Xcitium Endpoint Security was obliterated by an exploit!
Hello Vitao,
Interesting...
Let me ask you about some cases:
1. To the best of my knowledge, Xcitium is using the new 2023 security policy - "Windows Security Profile 8.1". I ask because I didn't notice that you showed the configuration of the agent OR I missed something. It was previously a 2016 configuration, so very old and not adapted to the new versions of Xcitium Endpoint agent. In this configuration HIPS is enabled by default, so please let me know what about of that:
2. In our test we always use "BLOCK REQUESTS" for HIPS rules configuration because the setting is recommended by Vendor. I do not know why the default configuration have "allow request". Perhaps this is something that requires contact with technical support.
I wonder about the effectiveness of the exploit when HIPS will be changed to Block all Requests....
3. As for EDR feature and logging in the admin dashboard: I know from experience that it takes 20-60 minutes for logs and technical information to jump here, so you have to wait with the VM as enabled to see anything new in the dash. In particular, browse the EDR Search Query tab to find interesting Indicators of Compromise:
4. EDITED - added:
You didn't show the vector of malware delivering - based on my experience, delivering malware to the VM by "drag and drop" falsifies the results because the protocol is not real, so the file is losing metadata on Mark-of-the-Web as well. Without this mark you can bypass Microsoft Smart Screen alert like this:
You can check the MOTW by the command:
dir file.extension /R
example:
dir file.exe /R
Which it doesn't exclude your good work...
But I wanted to ask about these details only.
Interesting...
Let me ask you about some cases:
1. To the best of my knowledge, Xcitium is using the new 2023 security policy - "Windows Security Profile 8.1". I ask because I didn't notice that you showed the configuration of the agent OR I missed something. It was previously a 2016 configuration, so very old and not adapted to the new versions of Xcitium Endpoint agent. In this configuration HIPS is enabled by default, so please let me know what about of that:
2. In our test we always use "BLOCK REQUESTS" for HIPS rules configuration because the setting is recommended by Vendor. I do not know why the default configuration have "allow request". Perhaps this is something that requires contact with technical support.
I wonder about the effectiveness of the exploit when HIPS will be changed to Block all Requests....
3. As for EDR feature and logging in the admin dashboard: I know from experience that it takes 20-60 minutes for logs and technical information to jump here, so you have to wait with the VM as enabled to see anything new in the dash. In particular, browse the EDR Search Query tab to find interesting Indicators of Compromise:
4. EDITED - added:
You didn't show the vector of malware delivering - based on my experience, delivering malware to the VM by "drag and drop" falsifies the results because the protocol is not real, so the file is losing metadata on Mark-of-the-Web as well. Without this mark you can bypass Microsoft Smart Screen alert like this:
You can check the MOTW by the command:
dir file.extension /R
example:
dir file.exe /R
Which it doesn't exclude your good work...
But I wanted to ask about these details only.
Last edited:
vitao
Level 5
helllo my friend.
1. have no idea. just installed and let it with its default configurations for the test;
2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows...
about hips, well, if marked to block, then hips will block as the exploit is not for hips, its for containment.3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.
4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.
about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.
hope i answered you my friend.
i dont remember if this video has subtitles. if not, please let me know and ill provide it. i know that the video showing this same poc downloading and running an ransomware has multiple subs already.
btw., the poc will work with xcitium as xcitium client security is just the same cis with a little tweaking to make it work with the dashboard for the edr part of xcitium, so, any malware/payload/kit/poc/etc that can evade cis sandbox will do the same with xcitium. in fact, if you watch closely youll realize that the real differences between cis and xcitium are the rulesets and not the modules itself...
any more informations must be asked for the dev of this poc as he is the guy with the best knowledge to answer technical questions regardless his poc
for things related to the tests, please, bring it to me and if necessary i can do another test too.EDIT.: oh! maybe i mix everything here... i recently posted a new video testing xcitium against 100 malwares...
the link is this one: sorry if i mixed the answers provided here with the results from both videos
ps.: regardless the poc on the vm, i did drag n drop for the poc, then disabled the drag n drop feature and did the testings. for the video with 100 malwares it was different. all downloaded from inside the vm.
Understood. Well, worth checking for yourself.
The configuration...2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows...
The configuration is extremely important. It can be turned out that product X Y Z must have disabled function X and Y to exploit may work. I'm commenting in general.
ad4. Yes, I had in mind how the malware is downloaded/delivered into the Windows machine - by the browser? Local downloading from shared space? SFTP protocol? Other protocol? Just how the malware files included in Windows.
I really understand. However in real environment in business or in school, in home, Microsoft technologies are enabled by default or even hardened, even if technical staff use another security solution than Microsoft Defender.
BUT...
If exploit is really effective in real life, please consider contact with Xcitium support, Comodo their official forum (forum.xcitium.com). I don't know if they provide a bug bounty program, but you can check by own or just ask them.
Would be awesome if you can add
helllo my friend.
1. have no idea. just installed and let it with its default configurations for the test;
2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows...
3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.
4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.
about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.
hope i answered you my friend.
i dont remember if this video has subtitles. if not, please let me know and ill provide it. i know that the video showing this same poc downloading and running an ransomware has multiple subs already.
btw., the poc will work with xcitium as xcitium client security is just the same cis with a little tweaking to make it work with the dashboard for the edr part of xcitium, so, any malware/payload/kit/poc/etc that can evade cis sandbox will do the same with xcitium. in fact, if you watch closely youll realize that the real differences between cis and xcitium are the rulesets and not the modules itself...
any more informations must be asked for the dev of this poc as he is the guy with the best knowledge to answer technical questions regardless his poc
EDIT.: oh! maybe i mix everything here... i recently posted a new video testing xcitium against 100 malwares...
sorry if i mixed the answers provided here with the results from both videos
ps.: regardless the poc on the vm, i did drag n drop for the poc, then disabled the drag n drop feature and did the testings. for the video with 100 malwares it was different. all downloaded from inside the vm.
He reported the bug and he was banned from the fourm for sharing that there is a vulnerability as they seem to not care about fixing their own product even with a severe vulnerability
Oh, really???
Could you let me know some details on this matter at private msg? I will try to contact with somebody from the producer and ask them about the potential vulnerability.
Serious Discussion - Comodo Internet Security 2025 was obliterated by an exploit! (here is the message about him being banned in comodo fourm)
helllo my friend.
1. have no idea. just installed and let it with its default configurations for the test;
2. the recomended settings will always be applied when installing the software so if they recomend anything diff from what you see on my video, its their mistake as they dont have any kind of place to show their recommendations. but who knows...
3. for my experience it takes seconds to propagate informations regardless what was going on at the vm used on this tests. in the video some parts had to be accelerated but even with that, when i come to the logging part it was not "rushed". one important note, when cis/xcitium is not able of classifying some file, no matter how long you wait, it will not be classified in xcitium/cis nor xcitium edr dashboard.
4. sorry. as english is not my primary language... if i understand correctly you are talking about how i bring the malwares to the vm for the tests? if so, in this video i didnt show this part so the video could be not so big but i explained that these samples were downloaded in the same day as the video recording. in fact, all my videos testing avs uses samples downloaded from the internet (downloaded from the vms). the drag n drop vm feature is always off as this could expose my host machine to the malwares.
about microsoft smart screen, its not disabled but i tend to disable everything related to defender and security center for these tests. the goal is not to have any microsoft technologies interfering on the tests.
hope i answered you my friend.
i dont remember if this video has subtitles. if not, please let me know and ill provide it. i know that the video showing this same poc downloading and running an ransomware has multiple subs already.
btw., the poc will work with xcitium as xcitium client security is just the same cis with a little tweaking to make it work with the dashboard for the edr part of xcitium, so, any malware/payload/kit/poc/etc that can evade cis sandbox will do the same with xcitium. in fact, if you watch closely youll realize that the real differences between cis and xcitium are the rulesets and not the modules itself...
any more informations must be asked for the dev of this poc as he is the guy with the best knowledge to answer technical questions regardless his poc
EDIT.: oh! maybe i mix everything here... i recently posted a new video testing xcitium against 100 malwares...
sorry if i mixed the answers provided here with the results from both videos
ps.: regardless the poc on the vm, i did drag n drop for the poc, then disabled the drag n drop feature and did the testings. for the video with 100 malwares it was different. all downloaded from inside the vm.
Vitao please dm Adrian scibor when you're online pushing on the vendor to patch a containment bypass could save both hoke and enterprise users from getting exploited and Adrian should have contact with representatives who have a higher authority in xcitium then the fourm mods
Please teach Xcitium a lesson
vitao
Level 5
hello guys. being really busy these days.
i can not provide the poc files as im not the dev behind it and i promised the guy ill not share it. but even if i was allowed to do so, i dont think there is any point as comodo/xcitium seems to really dont care.
they banned me for reasons i dont know and i really dont care much, but the exploit is here and it tends to stay here for a looooong time as some are developing it further...
i guess its a matter of when we will start seeing things related to it messing around in fileless and some other ways. in fact its already happening but no one can talk about it as cis and xcitium are perfect
they banned me and deleted all the topics related to the exploit in cis forum and xcitium forum too, so...
or maybe its something personal and they are indeed working on some fix? who knows... what i know is that they took 2 months to solve the certificate issue just to prove they have no clue as there is one invalid cert inside cis as of now...
lets move on...?
i can not provide the poc files as im not the dev behind it and i promised the guy ill not share it. but even if i was allowed to do so, i dont think there is any point as comodo/xcitium seems to really dont care.
they banned me for reasons i dont know and i really dont care much, but the exploit is here and it tends to stay here for a looooong time as some are developing it further...
i guess its a matter of when we will start seeing things related to it messing around in fileless and some other ways. in fact its already happening but no one can talk about it as cis and xcitium are perfect
they banned me and deleted all the topics related to the exploit in cis forum and xcitium forum too, so...
or maybe its something personal and they are indeed working on some fix? who knows... what i know is that they took 2 months to solve the certificate issue just to prove they have no clue as there is one invalid cert inside cis as of now...
lets move on...?
The topic is still exist at Comodo forum, they said that working on a solution: PoC bypass Auto-Sandbox CIS
vitao
Level 5
so its personal as this topic was not created by me
F
ForgottenSeer 114717
No. It is a software with very low revenue. If users want to pay for the bug fixes, then Comodo will fix it.
Comodo has no obligation to fix its software. That is not how software works. It is sold "As Is." And if a software publisher does not want to fix bugs and problems, then they do not have to.
Microsoft has not fixed hundreds and hundreds of POC and other security problems over the decades. Man of those problems still remain.
vitao
Level 5
all this to defend one company?
F
ForgottenSeer 114717
There is no need to defend Comodo.all this to defend one company?
It owns the product. It can do whatever it wants or does not want to do with the product. Don't like it? Then don't use it.
A software with little to no revenue is never going to be any better than it is right now.
That's why you should sandbox everything if you going to sandbox otherwise this thing happens.
vitao
Level 5
that i agree with you my friend.
Recently browsing
Members who viewed this thread in the last 5 minutes
