COMODO V3 is NDIS driver firewall??

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
#1

谁能够告诉我COMODO究竟是不是NDIS驱动级别的防火墙？
一些程序员说，它是一款TDI驱动级的防火墙。

Who can tell me whether COMODO V3 is a firewall with NDIS driver?

Some coder say,COMODO is a firewall with TDI driver!

http://www.rootkit.com/newsread.php?newsid=849

#2

From this website you can download 30 samples of the real rootkits to test Comodo’s HIPS!!!

#3

我知道COMODO在HIPS部分的强大，但不太明白，NDIS和HIPS之间关系。

I know the powerful of COMODO in HIPS, but i don’t understand the Correlation
between NDIS driver and HIPS yet.

#4

I don’t understand what MaD was smoking when he posted a $79 price tag for Comodo.

#5

CFP has special option under settings. Maybe this is what you are looking for.

[attachment deleted by admin]

#6

Hi Guys,

I have read that article a couple of weeks ago. There can be no firewall without any NDIS layer filtering. The guy is wrong about CFP 2.4. Never ming 2.4, even CPF 1.0 had this.

It would be a bad joke to claim a product be “a firewall” without NDIS filtering implemented…

So never mind that article :slight_smile:

Egemen

#7

Thanks for information Egemen :-TU
Didn’t know that.

#8

Egemen, I saw few devices mentioned in MaD’s story, something like this:

\Device\RawIp
\Device\Ip

DeviceIp
DeviceTcp
DeviceUdp
DeviceIPMULTICAST
DeviceRawIp

I don’t have clue whats that meaning, so I will ask some (probably stupid) questions:
Are those devices defended by/in CFP?
If not, is it safe to add it to “My Protected Files”, “Protocol Drivers” or something like this?

Sorry in advance if this is too stupid (:SHY)

#9

Those are TDI interfaces attached by the firewall. You dont need to protect them by hips. Honestly, do not get yourselves confused with those details.

#10

Aha, those are specific for particular FW, from which particular FW monitors data transport.
Am I right?
Thanks for explanation

#11

yes