Serious Discussion Three Unpatched Vulnerabilities Plague Comodo. Documented Online.

[Andy Ful]

Ten years ago, Comodo was pretty popular on MT. Users could tweak it to death, which happened sometimes due to overusing HIPS.
@cruelsister was probably the first MT member who showed a simpler, safer (for users), and still effective way of using Comodo.
She also put a lot of effort into testing her configuration and presenting results in a series of videos.
After ten years, this configuration is still very effective in the home environment. Even if currently there are some known weak points, they do not have much impact on overall protection.

 

[ForgottenSeer 114717]

Ten years ago, Comodo was pretty popular on MT. Users could tweak it to death, which happened sometimes due to overusing HIPS.
@cruelsister was probably the first MT member who showed a simpler, safer (for users), and still effective way of using Comodo.
She also put a lot of effort into testing her configuration and presenting results in a series of videos.
After ten years, this configuration is still very effective in the home environment. Even if currently there are some known weak points, they do not have much impact on overall protection.

The way that Comodo is managed and developed and Cruelsister's posting and participation style are always going to be a sore point for some. Particularly the way she avoids detailed engagement with others on security forums.

Without repeated exposure or interactions with a person face-to-face it is very difficult to truly determine the person's intent. So much of online posting can be misinterpreted. That's true across the entire internet.

I am not giving anyone a "pass," I'm just saying there are problems. Some people say that "perception is reality" and for them that is all the truth they need. For me, "perception is never reality." Time and time again after conducting an investigation what is reality is different than perception - if you're an investigator without an agenda, motive, or bias, and you assume nothing.

 

[Pico]

Ten years ago, Comodo was pretty popular on MT. Users could tweak it to death, which happened sometimes due to overusing HIPS.
@cruelsister was probably the first MT member who showed a simpler, safer (for users), and still effective way of using Comodo.
She also put a lot of effort into testing her configuration and presenting results in a series of videos.
After ten years, this configuration is still very effective in the home environment. Even if currently there are some known weak points, they do not have much impact on overall protection.

A configuration without IPv6 filtering enabled? You call that very effective?
Or not working CFW when using VPN?
And disable HIPS just to avoid that nasty bug?
Etc. etc.

 

[Andy Ful]

The way that Comodo is managed and developed and Cruelsister's posting and participation style are always going to be a sore point for some. Particularly the way she avoids detailed engagement with others on security forums.

Being different from you and me is not necessarily a disadvantage.

 

[Andy Ful]

A configuration without IPv6 filtering enabled? You call that very effective?
Or not working CFW when using VPN?
And disable HIPS just to avoid that nasty bug?
Etc. etc.

Yes, it is very effective in preventing malware at home. Of course, it is not for everyone, even with IPv6 filtering and VPN, HIPS + etc., working well.
For example, I stopped using Comodo (for good reasons) over 10 years ago.

 

[ForgottenSeer 114717]

Being different from you and me is not necessarily a disadvantage.

You and I don't care or mind, but others do. Some, I think, way too much.

A configuration without IPv6 filtering enabled? You call that very effective?
Or not working CFW when using VPN?
And disable HIPS just to avoid that nasty bug?
Etc. etc.

Comodo has no obligation to fix those things. That is what really matters. What a company is legally required to do. For people that disagree they should move on.

Comodo does not have any ethical or social responsibility where its software is concerned. All that matters is what is legally required. Until some government requires Comodo to take down CFW/CIS, then it can remain available as long as Melih wishes it to be available.

When Melih created CFW/CIS it was as an ideological showpiece software. His stated intent was never to make the product highly refined - or even to develop or maintain it past a certain point that he, himself, determined.

I am always going to default to what the EULA says: "OFFERED AS IS" and "USE AT YOUR OWN RISK."

Anyways, Comodo's problems are a moot point. Xcitium "staff" has stated that CFW/CIS are not a priority and not being developed further.

Most users that use Cruelsister configuration will be protected, despite the issues that you point out.

 

[simmerskool]

I am not trying to push off anyone from any platform,
It's just like marketing - when they start making claims like "better than..." "best...", "100%" and so on, there is a lawsuit.

IIRC (in the US) vendors can & do promote their product is the "best" -- legally permitted. Sue over that and you paid lawyers for nothing. An ethical attorney would not file that lawsuit in US. (of course times change, laws & practices change...)(& yes most of the lawyers I know are ethical -- but unfortunately... )

 

[Behold Eck]

CIS is still doing well according to AVlabs reports for April. Advanced In-The-Wild Malware Test Results For March 2025 » AVLab Cybersecurity Foundation

Just wondering if there`s no further development for CIS does that just mean no more signatures? I only used the firewall anyway as the auto sandboxing was the best feature.

No odds to me anyway as I`m having a bit of a "float around in Linux" at the moment.

Regards Eck

 

[ForgottenSeer 114717]

Just wondering if there`s no further development for CIS does that just mean no more signatures? I only used the firewall anyway as the auto sandboxing was the best feature.

Probably has not changed. However, as Melih stated many, many, many times the Comodo signatures are for old malware for the purpose of avoiding needless auto-sandboxing. But otherwise, signatures are not required because of Comodo's auto-containment.

That was how Comodo was designed, intended to function, but so many people could not or cannot wrap their heads around that - always complaining that Comodo needs better detection signatures.

 

[dmknght]

Hey there! I'm the researcher that found the RCE in Comodo! I didn't see this topic just until now. I want to fully break down about this (just for fun and to share techical details )
- Comodo doesn't have any intergrity check whatsoever. That means threat actor can easily create fake update server. There are other defense mechanisms but can be bypassed to make a full chain attack.
- The 1 mechaism is binary signing. Comodo verifies ANY PE file. Funny enough, I just used powershell script to bypass this. That was hilarious.
- The connection is using HTTPS. However, update client of Comodo ignore cert check. That means any HTTPS server with invalid certificate is accepted. In fact, Comodo has official changelog somewhere that said update started using HTTPS from 2020.
- The exploit is in LAN RCE. But since that's a Desktop Application, it's dangerous enough.
- Update client is also vulnerable to Arbitrary Command Execution (yes it executes commands from server) and Path Traversal. There are serveral ways to create a full chain attack. But the Command Execution is the most dangerous one because it executes command as a sub-process of cmdagent.exe, the service of Comodo. Ofc this one is trusted by Comodo.
- The other attack chains write file on disk. After that, executed payload runs under Comodo's sandbox. However, this so-called sandbox didn't prevent many post-exploit modules like gain NT-SYSTEM nor hashdump.
- There were no response from Comodo. After quick google search, there was a researcher found a vulnerability in Comodo and he didn't have any response either. The worst part is, I saw very misinformation comment on Comodo forum (cruelsister) and I tried register in Comodo forum. Comodo gave me 502 error everytime (lol).
- Comodo user can enable HIPS (AV) and anti-ARP Spoofing (Firewall). Both options are not enabled by default.

That was a huge disappoinment about Comodo, really. I really like Comodo when I started learning Cybersecurity.

 

[dmknght]

Regarding:

Failure 1: Trusting the Network. The inability to validate a simple SSL certificate for its own updates is staggering. This is Security 101. It's like a bank building a vault with a solid steel door but leaving the key under the mat.
Failure 2: Blindly Executing Instructions. The updater then blindly trusts the manifest file it receives. Allowing an <exec> tag to run arbitrary commands with SYSTEM privileges is a colossal oversight. It effectively gives a potential attacker a "God Mode" remote control for the entire PC.
Failure 3: Ignoring the Vendor's Responsibility. The fact that Comodo is unresponsive to the disclosure is perhaps the most damning part. It signals that the product is likely unmaintained and that users are on their own.

Failure 4: Doesn't do intergrity check. In fact, better vendors like Kaspersky, BitDefender, Avast has this mechanism to prevent untrusted update over internet. Update server always have serveral text files to tells client if server has newer version and other details about later version. In short, the text files (I'd like to call manifest files) answered some questions:
- Is there a new update?
- Files should be downloaded (patched)?
- Files should be removed?
- ... etc
Threat actor can manipulate these files to create "fake answers": "hey this file is a new version. Download and execute it!". To prevent this, each vendor (I mentioned above) created custom mechanism to verify manifest files. For example, the screenshot bellow is the signed hash of Avast.

 

[dmknght]

To me, it doesn't matter if she's here or not, how and what she does and does not do. She's always had an annoying element to her videos and comments at times and I just ignored it. I know others will disagree, but that is the wonderful thing about it all - everybody can have their own opinions and perspectives. Where I take issue is with Decopi always calling Cruelsister, me, and others "immoral" because none of us are. MT staff let's him get away with it, and it is wrong but at the end of the day there's nothing that can be done about it. So when he rage posts, I respond like a broken record.

It's the same as Cruelsister's tactic. If someone says something she doesn't like about Comodo, one can expect her to make "response" videos.

To me, this "tactic" is dangerous! It creates misconception of "this is vulnerable but this is fine". Sure, some mitigation methods help. However, it doesn't magically make vulnerabilities disappear. This is a denial method to defense vendor from fixing their products. In real world scenarios, threat actor would combine exploits with other bypass mechanism to make a full chain attack that gains machine control and ofc bypasses defense mechanism. It's like 2 faces of a coin. 1 face is like: "you are safe if you do it correctly", the other face is "this product is insecure so users must hardening by their own hands".

And to me, a free product is not an excuse for poorly maintained / developed by developers. AV products meant to work with untrusted files (and untrusted data) every second while using high system's privilege. Any small mistake can create a huge disaster.

 

[dmknght]

Question: If I disable app update plus disable signature updates. ( since app is unmaintained, and their av is hopelessly inadequate )
Then one would not be affected by the dns vuln and the 2 manifest vuln's mentioned in post #1.

Then, mark Kaspersky Labs as untrusted in File Rating>Vendors as suggested by Andy Ful to bypass his attack.

Then set Untrusted AutoContainment rules to Block instead of Run Virtually, as mentioned in CIS was obliterated by an exploit.

In addition, disable the av and use Windows Defender.



I stand to gain proven strong auto-containment (shadowra test) and a flexible HIPS (it can block any folder, file, registry). Or am I wrong ?

If you can completely disable update, you won't be exploited by the ARP spoofing that redirects your update request to untrusted update server. But disabling update is againsts the point of "update latest signatures of cyber threats". Enable anti-ARP Spoofing in Firewall module is definitely better.

Block instead of Run Virtually sounds good. But it won't help against the Remote OS Command Execution (IMO). This mechanism (untrusted autocointainer) runs untrusted file. Meanwhile this Remote OS Command Execution doesn't drop file but executes remotely using Comodo itself. In attack chain that I discovered, there are 3 different routines to exploit:
- Deliver malicious file then execute file when update completes.
- Path traversal. Payload runs after reboot as logon user's privilege.
- Remote OS command execution as highest privilege --> The most dangerous one, trusted by Comodo.

Perhap the safest way is to not use Comodo.

 

[Andy Ful]

Perhap the safest way is to not use Comodo.

Hi,
Thanks for sharing the details of the vulnerabilities.
Technically, the attacker can bypass Comodo by exploiting the vulnerabilities mentioned by you and a few other methods of abusing trusted executables (we have discussed this extensively on MT). Therefore, I agree that in targeted attacks, Comodo's protection will not pose a significant challenge to a motivated hacker. I would not recommend it in Enterprises.

However, in widespread attacks on home users, all those vulnerabilities will not be exploited, except for rare accidental events. This follows from the low popularity of Comodo among home users. It is more probable that popular AV could be bypassed instead of Comodo. So, I could still recommend Comodo to home users if they like such protection based on autocontainment. Comodo will not be worse than the top home AVs. My recommendation would be strictly practical - I do not question the validity of your posts.

 

[Andy Ful]

dmknght,

It would be interesting to test Xcitium against those vulnerabilities.

 

[dmknght]

Hi,
Thanks for sharing the details of the vulnerabilities.
Technically, the attacker can bypass Comodo by exploiting the vulnerabilities mentioned by you and a few other methods of abusing trusted executables (we have discussed this extensively on MT). Therefore, I agree that in targeted attacks, Comodo's protection will not pose a significant challenge to a motivated hacker. I would not recommend it in Enterprises.

However, in widespread attacks on home users, all those vulnerabilities will not be exploited, except for rare accidental events. This follows from the low popularity of Comodo among home users. It is more probable that popular AV could be bypassed instead of Comodo. So, I could still recommend Comodo to home users if they like such protection based on autocontainment. Comodo will not be worse than the top home AVs. My recommendation would be strictly practical - I do not question the validity of your posts.

Hello! That was a great statement, really! When I said "to not use comodo", i didn't mean anything against it but based on the original point "how to stay safe against this exploit" and the fact that Comodo poorly managed their product and communications with users / security researchers. It sounds kinda wrong when take it out of context. That was my bad because I choosed wrong words .

I would like to break down "Comodo's protection will not pose a significant challenge to a motivated hacker" a bit:
- Bypassing detection / protection is not something new. All vendors are having hard time with this. That's why we have so many new technologies like Cloud Detection and Machine Learning. But in other hand, bypass detection must combine with other techniques to infect victim's machine.
- Vulnerabilities like Comodo's RCE is a dangerous open gate allows attacker to control victim's system remotely. It's software vulnerability so it's a different category compares to bypass detection although both shares the same impact in this very topic. It's like "you hired a guard that's the double agent" versus "the guard failed to protect you".

I have no argument against the later part of your comment. It's just a different perspective based on attack scenarios. I didnt spend time to analysis and bypass or exploit the autocontainer. But in the other hand, I wouldn't trust this feature either. It based on 2 facts:
- This feature can be bypassed or exploited. In fact, there was 1 exploit that gains highest privilege from this auto-sandbox feature (CVE-2019-3969). It was a sandbox escape + privilege escalation exploit. Ofc based on the changelogs, Comodo fixed it. But can we believe that Comodo fixed all problems based on current maintaining state of Comodo?
- Auto container is more or less a "marketing point". Some other AV vendors has similar mechanism (inject DLL, function hooking, ...) to monitor processes. I still remember Kaspersky had "Safe run" feature and Avast has a "execute in sandbox" which should works similar. However, both vendors I mentioned dropped the feature. I don't know why but I think this mechanic is not worth to keep.

I haven't tried Xcitium products. I couldn't find any free version. But based on the other comment that showed screenshot, the product (in the screenshot) looks like Comodo pro before 2025 but renamed a bit. So I would not surprised if the product is (or was) vulnerable. In the other hand, I'm not really interested in testing Xcitium. A bug bounty program could pay 3k-5k USD or even more for a RCE like this one. I don't think giving full research's result to a company that's making profits of their products is a good idea, especially I'm very poor )

 

[Andy Ful]

I haven't tried Xcitium products. I couldn't find any free version. But based on the other comment that showed screenshot, the product (in the screenshot) looks like Comodo pro before 2025 but renamed a bit.

Xcitium has many similar features to Comodo, but also some important settings that are not included in Comodo. One of them is preventing trusted executables from loading unknown DLLs. If the vulnerabilities mentioned by you were valid for Xcitium, this would be a real danger for the Enterprise users. For home users, those vulnerabilities are theoretical news, just like the exploits I created last year.

 

[Trident]

The usage of abandoned and neglected software, even more so when the said software has kernel access and components dealing with malicious code, automatically parsing all files as soon as they are written and so on, is not recommended in any environment, for any user.

Sometimes in enterprise environments, there are no options, the usage of such software is necessary because transition to a supported one is linked to very high costs and operational downtimes.

But in the case of Comodo, users can easily uninstall and install software from 10-15 other vendors. The whole process rakes 3-5 minutes.
There is no logical reason to use Comodo.

 

[stonjean633]

The usage of abandoned and neglected software, even more so when the said software has kernel access and components dealing with malicious code, automatically parsing all files as soon as they are written and so on, is not recommended in any environment, for any user.

Sometimes in enterprise environments, there are no options, the usage of such software is necessary because transition to a supported one is linked to very high costs and operational downtimes.

But in the case of Comodo, users can easily uninstall and install software from 10-15 other vendors. The whole process rakes 3-5 minutes.
There is no logical reason to use Comodo.

Well explained.

 

[Trident]

Comodo is being put in maintenance mode and that’s even a gentle and generous way to call it. Comodo went for 3.5 years without any updates whatsoever. The new version was released merely with a few cosmetic enhancements, useless TDT integration (as VirusCope updates are received as part of a whole product update) and with unpatched vulnerabilities.

It is clear that the software is a legacy product of a very little priority, not even providing basic maintenance, let alone new features and innovation. They’ve shifted their energy and focus to Xcitium and Comodo receives enough attention just not to vanish as a brand. If the developers hardly remember a piece of software, it’s time for users to forget about it too.