Defense+ file integrity detection

[Guest]

[Vettetech]

Thank you Panic.....................this is my exact point. If you r just using your pc then for all of a sudden you get a D+ alert like what you said then something should make your spider sense tingle. This is how I became a believer in Comodo years ago with 2.4. One day out of the blue I got an alert about an unknown program to be trying to access the internet. I blocked it and ran a virus ans spyware check and bang. Spyware was found and deleted. Comodo made me aware of it.

[gpnx]

You guys relly too much on the file protection to keep your rules integrity intact. I will give you couple examples that its easily compromised during the normal computer usage.

1) Here i work on my computer and made couple of rules. Then some one else from the family sits down and installs something using install mode (hey, not everyone is computer savy, and not everyone can afford too many computers for everyone). Now, depending on what that person insall in comodo install mode, it can change anything, and it can modify exe's for which i have rules and comodo won't know that, because you use a "file path" as the way to connect exe to rule... AND DON"T ARGUE WITH ME HERE what should i use. I am the dumb user using what its alloweed, because i am using what comodo allows me - "install mode". So you see, using your product features allows easily the whole policy set integrity to be compromised.

2) A "windows system process" have memory buffer overrun issue which allows hacker to take over. Do a GOOGLE search and you will see countless cases of this. Now this modified exe can modify anything because it has the rights to do it. Here again, the integrity of the policies gets compromised

3) What about removable devices. Ppl nowadays use jump drives, hd enclosures etc to share stuff. Sometimes the same stuff just to be run on another computer. Files for which policy are establish can be changed outside the computer on which comodo runs...

Please, please, please, dont jump now and try to tell me how i can tighten the security even more which will lead to a frustration using the produc with all the popups. IF I PUT EXPLORER.EXE out of trusted apps, i will get popups on every action i try - for example executing a file... its annnoing.. I CAN DO THE SAME STUFF JUST USING NTFS - WHY I NEED COMODO AT ALL? VISTA ALREADY HAS GOOD THINGS.

Now, stop rellying too much on the file protection to keep your exe/policy rule integrity - as i show you already it can be easily skipped. Its dumb to really only on file path as the only way to connect/ensure the policy is applied for the exe for which it was created. Its laughable.

[Vettetech]

If people using your pc are downloading and installing anything they please then THAT is your problem. You can set up a LUA. Common sense plays a big roll here. If you do not trust who is using your pc and what they are doing then why are you letting them. Come on now your reaching for straws. I have told everyone in my family how has there own pc's never,never,never download or install anything you do not know or trust. And guess what. They don't. Educating people on how to surf the internet safely is more important then letting them install whatever they want. You can also put a password on Comodo to lock in your settings.

[gpnx]

If people using your pc are downloading and installing anything they please then THAT is your problem. You can set up a LUA. Common sense plays a big roll here. If you do not trust who is using your pc and what they are doing then why are you letting them. Come on now your reaching for straws. I have told everyone in my family how has there own pc's never,never,never download or install anything you do not know or trust. And guess what. They don't. Educating people on how to surf the internet safely is more important then letting them install whatever they want. You can also put a password on Comodo to lock in your settings.

If you install only trusted stuff (you don't install non trusted based on your words) WHY YOU NEED COMODO AT ALL?


Because THAT was my problem (ppl installing stuff etc, myself too)...i am trying security products, DON'T YOU UNDERSTAND IT? Common sense is to have the product working as supposed. If the product itself (via the install mode for example) allows the whole friging rule set to be compromised, then ...what a security is that.

Here i gave you 3 examples and you are bringing AGAIN OVER AND OVER your "install only trusted" stuff idea w/o even reviewing what i said. Please, please, please, enough. I got your idea, and i explained why it does not work.

[Vettetech]

Every pc needs security. Thats a given. There are things called drive by viruses and such. I also download music which I scan ever before opening. I fail to see your problem. Go ahead and download and install anything you want. You are asking for trouble like egemen said. I am not arguing with you but security starts with the user of the pc. Everyone users some sort of security. Some don't use av's but they still have something such as a behavoir blocker or Sandbox or even Returnil. If you want to install something and try this and try that then I would suggest to use Returnil. Especially if you do not trust who is using your pc and what they are installing. With Returnil all you have to do is reboot and all changes will be undine and your pc will be back to the way it was before some program was installed. Read here. I installed this on my neighbors pc since her kids would be downloading and installing anything.

http://www.returnilvirtualsystem.com/

[Melih]

If you install only trusted stuff (you don't install non trusted based on your words) WHY YOU NEED COMODO AT ALL?

Because malware doesn't just get in through user initiated means. By simply viewing a web page you can get malware!

What you need is a protection for Shared Computer. That is Comodo DiskShield !

thanks
Melih

[gpnx]

Because malware doesn't just get in through user initiated means. By simply viewing a web page you can get malware!

What you need is a protection for Shared Computer. That is Comodo DiskShield !

thanks
Melih

I will take a look at this, but still that won't resolve the (3) issue i explained which may invalidates the integrity of the comodo firewall/defense policy association to a particular exe.

I really don't know why trying to shift the issue - its a flaw in comodo that does not do a check if the executable is the original for which the policy is applied. And again, i gave you 3 exaples... I understand that your idea is that comodo tracks the changes to the files, so suposedly the user will always be notified.but as i explained, there are cases in which the user won't be notified...
Just add a hash check as all other respectable firewalls/hips does... its not that hard anyway.

[Vettetech]

You are doing things malware cannot do. Plain and simply. Malware cannot just run invisible unless you allow it to. If you have a malware infection and when that certain malware trys to run D+ will give you an alert or else you av will catch it.If you get an alert and you do not know what it is then block it.

[Vettetech]

You clearly are not understanding how D+ works or any other HIPS program. Install mode is for installing something. Thats it. Once your done installing and you launch that program you just installed then D+ will give an alert about that program and what it is doing. If you do not like what its doing then block it. Then again like I keep saying why are you installing something you do not trust. Any security software is only as good as the user. If my NOD32 finds a virus but I choice not to clean it is that NOD32's fault. No. It did its job and told me about it and its up to me to clean and delete it.

[Vettetech]

Any HIPS program involves user intervention. So even if you infected and you have different users of your pc as you say, who is to say that D+ gives them an alert and all they do is click "allow" and let the malware run amock. Where as you would block it. If your trying to protect your pc when others are using it then Comodo cannot do this without user intervention. This is why I said  use Returnil. It doesn't matter if you download every virus and malware in the world. It doesn't matter what changes go on cause they will be all gone the minute you reboot.

[gibran]

I will take a look at this, but still that won't resolve the (3) issue i explained which may invalidates the integrity of the comodo firewall/defense policy association to a particular exe.

I really don't know why trying to shift the issue - its a flaw in comodo that does not do a check if the executable is the original for which the policy is applied. And again, i gave you 3 exaples... I understand that your idea is that comodo tracks the changes to the files, so suposedly the user will always be notified.but as i explained, there are cases in which the user won't be notified...
Just add a hash check as all other respectable firewalls/hips does... its not that hard anyway.

I guess that even if I provide an answer to your suggested scenarios you won't be satisfied.
It's clear to me you want a feature most CFP user don't make use of and that you consider "shifting" all the descriptions how the CFP design can be used to secure a machine.

I'll provide a short answer in case another reader crosses this topic without such unalterable perspective.

1) Here i work on my computer and made couple of rules. Then some one else from the family sits down and installs something using install mode

There is not much to do with this scenario even with hash-based integrity checks. Untrained users can render useless any kind of protection. In this case they only have to accept hash changes alerts. CFP can limit such scenarios using parental control letting users only use programs with an assigned policy and deny any new action.

2) A "windows system process" have memory buffer overrun issue which allows hacker to take over. Do a GOOGLE search and you will see countless cases of this. Now this modified exe can modify anything because it has the rights to do it. Here again, the integrity of the policies gets compromised

BO exploits cannot be monitored using hash-based integrity checks however Comodo Safesurf that can be optionally installed with CFP 3.0.25 can prevent such scenarios. Updated software can limit such scenarios in first intance.

3) What about removable devices. Ppl nowadays use jump drives, hd enclosures etc to share stuff. Sometimes the same stuff just to be run on another computer. Files for which policy are establish can be changed outside the computer on which comodo runs...

CFP doesn't consider trusted applications belonging to removable devices. Saving a policy for apps on such devices is a poor user-behaviour.

Previous CFP version reported filechanges in all modes (pending files), however user complains restricted this feature only to CFP CleanPC Mode. There was no need to use Hash integrity check from the start as CFP was already able to track such changes.

However CFP never used pending list to invalidate existing policies since D+ is able to monitor system integrity in realtime and such policy invalidation could be perceived as an hassle by users.

Hash integrity checks belonged to previous generation of Firewall and were a way to ensure that applications connecting to internet were not altered before existing firewall rules were enforced. In fact most hips-less firewall were not able to control file integrity in realtime so this check was postponed when an application attempted a connection.

CFP installation policy is only meant for trusted executables. That is an user need to make sure that an executable is trusted before using such policies. This can be done using AV or submitting executables to Comodo. Comodo Safelist DB installed with CFP already recognize a vast amount of safe apps.

Defense+ kicks in when handling apps that the user cannot trust completely. Post detection of file changes by means of hashes cannot prevent scenarios which CFP currently warn about.
Eg overwriting a kernel driver (in this case hash based protection will be useless once that driver has full control over the system)

[gibran]

I guess this topic has fulfilled its purpose therefore it will be locked.

Please submit feature suggestions to Comodo Firewall Wishlist V6 or gather feedback from other Comodo users creating a poll in an appropriate board and submitting a link to PLEASE VOTE HERE!!!!!! (If you are running a poll then pls put a link here!)

[Tags:]