Serious Discussion Three Unpatched Vulnerabilities Plague Comodo. Documented Online.

[ForgottenSeer 114717]

So my post is relevant. What's your problem? In your eyes, I use vulnerable and outdated software, even though alternatives exist. For that reason alone, I can't take your post seriously.
Your post is LoL for me, because:
- And I dealt with a lot of sensitive data and data exchange (including my own). I never received any complaints.
- Comodo ran as a security program on all computers and laptops in my PC life
- Windows was the OS on all of them, in almost all its versions
- I never had viruses, ransomware, Trojans, or anything else on any of them
- Even in my early years, Comodo's inadequacies were pointed out (so nothing new)
- Comodo was recommended to me back then by an IT specialist (I've written about this before) who was responsible for security at one of the largest companies in my country, where he still is today

A security program is like a protective vest or a firewall. Over all these decades, I should have been caught off guard by Comodo's vulnerability at some point. I wasn't. Now we're on the topic. If I had been recommended CyberGhost back then (it's been around for a long time too) and had had this experience with it, I would write the same thing.

If a protective wall has been able to protect a city from an attack until now, why should it be torn down? But maybe I'm too uninteresting for hackers. That could be the case, and that's fine, too.

So I can't make any sense of your post at all. My bank account remained untouched, all my PCs and laptops, and there were quite a few of them by now, with all versions of Windows, remained protected. What more could I want, and why do you think I now have doubts about Comodo's protective effectiveness?

I only wrote that I'm not a programmer because I can't come up with any evidence or possibilities of where Comodo has its weaknesses, as some here can, and especially because they never appeared on my devices. And I was looking, believe me, for Comodo users whose bank accounts were emptied, whose identities were stolen, who were blackmailed with ransomware, whose computers were misused for criminal purposes – I couldn't find any. Not even in the Comodo forum, where that would be the first port of call to show how someone got into serious trouble despite using Comodo. All the nice comparisons don't help me. My comparison is simply my experience.

I can't prove that a doctor made a wrong diagnosis just because I know what my blood pressure should be. I don't understand why you didn't understand that.

Again, I'm really not trying to defend Comodo; quite the opposite, and I've read better responses to my post than yours. I considered Norton 360, but I feel a bit like J. Bond, who was always happy with his Beretta.

Again, I'm not defending Comodo. On the contrary, I'm looking for security, which is my priority, and @cruelsister was and is more convincing in this regard and was able to reduce my doubts considerably.

I also have a comparison:

If I, as a police officer, wear a body armor and have never been injured in my 25 years of service, then I don't care at all if people say:

Maybe you were never shot at

Maybe you didn't even notice you were hit

Maybe you were just lucky so far

There are much better body armor now

Sure, the weapons are also getting "better" and can penetrate the body armor.

Three times, Comodo warned me to stop working because another computer was trying to tamper with my computer, and Comodo stopped my internet connection and told me to delete the remote software (in essence). That was just a short time ago. I know where it came from in one attempt, but not in the others. I was hit, but the body armor protected me. not invented by me.

Thanks for the answers.

It's not my fault that I've been spared so far.

You have the right to use and do as you wish. It is your system(s). It is your data. It is your finances. It is your risk(s).

You do not have to justify anything.

It is strange that other people are so bothered by what you use and do, even though those people have nothing to do with it - and it will never affect them.

 

[dmknght]

Of course, people can criticize and complain as they wish, but doing so will never bring any positive change to Comodo (or Xcitium).

If one looks at the Comodo/Xcitium history, this is not difficult to understand.

I think all the disagreements and fighting about Comodo and/or Xcitium are 100% wasted time and effort.

Yup all my comments on here based on the fact that I discovered vulnerabilities in Comodo. And ofc beside the fact that Comodo didn't fix their product, fanboyz keep defending it using either misleading comparison or survivorship bias tactic to say "it's not that dangerous". I couldn't care less, really.

 

[ForgottenSeer 114717]

Comodo as an "abandoned project", is rather a probable hypothesis than a fact.

Whatever one labels it, it sure ain't routinely developed software.

At the very least, at this point in time it is not improper or incorrect to label it, at the very least, "pseudo-abandonware."

None of us know what Melih will decide to do with Comodo. While it is possible that he will "resurrect" the CIS/CFW, given hist statements and behaviors that is extremely unlikely. Melih does not believe in, nor has he ever used, dedicated product developer teams. He uses a single pool of developers that get pushed around temporarily from project to project as Melih and the other company executives see fit. Furthermore, he is OK with bugs. Then he is perfectly OK with the current state of CIS/CFW.

Combine that with $0 revenue for CIS/CFW, and all hope is lost.

Perhaps someone here can play and win the global lottery, then buy CIS/CFW from Melih, start their own company to "fix" that software, and put an end, once and for all, to the never-ending ridiculous complaints about Comodo.

 

[ForgottenSeer 114717]

And ofc beside the fact that Comodo didn't fix their product

It is almost a 100% certainty that Comodo will never fix the software because 1) there are no developers within Comodo available to do so, and 2) there is no benefit to the company by fixing the software.

fanboyz keep defending it using either misleading comparison or survivorship bias tactic to say "it's not that dangerous".

I've read posts and it appears that in many instances they are not native English speakers. So they do not articulate and explain what they mean very well.

My interpretation, based upon numerous posts justifying use of Comodo or countering any criticism across many threads, even though they state or phrase their stuff rather unclearly or illogically, is that what they're really saying is "I think the risk of danger from using Comodo is very low. Ergo, I use it and shall continue to use it."

Well, OK then. Better them than me.

 

[Andy Ful]

It is almost a 100% certainty that Comodo will never fix the software because 1) there are no developers within Comodo available to do so, and 2) there is no benefit to the company by fixing the software.

That probably depends on the vulnerability. The last sandbox bypass reported by "@Loyisa" was fixed in a few months this year.
The vendor just showed that the sandbox vulnerabilities may be crucial both for Xcitium and Comodo.

 

[ForgottenSeer 114717]

That probably depends on the vulnerability. The last sandbox bypass reported by @Loyisa was fixed in a few months this year.
The sandbox is crucial for Xcitium and Comodo.

I agree, but we can all agree that Melih's perspectives about maintaining software is not what most in the industry practice or consider an "acceptable" standard.

I don't think that will ever change as long as Melih owns the products.

Is Melih wrong? I do not think so. It's his product and he can do whatever he wants. The market will be the judge of Comodo/Xcitium. And the market has weighed and measured Comodo and found it lacking. It appeals to a small cohort of users in meatspace that use it for various reasons.

Nobody ever addresses this critical fact about Comodo - Melih created it for his specific ideological agenda. He stated many times that he had no intention whatsoever of EVER doing what other software publishers do (including development and maintenance of the software) nor making Comodo software refined and polished. This is very important to understand, but except for me, I know of no one else that ever mentions this critically important fact when discussing Comodo.

Stated another way, to Melih his ideology is of utmost importance. Furthering his ideological agenda supersedes any problems with the software. Any complaints about his products are irrelevant to him as a matter of his routine, dismissive responses to criticisms as his ideological campaign is far more important. That, and the fact that he said multiple times "I give the software away for free. I pay for it. The money that created and supports the software is out of my own pocket. Nobody else provides funds for these projects. There is no revenue stream to support it. If anyone does not like my software, then I'd prefer they use something else - Please!!" (paraphrase by aggregation).

Melih's ideology explains a lot about Comodo software.

 

[Andy Ful]

These guy must be troll.

You posted this just after my post. ???????

 

[Andy Ful]

I agree, but we can all agree that Melih's perspectives about maintaining software is not what most in the industry practice or consider an "acceptable" standard.

Probably, yes. It is a very practical and minimalistic perspective, focused on auto-containment.

 

[Behold Eck]

My interpretation, based upon numerous posts justifying use of Comodo or countering any criticism across many threads, even though they state or phrase their stuff rather unclearly or illogically, is that what they're really saying is "I think the risk of danger from using Comodo is very low. Ergo, I use it and shall continue to use it."

CFW is free, light and still makes a good contribution to anyones security setup despite suffering a few obscure bypasses. That`s why people cintinue to use it. Do you really think these tests are real world scenarios? It`s the end users habits in most cases that determine whether or not they get infected and not the particular AV that they`re running.

There might even be some cross fertilisation, as it were, between Xcitium and Comodo at some future date?

Time will tell.

Regards Eck

 

[Pico]

It seems that everybody is forgetting about that CIS suffers of having over 100 bugs which do increase with every new release. We all know by now that Comodo won't do anything to fix these bugs despite Comodo Staff on Comodo forum telling otherwise or make believe that "they are working on it" which is just nothing more than a big fat lie which purpose is to silence the Comodo forum community.

 

[ForgottenSeer 114717]

It seems that everybody is forgetting about that CIS suffers of having over 100 bugs which do increase with every new release. We all know by now that Comodo won't do anything to fix these bugs despite Comodo Staff on Comodo forum telling otherwise or make believe that "they are working on it" which is just nothing more than a big fat lie which purpose is to silence the Comodo forum community.

Nobody here is forgetting. Every person here at MT knows about the unfixed bugs and that Comodo will never fix those bugs.

If people choose to use Comodo, regardless of how many bugs and other problems, that is their right. I say "Isn't that wonderful for them?"

Complaining over-and-over to Comodo and on security forums for 17+ years since the release of the product has not induced Melih to fix the bugs and problems. The product is Melih's ideological pet project. How can people not get that? He is never going to do what the complainers want him to do. Period. Ever. As long as he owns the software.

I've been accused of defending Comodo and Melih for my statements. I am not defending or justifying anything. All I am doing is pointing out the facts. Legally, what Melih is doing is 100% legal. If some people think he is "immoral" or "unethical," then they have the right to think so. As far as accusing fanbois and fangirlz as "immoral" and "unethical," that crosses the line, but again, people are entitled to their opinion.

Where Melih and Comodo are concerned, I am only interested in what is legally permitted.

As far as the incessant complaints, I get it. However, those complaints are wasted time and effort. Attacking users who are fanbois or fangirlz of the product is wrong and socially destructive.

 

[dmknght]

Lmao "these tests are not real world scenarios" lmao. I'm so done here bahahahaha.

 

[rashmi]

I have a question that's meant honestly and has nothing to do with fanboying or anything else.

First of all: I've been seriously doubted by the recently discovered security vulnerabilities and the discussions about them, not here, but in the Comodo forum. I was about to leave Comodo after decades. My question, which will be difficult to answer, not because it's too specific or technically difficult (I wouldn't be able to do that due to a lack of knowledge, as I'm not a programmer), but because no one can look at my configurations and immediately tell me for this or that reason or because of that. My question, as I said, has nothing to do with Comodo itself; I could certainly ask a similar question about other programs.

Why, in all the decades I've been using Comodo, haven't I been harmed even once by a cyberattack:
Identity, bank account, ransomware, or anything else.

I can already offer one or two answers based on what I've read here:
- Comodo is too insignificant for cybercriminals, so it's not worth attacking.
- The user base is too small and also too insignificant.
- Attempting a break-in would be too complex, or the hurdles are too high at Comodo.

There have been security concerns and vulnerabilities at Comodo for some time, and these have been discussed.

I was really considering switching, and the recent posts here have reinforced my doubts somewhat (but then some things were revised again), but my experience with Comodo contradicts this.

Comodo's positives and negatives are available on its forums and in various discussions here. The opinions, experiences, tests, reports, and expert analyses provide ample information for you to decide whether to continue using Comodo or to explore alternatives.

I use Comodo; it is a discontinued product for me. The bugs don't affect my experience, and I'm not concerned about the vulnerabilities.

Comodo is the Marvel of cybersecurity, and we, the few users, are the Avengers—with passionate fans appreciating, criticizing, and sometimes resorting to name-calling... I love my fans!

 

[Helmut]

I found this:



Is this a guide on how to exploit a vulnerability?

As a complete layman, this is beyond Chinese to me. But from what I can see, the effort required to exploit and manipulate such a vulnerability must be very, very high, and the effort-to-benefit ratio very small.

As a dummy, I'm faced with this as if my car suddenly stopped moving on the highway at 180 km/h and came to a standstill, or if someone were presenting me with the design of a space rocket.

Nevertheless, I can't say anything else in brief:
Never had any infected computers, never had any blackmail attempts, everything worked and continues to work perfectly, smoothly.

J. Bond didn't want to trade his Beretta because of the positive experience he had with it in life-threatening missions. "The Beretta has never let me down or disappointed me."

Was he a fanboy, a fanatical one? Was he defending the weapon's manufacturer? Or had he "only" brought up his experiences with it when he was offered a better weapon to replace his Beretta because of its unreliability and jamming, which it had already experienced. That's how I feel about Comodo, it's my Beretta:
It was always reliable, recently protected me from three remote attempts (immediately cutting off the internet connection - is that one of them mentioned in the link above?). J. Bond wasn't concerned about the Beretta, he was concerned about his safety, and the Beretta was part of that. The Beretta didn't give him security, but the Beretta was a part of it. He had to do something for security himself. Yes, every example is flawed in some way.

@rashmi:​

Comodo is the Marvel of cybersecurity, and we, the few users, are the Avengers—with passionate fans appreciating, criticizing, and sometimes resorting to name-calling... I love my fans!

Is this Beretta, no, this comodo CIS a little marvel?

Here's another perspective on blind trust in certificates and their "power":

Comodo CIS)Dead?????? Who knows more ???

Well there are a couple reasons why blind trusting in CA's is a bad thing. For once it depends on what you define as malware, to me google chrome's...

www.wilderssecurity.com

 

[overdivine]

Lmao "these tests are not real world scenarios" lmao. I'm so done here bahahahaha.

yes, because if you are not a high value target, you are more likely to be struck by lightning than to encounter 0 day malware in your lifetime

 

[Andy Ful]

As a complete layman, this is beyond Chinese to me. But from what I can see, the effort required to exploit and manipulate such a vulnerability must be very, very high, and the effort-to-benefit ratio very small.

The complexity is not high enough to prevent targeted attacks in Enterprises. However, it is possible to make it higher by some Comodo tweaks, like enabling Anti-ARP Spoofing, hardening PowerShell option in Script Analysis, and blocking the Internet connection for contained processes. Those settings should mitigate all POCs mentioned in your post.
However, a highly motivated attacker can likely find a way to exploit the vulnerabilities using some trusted tools or LOLBins that are not protected by Script Analysis. That is why it would be risky to use Comodo in Enterprises.

 

[dmknght]

yes, because if you are not a high value target, you are more likely to be struck by lightning than to encounter 0 day malware in your lifetime

It's still has nothing to do with "it's not real world scenarios". All setups were similar to a regular user that installed the software and used it normally. But by "real world scenarios" from the comment above, it can be like:
- Local Privilege Escalation requries Local Access so it's not dangerous nor realistic.
- A Desktop / Router / Switch / IOT device is inside NAT, hence attacker can't attack directly. It's not dangerous nor realistic.
- An exploit via chat application or mail application requires user to read it. I have <insert favorite security product here> so i'm safe. It's not dangerous nor realistic.
- An exploit via public internet protocol might face Firewall / WAF / IPS system hence this exploit is not realistic.

In the end of the day, all argument is gonna be like "finding new 0-day, even very critical one, is useless and user over internet are fine".

 

[rashmi]

@rashmi:​

Comodo is the Marvel of cybersecurity, and we, the few users, are the Avengers—with passionate fans appreciating, criticizing, and sometimes resorting to name-calling... I love my fans!

Is this Beretta, no, this comodo CIS a little marvel?

Yes, Comodo truly is a Marvel!... In fact, the billionaire tech genius, Tony Stark, in Iron Man, is based on Melih's personal and professional prowess, with Comodo's innovative containment technologies behind the blueprint for Iron Man's unique weaponized suit of armor!

 

[Pico]

Complaining over-and-over to Comodo and on security forums for 17+ years since the release of the product has not induced Melih to fix the bugs and problems. The product is Melih's ideological pet project. How can people not get that? He is never going to do what the complainers want him to do. Period. Ever. As long as he owns the software.

Because new CIS users don't know anything about the history of CIS nor do they know who Melih is nor do they read all the good and bad stuff written on Comodo forum. New CIS users must be informed about this "marvellous" piece of software, one cannot repeat the same message often enough even if Melih is immune to this.

Besides, I thought Melih sold his CISter long time ago and is no longer the owner of it?
And new Comodo Staff (new CEO) made a statement some time ago on Comodo forum to solve all the bugs!

 

[Andy Ful]

It's still has nothing to do with "it's not real world scenarios". All setups were similar to a regular user that installed the software and used it normally. But by "real world scenarios" from the comment above, it can be like:
- Local Privilege Escalation requries Local Access so it's not dangerous nor realistic.
- A Desktop / Router / Switch / IOT device is inside NAT, hence attacker can't attack directly. It's not dangerous nor realistic.
- An exploit via chat application or mail application requires user to read it. I have <insert favorite security product here> so i'm safe. It's not dangerous nor realistic.
- An exploit via public internet protocol might face Firewall / WAF / IPS system hence this exploit is not realistic.

In the end of the day, all argument is gonna be like "finding new 0-day, even very critical one, is useless and user over internet are fine".

You are right.
Local privilege escalation is simple against Comodo by abusing trusted applications or scripting.
Breaking into the business networks happens daily all over the world.
Exploit delivery via social media, emails, SEO poisoning, or malicious ADs happens every day.

However, in the case of strictly Comodo exploits, this requires one crucial assumption: the attacker already knows that the target uses a very rare protection, namely Comodo. If not, then the chances of a successful attack in the wild are negligible compared to the advantages of using auto-containment for malware, especially for FUDs.

For home users, the attack can happen when the user searches the Internet for Comodo content (tweaks, guides, troubleshooting, etc.). The attacker can apply a simple ClickFix method to compromise Comodo (if PowerShell is not properly restricted).