Why Comodo programmer's not develop heuristic for phishing sites ?

[Melih]

@devilbat66 post:14

This is awesome and again not trying to criticize, but recently there are some problems in this containment technology. To name a few, buffer overflow protection not working, Firewall not filtering raw packets, Heuristic Cmdline Analysis not working if cmdline contain multiple commands… A more extensive beta testing cycle would avoid those issues IMO.

its not about cycles of beta but how wide the beta test is…

if you only have one person beta testing, then it doesn`t matter how many times you run the same thing on the same machine you will have the same answer.

We run beta tests and a number of people attend beta tests…we get feedback…we address what we think is critical and important and we launch…
after we launch, because it then goes to wider audience with differing configurations, we see more bugs…just like any other software…

So the point is not the beta cycle but the beta reach…

[SanyaIV]

@Melih post:16

we address what we think is critical and important and we launch…

Are you saying that the bugs devilbat66 mentioned aren’t considered important by Comodo?

[devilbat66]

@Melih post:16

just like any other software…

That is true, software will always have bugs, because its made by human hands, so it can’t be perfect. I believe that Comodo is making the right choice by focusing on prevention. However IMO Comodo should give a bit more attention to the Buffer Overflow prevention component of CIS alongside the Heuristic Commandline analysis module, since that those two modules are almost hidden in the CIS suite {by hidden I mean how they are located deeply inside settings} and tend to be forgotten. Not saying that you guys don’t test them, because I don’t know what happened in those two situations and hence why I can’t judge.

[Melih]

@Sanya IV Litvyak post:17

Are you saying that the bugs devilbat66 mentioned aren’t considered important by Comodo?

its all about protecting the user.
If that bug proves to cause insecurity then we will address it.
Can you infect the computer using this bug, if you can`t, then its not critical.

[miloszcz]

You have to admit, Melih, that Containerization is not going to protect users from phishing websites etc. Comodo webfilter is very poor and will not block them as well. I remember you’ve told about some logo recognition technology, is it still developed?

[devilbat66]

@Melih post:19

Can you infect the computer using this bug, if you can`t, then its not critical.

The problem in the Buffer Overflow Prevention component can be used by exploits to infect systems via Buffer Overflow attack. Besides this, Buffer Overflow Protection was one of the most advertised CIS features by Comodo in the past.

@futuretech post:10

Still non-functional in version 8.2.0.4591 and I noticed that guard32/64.dll which is the buffer overflow prevention component of CIS does not properly hook the various WinAPI functions for it to handle shellcode that perform the Windows API calls.

Also the Firewall not monitoring other NDIS protocols besides TCP/IP (lack of raw packets filtering) since CIS version 6 and above can lead to data exfiltration. If Firewall filtered raw packets in CIS version 5 and older, then one would think that it should filter in newer versions too.

[Henrique_RJ]

@morphiusz post:20

You have to admit, Melih, that Containerization is not going to protect users from phishing websites etc. Comodo webfilter is very poor and will not block them as well. I remember you’ve told about some logo recognition technology, is it still developed?

Exactly !

And malicious Facebook links ?

Therefore need to use Bitdefender products with its heuristic against phishing sites.

[Melih]

@morphiusz post:20

You have to admit, Melih, that Containerization is not going to protect users from phishing websites etc. Comodo webfilter is very poor and will not block them as well. I remember you’ve told about some logo recognition technology, is it still developed?

Phishing website trying to do what?
Inject an executable? If so yes it will.
Trying to get your information?
No it won’t.

CIS is designed to keep a clean computer clean.

[Henrique_RJ]

@Melih post:23

Phishing website trying to do what?
Inject an executable? If so yes it will.
Trying to get your information?
No it won’t.

CIS is designed to keep a clean computer clean.

And the theft of banking information by phishing pages ?

[Melih]

@Henrique - RJ post:24

And the theft of banking information by phishing pages ?

Protecting data vs Protecting computer are 2 different things.

CIS is designed to protect the computer from getting infected.

[Henrique_RJ]

@Melih post:25

Protecting data vs Protecting computer are 2 different things.

CIS is designed to protect the computer from getting infected.

But do not you think limited this protection to a suite as the CIS ?

And why of the web filter presence in the CIS ?

[Melih]

@Henrique - RJ post:26

But do not you think limited this protection to a suite as the CIS ?

And why of the web filter presence in the CIS ?

i would like to focus the discussion…there are many names we are throwing around like web filtering etc…
there are 2 main things to protect

1)user’s computer from infection
2)user’s data from falling into wrong hands

CIS is designed to do 1.

[miloszcz]

That is correct, Melih. I understand that. CIS is designed to prevent infection and it does it brilliantly. :-TU

However, protecting sensitive user’s data (eg from phishing attack) is also part of online security. Is comodo going to offer any solution to do this or is it going to specialize in protecting computer only?

[Henrique_RJ]

@Melih post:27

i would like to focus the discussion…there are many names we are throwing around like web filtering etc…
there are 2 main things to protect

1)user’s computer from infection
2)user’s data from falling into wrong hands

CIS is designed to do 1.

Therefore need to use an additional software to strengthen security.

Bitdefender Free offers optimum detection ( heuristics ) of phishing and malicious links from Facebook and Twitter and also against zero-day ( heuristics ) binaries.

[devilbat66]

Since CAV does not actively scan javascripts in browsers, how can CIS block this kind of malware?

@cocalaur post:1

“Next gen cyber attacks could be through Internet images using Stegospoilt tool which allows hackers to embed malware in an image”

Any thoughts?

Spreading malware through Images with Stegosploit tool

[Henrique_RJ]

@devilbat66 post:30

Since CAV does not actively scan javascripts in browsers, how can CIS block this kind of malware?

Ever read about this kind of attack.

It is possible only in special rare conditions.

[jebuchanan]

You’re talking Browsers now. Would this not be the domain of, say, Comodo Dragon? Not CIS

[hyatt69]

Im running cis only and liking it as its very fast on my computer but reading this thread i want to ask,am i good using only cis or do i need something else with it?Me and my family do alot of online banking and shopping online on our computers?

[wasgij6]

@hyatt69 post:33

Im running cis only and liking it as its very fast on my computer but reading this thread i want to ask,am i good using only cis or do i need something else with it?Me and my family do alot of online banking and shopping online on our computers?

Please do not hijack this topic. Open a new one and we will be glad to answer your question.

Thanks.

[hyatt69]

Did not think i was hijacking the thread as the question was because of the posts inside this thread,sorry.You can delete if you like.