Author Topic: CMG & DEP  (Read 30434 times)

Offline SiberLynx

  • Comodo's Hero
  • *****
  • Posts: 2194
CMG & DEP
« on: September 02, 2007, 07:42:48 AM »
Greetings all,
Ok! Another Comodo product installed. (B)
We have system software DEP implemented. Most contemporary PCs (like this one here) have Hardware-enforced DEP, which is enabled in BIOS, as recommended.
May I ask the respective community where CMG stands?
Is it a strong(-est!) additional layer of such particular type of needed security or, ideally,  in the nearest “after-beta” future – that’s all we may pray for and use?
Where can one read more detailed technical info, comparisons, reviews,.. how CMG can fight some known methods to circumvent HD and/or  SW DEP protection etc.
Thanks in advance
« Last Edit: October 10, 2008, 07:53:36 AM by SiberLynx »
Main OS - Ubuntu
XP Pro, SP3 (32bit), Admin; Comodo Firewall 3.14.130099.587; Proactive with Defense+; Emsisoft Anti-Malware v9; Sandboxie
Win 7 x64, Admin (UAC off); Win7 advanced FW +TinyWall; Emsisoft Anti-Malware v9; Sandboxie
Win 7 Ultimate 32bit (UAC off); Emsisoft Internet Security v9 beta

Offline Tyler Durden

  • Comodo Loves me
  • ****
  • Posts: 164
Re: CGM & DEP
« Reply #1 on: September 02, 2007, 08:18:59 AM »
I've allready answered that question in other topic mate :) Ok here we go again:
1. Software DEP is nothing but SEH chain validator (means it's not a DEP but some way to prevent one rare type of shellcode's injection)
2. Hardware DEP is very incompatible thing, that's why:
 a) DEP mode by default is OptIn = all system services are protected, user apps aren't protected
 b) DEP is _VERY_ incompatible thing so we 've got one more "layer" over DEP-mode - windows disables DEP for app which is know to be incompatible with DEP (this includes many checks, like exe-packers check and so on)
3. DEP-protection is vulnerable to ret2libc kind of attack (so you're not protected at all)

So we 've got CMG :) A fast and compatible way to be protected. It protects all apps against ret2libc and common BO attacks, and it doesn't treminate your favorite apps as well :)
« Last Edit: September 02, 2007, 08:24:01 AM by Tyler Durden »
The Verve RETURNED !!! Can't you feel this beauty in life ?!

Offline SiberLynx

  • Comodo's Hero
  • *****
  • Posts: 2194
Re: CGM & DEP
« Reply #2 on: September 02, 2007, 10:44:43 AM »
Hi Tyler,
Thank you very much, mate :)
Very interesting and that's info I was searching for (ret2libc in particular).
As a matter of fact, I was searching for "DEP" before posting. I usually do that. I found some DEP-CPF related Q&A but missed that "other topic" you are referring to.
I'm sure another mate will come with the similar Q and you will be quite annoyed to
write:
I've allready answered that question in other topic mate :) Ok here we go again:...
It is very helpful and important info, mate :). It deserves to be Sticky
I do appreciate your reply.
Ok here we go again...Mate! (:WAV) :Beer   
Main OS - Ubuntu
XP Pro, SP3 (32bit), Admin; Comodo Firewall 3.14.130099.587; Proactive with Defense+; Emsisoft Anti-Malware v9; Sandboxie
Win 7 x64, Admin (UAC off); Win7 advanced FW +TinyWall; Emsisoft Anti-Malware v9; Sandboxie
Win 7 Ultimate 32bit (UAC off); Emsisoft Internet Security v9 beta

Offline Tyler Durden

  • Comodo Loves me
  • ****
  • Posts: 164
Re: CGM & DEP
« Reply #3 on: September 02, 2007, 10:56:23 AM »
No problem  :Beer :Beer :Beer :Beer :Beer :Beer :Beer
The Verve RETURNED !!! Can't you feel this beauty in life ?!

Offline SiberLynx

  • Comodo's Hero
  • *****
  • Posts: 2194
Re: CGM & DEP
« Reply #4 on: September 02, 2007, 12:38:00 PM »
7 beers!!!???
I am not sure I will be interested in DEP after that...
unless it stands for Damn Enuresis Piss
 :SMLR
Main OS - Ubuntu
XP Pro, SP3 (32bit), Admin; Comodo Firewall 3.14.130099.587; Proactive with Defense+; Emsisoft Anti-Malware v9; Sandboxie
Win 7 x64, Admin (UAC off); Win7 advanced FW +TinyWall; Emsisoft Anti-Malware v9; Sandboxie
Win 7 Ultimate 32bit (UAC off); Emsisoft Internet Security v9 beta

Offline MikeH

  • Comodo Loves me
  • ****
  • Posts: 169
Re: CGM & DEP
« Reply #5 on: November 23, 2007, 03:32:24 PM »
It is very helpful and important info, mate :). It deserves to be Sticky

I could not agree more!

Regards,
Mike

Offline SS26

  • Comodo's Hero
  • *****
  • Posts: 1925
Re: CGM & DEP
« Reply #6 on: February 25, 2008, 04:55:05 PM »
Just to make sure: can someone who has CMF running disable DEP completely (NoExecute=AlwaysOff) as it is useless (with CMF running)?

Offline Tyler Durden

  • Comodo Loves me
  • ****
  • Posts: 164
Re: CGM & DEP
« Reply #7 on: February 25, 2008, 05:59:58 PM »
Yes, you can. But overprotection is not bad too :)
The Verve RETURNED !!! Can't you feel this beauty in life ?!

Offline SS26

  • Comodo's Hero
  • *****
  • Posts: 1925
Re: CGM & DEP
« Reply #8 on: February 25, 2008, 06:34:23 PM »
Yes, you can. But overprotection is not bad too :)
Thanks for reply :-TU

Offline BigWoop

  • Comodo Member
  • **
  • Posts: 34
Re: CMG & DEP
« Reply #9 on: November 03, 2008, 10:26:17 AM »
Confused, where is CMG available? Is it different to CMF? Does CIS include anything like either of the two?

Offline SS26

  • Comodo's Hero
  • *****
  • Posts: 1925
Re: CMG & DEP
« Reply #10 on: November 03, 2008, 03:46:40 PM »
It's an evolution: first was CMG (Comodo Memory Guardian), than it was renamed at some stage to CMF (Comodo Memory Firewall).
...And CIS has SafeSurf (if you agreed to install it during installation process of CIS) which do (nearly) same job as CMF.
Hopefully I'm not mistaken anywhere :)

Offline BigWoop

  • Comodo Member
  • **
  • Posts: 34
Re: CMG & DEP
« Reply #11 on: November 05, 2008, 05:59:05 AM »
Safe surf being the same safe surf toolbar thing that comes with CFP3 I guess?

I thought that scanned websites you were surfing or something, unless it does also have the functionality of CMF.

I would have thought that CIS would have something similar to CMF, other than safe surf.

Offline SS26

  • Comodo's Hero
  • *****
  • Posts: 1925
Re: CMG & DEP
« Reply #12 on: November 05, 2008, 10:52:35 AM »
Safe surf being the same safe surf toolbar thing that comes with CFP3 I guess?
Yes. It is same thing (even same version: 1.0.0.6), but I'm referring to cssurf.exe, which provides BO protection but is not related to toolbar - you can uninstall toolbar (ask.com entry under add\remove apps) but still have BO protection.

Offline BigWoop

  • Comodo Member
  • **
  • Posts: 34
Re: CMG & DEP
« Reply #13 on: November 05, 2008, 02:50:55 PM »
But isn't BO protection what CBOClean does? CMF handles memory buffer overflow attacks (whatever those are :))

Offline Japo

  • Autonomous Human
  • Comodo's Hero
  • *****
  • Posts: 1773
  • Life starts every day anew. Prospects not so good.
Re: CMG & DEP
« Reply #14 on: November 05, 2008, 04:45:50 PM »
BOClean doesn't protect against buffer overflow. The BO in BOClean stands for Back Orifice, believe it or not.

The Comodo products that protect against buffer overflow (also usually abbreviated BO) are CMF and SafeSurf, not BOClean.
Windows users do not disable UAC

 

Seo4Smf 2.0 © SmfMod.Com Smf Destek