Comodo 4.1 still fails with spyshelter leaktests

Comodo Internet Security - CIS News / Announcements / Feedback - CIS
61

It fails the following; camera capture, screen capture 4a/b 5a/b and mic capture.

just as a side note I ran this test against KIS 2010 and it failed everything.

62

Thanks. Guess that hardware id will do as well.
AFAIK the Webcam custom setting was meant for such types of devices ids (\Device\Usb#Vid*) :frowning:

Hopefully some other member will come with an alternative custom setting (in case device naming conventions changed on more recent windows releases)

63

Anyone can try all of theses tests?

64
Sound Record: FAIL
As much as I love to tweak things on my computer, some of the tests I feel are pointless, Do any of you people really care about about the Sound Record TEST??? As for the webcam, just do what my friend does if your that concerned, rip out a tiny piece of paper and get a piece of tape to cover the web cam.

Here’s a more realistic test for a corporate environment (I forgot where I got this from)

How to defeat hardware loggers, the best part (it doesn't cost anything and doesn't need to modify any software to pass this test) 
This is an example of a very simple way to defeat inline, hardware-based keystroke loggers, like the kind that go inbetween your computer and the keyboard.

They work by storing anything you type (64,000 characters or more) in their internal memory for retrieval later.  They require no software to operate and are not detectable without a physical search of your computer.

Their simplicity is also their downfall.  The Key Katcher draws its power from the +5 VDC line on computer's internal keyboard port.  This is usually PIN 4 on the PS/2-style (mini-DIN) keyboard connector.  By disabling the keyboard's +5 VDC power line internally within the computer, anything connected to the keyboard port will not receive any power, including any Key Katchers (or any keyboards).

To power the keyboard you just need to run an external +5 VDC power line, or you can even use batteries within the keyboard.</blockquote>

Here’s a picture if it helps

[attachment deleted by admin]

65

I tested the advanced process terminator included in the all_tests.zip file. Comodo failed Kill #10
which uses WinStationTerminateProces(requires terminal services). I think Comodo should take a look at this. At least cpf.exe was terminated. I did not test if it continue protecting. I will upload a video later on.

66

it might have killed just the tray/UI, but importantly was it able to kill cmdagent.exe? That is the protection part of comodo.

67

It was only the cpf.exe so I guess it was only the GUI part of CIS that was terminated.
(V)

68

good to hear, so in reality it did not kill comodo, it was still working you just would not get any warnings or pop ups, it would automatically block everything that it would normally ask you about. (:KWL)

69

Only if this is enabled, right?

http://i45.tinypic.com/10faxya.jpg

[attachment deleted by admin]

70

All CIS proccesses are protected by Defense+, so if cfp.exe was killed then most likely cmdagent.exe would have been killed as well.

[attachment deleted by admin]

71

nope, that is concerning applications that you run on the system, not CIS it’s self.

72

nope, because cmdagent is part of the kernel driver and you can’t kill it. I can make cfp.exe crash and I will still be protected. The only way to kill cmdagent is to try to unhook the kernel driver which would be impossible do do it without a reboot, once the system is running disabling drivers is next to impossible.

73

I totally understand but I have a question. How do you get D+ popups or av notifications if cpf.exe crashes?? Dows cmdagent is the one that handles those? if it is like that then we have nothing to worry about!

74

you don’t get any warnings, if cpf.exe crashes comodo automatically denies everything. That is why it is called default deny protection. Just like if you leave the computer running and you get a popup, if after a while it does not get answered, it just gets denied for safety.

75

DDP!! Excellent!! Thanks!

76

…
If COMODO Dont detect this terminate poc, A malware can kill some process without any alerts from DEFENSE+. Right?

So Devs need to take a look at this, for see in the next release IMPROVED! Defense+ (Terminating process) :slight_smile:

77

Any news about that?

78

Any dev is reading this? ;D

79

Assume they do even though it doesn’t always show. (:KWL)

80

For something this important I think its safer to assume they’re not reading it and continue prodding ;D until Comodo Staff respond.

Bring on the pitchforks, let’s form a mob. >:-D