Xcitium Endpoint Security was obliterated by an exploit!

[vitao]

Watch:

Ps.: Xcitium Client Security v13 (latest one) used on this test.

For now please use the yt automatic subs as im working on proper subs for the videos.

 

[Bot]

Thanks for sharing the video. It's concerning to see Xcitium Client Security v13 being exploited. This definitely calls for immediate attention from the developers. Looking forward to the proper subtitles for better understanding.

 

[Adrian Ścibor]

Hello Vitao,

Interesting...

Let me ask you about some cases:

1. To the best of my knowledge, Xcitium is using the new 2023 security policy - "Windows Security Profile 8.1". I ask because I didn't notice that you showed the configuration of the agent OR I missed something. It was previously a 2016 configuration, so very old and not adapted to the new versions of Xcitium Endpoint agent. In this configuration HIPS is enabled by default, so please let me know what about of that:

2. In our test we always use "BLOCK REQUESTS" for HIPS rules configuration because the setting is recommended by Vendor. I do not know why the default configuration have "allow request". Perhaps this is something that requires contact with technical support.

I wonder about the effectiveness of the exploit when HIPS will be changed to Block all Requests....

3. As for EDR feature and logging in the admin dashboard: I know from experience that it takes 20-60 minutes for logs and technical information to jump here, so you have to wait with the VM as enabled to see anything new in the dash. In particular, browse the EDR Search Query tab to find interesting Indicators of Compromise:

4. EDITED - added:
You didn't show the vector of malware delivering - based on my experience, delivering malware to the VM by "drag and drop" falsifies the results because the protocol is not real, so the file is losing metadata on Mark-of-the-Web as well. Without this mark you can bypass Microsoft Smart Screen alert like this:

You can check the MOTW by the command:

dir file.extension /R

example:

dir file.exe /R

Which it doesn't exclude your good work...

But I wanted to ask about these details only.

 

[vitao]

Hello Vitao,

Interesting...

Let me ask you about some cases:

1. To the best of my knowledge, Xcitium is using the new 2023 security policy - "Windows Security Profile 8.1". I ask because I didn't notice that you showed the configuration of the agent OR I missed something. It was previously a 2016 configuration, so very old and not adapted to the new versions of Xcitium Endpoint agent. In this configuration HIPS is enabled by default, so please let me know what about of that:

View attachment 286057

2. In our test we always use "BLOCK REQUESTS" for HIPS rules configuration because the setting is recommended by Vendor. I do not know why the default configuration have "allow request". Perhaps this is something that requires contact with technical support.

I wonder about the effectiveness of the exploit when HIPS will be changed to Block all Requests....

View attachment 286058

3. As for EDR feature and logging in the admin dashboard: I know from experience that it takes 20-60 minutes for logs and technical information to jump here, so you have to wait with the VM as enabled to see anything new in the dash. In particular, browse the EDR Search Query tab to find interesting Indicators of Compromise:

View attachment 286059


4. EDITED - added:
You didn't show the vector of malware delivering - based on my experience, delivering malware to the VM by "drag and drop" falsifies the results because the protocol is not real, so the file is losing metadata on Mark-of-the-Web as well. Without this mark you can bypass Microsoft Smart Screen alert like this:

View attachment 286060

You can check the MOTW by the command:

dir file.extension /R

example:

dir file.exe /R

View attachment 286061

Which it doesn't exclude your good work...

But I wanted to ask about these details only.

helllo my friend.

1. have no idea. just installed and let it with its default configurations for the test;

2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows... about hips, well, if marked to block, then hips will block as the exploit is not for hips, its for containment.

3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.

4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.

about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.

hope i answered you my friend.

i dont remember if this video has subtitles. if not, please let me know and ill provide it. i know that the video showing this same poc downloading and running an ransomware has multiple subs already.

btw., the poc will work with xcitium as xcitium client security is just the same cis with a little tweaking to make it work with the dashboard for the edr part of xcitium, so, any malware/payload/kit/poc/etc that can evade cis sandbox will do the same with xcitium. in fact, if you watch closely youll realize that the real differences between cis and xcitium are the rulesets and not the modules itself...

any more informations must be asked for the dev of this poc as he is the guy with the best knowledge to answer technical questions regardless his poc for things related to the tests, please, bring it to me and if necessary i can do another test too.

EDIT.: oh! maybe i mix everything here... i recently posted a new video testing xcitium against 100 malwares... the link is this one:

sorry if i mixed the answers provided here with the results from both videos

ps.: regardless the poc on the vm, i did drag n drop for the poc, then disabled the drag n drop feature and did the testings. for the video with 100 malwares it was different. all downloaded from inside the vm.

 

[Adrian Ścibor]

helllo my friend.

1. have no idea. just installed and let it with its default configurations for the test;

Understood. Well, worth checking for yourself.

2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows... about hips, well, if marked to block, then hips will block as the exploit is not for hips, its for containment.

The configuration...

The configuration is extremely important. It can be turned out that product X Y Z must have disabled function X and Y to exploit may work. I'm commenting in general.

3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.

4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.

ad4. Yes, I had in mind how the malware is downloaded/delivered into the Windows machine - by the browser? Local downloading from shared space? SFTP protocol? Other protocol? Just how the malware files included in Windows.

about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.

I really understand. However in real environment in business or in school, in home, Microsoft technologies are enabled by default or even hardened, even if technical staff use another security solution than Microsoft Defender.

BUT...

If exploit is really effective in real life, please consider contact with Xcitium support, Comodo their official forum (forum.xcitium.com). I don't know if they provide a bug bounty program, but you can check by own or just ask them.

 

[Vitali Ortzi]

Hello Vitao,

Interesting...

Let me ask you about some cases:

1. To the best of my knowledge, Xcitium is using the new 2023 security policy - "Windows Security Profile 8.1". I ask because I didn't notice that you showed the configuration of the agent OR I missed something. It was previously a 2016 configuration, so very old and not adapted to the new versions of Xcitium Endpoint agent. In this configuration HIPS is enabled by default, so please let me know what about of that:

View attachment 286057

2. In our test we always use "BLOCK REQUESTS" for HIPS rules configuration because the setting is recommended by Vendor. I do not know why the default configuration have "allow request". Perhaps this is something that requires contact with technical support.

I wonder about the effectiveness of the exploit when HIPS will be changed to Block all Requests....

View attachment 286058

3. As for EDR feature and logging in the admin dashboard: I know from experience that it takes 20-60 minutes for logs and technical information to jump here, so you have to wait with the VM as enabled to see anything new in the dash. In particular, browse the EDR Search Query tab to find interesting Indicators of Compromise:

View attachment 286059


4. EDITED - added:
You didn't show the vector of malware delivering - based on my experience, delivering malware to the VM by "drag and drop" falsifies the results because the protocol is not real, so the file is losing metadata on Mark-of-the-Web as well. Without this mark you can bypass Microsoft Smart Screen alert like this:

View attachment 286060

You can check the MOTW by the command:

dir file.extension /R

example:

dir file.exe /R

View attachment 286061

Which it doesn't exclude your good work...

But I wanted to ask about these details only.

Would be awesome if you can add

helllo my friend.

1. have no idea. just installed and let it with its default configurations for the test;

2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows... about hips, well, if marked to block, then hips will block as the exploit is not for hips, its for containment.

3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.

4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.

about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.

hope i answered you my friend.

i dont remember if this video has subtitles. if not, please let me know and ill provide it. i know that the video showing this same poc downloading and running an ransomware has multiple subs already.

btw., the poc will work with xcitium as xcitium client security is just the same cis with a little tweaking to make it work with the dashboard for the edr part of xcitium, so, any malware/payload/kit/poc/etc that can evade cis sandbox will do the same with xcitium. in fact, if you watch closely youll realize that the real differences between cis and xcitium are the rulesets and not the modules itself...

any more informations must be asked for the dev of this poc as he is the guy with the best knowledge to answer technical questions regardless his poc for things related to the tests, please, bring it to me and if necessary i can do another test too.

EDIT.: oh! maybe i mix everything here... i recently posted a new video testing xcitium against 100 malwares... the link is this one:

sorry if i mixed the answers provided here with the results from both videos

ps.: regardless the poc on the vm, i did drag n drop for the poc, then disabled the drag n drop feature and did the testings. for the video with 100 malwares it was different. all downloaded from inside the vm.

He reported the bug and he was banned from the fourm for sharing that there is a vulnerability as they seem to not care about fixing their own product even with a severe vulnerability

 

[Adrian Ścibor]

Would be awesome if you can add

He reported the bug and he was banned from the fourm for sharing that there is a vulnerability as they seem to not care about fixing their own product even with a severe vulnerability

Oh, really???

Could you let me know some details on this matter at private msg? I will try to contact with somebody from the producer and ask them about the potential vulnerability.

 

[Vitali Ortzi]

Oh, really???

Could you let me know some details on this matter at private msg? I will try to contact with somebody from the producer and ask them about the potential vulnerability.

Serious Discussion - Comodo Internet Security 2025 was obliterated by an exploit! (here is the message about him being banned in comodo fourm)

helllo my friend.

1. have no idea. just installed and let it with its default configurations for the test;

2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows... about hips, well, if marked to block, then hips will block as the exploit is not for hips, its for containment.

3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.

4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.

about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.

hope i answered you my friend.

i dont remember if this video has subtitles. if not, please let me know and ill provide it. i know that the video showing this same poc downloading and running an ransomware has multiple subs already.

btw., the poc will work with xcitium as xcitium client security is just the same cis with a little tweaking to make it work with the dashboard for the edr part of xcitium, so, any malware/payload/kit/poc/etc that can evade cis sandbox will do the same with xcitium. in fact, if you watch closely youll realize that the real differences between cis and xcitium are the rulesets and not the modules itself...

any more informations must be asked for the dev of this poc as he is the guy with the best knowledge to answer technical questions regardless his poc for things related to the tests, please, bring it to me and if necessary i can do another test too.

EDIT.: oh! maybe i mix everything here... i recently posted a new video testing xcitium against 100 malwares... the link is this one:

sorry if i mixed the answers provided here with the results from both videos

ps.: regardless the poc on the vm, i did drag n drop for the poc, then disabled the drag n drop feature and did the testings. for the video with 100 malwares it was different. all downloaded from inside the vm.

Vitao please dm Adrian scibor when you're online pushing on the vendor to patch a containment bypass could save both hoke and enterprise users from getting exploited and Adrian should have contact with representatives who have a higher authority in xcitium then the fourm mods

 

[Sandbox Breaker]

Oh, really???

Could you let me know some details on this matter at private msg? I will try to contact with somebody from the producer and ask them about the potential vulnerability.

Please teach Xcitium a lesson

 

[vitao]

hello guys. being really busy these days.

i can not provide the poc files as im not the dev behind it and i promised the guy ill not share it. but even if i was allowed to do so, i dont think there is any point as comodo/xcitium seems to really dont care.

they banned me for reasons i dont know and i really dont care much, but the exploit is here and it tends to stay here for a looooong time as some are developing it further...

i guess its a matter of when we will start seeing things related to it messing around in fileless and some other ways. in fact its already happening but no one can talk about it as cis and xcitium are perfect

they banned me and deleted all the topics related to the exploit in cis forum and xcitium forum too, so...

or maybe its something personal and they are indeed working on some fix? who knows... what i know is that they took 2 months to solve the certificate issue just to prove they have no clue as there is one invalid cert inside cis as of now...

lets move on...?

 

[Adrian Ścibor]

The topic is still exist at Comodo forum, they said that working on a solution: PoC bypass Auto-Sandbox CIS

 

[vitao]

The topic is still exist at Comodo forum, they said that working on a solution: PoC bypass Auto-Sandbox CIS

so its personal as this topic was not created by me

 

[bazang]

but even if i was allowed to do so, i dont think there is any point as comodo/xcitium seems to really dont care.

No. It is a software with very low revenue. If users want to pay for the bug fixes, then Comodo will fix it.

Comodo has no obligation to fix its software. That is not how software works. It is sold "As Is." And if a software publisher does not want to fix bugs and problems, then they do not have to.

Microsoft has not fixed hundreds and hundreds of POC and other security problems over the decades. Man of those problems still remain.

 

[vitao]

No. It is a software with very low revenue. If users want to pay for the bug fixes, then Comodo will fix it.

Comodo has no obligation to fix its software. That is not how software works. It is sold "As Is." And if a software publisher does not want to fix bugs and problems, then they do not have to.

Microsoft has not fixed hundreds and hundreds of POC and other security problems over the decades. Man of those problems still remain.

all this to defend one company?

 

[bazang]

all this to defend one company?

There is no need to defend Comodo.

It owns the product. It can do whatever it wants or does not want to do with the product. Don't like it? Then don't use it.

A software with little to no revenue is never going to be any better than it is right now.

 

[XylentAntivirus]

That's why you should sandbox everything if you going to sandbox otherwise this thing happens.

 

[vitao]

There is no need to defend Comodo.

It owns the product. It can do whatever it wants or does not want to do with the product. Don't like it? Then don't use it.

A software with little to no revenue is never going to be any better than it is right now.

that i agree with you my friend.