COMODO Leaktests v.1.1.0.3

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
#1

Date 13:28:13 - 2009-08-13

OS Windows Vista SP2 build 6002

  1. RootkitInstallation: MissingDriverLoad Protected
  2. RootkitInstallation: LoadAndCallImage Protected
  3. RootkitInstallation: DriverSupersede Protected
  4. RootkitInstallation: ChangeDrvPath Vulnerable
  5. Invasion: Runner Protected
  6. Invasion: RawDisk Vulnerable
  7. Invasion: PhysicalMemory Protected
  8. Invasion: FileDrop Vulnerable
  9. Invasion: DebugControl Protected
  10. Injection: SetWinEventHook Vulnerable
  11. Injection: SetWindowsHookEx Vulnerable
  12. Injection: SetThreadContext Vulnerable
  13. Injection: Services Vulnerable
  14. Injection: ProcessInject Protected
  15. Injection: KnownDlls Vulnerable
  16. Injection: DupHandles Protected
  17. Injection: CreateRemoteThread Protected
  18. Injection: APC dll injection Vulnerable
  19. Injection: AdvancedProcessTermination Vulnerable
  20. InfoSend: ICMP Test Protected
  21. InfoSend: DNS Test Vulnerable
  22. Impersonation: OLE automation Protected
  23. Impersonation: ExplorerAsParent Vulnerable
  24. Impersonation: DDE Vulnerable
  25. Impersonation: Coat Vulnerable
  26. Impersonation: BITS Vulnerable
  27. Hijacking: WinlogonNotify Protected
  28. Hijacking: Userinit Vulnerable
  29. Hijacking: UIHost Protected
  30. Hijacking: SupersedeServiceDll Vulnerable
  31. Hijacking: StartupPrograms Vulnerable
  32. Hijacking: ChangeDebuggerPath Protected
  33. Hijacking: AppinitDlls Vulnerable
  34. Hijacking: ActiveDesktop Vulnerable
    Score 140/340

In short - FAIL

or fail BIG TIME

I’ve been trying to PASS the test for a couple of days

I uninstalled PC Tools Firewall Plus 5.0 [it gave me 180/340]

My AV - Avira 9.407
Vista SP2
Opera 9.64

I stumbled upon the guide on how to configure the firewall yet I keep failing.
My settings:
Net defense - safe mode
Proactive defense - safe mode

Yes, I am new to the field but would like to score more.

Any tips would be greatly appreciated.

#2

If you haven’t already done so, change your configuration to proactive security and try again…

#3

Could you be more exact, please?

Change what settings to what?

#4

Right click on the CIS Icon in the system tray, select Configuration and click COMODO - Proactive Security.

By the way when you run the tests do you block each request?

#5

Somehow it never occured to me to find out what’s under R+Click menu O0
Proactive Security - check [I think it’s like this from the very beginning]
Still no better results…

By the way when you run the tests do you block each request?

I laughed reading this :smiley:
Yes, it’s all pretty new to me but I learn rather fast wink
Yes, I block requests as illustrated below…

In the meantime I tried to run Gibson’s Firewall Leak Testing Utility but blocked the first instance and it requires net access on 1st run. How to re-enable it?

#6

It probably will have created a block rule in your firewall rules section, just select it, click remove and apply.

#7

Yup, found it in Net Security Policy.

Any other suggestions regarding COMODO Leaktest failure?

#8

If you have chosen proactive security and have the firewall and D+ in safe mode, you should be good to go. I just ran the test in that configuration on a test system and it passed 340/340.

#9
proactive security and have the firewall and D+ in safe mod

check!

I looked into Net Security Policy and clt.exe was allowed.
I changed the settings to BLOCK and the test results are as follows:

COMODO Leaktests v.1.1.0.3
Date 16:14:24 - 2009-08-13

OS Windows Vista SP2 build 6002

  1. RootkitInstallation: MissingDriverLoad Protected
  2. RootkitInstallation: LoadAndCallImage Protected
  3. RootkitInstallation: DriverSupersede Protected
  4. RootkitInstallation: ChangeDrvPath Vulnerable
  5. Invasion: Runner Protected
  6. Invasion: RawDisk Vulnerable
  7. Invasion: PhysicalMemory Protected
  8. Invasion: FileDrop Vulnerable
  9. Invasion: DebugControl Protected
  10. Injection: SetWinEventHook Vulnerable
  11. Injection: SetWindowsHookEx Vulnerable
  12. Injection: SetThreadContext Vulnerable
  13. Injection: Services Vulnerable
  14. Injection: ProcessInject Protected
  15. Injection: KnownDlls Vulnerable
  16. Injection: DupHandles Protected
  17. Injection: CreateRemoteThread Protected
  18. Injection: APC dll injection Vulnerable
  19. Injection: AdvancedProcessTermination Vulnerable
  20. InfoSend: ICMP Test Protected
  21. InfoSend: DNS Test Protected
  22. Impersonation: OLE automation Protected
  23. Impersonation: ExplorerAsParent Vulnerable
  24. Impersonation: DDE Vulnerable
  25. Impersonation: Coat Vulnerable
  26. Impersonation: BITS Vulnerable
  27. Hijacking: WinlogonNotify Protected
  28. Hijacking: Userinit Vulnerable
  29. Hijacking: UIHost Protected
  30. Hijacking: SupersedeServiceDll Vulnerable
  31. Hijacking: StartupPrograms Vulnerable
  32. Hijacking: ChangeDebuggerPath Protected
  33. Hijacking: AppinitDlls Vulnerable
  34. Hijacking: ActiveDesktop Vulnerable
    Score 150/340

10 points more - still weak :frowning:

what can be wrong with my laptop settings? I’m clueless…

#10

This might sound daft, but are you sure D+ is not in ‘Installation Mode’ when you run the tests?

Also, before doing anything else, review your settings and your entries in D+ Computer Security and Your firewall rules. As you’ve run these tests several times, there’s always a possibility something got left behind.

#11

Nope, the button that says Switch to Installation Mode - untouched.

I looked into Comp Secutiry Policy and found the .exe
Changed the rules to BLOCK everything
the result:

Date 16:36:07 - 2009-08-13

OS Windows Vista SP2 build 6002

  1. RootkitInstallation: MissingDriverLoad Protected
  2. RootkitInstallation: LoadAndCallImage Protected
  3. RootkitInstallation: DriverSupersede Protected
  4. RootkitInstallation: ChangeDrvPath Protected
  5. Invasion: Runner Protected
  6. Invasion: RawDisk Protected
  7. Invasion: PhysicalMemory Protected
  8. Invasion: FileDrop Protected
  9. Invasion: DebugControl Protected
  10. Injection: SetWinEventHook Protected
  11. Injection: SetWindowsHookEx Protected
  12. Injection: SetThreadContext Protected
  13. Injection: Services Protected
  14. Injection: ProcessInject Protected
  15. Injection: KnownDlls Protected
  16. Injection: DupHandles Protected
  17. Injection: CreateRemoteThread Protected
  18. Injection: APC dll injection Protected
  19. Injection: AdvancedProcessTermination Protected
  20. InfoSend: ICMP Test Protected
  21. InfoSend: DNS Test Protected
  22. Impersonation: OLE automation Protected
  23. Impersonation: ExplorerAsParent Vulnerable
  24. Impersonation: DDE Vulnerable
  25. Impersonation: Coat Vulnerable
  26. Impersonation: BITS Protected
  27. Hijacking: WinlogonNotify Protected
  28. Hijacking: Userinit Vulnerable
  29. Hijacking: UIHost Protected
  30. Hijacking: SupersedeServiceDll Vulnerable
  31. Hijacking: StartupPrograms Vulnerable
  32. Hijacking: ChangeDebuggerPath Protected
  33. Hijacking: AppinitDlls Vulnerable
  34. Hijacking: ActiveDesktop Vulnerable
    Score 260/340

we’re making headways here!

#12

As you say, getting there :slight_smile: But we’ve still a few holes in there somewhere? have you created any firewall rules or D+ rules, or more to the point what are the rules that may have been created automatically in these two areas?

#13

I might have…I can’t remember…since almost all my actions are carried out using this method:
trial n error - everything is possible wink

should I make a screenshot of sth?

#14

Date 19:50:41 - 2009-08-13

OS Windows Vista SP2 build 6002

  1. RootkitInstallation: MissingDriverLoad Protected
  2. RootkitInstallation: LoadAndCallImage Protected
  3. RootkitInstallation: DriverSupersede Protected
  4. RootkitInstallation: ChangeDrvPath Protected
  5. Invasion: Runner Protected
  6. Invasion: RawDisk Protected
  7. Invasion: PhysicalMemory Protected
  8. Invasion: FileDrop Protected
  9. Invasion: DebugControl Protected
  10. Injection: SetWinEventHook Protected
  11. Injection: SetWindowsHookEx Protected
  12. Injection: SetThreadContext Protected
  13. Injection: Services Protected
  14. Injection: ProcessInject Protected
  15. Injection: KnownDlls Protected
  16. Injection: DupHandles Protected
  17. Injection: CreateRemoteThread Protected
  18. Injection: APC dll injection Protected
  19. Injection: AdvancedProcessTermination Protected
  20. InfoSend: ICMP Test Protected
  21. InfoSend: DNS Test Protected
  22. Impersonation: OLE automation Protected
  23. Impersonation: ExplorerAsParent Protected
  24. Impersonation: DDE Protected
  25. Impersonation: Coat Protected
  26. Impersonation: BITS Protected
  27. Hijacking: WinlogonNotify Protected
  28. Hijacking: Userinit Protected
  29. Hijacking: UIHost Protected
  30. Hijacking: SupersedeServiceDll Protected
  31. Hijacking: StartupPrograms Protected
  32. Hijacking: ChangeDebuggerPath Protected
  33. Hijacking: AppinitDlls Protected
  34. Hijacking: ActiveDesktop Protected
    Score 340/340

we made it!

Quill, thank you for this valuable lesson!!