The Good, The Bad and The UGLY (ugly because its unknown!!)

[burebista]

@lordraiden post:80

If a simple programmer of a security application is able to make a tool able to bypass comodo I dont want to think what a real hacker is able to do.

Then don’t think do it and show us. Then we’ll bash Melih together. ;D

[Tech]

@John Buchanan post:7

The FP at least tells you it may be malicious, hence the option of submission to have it tested for absolute certainty.

Absolute? Well, you don’t even have with virus total on demand scanners… You will have to trust everything in virus lab analysis… and it can always fail.

All security program claims it protects more and better than any other. No exceptions

Best Internet Security Software | Antivirus Total Security

But…

@Lunz post:21

Would you buy software that advertises itself as letting viruses through or that there is a possibility that you’ll be hacked? I don’t think so.

@lordraiden post:30

Anyway the web is plenty of AV’s better than CAV

I won’t discuss which is better or best. I think this is not my point of discussion.
I do not use any Symantec product. I don’t trust in the company, in the software development, in the sales/marketing policy, in the feedback and support, etc.

@EricJH post:29

You are around long enough to know that sandbox, av and bb are very much there to lessen the amount of alerts from D+'s default deny strategy.

Lessen is always necessary. Popups are an annoying thing for common users. It the amount is huge, it’s annoying even to advanced users.

@EricJH post:29

Users make mistakes; so there is a potential source of getting infected.

That’s the major point and the one I wish to discuss.
Seems that the advantage of a combined approach is necessary.
You can’t rely only in “deny all” or in the popup of Defense+… Users will allow, sooner or later,
and won’t wait for the answer of the Comodo labs…

@EricJH post:29

Luckily CTM brings a solution to go back in time to get rid off an infection.

CTM is one of the most interesting software technology I’ve saw in the last time. You can really test software with security and I, myself, disabled other security programs resident (ThreatFire, Winpatrol, etc.) and improve my performance.

@lordraiden post:30

Do you belive what are you saying? so if I execute any malware in the world D+ is going to stop it the 100% of the times… Taking into account that D+ is going to ask me about to execute any file we could say yes, but them UAC is also 100% efficient.

I agree. This is the major point of discussion in the “default deny” / “default allow” policies.

@ssj100 post:31

That’s exactly right! And this is the reason why a default-deny approach is the best.

I think the opposite. When we come to users errors, the default deny has a lot of weakness…

@ssj100 post:31

therefore, the user doesn’t need to make a decision of whether a file is bad or not

That’s the “default allow” policy. The decision is made by the antimalware team/software.

@lordraiden post:33

Even if is true (is not true) who wants to make 50 click only to open and application, or 500 to install something, is not a real solution, and also you can get infected anyway if you dont make the right choice.

+1

More in a second post…

[Tech]

@Ovidiu G. post:49

I have tested CIS 4.0 (Sandbox enabled )with several hundred NEW malwares (many were not in any AV database and at least 140 were reported to Comodo for analysis) and NONE has infected my computer.

Because you didn’t run them… it it passed by the AV and you click ok in Defense+… Against insanity or ignorance it’s hard to fight… I’m talking about myself, not others. For sure I will allow some software that I shoudn’t…

I’m not technical enough to discuss the points of Kyle and Endymion are involved. Sorry.

Summarizing my point of view:
I do trust in HIPS and Defense+ as being a layer of defense.
I also do trust in legacy antivirus as taking right decisions instead of the user.
Usability and configurability are must have in security world as I need to work with the computer, not take all my time to protect it.
I’m not a fanboy of anything (maybe only my soccer team ;D).

[Melih]

@Tech post:83

Because you didn’t run them…

Tech

I think Ovidiu is saying that he run them and they were sandboxed.

Of course he can conirm that himself.

thanks
Melih

[Tech]

Melih, I think the focus (at least mine) is not what can bypass (if any) Defense+ or the protection level you can achieve, or if a legacy antivirus is better than “default deny” policy.

I’m trying to discuss how Comodo could prevent a bad user decision without a good antimalware behind. It’s not only a matter of reducing the Defense+ popups but preventing the user having to take a bad decision after 50 popups…
Seems I’m trying to defend the best of both worlds…

[Melih]

@Tech post:85

Melih, I think the focus (at least mine) is not what can bypass (if any) Defense+ or the protection level you can achieve, or if a legacy antivirus is better than “default deny” policy.

I’m trying to discuss how Comodo could prevent a bad user decision without a good antimalware behind. It’s not only a matter of reducing the Defense+ popups but preventing the user having to take a bad decision after 50 popups…
Seems I’m trying to defend the best of both worlds…

First you need to narrow down as to when the “user decision” is required for CIS…

then analyse the alerts…and then tell us
1)how many alerts and when
2)if those alerts are not easily understood.

thanks
Melih

[Tech]

@Melih post:86

First you need to narrow down as to when the “user decision” is required for CIS…

then analyse the alerts…and then tell us
1)how many alerts and when

Quite some when I install software… from the setup.exe file to invoking the .msi and saving files, etc.

@Melih post:86

2)if those alerts are not easily understood.

They’re easy to understood.
But I want to install the software. Mostly I know the source and I’m not playing with fire. But I’m not a paradigm. People will understand the alerts and will bypass them because they want to install the software.

[Melih]

@Tech post:87

But I want to install the software. Mostly I know the source and I’m not playing with fire. But I’m not a paradigm. People will understand the alerts and will bypass them because they want to install the software.

How is that different when I receive a malware warning from a legacy AV, when, as you said:

“But I want to install the software. Mostly I know the source and I’m not playing with fire. But I’m not a paradigm. People will understand the alerts and will bypass them because they want to install the software.”

You will still tell the legacy AV, hey its trusted…I want to install the software…Mostly I know the source and I am not playing with Fire…etc etc…

It is exactly the same scenerio…

Melih

[languy99]

let me inject something here. My brother is now using comodo IS after using KIS 2010 for a whole year. He is fairly computer savvy, not a geek like me but not a total dud. He was telling me today that the computer works ok but he keeps getting firewall alerts and other popups the he does not know what they mean. He said he really liked kaspersky becasue it just worked and left him alone. So as far as comodo’s usability is concerned, yes it has gotten better but for some people it is still too much. Today I will use EVPN to long on his computer and set it so he does not get anymore warnings.

[Melih]

@languy99 post:89

let me inject something here. My brother is now using comodo IS after using KIS 2010 for a whole year. He is fairly computer savvy, not a geek like me but not a total dud. He was telling me today that the computer works ok but he keeps getting firewall alerts and other popups the he does not know what they mean. He said he really liked kaspersky becasue it just worked and left him alone. So as far as comodo’s usability is concerned, yes it has gotten better but for some people it is still too much. Today I will use EVPN to long on his computer and set it so he does not get anymore warnings.

did the kaspersky he used had an outbound firewall?
what other alerts does he get? (are they sandbox information alerts or others?)

thanks
Melih

[Chiron494]

I think the difficulty here is letting the user know in an alert whether it is likely malware or likely safe.

The problem is that (other than Defense+ malware heuristics) I don’t know how this can be accomplished. Perhaps the Behavioral Blocker will fill this role, but at this point I’m not sure.

[languy99]

@Melih post:90

did the kaspersky he used had an outbound firewall?
what other alerts does he get? (are they sandbox information alerts or others?)

thanks
Melih

yes it had an outbound firewall, but it never asked a question. Also when he used utorrent it worked automatically I had to create a rule for it to work on CIS.

He told me that he is getting lots of firewall inbound alerts. He said that he is getting an inbound firewall alert about a computer wanting to connect to his computer even though he is the only one on the network. He told me he will send some screen shots to me. No sandbox alerts.

[Tech]

@Melih post:88

How is that different when I receive a malware warning from a legacy AV, when, as you said:
It is exactly the same scenerio…

You’re right. Both could have automatic actions set, the antimalware to send to Quarantine and Defense+ to Sandbox.
It’ll be a matter of trust. I need to trust in Comodo AV or, saying better, I wish Comodo has a better AV and my antivirus to have, at least, a decent HIPS.

@languy99 post:89

So as far as comodo’s usability is concerned.

Manage the popups is a must have.

@Chiron post:91

I think the difficulty here is letting the user know in an alert whether it is likely malware or likely safe.

Exactly. For me, if we can trust in the judgment of a better antivirus, with trustable detection rates, well, we could have a previous judgment of the nature of the file.

[Chiron494]

@Tech post:93

Exactly. For me, if we can trust in the judgment of a better antivirus, with trustable detection rates, well, we could have a previous judgment of the nature of the file.

So maybe if the Defense+ alerts had an option to also see what other AV’s think of this file.

It would be very nice if you could get a verdict like you get from virustotal. Perhaps an option to automatically send the file to virustotal (or a similar site) to be checked.

Thus the advanced user understands what the file is doing, but the ordinary user can merely rely on whether any other AV detects it before allowing. The user would still be protected from zero-day malware (although they still may allow it), but for malware that is already known they will be protected because they can check the results and then make their choice.

I hope I have been clear. I think this may be a good balance between Default Deny and the traditional AV protection. What do you think?

[Tech]

@Chiron post:94

So maybe if the Defense+ alerts had an option to also see what other AV’s think of this file.

Well… it will be a link to www.virustotal.com, but, in my opinion, this won’t make it better. The user won’t check each file (.exe), or library (.dll), or installer (.msi)… A better and fast response from the product is needed.

@Chiron post:94

Thus the advanced user understands what the file is doing, but the ordinary user can merely rely on whether any other AV detects it before allowing. The user would still be protected from zero-day malware (although they still may allow it), but for malware that is already known they will be protected because they can check the results and then make their choice.

A better CAV will make a good approach, don’t you think?

@Chiron post:94

I hope I have been clear. I think this may be a good balance between Default Deny and the traditional AV protection. What do you think?

Any approach is making it better and more secure.
But you can’t lose performance or making the user lose that much time, or difficult tasks to be done… But I agree with you, we could have a better approach…

[Chiron494]

@Tech post:95

A better CAV will make a good approach, don’t you think?

No, one lab is not as good as being able to compare the results of several. The detection rate is much higher and the ability to diagnose a false positive is much improved if you use several different labs.

Maybe Comodo could do something like run the file past Comodo, Avira, Kaspersky, Avast, Microsoft, … (or any combination). Maybe 5 or so AV’s. Also, pass on any suspicious files to these companies for analysis. In this way the users of Defense+ get the ability to better investigate a file while doing less work and the AV companies will have improved detection rates. Essentially the Comodo community becomes a honeypot for the AV’s and everyone benefits.

By the way, I’m envisioning this as another tab in Defense+ that gives the results of this analysis. Maybe something like the way Hitman Pro works.

Do you think that giving the user this type of information would make it much more likely for them to distinguish between the good files and bad files when making a decision? I think this would go a long way.

Tell me if you don’t think it’s possible or there’s a flaw in my logic.

[Tech]

@Chiron post:96

Tell me if you don’t think it’s possible or there’s a flaw in my logic.

I submit myself all “unknown” files I use/install to Virus Total.
I would be glad if it could be done by the interface directly.
But you will have to convince the company (and the antivirus companies) to work like that.
The honeypot is giving the community… the antivirus, the work for detection.
I think the paid antivirus won’t like the solution

[Tech]

@Melih post:88

It is exactly the same scenerio.

A common complain of antivirus is the lack of detection.
Another one is the speed of updates and the improvement of the database.

What can we say of Comodo speed?

1. Correction of false positives: https://forums.comodo.com/beta-corner-ccs/how-to-easy-report-ccs-false-positives-t58390.0.html;msg408997#msg408997
2. Update the database: https://forums.comodo.com/news-announcements-feedback-cis/cis-and-avcomparativesorg-t58274.0.html;msg410243#msg410243

Room for improvement?

[Melih]

@Tech post:98

Room for improvement?

Does perfection exist?

If not…there is always room for improvement

melih

[Tech]

Ok, but there is improvement from 9.5 to 10 and from 1.0 to 9.5…
The response time is much away from a tolerate margin to the user and to the company image.