New Version 12.3.4.8162 Available for Comodo Internet Security 2025

[Citizen_K]

@k1k2k3

default of trusting certificates

CIS only trusts certificates of companies that have been vetted by Comodo.

@k1k2k3

would allow a dll dropin execute on a “trusted” MS binary that suddenly runs from the wrong path (which I suppose should be flagged).

That would make an interesting hardening.

DLL Dropping is a feature, not a bug. It can be used for good, or bad.

The Xcitium client, CIS professional brother, keeps an eye on loading of .dll files and it would with default settings not allow loading of unsigned .dll files by allowed applications. That caused too many false positives because lots of legit applications will load their own unsigned .dll files. Hence the default in Xcitium was changed.

Decimatech unearthed an old comment from egemen (the original developer of CIS) commenting on dll loading:

@DecimaTech

CIS no longer protects against dll hijacking as the ability for HIPS to control dll loading was removed a long time ago.

You mean loading a DLL into memory? CIS is not supposed to or even designed to detect if you load a DLL into the process space of an application normally(without hooking or memory injection) except for rundll32.exe(Even this is going to change in the future versions).

By setting image execution control to aggressive and adding *.dll to execution list, you can receive alerts for DLLs but this is not really recommended/intended to be used and we will discontinue this ability in the future versions.

However, if you have a way to execute a standalone executable and bypass the image execution control, that means a flaw and let me know.

Egemen