Comodo Leaktest

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
#1

Hi.

I use the latest CIS. I have Pro version.

I tried Comodo Leaktest and I only have 210 from 340 points.

I was looking in the forum but have not found anything.

I have this settings:

w8 64b, firewall - custom ruleset, HIPS - off, BB - fully virtualized, I use almost the same settings as in Chiron recommendation.

Please could anybody advice me how to set it up to have the maximum amount of th points?

I also tried another tests and they all went wrong (PC Security Test 2011 and Spyshelter Security Test).

Thank you.

radek

#2

The Leaktest was made to test HPS only solutions, When using it with the sandbox you will get skewed results.

Please read Getting Accurate Leak Test Results for reference.

#3

Thank you for your answer. I also tried with HIPS ON but the results were just a little bit better.

I will try to have a look at your link.

Do you know how to set up CIS to go through to the next two tests?

Then I want to ask if its necessary to set up CIS to go through those tests or is it enough to have Chron settings?

#4

To pass the test disable the Behaviour Blocker. You will then test HIPS only. There are some tips in the linked article how to proceed to make sure you start with a clean slate each time you run the tool.

#5

Ok, thank you. Then I want to ask if its necessary to set up CIS to go through those tests or is it enough to have Chiron settings? Does it have a point? I want to be protected from different malware. I do not need to have the best results from the test when it is not necessary for comon use.

#6

Just follow Chiron’s advice. The scores from that leaktest are completely irrelevant regarding the methods of protection the current incarnation of CIS uses.

As Eric mentioned, that test only tests the HIPS. It was released before the automatic sandbox was introduced, therefore it will give erroneous results testing the recent CIS versions.

What exactly does this mean? With the sandbox in CIS, an unrecognized application is allowed to run, but it is isolated in the sandbox. The leaktest doesn’t realize this, and is just aware that the application was not blocked by the HIPS, so it considers this a fail even though CIS is still protecting your system from this unrecognized application.

So no, unless you plan on running CIS as a HIPS only security product without the sandboxing functionality, there is no point in reconfiguring CIS just to score well on this test.