Comodo Secure Shopping not so secure in ver 10.0.1.6209 [M2209]

Comodo Internet Security - CIS Format verified Issue Reports - CIS
21

Please observe how Secure Shopping SHOULD behave (I see no activity so I have done other tests):

Based on previous version of Comodo
Run in Virtual Machine

More details in the video description.

Same recording software used to test this COMODO version - oCam latest version

22

OK…

i see no activity on this thread :‘( :’(

I have conducted some more tests and i can share the details.
I have set up secure browser again on CIS 10.0.1.6223 and recorded with oCam
Connected via TeamViewer from my phone to my PC.

  • At first I could see the window contents in TeamViewer
  • However, shortly I got a Remote Connection Alert on PC and when I hit “Continue”, the box became black
    on the remote screen initiating the connection. (phone)

So, somehow I think the window protection is not activated unless Remote Connection alert is triggered.

Can you please test the same case and tell me your findings? Thank you

23

So I think, recording with oCam on my PC, since I couldn’t make oCam trigger Remote Access connection
to test (I tried my best), that’s why the window can be seen - because of this bug.

Is there any way you can emulate a remote access warning coming from oCam directly (like in TeamViewer case)
and see if it works?

24

Bug still present in v10.0.1.6246

25

Hi Cocalaur,

Thank you so much for checking. We will look into it and make it prioritize.

Kind Regards,
PremJK

26

Thank you.

I must say that I like COMODO very much and that is why I wish i help hpwever I can (even if it’s something simple
like reporting a bug)

I am sure there are many things you deal with, many bug checks/improvements/testing put into COMODO and I am sure
your task is not easy.

While I don’t want to sound like a push, I do wish this bug is squashed - especially when Secure Shopping used to work
as expected up to the mentioned release onwards.

Again, if there is anything I can do, I can try to do and help you because I love COMODO and I wish it gets better and better
with no compromise of security. :slight_smile:

Thank you.

27

I have tested the full blown Secure shopping again in CIS CIS 10.0.1.6246
and I have found leaks even in the full blown Secure Shopping environment.

28

As personal thoughts on the Secure Browser: (also tested in RC 10.0.1.6250)

Secure Shopping is a great feature and a unique one and it makes COMODO stand out of other security vendors, along with its
default deny/auto-sandbox technology.

I am thinking if after several tests the devs cannot fix the Secure Browser recording protection, maybe they can remove the secure
browser choice and leave only the full Secure Shopping environment, which doesn’t have this bug and can prevent screen recording and
screenshots.

This could be seen as a last resort and only if all other fixes eventually don’t fix the problem in subsequent versions. - and it’s just a
thought/consideration and a personal opinion - Better than to have this security issue.

If in previous versions the screen couldn’t be recorded and now it can, then maybe there is a security issue which, if found
my malware writers could bypass the protection in Secure Browser.

Or, just like when Fully Virtualized Sandbox was introduced - default disabled and enabled by registry hack - maybe the devs
can do the same with Secure Browser and put it disabled by default, can be enabled via registry hack, until / if the problem is
fixed.

Thank you.

P.S. - on the good side, Windows is not stuck / blank anymore after the 10.0.1.6250 RC version.

29

Bug still present in CIS 10.0.1.6254 / Secure Shopping 1.1.421657.99
Tested it after uninstalling old CIS and clean installing the new version.

30

Thanks for checking I have update the tracker indicating it is not fixed with newest version.

31

What configuration do the devs use to test this into?
The one i have provided or have they managed to see in other
OS environments as well (like Win 8.1 / 7)?

32

Hi cocalaur,
We are addressing it now and will pass to you possible fix for cross verification in next days.

Thanks
-umesh

33

Thank you for your feedback umesh :slight_smile: .

Please let me know once the fix is in place and I will test it again.

34

Hi Cocalaur,

Bug can be reproduced in OBS Studio but we are not able to reproduce in oCam as you mentioned here.

Can you please recheck it and if you can reproduce, please provide what version of oCam you use.

Thanks in advance.

Kind Regards,
PremJK

35

Hi.

Sorry for delayed feedback.

As of now I use oCam v414

There is solid evidence that it’s not just oCam that can get through secure Shopping, but other recording apps too
(such as OBS)

I don’t know how to check Secure shopping version, but the product version of file vdcss.exe is 1.1.421657.99,
SHA1 149ae0237802f6b2c8d5fa454cfa3fe6b0910deb

Another fresh test:

There is still a glitch in the Secure Browser Protection.

36

Bug still present in CIS version 10.0.1.6294…

37

Thank you for checking I have updated the bug tracker.

38

Hello.

Any updates on this?

Have you found a possible cause for this bug ?

Thank you.

39

Hi cocalaur,
As per team, these video software have never been supported by CSS.

We will be considering adding support in next CSS release.

Thanks
-umesh

40

Please… don’t just check with oCam.

If you check with oCam and OBS for example in CIS 10.0.0.6092, then again with both software in the latest version of CSS/CIS you will see that one version protects in both cases and the latest one in neither.

You can even check with other recording software… the results will be the same.