Wikileak documents show Governments couldn't penetrate Comodo Internet Security

[hjlbx]

but CIS always gives alerts

on my systems the only alerts i got are from the firewall after using a new soft

I run CIS in "Lock-Down" mode...

CIS settings:

Antivirus - Auto-quarantine upon detection - Notification only
Scan - Auto-disinfect upon detection - Notification only
Cloud Antivirus - Block and terminate - Notification only
Auto-Sandbox - Unrecognized - Block - Notification only
HIPS - Unrecognized - Block - Alerts Off
Firewall - Unrecognized - Block - Alerts Off

My system is so quiet it is boring...

 

[Deleted member 178]

My system is so quiet it is boring...

i know the feelings, it is why i keep adding things but i had to remove them few moments after; if not , my system will crawl

 

[hjlbx]

comodo IS = perpetual unfinished/unpolished products , that was enough to made me get rid of it.

I know exactly what you mean, but honestly, CIS is improving. Version 7 caused all kinds of problems on my AMD systems; version 8 is much better.

CIS is nothing more than the core modules of Comodo Endpoint Protection (CEP) with a different user interface. There are a lot of complaints about CIS... and while some are justified, most of what I see are due to lack of knowledge of how it works and how to use it.

Typical user does not understand that CIS is all about managing file ratings; generally, only Unrecognized file generates alerts.

 

[Deleted member 178]

i quit CIS at v6, maybe v8 is better as many people said, but i still have the bad taste and poor opinion of v6

 

[eXPerience]

What problems?

Well, in that time there were many. Releasing programs that shouldn´t even be beta´s destroying tons of computers, loads of antivirus problems (some were so sad they became laughable), problems with developers (getting fired), leaks in the forums, etc.

In my opinion, the community has always been the strongest point of Comodo, but if you always come up with empty promises and hypes, well, even they will move on.

 

[Deleted member 178]

In my opinion, the community has always been the strongest point of Comodo, but if you always come up with empty promises and hypes, well, even they will move on.

exact. v3,v4,and even v5 were awesome products; then the fanboys and their ridiculous demands came upon comodo , then it started to fail into an hyped and everbuggy suite.

 

[Deleted member 2913]

When you learn how CIS works and how to fully configure it, you do not need all the alerts - and soon disable them.

On "expert's" system there are few, if any, alerts. If there is an alert, something is wrong...

And on average users system, they will rarely get alerts.

 

[hjlbx]

exact. v3,v4,and even v5 were awesome products; then the fanboys and their ridiculous demands came upon comodo , then it started to fail into an hyped and everbuggy suite.

I'd like to express my opinions openly about some of the "Fanboy" attitudes and behaviors, but my continued standing here at MT is more important to me.

In the end I made the choice to visit the Comodo forum only when I need to report bugs and submit files for white-listing. Other than that I'm not there often. So, I guess you could say, I ignore them ("Fanboys") in my own way.

I've also chosen to use CIS - because I genuinely like it: it works well on my specific system - and - I learned how to use it.

 

[Tony Cole]

If they can hack Kaspersky, the UN etc., I am sure the NSA could bypass Comodo in seconds, Absolute crap! Melih's hype again, he probably paid Wikileaks to boost his popularity.

 

[Deleted member 178]

Melih's hype again, he probably paid Wikileaks to boost his popularity.

no he made the leaks himself

 

[Tony Cole]

That's 100% correct, but no, the forum will be all for this amazing piece of software that can stop what no other can??? Government hacking.... Edward Snowden is probably in contact with Melih so they can both develop an advanced APT kit that all enterprise's will want.....

 

[hjlbx]

That's 100% correct, but no, the forum will be all for this amazing piece of software that can stop what no other can??? Government hacking.... Edward Snowden is probably in contact with Melih so they can both develop an advanced APT kit that all enterprise's will want.....

I read the full reports - including the spreadsheets that show the results.

Comodo Internet Security and Emsisoft Anti-Malware were the only two security softs that alerted to all attempted installs on all tested systems (w\different OS versions). TrustPort Internet Security did well too.

FinFisher when installed on certain Windows versions was able to "heart-beat" - and as far as I can recall, Comodo and EAM couldn't stop it. The exact technical details of whether or not the "heart-beat" posed any kind of security risk with Comodo or EAM installed is unclear to me = read the full reports for yourself. "Heart-Beat" = ET Call Home - that's it; probably just pings C&C to let it know that it is installed and functional\operational.

All three (Comodo, Emsi and TrustPort) are HIPS-based systems (Emsi quasi-HIPS). All those documents prove is that each one has HIPS that can detect the specific system changes made by the FinFisher installer - that's it; the results are not a confirmation that each soft is the overall "best, of the best, of the best... Sir !"

I wouldn't even go so far as to conclude that Comodo, EAM and TrustPort have "Best-of-Class" HIPS capabilities, but I am confident that each one is more capable than the average HIPS. That's as far as I am willing to wager...

Although, Melih uses word games - just like any other AV's marketing tactics - to make a user\potential user think that is the case.

All this debate is meaningless - since Gamma International (FinFisher Reconnaissance Suite author) has probably developed a way to by-pass Comodo and EAM by this point in time. In fact, that was the whole point of the tests - to pentest each of the AVs - and determine which ones should be further targeted for bypass.

I am not Enemy-of-the-State No. 1 - so I don't worry about it.

Start worrying about it when Organized Crime gets their hands on the coding - or develops their own - that allows wide-spread hidden, undetectable installs of reconnaissance-type softs. Some would argue that they already have it - using roorkits, undetected Trojans, etc. What I am talking about is the most extreme high-level coding that avoids detection for years - like Enigma group's work. OC gets to this same level = it is probable that all of our "Gooses are cooked" regardless of what AV we use.

 

[vivid]

no he made the leaks himself

You should note that WikiLeaks post was discovered at a later time.

6 August 2014
https://netzpolitik.org/2014/gamma-...-source-code-of-government-malware-published/

15 September 2014
https://wikileaks.org/spyfiles4/

 

[Rolo]

hehe "Gandalf the Grey Hat" haha

 

[vivid]

All three (Comodo, Emsi and TrustPort) are HIPS-based systems (Emsi quasi-HIPS). All those documents prove is that each one has HIPS that can detect the specific system changes made by the FinFisher installer - that's it; the results are not a confirmation that each soft is the overall "best, of the best, of the best... Sir !"

CIS did not use HIPS.
http://malwaretips.com/threads/wiki...e-comodo-internet-security.38511/#post-312790

 

[hjlbx]

CIS did not use HIPS.
http://malwaretips.com/threads/wiki...e-comodo-internet-security.38511/#post-312790

Yes, it did. Buffer Overflow is monitored by HIPS - Physical Memory; HIPS generates all Protected Object alerts.

In CIS, HIPS is always active - even if disabled (just turns off specific alerts for Unrecognized files) - it continuously monitors Trusted applications and protected objects against policy violations (= malicious behaviors) and potentially malicious modifications. Even when disabled, HIPS will generate an alert if a major policy violation or modification is attempted - either by\to a Trusted app or protected objects.

So even at default CIS configuration = Internet Security with HIPS "disabled" - CIS will still generate HIPS alerts when certain file\object violations occur.

CIS designed this way to protect against safe file\protected object modifications (hijacks).

Ask @Umbra if you think this incorrect, but as far as my understanding this is all correct...

 

[hjlbx]

By the way, Comodo performed terribly against FinUSB = USB initiated infections (security service's preferred infection method).

Emsi Anti-Malware blocked everything.

 

[hjlbx]

Where did you find that information? I think you are misunderstanding the mentioned situation.
* 'HIPS' is not enabled by default.
** It was detected by 'buffer overflow protection' which is enabled by default.
*** From my understanding, the presentation videos exemplify shellcode injection.

HIPS is not really "turned off" when user sets HIPS to "Disabled."

"Disabled" only turns off certain HIPS alerts for Unrecognized files.

HIPS is always active monitoring Trusted file and protected object activity - even with it set to "Disabled"; HIPS will generate alerts whenever certain policy violations and file\system behaviors occur.

 

[vivid]

That's true to a certain manner. If you refer to public protected objects then you're somewhat wrong from my point of view. Self-defense makes use of HIPS but it's not really HIPS responsible.

 

[hjlbx]

That's true to a certain manner. If you refer to public protected objects then you're somewhat wrong from my point of view. Self-defense makes use of HIPS but it's not really HIPS responsible.

Page 335, v. 8.2 CIS User's Manual, HIPS Monitoring Settings

Objects To Monitor Against Direct Access:


Determines whether or not Comodo Internet Security should monitor access to system critical objects on your computer. Using

direct access methods, malicious applications can obtain data from a storage devices, modify or infect other executable

software, record keystrokes and more. Comodo advises the average user to leave these settings enabled:

• Physical Memory: Monitors your computer's memory for direct access by an applications and processes. Malicious

programs attempt to access physical memory to run a wide range of exploits - the most famous being the 'Buffer


Overflow' exploit. Buffer overruns occur when an interface designed to store a certain amount of data at a specific


address in memory allows a malicious process to supply too much data to that address. This overwrites its internal

structures and can be used by malware to force the system to execute its code (Default = Enabled).