about the keylogger and the screen logger

Comodo Internet Security - CIS News / Announcements / Feedback - CIS
1

In the sandbox level, “partially limited”, comodo can not block these actions.

(1)access the keyboard

(2)access the computer monitor

???

2

After reading you’re post i assume that sandbox levels like ‘restricted’ and ‘untrusted’ are not bypassed.
That would mean that Comodo made the decision to not block those actions on partially limited. Probably because of usability.

3

1.comodo sandbox can not block them only in the level, partially limited

2.comodo firewall allows all outgoing requests by default

3.If a keylogger or a screen logger accesses the network, comodo can not block it.

4

i think this is all by design not a bug. yes by default its less secure which is y a lot of people change the defaults

5

Agree. Although this is a security risk, it’s not a bug ore something. This just once again proves that you should up the sandbox restriction level to something like untrusted.

6

Personally I think that this needs to be changed.

7

+1 :-TU

8

:-TU

9

Plus change Unrecognized Files default from Partailly Limited to Limited at least.

10

Hi Axxx

Do you have a proof of concept?

These are probably not restricted via OS restrictions, but by D+.

Best wishes

Mouse

11

+1 :-TU

12

Direct physical access to these are supposed to be restricted. Do you have any evidence that they are not?

Best wishes

Mouse

13

I test COMODO firewall with the AKLT.

CIS sandbox with the level, “partially limited”, can not block it.

CIS sandbox with other levels can block it.

919×430 125 KB

14

Thanks, and the screen grab?

Can anyone replicate?

Best wishes

Mouse

15

screen logger:

clipboard logger:

16


2.


3.

1024×768 121 KB

4.

1024×768 121 KB

does this:
and re-test with spyshelter and aklt.

17

Thanks Axxx

Are you using 5.8 public? Others have reported Spyshelter screengrab no longer works in 5.8

Best wshes

Mouse

18

1.yes

2.Only “partially limited” can not block loggers.

19

Thank you for your helpful research

Please make an issue report in the bug forum using the standard format here.

Best wishes

Mouse

20

I find out this one interesting. :o

If comodo block the action first,“install global hooks” without “more options”, then comodo can block the loggers.

If comodo block the action first,“install global hooks” with “more options”, then comodo can not block the loggers.

If comodo does not block the action first,“install global hooks”, then comodo can not block the loggers.