bypass CIS v6.2 fully virtualized

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
1
  1. I ran the malware.

http://camas.comodo.com/cgi-bin/submit?file=c711b000360129c9417a61a7a1af765c56dd37df1c58492b827c19563e2674f3

http://valkyrie.comodo.com/Result.html?sha1=2b9e91baa9e2c63c3c1042b25b38d61d087e42c9&&query=1&&filename=1b9a02ec0636fde0a3b3cb70ac9d5eb5.exe

  1. It was sandboxed as fully-virtualized.

  2. I reset the sandbox.

  3. I checked the autorun entry.

Please view the attached image.

  1. The malware successfully create autorun entries outside the sandbox.

6.environment:
Win XP Pro SP3 32bit

[attachment deleted by admin]

2

Hi, thanks for the report. Does this happen too with Win 7, have you tried? Same for https://forums.comodo.com/news-announcements-feedback-cis/bypass-cis-v62-partially-limited-limited-and-hips-t95939.0.html

3

That issue is for 32bit system only.

4

could send me sample?
would like to test on windows 7 because use and wanted to see how the CIS 6.2 behaves.

========================================================
the issue of screenlogger reported by jaspion also not fixed.
https://forums.comodo.com/news-announcements-feedback-cis/screen-capture-protection-t94921.60.html

5

This case and a few other cases reported before rely on the same technique. We fixed it but haven’t issued the update yet.

6

And when would that be? Soon or later on?

7

When can we expect said update to go live? You don’t have to be super specific but maybe say days, weeks, months?

Edit: ■■■■ it, too late, I really must re-enable that warning about new posts 88)

8

The fix is very specific and hence we need to get it tested more. We should be able to include it with the next release.

Weeks is what we are talking about.

9

Alright, looking forward to the update.

10

In the mean time, you can simply add LocalSecurityAuthority.Debug to your protected COM interfaces to address this issue.

11

Thank you for the tip! =) I wonder, is there any similar malware/technique that you know of that can bypass CIS’ full virtualization on 64-bit systems?

12

@a256886572008, is this fixed with CIS version 6.2.285401.2860?

13

https://forums.comodo.com/leak-testingattacksvulnerability-research/bypass-cis-v62-fully-virtualized-t95943.0.html
no

https://forums.comodo.com/leak-testingattacksvulnerability-research/bypass-cis-v62-partially-limited-limited-and-hips-t95939.0.html
no

14

They have not released the fixes yet. Egemen said in few weeks on another topic, days ago.