The new version(439) has been released. So does it fix the bug that cause failure in some tests of FWC. What the exactly score it can get now?(despite the crash7,sss,socksniff, we’ve already ingorned the condition simulated by them) (:LOV)
Yeah,but I mean the appearance of version 439 because in https://forums.comodo.com/leak_testingattacksvulnerability_research/new_matousec_firewall_challenge-t30896.15.html ,our technical scientist Egemen said that the new version would fix a bug. I wonder if it ihas been done (:WIN) And can the 439 manage with the failed tests such suspend1&2~
system
December 4, 2008, 11:45pm
4
If you go to New Matousec Firewall Challenge (Reply #25 ) Egemen explains his review of the results. Also gibran at reply #59 explains some of the flaws.
Hi Guys,
We have reviewed the results. Dont worry. There are 3 issues to be highlighted here.
1 - There is a single bug in CIS/CFP which affects the previsous versions too.
Kill1.exe kill2.exe: kill9.exe kill12.exe crash1.exe crash2.exe crash3.exe crash4.exe crash5.exe crash6.exe
Do not worry. We have fixed the bug and you will be receiving the update on Tuesday(2/12/2008).
2 - There are errors in the test report:
CFP/CIS does not fail the following tests: kill3b.exe kill3f.exe kill3e.exe kill5.exe SSS2.exe SSS3.exe
It is unclear why CFP is reported as failed in these tests. You might try yourself and see. Attachment contains ssts.conf file with which you can test CFP/CIS.
CFP/CIS intercepts system shutdown privilege elevation requests and hence effective blocks sss2.exe and sss3.exe tests.
CFP/CIS can not be terminated by any of those kill tests.3 - There are some insignificant tests that do not pose any real threat and hence we will not do anything about them.
CFP/CIS is marked as failed in the following tests: SSS.exe i.e. System Shutdown Simulation tests.
It has been scored 50% because CFP/CIS does not intercept system shutdown requests. This is the testing methodology of the tester.
System shutdown poses no real threat. The malware waits for system shutdown to perform its harmful actions. So whether you intercept or not, it can attack the user when the user manually logs out. Original System Shutdown Simulation tests do care about this fact.
socksnif.exe: This test is designed to test if a malware can snif your network connection or not.
If “\Device\Afd\EndPoint” is added to the Defense+ My Protected Files list, this can be easily intercepted. Adding this entry to the protected files means, making Defense+ to alert you for each and every application which tries to access Windows Sockets.
However, we do not plan to add this to our default protected files. Because
It poses no real threat. Malware can not sniff your everyday bank transactions because everything is already SSL encrypted,
This is basically no different than sniffing your network traffic from another computer,
It will increase the number of popups unnecessarily,
crash7.exe: This test tries to allocate all the memory of the computer to crash applications including the security software
It might be possible for an application to crash if there is no more computer memory available. This is usually a random case. We do not plan to make any changes to pass this test because
The crash can be random, intermittent and ubiquitous
Assuming CFP/CIS processes also crashed, there is no real threat to the system because by terminating CFP/CIS, malware will not gain any advantage for byapssing Defense+.
So in summary: by terminating CFP/CIS, Defense+ will not be able to be bypassed.
Surely it the most suited for that kind of tests based on PoC and not on live malwares.
The default CIS configuration is named COMODO - Internet Security and it is only provided when installing the full suite (CFP + AV).
If the user choose to not install (or to not test) the AV and rely on HIPS protection then COMODO - Proactive Security is provided as a choice for full hips protection upon installation.
As matousec methodology involves disabling the AV protection since the PoCs are not supposed to be blocked using AV detection, there was actually a simpler way to test the product by choosing to not install the AV (which is a way more simple option than choosing to install the full suite and then disable the AV and fiddle with the configuration).
As for the new results it looks that Kill3f was claimed to fail because in some rare condition “cssurf.exe” was terminated.AFAIK there is no BO test in matousec testsuite .
Please anybody let me know if there are any BO PoC in matousec suite. ???
What is the point to test termination of a feature not tested in all products? Is there any test that penalize other products if they, by chance, don’t have BO protection at all? ???
…currently attempting to calculate an alternate score using a different interpretation of matousec published methodological description…
True info. As if the new version is going to be tested or not, that’s unknown… But the bug has been fixed atleast.
Cheers,
fazio93
December 5, 2008, 12:36am
5
COMODO is #2 again so, I guess it was tested again.
ailef
December 5, 2008, 12:43am
6
hé hé, now comodo scores great at matousec with build 432, was incredible that some others products were better than comodo, there was a problem for sure and matousec fixed his results.
does build 439 fixes things so it would score even better or the score would stay the same?
great job comodo team again :-TU
i don’t think the new build 439 will be tested as matousec doesnt want to retest every products everyday when they release there work cause if they find new ways to bypass eachtime products, they’ll have te retest products every day, after bug is fixed.
fazio93
December 5, 2008, 12:49am
7
Oh yes, I forgot. The matousec tester tested it wrong and gave .432 the wrong results, right? So, is that all that was fixed in the results? .439 bug fixes haven’t been tested yet, so CIS could possibly score higher?
system
December 5, 2008, 1:05am
8
According to there rules, They only test every 6 months for certain reasons or something, I forgot where I read it… And yes matousec made a mistake and fixed the results up.
Cheers,
Oh yes, I forgot. The matousec tester tested it wrong and gave .432 the wrong results, right? So, is that all that was fixed in the results? .439 bug fixes haven’t been tested yet, so CIS could possibly score higher?
I think your right FaZio.
Melih
December 5, 2008, 3:12am
10
Oh yes, I forgot. The matousec tester tested it wrong and gave .432 the wrong results, right? So, is that all that was fixed in the results? .439 bug fixes haven’t been tested yet, so CIS could possibly score higher?
they did not re-test our latest version, which would claim the no 1 positon.
they simply corrected their mistake and put us no 2 position. (before we issued the latest version)
Melih
even this position (#2 ) will give people a reason to try CIS if they haven’t already. Getting a higher score next testing will just be that much better.
fazio93
December 5, 2008, 4:30am
12
at least COMODO is listed as the #1 FREE FW
system
December 5, 2008, 4:34am
13
Let a lone, #1 Security Suite. Free or Paid! Oh, I forgot Comodo has the only FREE Suite.
Cheers,
