What is a "protected interface"

Learn about Computer Security General Security Questions and Comments
#1

Could you make me some practical examples (and easy ones) just to understand? :-TU

#2

Either reword it or be more specific

#3

in COMODO Firewall I see there is a section called “My Protected COM interfaces”
What are they? ???

#4

Some of them are software components like ActiveX and can be used by other applications or scripts to control even entire applications (eg Outlook.Application.*) or specific components (eg {8856F961-340A-11D0-A96B- 00C04FD705A2} IE Rendering component/Webbrowser)

Some other are System privileges (eg LocalSecurity.debug) similar to User right Assigments

Some others are system objects that can be triggered when an application use some Windows functions/services (eg \RPC Control\spoolss for windows spooler)

In V4 COM alerts that have an executable as target (eg: c:\windows\explorer.exe) corresponds to some of V3 Interprocess Memory Access (IMA) alerts:

So far most of these new COM alerts are triggered when some elements of File-Open/save dialogs are clicked whereas in V3 they caused IMA alerts (perhaps this is to distinguish them from IMA like those carried in CLT tests like CreateRemotethread or APC dll injection)

#5

Thanks, it is more clear now :-TU

#6

:-TU