Comodo Firewall is easily killable

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
#1

Hi,

I have testet the BETA of Comodo Firewall and found out that the Firewall is easily killable via task manager (kill the cfp.exe). That means that a malware can simply terminate the process.

Sygate Personal Firewall 5.5 has a protection for its process.

It would be cool if you guys could implement such protection.

EDIT: If you want I could write a sample application that kills comodo to proof it.

Regards,
ravel

#2

Hi,

Which BETA version are you testing so that we can move this to the right BETA section of the forum?

Garry

#3

its 3.0.9.229 but i guess all versions of comodo firewall behave like that

#4

three lines of vb.net-code to kill the firewall:

Dim proc() As System.Diagnostics.Process proc = Process.GetProcessesByName("cfp") proc(0).Kill()

it even keeps the firewall-icon in the system tray so the user thinks he is still protected until he moves the mouse over the icon.

#5

Strange…
I am also using 3.0.9.229, and I can’t terminate cpf.exe via task manager. Maybe your installation is corrupted.

#6

Or simply create a batch file with either ‘tskill cpf’ or ‘pskill cpf.exe’
Is there any option to protect CPF 3 from unauthorized termination?
I doubt CPF 3 would lack this protection if 2.4 has it, so as Blas said, maybe your installation is corrupt?

Ragwing

#7

is rather think you aren’t using administrator accounts on windows. i do

#8

ravel i can also terminate cpf using task manager. Must be something to do with other software installed. Kinda dumb for me to be running the newest beta along with norton is 2007 :D.

#9

Were using 3.0 beta.

We do not have that option.

#10

Here is the latest test on v-3.0.10.238

John

[attachment deleted by admin]

#11

Do you have the hips on, or simple mode?

#12

I had it with HIPS on and in training mode.

John

#13

I just read this post. No-one seemed to have answered this.

We now have the official v3.0.13.268 and I also tried to kill cfp.exe

Run taskmanager, end process and yes… firewall gone! Defense+ was not enabled but this should not be possible! I’m running a limited account. Something to fix soon it seems!

#14

I’m running (getting used to) 3.0.13.268, I cannot kill the process using taskman. (Using XP-Pro).

Keep up the good work btw, MASSIVE ammount of changes to get used to after porting from 2.7.

#15

I bet you have Defense+ enabled. If I do that, I can’t kill cfp.exe either. BUT you can install this firewall without Defense+ and then it’s easy to kill the firewall. Just try it out…switch Defense+ to ‘disable’, and you can kill the firewall easily. If you can install comodo 3 w/o Defense+, cfp.exe should also be protected when Defense+ is not there.

#16

This is really too bad and should seem obvious, although when I was testing the beta, this issue was noted and was not subsequently corrected. It almost seems punitive to those of us who choose not to use Defense+.

#17

Does anyone know if this will be fixed with the next update?

#18

Unfortunately no. Time will tell us:). (btw I am comfortable with defense+)
But I saw somewhere that in a future update their will be a Version2-like operating mode.(for those who prefer not to use defense+)

#19

This would be most welcome! CHUCK