Comodo containment and HIPS against recent ransomware

[cruelsister]

Just in case anyone was wondering, Comodo Containment deals with the Darkside ransomware strain (the one that is all over the news the past few days) quite nicely. All system changes are prevented.

[Eric Cryptid]

Just in case anyone was wondering, Comodo Containment deals with the Darkside ransomware strain (the one that is all over the news the past few days) quite nicely. All system changes are prevented.

Nice one, thanks for confirming!

[CISfan]

Just in case anyone was wondering, Comodo Containment deals with the Darkside ransomware strain (the one that is all over the news the past few days) quite nicely. All system changes are prevented.

Thank you. That's very good to know.

Do all default CIS config types protect against it the same way or only the pro-active one?
Does CIS need some special settings for optimal protection?

[Ploget]

Thanks M .  . . . nice to know and thanks for the info 

Just in case anyone was wondering, Comodo Containment deals with the Darkside ransomware strain (the one that is all over the news the past few days) quite nicely. All system changes are prevented.

[cruelsister]

The configuration doesn't matter, nor does the actual Containment level (Partially Limited works just fine). Note also that the Firewall at Safe Mode will alert to the ransomware attempting to infect others on the Network,

Also for giggles, in addition to this one from the Darkside Group I also ran a few newer files that are all the rage this month on TOR. They come from what my friends at Mandiant have labeled as the UNC2447 group. Related to Deathransom (HelloKitty), the variants tested were FIVEHANDS and Sombrat. All were contained without any system changes.

Why Industry doesn't use Comodo Endpoint is beyond me...

[CommodoUser2019]

Why Industry doesn't use Comodo Endpoint is beyond me...

I agree... and why they think having CRITICAL infrastructure connected to the internet as good security is beyond stupid regardless of their rhetoric.

[NDABBRU]

The configuration doesn't matter, nor does the actual Containment level (Partially Limited works just fine). Note also that the Firewall at Safe Mode will alert to the ransomware attempting to infect others on the Network,

Also for giggles, in addition to this one from the Darkside Group I also ran a few newer files that are all the rage this month on TOR. They come from what my friends at Mandiant have labeled as the UNC2447 group. Related to Deathransom (HelloKitty), the variants tested were FIVEHANDS and Sombrat. All were contained without any system changes.

Why Industry doesn't use Comodo Endpoint is beyond me...

It's very interesting, and it's nice to know that Comodo's containment (in any configuration) protects us. 

[Citizen K]

The configuration doesn't matter, nor does the actual Containment level (Partially Limited works just fine). Note also that the Firewall at Safe Mode will alert to the ransomware attempting to infect others on the Network,

Also for giggles, in addition to this one from the Darkside Group I also ran a few newer files that are all the rage this month on TOR. They come from what my friends at Mandiant have labeled as the UNC2447 group. Related to Deathransom (HelloKitty), the variants tested were FIVEHANDS and Sombrat. All were contained without any system changes.

Why Industry doesn't use Comodo Endpoint is beyond me...

Thank you and good to hear from you again.

[cruelsister]

Thanks Eric! And if you would allow a followup- the FIVEHANDS ransomware I mentioned above is making the news today, example here:

https://www.zdnet.com/article/new-ransomware-cisa-warns-over-fivehands-file-encrypting-malware-variant/

One interesting thing about it is that although it is totally blocked by Comodo Containment, the encryption process would be allowed to proceed if ONLY the HIPS is enabled at Safe Mode (even if the user selects Block at every prompt).

I bring this up only for those that would prefer HIPS (any HIPS from anybody, actually) over Containment.

[Citizen K]

How does Fivehand get around a HIPS? Is it a fileless malware that calls legit script engines? Is it living off the land?

[futuretech]

Thanks Eric! And if you would allow a followup- the FIVEHANDS ransomware I mentioned above is making the news today, example here:

https://www.zdnet.com/article/new-ransomware-cisa-warns-over-fivehands-file-encrypting-malware-variant/

One interesting thing about it is that although it is totally blocked by Comodo Containment, the encryption process would be allowed to proceed if ONLY the HIPS is enabled at Safe Mode (even if the user selects Block at every prompt).

I bring this up only for those that would prefer HIPS (any HIPS from anybody, actually) over Containment.

I find that very hard to believe unless you expect HIPS to protect files that are not listed under protected files. If you add ?:\* to protected files then all drivers will be protected from unwanted modification.

[CISfan]

I'm wondering (in case not using Containment), how does the ransomware encryption process still pass thru HIPS safe mode when the user blocks every HIPS Alert?
Can this be prevented in some way?
It would be nice to have two protection layers, one by Containment and one by HIPS (safe mode).

[Nautilus]

[at]cruelsister , hi meghan. I am still rocking your config with containment and all the other setting you did recommend , and it still runs smooth and light , without the hassle of all those popups / warnong messages! hope you are doing fine in NYC!

[Citizen K]

I find that very hard to believe unless you expect HIPS to protect files that are not listed under protected files.

Cruelsister states CIS HIPS gets bypassed when running it in Safe Mode.

If you add ?:\* to protected files then all drivers will be protected from unwanted modification.

Drivers, .sys files, are protected executables.

Looking forward to hear more in depth comments from cruelsister. 

[-MOKSHA-]

Cruelsister states CIS HIPS gets bypassed when running it in Safe Mode.

So does this mean using HIPS with the default - recommended by Comodo itself - is unsafe?