Another bypass ?

[Chiron494]

@aweir14150 post:39

The solution would be to:

1. Comodo test each software individually, and remove the trusted vendor list.
2. Remove the “default allow” trusted software vendors from the computer security policy manually.

The problem with this is that it would greatly reduce the usability of CIS.

[Valentinchen]

@Chiron post:37

Can you please provide a link to this advice.

I will make the solution thicker.

@Valentin N

I have seen that malware researchers have found something that weaken CIS. We need to solve this problem which is: malware that have safe digital signatures.

in case someone want to read here they are.

Bypass #1

bypass #2

Bypass #3

Bypass #4

Bypass #5

A spontenous solution would be that comodo checks the digitals signature, compares and see if the company has this product if it doesn’t then it should be deleted without even asking the user.

Come with ideas!

If a mod looks at this please stick it

Thanks

Regards,
Valentin N

[aweir14150]

@Chiron post:41

The problem with this is that it would greatly reduce the usability of CIS.

How else can signed malware be stopped??

[Valentinchen]

Hey

@aweir14150 post:43

How else can signed malware be stopped??

1. companies have to protect their digital signatures better.

2. The best and easiest way to solve it is that comodo either add what products certain company offers or checks it through the cloud scanner. While comodo checks through the malware will have to wait.

I have asked people in the malware forum to give ideas how to solve this issue but nothing happened; comodo’s employees only removed the names from the trusted vendor list.

I am doing what I can to help if it’s not taken in consideration it’s not my problem and I feel proud of helping and contributing ideas.

Regards,
Valentin N

[Chiron494]

@aweir14150 post:43

How else can signed malware be stopped??

Malware like Stuxnet should be able to be stopped with V3.

For malware that is in the TVL I believe a response from umesh (which can be read here) explains the case quite well. These will not be dangerous malware, but adware.

If you find a company in the TVL that is distributing a product you do not believe to be trustworthy, just report it and it will be fixed promptly.