In it's current state Comodo's buffer overflow protection will be useless on x64

[evil_religion]

…because the main advantage in comparison to DEP, being able to block Ret2Libc attacks, doesn’t apply for x64 processes:

http://www.ld-host.de/uploads/thumbnails/276afa5d21a8ed7068158412699f1976.png

I hoped that you would make it until CIS v.4 but you obviously didn’t.

My two cents regarding other things of v.4:
D+ is still uncomfortable and flawed. There are still these stupid pop ups of the services.exe when installing new drivers and still it can’t control the activity of batches and scripts (some other HIPSes do!).
It still sucks on x64 and that is not related to Patchguard. It scores very poor at SSTS in comparison to Sandboxie and partially also other HIPSes like KIS.
The sandbox is uncomfortable and insecure in comparison to Sandboxie. Also, the concept sucks because no applications which require admin privileges run sandboxed, there’s just a warning about that.
Is this the “zero pop ups mode” promised by Melih? :-TD
And there’s still no behavior blocker…

The only positive things are IMO increased detection of the AV and the new skin.

[goodbrazer]

@evil_religion post:1

still it can’t control the activity of batches and scripts

Nope, it can (also checked on v4 beta with SB turned off):

@SS26 post:26

Defense+ (in Safe mode) in fact can… treat batch scripts as standalone programs.
Adding *.bat and *.cmd to “Files to check” list and setting Image execution control to Aggressive does the trick.

@evil_religion post:1

still it can’t control the activity of batches and scripts

What else scripts D+ is unable to control?

It scores very poor at SSTS

What is SSTS ?

[secureme]

SSTS = new Matousec tests coming.

[goodbrazer]

thanks :-TU

[evil_religion]

@SS26 post:2

Nope, it can (also checked on v4 beta with SB turned off):

Checked that again. It doesn’t fail for batches but for example for VB scripts.

[goodbrazer]

@evil_religion post:5

Checked that again. It doesn’t fail for batches but for example for VB scripts.

As for VBS scripts. D+ is CAPABLE to protect against them. In Safe mode (not taking into account Paranoid). It is “specific” implementation which results users to allow and remember some/all activities for wscript.exe and explorer.exe calling wscript.exe.

wscript.exe is not trusted by Comodo and there are always D+ alerts at wscript.exe execution unless you chose in the past “allow and remember”.
Try this test script:

@MaratR post:43

I have a small VBS script (originally posted by pykko here on the forum) attached to this message. It launches your web browser and opens the Google webpage, nothing dangerous.

Regarding “specific” implementation of protection against VBS scripts by D+ :

@MaratR post:38

Comodo has only one ruleset for these executables (one of which wscript.exe – note by SS26). Which means that you can either create a single policy that would apply to any dll’s or scripts run by them (this is no good, because some functions could be required by both “good” dll’s/scripts and the “bad” ones, and you can’t differentiate between them), or have Comodo alert you every single time some dll/script is launched. The latter option is weak, too, since you won’t be presented with information on what dll/script is being launched, all you would see is an alert that the rundll32/wscipt is executed. Not practical at all.

Valid for current V3. Tho not sure about V4… IIRC moderator Ronny said somewhere on beta board that handling of scripts by D+ was improved…but in what manner etc ???

[Citizen_K]

Notice that not all sandboxing/virutalisation goodies are deployed yet. More information in How the Comodo Sandbox works. Also notice this extensive post by mouse1 about the current workings while in the test phase as well as an extensive post by Endymion about how test results may not be what they seem when being ran in sandbox.

According to Melih we will see the full blown sandbox with v4.1. That release should also bring CIMA based heuristics and behaviour blocker iirc.