impersonation: Coat vulnerable

[josinpaul]

OS Windows Vista SP0 build 7600

1. RootkitInstallation: MissingDriverLoad Protected
2. RootkitInstallation: LoadAndCallImage Protected
3. RootkitInstallation: DriverSupersede Protected
4. RootkitInstallation: ChangeDrvPath Protected
5. Invasion: Runner Protected
6. Invasion: RawDisk Protected
7. Invasion: PhysicalMemory Protected
8. Invasion: FileDrop Protected
9. Invasion: DebugControl Protected
10. Injection: SetWinEventHook Protected
11. Injection: SetWindowsHookEx Protected
12. Injection: SetThreadContext Protected
13. Injection: Services Protected
14. Injection: ProcessInject Protected
15. Injection: KnownDlls Protected
16. Injection: DupHandles Protected
17. Injection: CreateRemoteThread Protected
18. Injection: APC dll injection Protected
19. Injection: AdvancedProcessTermination Protected
20. InfoSend: ICMP Test Protected
21. InfoSend: DNS Test Protected
22. Impersonation: OLE automation Protected
23. Impersonation: ExplorerAsParent Protected
24. Impersonation: DDE Protected
25. Impersonation: Coat Vulnerable
26. Impersonation: BITS Protected
27. Hijacking: WinlogonNotify Protected
28. Hijacking: Userinit Protected
29. Hijacking: UIHost Protected
30. Hijacking: SupersedeServiceDll Protected
31. Hijacking: StartupPrograms Protected
32. Hijacking: ChangeDebuggerPath Protected
33. Hijacking: AppinitDlls Protected
34. Hijacking: ActiveDesktop Protected
    Score 330/340
    (C) COMODO 2008
    tested after deleting all current rules and firewall on custom policy(Now old rules all fresh)
    test ran in sand box denied all requests while testing except the first one to begin the test
    alert settings very high
    can any one help me whats happened?
    am i really vulnerable?
    how can i get 340/340 score?

[jebuchanan]

Try changing the sandbox level to Untrusted. One member tried this and received 340/340 np.

[Bill_M]

To all those having the same problem like I did before, clear all your internet cache and history then run the test again. The shortcut to clear the cache and history on IE and Firefox is by pressing the Ctrl+Shift+Delete keys. You need to do this for each browser of course.

[josinpaul]

no such problems in cis 2011…everything are in good shape

[Whoop-dee-doo]

Re: “Impersonation: Coat” vulnerable on CLT testing

See this post: Getting Accurate Leak test Results for details.

Here is an excerpt from that post:

@Whoop-dee-doo

…[snip]…

3. Delete the Internet Explorer (IE) browsing history cache. Run IE, click on the “tools” menu, then select “internet options”. Click on the “general tab” and then click on the “delete” button under browsing history. You can also delete the browsing history using cleaning programs such as CCleaner or Cleanup! The reason why you need to clean the IE history: If CLT was previously run and previously failed “Impersonation: Coat”, IE will open the target webpage from the IE cache, and not through the leak, leading to a false failure of “Impersonation: Coat”. Erasing the browsing history ensures that IE cannot load the webpage from the cache and forces IE to load the webpage through the leak.

…[snip]…