Author Topic: Buffer Overflow Testing Application!  (Read 78275 times)

Offline Melih

  • CEO - Comodo
  • Administrator
  • Comodo's Hero
  • *****
  • Posts: 14692
    • Video Blog
Buffer Overflow Testing Application!
« on: September 10, 2007, 01:33:18 PM »
Lets see if your security products (AV, firewall or other) protect you from a Buffer Overflow (BO) attack, which is one of the most common form of attacks for users. Especially Drive-by-Download attacks extensively utilise BO to inject malware to users's machines.

COMODO BO Tester is a testing utility which checks whether your system is vulnerable to buffer overflow attacks or not.

COMODO Memory Guardian protects your applications against these attacks in both 32 bit and 64 bit environments.

It includes 3 separate tests each of which tries to exploit a different type of attack technique.

Test 1
-------
Tests the protection against stack overflows i.e. code execution in the stack

Test 2
------
Tests the protection against heap overlows i.e. code execution in the heap

Test 3
------
Tests the protection against ret2libc attacks i.e. one of the most difficult to detect BO attacks.


If your host (PC/Machine) is protected, the utility will report the status "Protected"
ortherwise it will report "Vulnerable"

Download Locations :

For 32 bit Operating Systems
http://download.comodo.com/cpf/download/setups/utility/Setup_BOTester_x32.exe

For 64 bit Operating Systems
http://download.comodo.com/cpf/download/setups/utility/Setup_BOTester_x64.exe

Go ahead and distribute this to everyone you know to see if they are protected or not.. and for the Protection come and get Comodo Memory Guardian... FOR FREE!!!

thanks
Melih
« Last Edit: December 30, 2007, 02:10:12 PM by Melih »

Offline sandip

  • Newbie
  • *
  • Posts: 1
Re: Buffer Overflow Testing Application!
« Reply #1 on: September 12, 2007, 06:39:31 PM »
Hi Melin

COMODO BO Tester

Test 1 & 2 showed "Protected", but Test 3 showed that my system is vulnerable.Pls suggest what to do now?

Offline grcguy

  • Comodo Family Member
  • ***
  • Posts: 78
Re: Buffer Overflow Testing Application!
« Reply #2 on: September 12, 2007, 07:17:11 PM »
Hi Melih,

I have installed the Comodo Memory Guardian, and it told me all three tests are protected, but I'm just wondering if I should be seeing any activity to know that this is working? Since I installed it, it just sits in my tray. Does it need to get updated? Just curious.

Thank you for the great products, I appreciate the time and expense that your company puts into deveopments for people like me who have no clue! (V)
Secured by:
CIS:4.1
Browser: Firefox
MS Windows SP2
Intel Pentium D 3.20Ghz

Offline Melih

  • CEO - Comodo
  • Administrator
  • Comodo's Hero
  • *****
  • Posts: 14692
    • Video Blog
Re: Buffer Overflow Testing Application!
« Reply #3 on: September 12, 2007, 10:08:33 PM »
Hi Melih,

I have installed the Comodo Memory Guardian, and it told me all three tests are protected, but I'm just wondering if I should be seeing any activity to know that this is working? Since I installed it, it just sits in my tray. Does it need to get updated? Just curious.

Thank you for the great products, I appreciate the time and expense that your company puts into deveopments for people like me who have no clue! (V)

Hi Grcguy

yep, its working!
you don't get BOd everyday.. but when you do... you are hosed! So leave it running. it will save you one day!

Melih

Offline Tyler Durden

  • Comodo Loves me
  • ****
  • Posts: 164
Re: Buffer Overflow Testing Application!
« Reply #4 on: September 13, 2007, 02:36:47 AM »
Hi Melin

COMODO BO Tester

Test 1 & 2 showed "Protected", but Test 3 showed that my system is vulnerable.Pls suggest what to do now?

Hi. Install Comodo Memory Guardian :)
The Verve RETURNED !!! Can't you feel this beauty in life ?!

Offline MikeG

  • Comodo's Hero
  • *****
  • Posts: 334
  • Retired Radio and Electronics Engineer
Re: Buffer Overflow Testing Application!
« Reply #5 on: September 13, 2007, 03:13:12 AM »
Just a point to make that did confuse me on the first run.

You have to click on 'kill' on all 3 pop-up boxes if you have CMG installed, then the test  says you are 'protected' on all 3 threats.

If you 'allow' all 3 in CMG then the test shows 'Vulnerable'.

Logical but I had to think about it.  ;)

Good little test program though; thanks Melih. :)

Mike.
« Last Edit: September 13, 2007, 03:15:01 AM by MikeG »
ISP: VirginMedia ADSLmax. up to 8Mb.
Firewall: Comodo Firewall Pro v.4.1
Anti Virus: BOClean 4.27, Avast 5.
Anti-spyware: SpywareBlaster, Spybot.
For scans when required: SuperAntiSpyware, Malwarebytes

Offline N.T.T.W.

  • Comodo's Hero
  • *****
  • Posts: 1124
  • A minute of your time can help many.
Re: Buffer Overflow Testing Application!
« Reply #6 on: September 13, 2007, 04:38:35 AM »
Good test. Also good to see that CAVS HIPS prevents any of the tests from running if you tell it to.

 :SMLR
Post proelia praemia.
Die dulci fruere.

Offline Tyler Durden

  • Comodo Loves me
  • ****
  • Posts: 164
Re: Buffer Overflow Testing Application!
« Reply #7 on: September 13, 2007, 08:02:04 AM »
CAVS doesn't protect from BO, it just block "suspicious behavior" of test's files.
The Verve RETURNED !!! Can't you feel this beauty in life ?!

Offline N.T.T.W.

  • Comodo's Hero
  • *****
  • Posts: 1124
  • A minute of your time can help many.
Re: Buffer Overflow Testing Application!
« Reply #8 on: September 13, 2007, 08:11:37 AM »
If HIPS warns about a file attempting to do something and then is able to stop that file's action then surely this is a form of protection. Merely a different type or 'added layer' of protection.

I know the HIPS in CAVS at present will not prevent some files from acting (though I believe CFP beta is better), as I have discovered with a few nasties, however it is reassuring that it can stop some files. All part of Melih's concept of layered protection - what one layer misses another catches.  ;D
Post proelia praemia.
Die dulci fruere.

Offline lmg_35C

  • Newbie
  • *
  • Posts: 2
Re: Buffer Overflow Testing Application!
« Reply #9 on: September 19, 2007, 11:57:44 AM »
Well, my McAfee product (latest and most updated version) failed all three tests. Time to switch to Comodo - Thanks!

Offline ganda

  • thermodynamic defier
  • Comodo's Hero
  • *****
  • Posts: 5896
Re: Buffer Overflow Testing Application!
« Reply #10 on: September 20, 2007, 05:06:39 AM »
Test 1 & 2 showed "Protected", but Test 3 showed that my system is vulnerable.Pls suggest what to do now?
i even failed all of tests.

i have CAVS 2.0.15.51, CFP 2.4, CBOclean, & CMG. i disabled CMG and tried the tester, i failed all of the tests, (HIPS warning showed up though).
is it normal?
so AV & firewall can't protect our computer from BO attack at all?

Offline Melih

  • CEO - Comodo
  • Administrator
  • Comodo's Hero
  • *****
  • Posts: 14692
    • Video Blog
Re: Buffer Overflow Testing Application!
« Reply #11 on: September 20, 2007, 10:02:00 AM »
i even failed all of tests.

i have CAVS 2.0.15.51, CFP 2.4, CBOclean, & CMG. i disabled CMG and tried the tester, i failed all of the tests, (HIPS warning showed up though).
is it normal?
so AV & firewall can't protect our computer from BO attack at all?

well v3 of our firewall can, cos it will have CMG built in.

Melih

Offline ganda

  • thermodynamic defier
  • Comodo's Hero
  • *****
  • Posts: 5896
Re: Buffer Overflow Testing Application!
« Reply #12 on: September 20, 2007, 10:01:25 PM »
well v3 of our firewall can, cos it will have CMG built in.

Melih

 :Beer :Beer :Beer cheers to that

Offline gkweb

  • Newbie
  • *
  • Posts: 6
Re: Buffer Overflow Testing Application!
« Reply #13 on: September 21, 2007, 03:57:26 AM »
Hello,

EDIT : i'm talking about CMG and not the tester which works fine, I'm in the wrong post.

Seems interesting. However, what is the overhead caused by CMG ? I mean, it must check every memory access for every application constantly ? Doesn't it slow down the system ?
Also, I'm on Vista x64 and wanted to give it a try, but it cannot install as apparently one file is not signed.

Regards,
gkweb.
« Last Edit: September 21, 2007, 04:03:18 AM by gkweb »

Offline Tyler Durden

  • Comodo Loves me
  • ****
  • Posts: 164
Re: Buffer Overflow Testing Application!
« Reply #14 on: September 21, 2007, 04:13:07 AM »
Hello,

EDIT : i'm talking about CMG and not the tester which works fine, I'm in the wrong post.

Seems interesting. However, what is the overhead caused by CMG ? I mean, it must check every memory access for every application constantly ? Doesn't it slow down the system ?
Also, I'm on Vista x64 and wanted to give it a try, but it cannot install as apparently one file is not signed.

Regards,
gkweb.
There's no "overhead" (overhead ?) caused by CMG at all, it's very _VERY_ fast due to it's original protection method (and it's a secret actually :))
The Verve RETURNED !!! Can't you feel this beauty in life ?!

 

Free Endpoint Protection
Seo4Smf 2.0 © SmfMod.Com Smf Destek