watch the video carefully, I show that the service is not stopped before the Windows restart.
There are many fileless persistence methods. The most known is hiding the malicious code in the Registry (not used in the video).
You may also like...
-
-
This ransomware bypass every antivirus and removes antivirus- Started by HydraDragonAntivirus
- Replies: 59
-
-
Why Don’t Major AV Vendors Use Auto-Containment Like Comodo?
- Started by NoveyBoy
- Replies: 23
-
Protect Yourself From the macOS Flaw that Bypasses Apple Privacy Controls- Started by lokamoka820
- Replies: 1