Comodo Firewall and Avast 7

[Guest]

[Radaghast]

Is he saying they found a security hole and are using it with thier antivirus to fix the issue.

If so, maybe they should've notified microsoft...

I don't believe it's a "security hole" as such, it's more about the change of driver in Avast 7. From what lukor said, Avast have moved from using the TDI to using WFP and he believes that if Comodo is still using the TDI - from what I can see, it does - then this may be the reason we're seeing this. The problem with that hypothesis is, this also affects the Windows 7 firewall,  - and others - and the Windows 7 firewall is surely using the Windows Filtering Platform.   

[Radaghast]

Bitdefender Internet Security 2012 is also susceptible to this 'leak'. I wonder how many more...


 

[John Buchanan]

And as Microsoft is fond of saying... the issue lies with Avast's software. They need to correct it.

[Chiron]

Bitdefender Internet Security 2012 is also susceptible to this 'leak'. I wonder how many more...

Is it a leak or is this due to these programs trusting Avast in some way and it is thus allowed to 'bypass' all these programs?

[Radaghast]

Is it a leak or is this due to these programs trusting Avast in some way and it is thus allowed to 'bypass' all these programs?

It's the same as CIS, Windows 7 Firewall and Private firewall (I haven't personally tested PF), so far. They're simply unable to block connections being made through the Avast transparent HTTP proxy. Call it a leak, call it a failure on behalf of the firewall to block certain connections or call it a problem with the new Avast driver...

[clockwork]

And as Microsoft is fond of saying... the issue lies with Avast's software. They need to correct it.

Again, what would you say to a bad guy? Would it be HIS issue that his program can lead traffic of unrelated programs un-notified by a firewall into the internet? He needs to correct it?

Its an issue for the USERS!

[tbmaster]

Again, what would you say to a bad guy? Would it be HIS issue that his program can lead traffic of unrelated programs un-notified by a firewall into the internet? He needs to correct it?

Its an issue for the USERS!

That's true, the issue is with Comodo, not with Avast.
90% of firewalls don't have these problems with Avast.

Maybe we have to ask to malware creators to not use comodo's bugs to bypass the firewall. OMG!

[kail]

That's true, the issue is with Comodo, not with Avast.
90% of firewalls don't have these problems with Avast.

Maybe we have to ask to malware creators to not use comodo's bugs to bypass the firewall. OMG!

Since one the 10% is apparently Microsoft's own Windows 7 Firewall, then this should have given you some pause for thought before posting this.

[tbmaster]

Since one the 10% is apparently Microsoft's own Windows 7 Firewall, then this should have given you some pause for thought before posting this.

?_?

Microsoft windows 7 firewall si a simple basic firewall, not an advanced one.
If you advertise your firewall as the best of all, you can't compare it with windows firewall.
Using windows firewall is like not having a firewall.

EDIT:
If you are saying that, thinking that this is a windows bug, I have to think that comodo is based on windows firewall and this is no good.

[HeffeD]

?_?

Microsoft windows 7 firewall si a simple basic firewall, not an advanced one.
If you advertise your firewall as the best of all, you can't compare it with windows firewall.
Using windows firewall is like not having a firewall.

EDIT:
If you are saying that, thinking that this is a windows bug, I have to think that comodo is based on windows firewall and this is no good.

I think what he's is saying is that the Windows firewall has the widest user base of any software firewall...

In other words, whatever Avast has done with their updated web shield has negated millions of users firewalls.

[clockwork]

In other words, whatever Avast has done with their updated web shield has negated millions of users firewalls.

A security feature became a proof of concept

[languy99]

my issue is that the driver avast is using is doing this because it is trusted by comodo and allowing an install. If the driver was not trusted I highly doubt that it would be able to do any of this. Of course this is just theory and can't be tested unless avast provides and unsiged driver so that we can see what comodo does with it when trying to run it.

[Radaghast]

?_?

Microsoft windows 7 firewall si a simple basic firewall, not an advanced one.
If you advertise your firewall as the best of all, you can't compare it with windows firewall.
Using windows firewall is like not having a firewall.

It's staggering how many people still cling to the ridiculous notion that the firewall in Windows 7/Server 2008 is "simple" when it's anything but! It's also frustrating to see people pointing fingers at Comodo, when we know the problem is much wider than that.

The bottom line here, supposedly, Avast made a change to a single driver in Avast 7, that change appears to have rendered several firewalls, including CIS, vulnerable. 

[Radaghast]

my issue is that the driver avast is using is doing this because it is trusted by comodo and allowing an install. If the driver was not trusted I highly doubt that it would be able to do any of this. Of course this is just theory and can't be tested unless avast provides and unsiged driver so that we can see what comodo does with it when trying to run it.

It's an interesting idea and may well be applicable to CIS but it doesn't really explain the vulnerability in Windows firewall. For Private Firewall and Bitdefender - possibly others - we'd need to see if they have anything similar to the TVL/Trusted file/Safe list and how the interaction of such, with the firewall, causes the failure.

I also have a small problem with the idea that if something is 'Trusted' then all attempts to block connections in the firewall are subject to fail - which clearly isn't happening. By that logic, there wouldn't be any point having a firewall

What's basically being suggested, is that because D+ allows AvastSvc access to AFD, no amount of rule creation in the firewall, will have any impact and that really doesn't sound right.

[Chiron]

my issue is that the driver avast is using is doing this because it is trusted by comodo and allowing an install. If the driver was not trusted I highly doubt that it would be able to do any of this. Of course this is just theory and can't be tested unless avast provides and unsiged driver so that we can see what comodo does with it when trying to run it.

I would guess that it's either this or Avast has stumbled on a new way of bypassing many of the firewalls out there. Either way it's definitely worth it for Comodo to look into, at least to make sure that malware couldn't do this.

My best guess would be that it wouldn't happen if Avast weren't trusted, but I'm not sure. I'd like to hear from Comodo about this.

[Tags:]