Users or malware can kill VK, leaving VK'd processes revealed [M186]

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
1
  1. I enabled the the password protection for Virtual Kiosk.

714×645 46.7 KB

  1. In VK, I terminated the virtkiosk.exe by the task manager.

1024×768 281 KB

  1. I clicked on the X button on the window.

1024×768 282 KB

  1. I successfully switched to the window without typing the password. >:-D

1024×768 209 KB

5.This can be done by a malware.

Try the test2 in VK ! :wink:
https://forums.comodo.com/leak-testingattacksvulnerability-research/registry-test-from-ghost-security-t38635.0.html

2

Taskmgr is a trusted process, can you please retest with an ‘untrusted’ task manager?

3

You can try the test2 in VK ! (The program is unknown by CIS)

https://forums.comodo.com/leak-testingattacksvulnerability-research/registry-test-from-ghost-security-t38635.0.html

The result is the same.

Conclusion:
The virtkiosk.exe can be controlled by any VKed process.

4

Then I’ll move this post to bug reports.

5

1.Enable the HIPS and safe mode

  1. Add the following one to the group, “CIS”

C:\Program Files\COMODO\COMODO Internet Security\virtkiosk.exe

714×1844 179 KB

  1. Then, the VK will mot be terminated.
2012-12-23 20:25:12 C:\WINDOWS\system32\taskmgr.exe Access Memory C:\Program Files\COMODO\COMODO Internet Security\virtkiosk.exe
6

Good one! ;D :-TU

7

But the virtkiosk.exe is still killed by the test2.

https://forums.comodo.com/leak-testingattacksvulnerability-research/registry-test-from-ghost-security-t38635.0.html

8

They should harden the Kiosk against kill attacks from ‘inside’ with internal measures not depend on users HIPS settings.

9

This problem, dependency on HIPS, is a known bug #141 on the mods tracking system

10

a256886572008

I would be very grateful if you could please post a bug report in standard format, as this is an important security issue.

Best wishes

Mouse

11

PM sent

12

A. The bug/issue

  1. What you did:

(1) I enabled the the password protection for Virtual Kiosk.

714×645 46.7 KB

(2) In VK, I terminated the virtkiosk.exe by the task manager.

1024×768 281 KB

(3) I clicked on the X button on the window.

1024×768 282 KB

  1. What actually happened or you actually saw:

I successfully switched to the window without typing the password. >:-D

1024×768 209 KB

  1. What you expected to happen or see:
    The virtkiosk.exe should not be controlled by any VKed(or virtualized) process.

  2. How you tried to fix it & what happened:

(1) Enable the HIPS and safe mode

(2) Add the following one to the group, “CIS”

C:\Program Files\COMODO\COMODO Internet Security\virtkiosk.exe

714×1844 179 KB

(3) Then, the VK will not be terminated by the task manager.

2012-12-23 20:25:12 C:\WINDOWS\system32\taskmgr.exe Access Memory C:\Program Files\COMODO\COMODO Internet Security\virtkiosk.exe

(4)But the virtkiosk.exe is still killed by the test2.

https://forums.comodo.com/leak-testingattacksvulnerability-research/registry-test-from-ghost-security-t38635.0.html

  1. If its a software compatibility problem have you tried the compatibility fixes (link in format)?:
    none

  2. Details & exact version of any software (except CIS) involved (with download link unless malware):
    none

  3. Whether you can make the problem happen again, and if so exact steps to make it happen:
    It always happen.

  4. Any other information (eg your guess regarding the cause, with reasons):
    The virtkiosk.exe is not protected by VK.
    Any virtualized process can easily control it.

B. Files appended. (Please zip unless screenshots).
0. A diagnostics report file (Click ‘?’ in top right of main GUI) Required for all issues):
attached

  1. Screenshots of the 6.0 Killswitch Process Tab (see Advanced tasks ~ Watch Activity) or 5.x Active process list. If accessible, required for all issues:
    The virtkiosk.exe was terminated.

1024×768 209 KB

  1. Screenshots illustrating the bug:
    none

  2. Screenshots of related CIS event logs:
    none

  3. A CIS config report or file.
    none

  4. Crash or freeze dump file:
    none

  5. Screenshot of More~About page. Can be used instead of typed product and AV database version.
    none

C. Your set-up

  1. CIS version, AV database version & configuration used:
    comodo firewall v 6.0.260739.2674
    The configuration is Comodo Internet Security.

  2. a) Have you updated (without uninstall) from from a previous version of CIS: no
    b) if so, have you tried a clean reinstall (without losing settings - if not please do)?: yes

  3. a) Have you imported a config from a previous version of CIS: no
    b) if so, have U tried a standard config (without losing settings - if not please do)?:

  4. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.): disable the file rating

  5. Defense+/HIPS, Autosandbox/BBlocker, Firewall & AV security levels: D+/HIPS=disabled , ASB/BB=partially limited , Firewall = safe mode, AV = not installed

  6. OS version, service pack, number of bits, UAC setting, & account type:
    Windows XP Pro SP3 32bit

  7. Other security and utility software currently installed:
    none

  8. Other security software previously installed at any time since Windows was last installed:
    avast free antivirus, bitdefender free antivirus, virtualbox,…,etc

  9. Virtual machine used (Please do NOT use Virtual box):
    no

[attachment deleted by admin]

13

https://forums.comodo.com/bug-reports-cis/the-virtkioskexe-is-not-protected-by-vk-v6-t89650.0.html

14

I add that it is still possible exclusion of various items in the folder: C: \ Program Files \ COMODO \ COMODO Internet Security, with all modules active protection

15

Hi R

Thanks for doing this bug report

Having a bit of difficulty fully understanding this one, though I’m sure you are right.

Am I correct that the issues is as follows:

  1. If you password protect VK, it means you want to hide what you are doing in it
  2. But users or malware can kill VK, and this leaves the ;processes 'orphaned, and running under explorer, ie accessible from the standard user desktop
  3. these orphaned windows will reveal what you have been doing in virtkiosk

In addition it’s generally undesirable that security processes can be killed by malware, but in this case killing virtkiosk just leaves the malware process running virtualised.

So the system is protected as before, though privacy is not.

Is that correct?

If so I will update you bug report accordingly before forwarding it if that’s OK

Mouse

16

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again

Mouse

17

Can you please check and see if this is fixed with the newest version? Please let us know whether it is fixed or you are still experiencing the problem.

Thank you.

PM sent.

18

Can you please check and see if this is fixed with the newest version (6.2.282872.2847)? Please let us know whether it is fixed or you are still experiencing the problem.

Thank you.

PM sent.

19

The issue occurred for CIS v6.2 build 2847.

Wish:
Restart VK after the main processes are terminated.

20

Thank you for checking this.

I have also received feedback from Comodo that they have confirmed this bug. However, they have marked it as Confirmed and Deferred. This means that they will eventually fix this, but at the moment there are many other bugs which must first be addressed.

I hope you understand and can coexist with this bug until they are able to fix it.

Thank you.