Would Comodo have stopped the Stuxnet worm?

[Guest]

[aweir14150]

Would it stop a malware with a stolen digital signature from installing? 

[kagun]

depends on the config and how a user would answer any/all alerts....
I guess some if not all would be sandboxed because of, you know, they are unknown files after all 
As for digi certs, well, anything can happen...

[Chiron]

The next version should be immune to signed malware.

[Siketa]

The next version should be immune to signed malware.

That's good to hear!

Can you share something or give us a hint?

[SpeedyPC]

That's good to hear!

Can you shares some clue or give us a hint?

+1 Sound very interesting

[disPPlay]

+1 Sound very interesting

Agree with you.

[Valentin N]

Would it stop a malware with a stolen digital signature from installing?  

To answer you question: I don't think it will due to the safe digital signature.

I recommend you to have "unrecognized files will be treated as Untrusted" and unmark Automaticaly trust files from trusted installer in Sandbox Settings.

unknown files will be automatically sandboxed and you will get more pop ups but that's worth it; you will be protected.

Regards,
            Valentin N

[HeffeD]

and unmark Automaticaly install files from trusted vendors in Execution control Settings.

I think you are unclear on what this setting does. It's not like the old, don't use the trusted vendors list option.

If an installer is trusted (either by CIS or by the user) any files created by this installer are also considered trusted to keep them from being sandboxed during the install.

If you trust the installer, why wouldn't you want the respective files to stay out of the sandbox?

[Valentin N]

I think you are unclear on what this setting does. It's not like the old, don't use the trusted vendors list option.

If an installer is trusted (either by CIS or by the user) any files created by this installer are also considered trusted to keep them from being sandboxed during the install.

If you trust the installer, why wouldn't you want the respective files to stay out of the sandbox?

I mean sandbox settings. Sorry my mistake. I have modified my previous post.

Regards,
            Valentin N

[HeffeD]

I mean sandbox settings. Sorry my mistake. I have modified my previous post.

But again, I don't think you are understanding what this option does.

A quick example with Automatically trust files from trusted files enabled:

I want to install MyFavoriteApp.exe. This application uses a .bat file or two to unpack files or copy files to respective folders, or perhaps runs a script. This application is not on the trusted vendor list. I get an alert asking if the installer should be allowed to run. I say yes... Great success!! Installation went without a hitch! 

OK, now we disable Automatically trust files from trusted files:

Again, we want to install MyFavortieApp.exe. We tell CIS, yes, let the installer run at the alert. Oh, but wait, this .bat file is unrecognized! I'll sandbox it for you! Install fails because the .bat or script wants to do some things that our isolation level doesn't allow. OK, I click on the don't isolate again link in the sandbox alert, but this doesn't help because the install has already failed. So, we try again and the install gets past the original .bat, but hey, there's another one I don't recognize! Sandbox! Click don't isolate... Try to install again... Rinse and repeat for however many components of the installer that are unrecognized.

I wouldn't recommend disabling this. Sure, I guess you could say you're more secure because each unrecognized file is getting sandboxed, but really, do you want it to do that? If you don't trust all the components of an installer, you don't actually trust the installer, now do you?   

[aweir14150]

So, if a malware is signed, it will be treated as unknown?   sorry for the confusion, I thought Comodo only automatically sandboxed unknown, unsigned files.

There are 4 possible categories...

signed, known
signed, unknown
unsigned, known
unsigned, unknown.

Am I correct?

[Chiron]

So, if a malware is signed, it will be treated as unknown?   sorry for the confusion, I thought Comodo only automatically sandboxed unknown, unsigned files.

There are 4 possible categories...

signed, known
signed, unknown
unsigned, known
unsigned, unknown.

Am I correct?

It doesn't just matter that a file is signed. In order for it to be trusted the digital signature must be in the TVL. Otherwise the file is unknown and will be sandboxed (with the information that the file is signed provided in the popup).

[aweir14150]

Ok, now I see...and thanks for the clarification. 

[Valentin N]

But again, I don't think you are understanding what this option does.

A quick example with Automatically trust files from trusted files enabled:

I want to install MyFavoriteApp.exe. This application uses a .bat file or two to unpack files or copy files to respective folders, or perhaps runs a script. This application is not on the trusted vendor list. I get an alert asking if the installer should be allowed to run. I say yes... Great success!! Installation went without a hitch! 

OK, now we disable Automatically trust files from trusted files:

Again, we want to install MyFavortieApp.exe. We tell CIS, yes, let the installer run at the alert. Oh, but wait, this .bat file is unrecognized! I'll sandbox it for you! Install fails because the .bat or script wants to do some things that our isolation level doesn't allow. OK, I click on the don't isolate again link in the sandbox alert, but this doesn't help because the install has already failed. So, we try again and the install gets past the original .bat, but hey, there's another one I don't recognize! Sandbox! Click don't isolate... Try to install again... Rinse and repeat for however many components of the installer that are unrecognized.

I wouldn't recommend disabling this. Sure, I guess you could say you're more secure because each unrecognized file is getting sandboxed, but really, do you want it to do that? If you don't trust all the components of an installer, you don't actually trust the installer, now do you?   

Thank you for the explanation and for improving my knowledge regarding this option. I hope you also understand why I recommended those settings.

Regards,
            Valentin N

[SiberLynx]

I think you are unclear on what this setting does...

True! ... again

Unfortunately as it stands now - he is unclear of anything he is posting as far as I am concerned so far... Just posting a lot of ... and more & whole load of **** around the place

Well, blame me again ... and again  

"personal attack"? "flamebait" ? whatever ... please go ahead

Cheers! & Happy New Year! to all of you

[Tags:]