Author Topic: Performance issue with HIPS enabled  (Read 2089 times)

Offline User Name

  • Comodo Member
  • **
  • Posts: 46
Re: Performance issue with HIPS enabled
« Reply #30 on: July 13, 2019, 06:26:22 AM »
Futuretech;
Did like you said( and I also added the steam library folder on another hard drive) but it only made it worse, the usage was at the height like before I made the exclusions for the self defense.

delete the shellcode injection exclusions the usage is now smaller but strangely higher as before I tried your advice... but maybe a reboot will help.

Ps: To avoid misunderstandings I have the same issues like I had before with the older CIS version.
If you are in need of any other system information data let it me know.
« Last Edit: July 13, 2019, 06:35:53 AM by User Name »
Try to change your attitude and not the sky above you.- Ceneca

Offline eitanc

  • Newbie
  • *
  • Posts: 20
Re: Performance issue with HIPS enabled
« Reply #31 on: July 18, 2019, 03:45:03 AM »
Hi,

I use version 12.0.0.6870. Until this version I used HIPS as enable with a large and complex HIPS rules and it worked OK.
But, since the above version - performance dropped sharply.
When HIPS is disabled all is fine.
I even tried to begin with a fresh, empty HIPS policy and in training mode - but still - the same. Maybe a bit better, but still there is a notable slowness.

cmdagent.exe is using a constant 12-13 percent CPU and it several nested wait chain.
There is another cmdagent process that is running in parallel, but it is quite idle.

Offline Mathi R

  • Global Moderator
  • Comodo Loves me
  • *****
  • Posts: 149
Re: Performance issue with HIPS enabled
« Reply #32 on: July 18, 2019, 07:37:05 AM »
Hi eitanc,

Thanks for reporting.Performance issue with HIPS will be fixed in next version of CIS.

Offline eitanc

  • Newbie
  • *
  • Posts: 20
Re: Performance issue with HIPS enabled
« Reply #33 on: July 18, 2019, 09:03:01 AM »
Good to know. Any ETA?

Offline futuretech

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 4380
Re: Performance issue with HIPS enabled
« Reply #34 on: July 20, 2019, 11:33:21 AM »
I have merged all topics of the same issue and according to a staff member issue will be fixed in the next version of CIS.

Offline General Z

  • Newbie
  • *
  • Posts: 5
Re: Performance issue with HIPS enabled
« Reply #35 on: July 25, 2019, 03:14:31 PM »
I don't understand why hardcoded HIPS exclusion is not the standard solution for this from the Devs [at]Mod. Please advise because Steam exclusion should really be a built-in trusted rule for HIPS.

SteamOverlay.exe directly accesses any games memory in order to provision overlay. Steam itself directly accesses games to provide DRM and networking (VAC) protections, and doesn't run them as child processes for performance reasons. Steam is signed but most videogames wouldn't be, so both of those would be HIPS violations and be detected... but Steam is a store so the content is already verified safe.

[at]futuretech / eitanc / Mathi  etc

HIPS still performs badly due to the new Windows update which is not CIS fault. The bug actually simulates what would be seen as an attack on CIS itself in the form of a memory access and this is a major reason for the performance issue.

Online EricJH

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 25612
Re: Performance issue with HIPS enabled
« Reply #36 on: July 27, 2019, 07:57:42 PM »
The problems reported are not due to CIS blocking Steamoverlay from accessing games in memory so I see no need to make exception for Steam.

Offline eitanc

  • Newbie
  • *
  • Posts: 20
Re: Performance issue with HIPS enabled
« Reply #37 on: August 06, 2019, 04:51:26 AM »
Nope, version 12.0.0.6882 doesn't solve this issue.

Online EricJH

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 25612
Re: Performance issue with HIPS enabled
« Reply #38 on: August 06, 2019, 02:20:47 PM »
6882 only brings fixes for the leaks found by Tenable and some crashes by cavwp.exe. Next releases will be regular bug fix releases again.

Offline eitanc

  • Newbie
  • *
  • Posts: 20
Re: Performance issue with HIPS enabled
« Reply #39 on: October 22, 2019, 05:00:10 PM »
I see version 12.1.x is now released - Why didn't this issue was fixed in it?! or up to it?!

This issue forces us to disable HIPS, making us more exposed.

Offline futuretech

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 4380
Re: Performance issue with HIPS enabled
« Reply #40 on: October 29, 2019, 12:37:07 PM »
I see version 12.1.x is now released - Why didn't this issue was fixed in it?! or up to it?!

This issue forces us to disable HIPS, making us more exposed.
How do you know it is not fixed? What testing scenario are you using to determine the issue? The issue of incorrect memory access for 32-bit applications is fixed in the newest release which should also fix the performance issue.

Offline eitanc

  • Newbie
  • *
  • Posts: 20
Re: Performance issue with HIPS enabled
« Reply #41 on: October 30, 2019, 12:47:30 AM »
Because I didn't see any reference to this issue on the release notes...
Anyway, I enabled hips now back on and it looks OK now. Thanks.

 

Free Endpoint Protection
Seo4Smf 2.0 © SmfMod.Com Smf Destek