ZeroAccess rootkit can bypass CIS 5.8

[pykko]

I’ve tested CIS 5.8 against ZeroAccess rootkit, two days old sample.

CIS had sandboxing enabled, but when I run the malware the only alert from Defence+ was: “malware.exe is trying to launch explorer.exe”.

This would seem legit for many users and hit Allow.

In that moment Comodo is deactivated.

[AyeAyeCaptain]

@pykko post:1

I’ve tested CIS 5.8 against ZeroAccess rootkit, two days old sample.

CIS had sandboxing enabled, but when I run the malware the only alert from Defence+ was: “malware.exe is trying to launch explorer.exe”.

This would seem legit for many users and hit Allow.

In that moment Comodo is deactivated.

What was Sandbox set to?
parially limited
limited
restricted
untrusted
blocked

I always set it to untrusted as that’s been proven to tackle most…
Was AV set to On Access and Cloud options ticked and Enable Rootkit scanning?

Can’t comment any further after this, was just asking for more info that others who do know more will ask in advance.

[a256886572008]

2011-09-09 17:13:45 C:\Documents and Settings\Roger\桌面\virus\123\screensaver.exe Sandboxed As Partially Limited

2011-09-09 17:13:46 C:\WINDOWS\explorer.exe Sandboxed As Partially Limited

2011-09-09 17:13:53 C:\WINDOWS\explorer.exe Modify File C:\Documents and Settings\Roger\桌面\virus\123\screensaver.exe

2011-09-09 17:13:53 C:\WINDOWS\explorer.exe Access COM Interface LocalSecurityAuthority.Tcb

[siketa]

It is obvious now that default Internet Security with Partailly Limited setting can be bypassed…
Switching to Proactive Security setting should also raise the level of Unrecognized files to Restricted or Untrusted.

[AyeAyeCaptain]

@siketa post:4

It is obvious now that default Internet Security with Partailly Limited setting can be bypassed…
Switching to Proactive Security setting should also raise the level of Unrecognized files to Restricted or Untrusted.

Agreed, until we get v6 and then it will be fully virtualised…

[Mr.Henky]

@AyeAyeCaptain post:2

What was Sandbox set to?
parially limited
limited
restricted
untrusted
blocked

I always set it to untrusted as that’s been proven to tackle most…
Was AV set to On Access and Cloud options ticked and Enable Rootkit scanning?

Can’t comment any further after this, was just asking for more info that others who do know more will ask in advance.

What are differences between them?

[siketa]

Partially Limited - The application is allowed to access all the Operating system files and resources like clipboard. Modification of protected files/registry keys is not allowed. Privileged operations like loading drivers or debugging other applications are also not allowed.

Limited - Only selected operating system resources can be accessed by the application. The application is not allowed to execute more than 10 processes at a time and is run with out Administrator account privileges.

Restricted - The application is allowed to access very few operating system resources. The application is not allowed to execute more than 10 processes at a time and is run with very limited access rights.

Untrusted - The application is not allowed to access any of the Operating system resources. The application is not allowed to execute more than 10 processes at a time and is run with very limited access rights.

Blocked – The application is not allowed to run at all.

[a256886572008]

@siketa post:4

It is obvious now that default Internet Security with Partailly Limited setting can be bypassed…
Switching to Proactive Security setting should also raise the level of Unrecognized files to Restricted or Untrusted.

comodo sandbox by default can not be bypassed by the 0access rootkit

[a256886572008]

@pykko post:1

I’ve tested CIS 5.8 against ZeroAccess rootkit, two days old sample.

CIS had sandboxing enabled, but when I run the malware the only alert from Defence+ was: “malware.exe is trying to launch explorer.exe”.

This would seem legit for many users and hit Allow.

In that moment Comodo is deactivated.

You have to check this one for enabling the sandbox.

[pykko]

@a256886572008 post:9

You have to check this one for enabling the sandbox.

http://i.imgur.com/YPIDU.png

You’re right, I didn’t do it.

I wanted to test CIS with default settings.

Enabling that option, the file is sandboxed.
It’s strange Comodo doesn’t enable it by default.

[siketa]

Use Custom installation.

[a256886572008]

@pykko post:10

You’re right, I didn’t do it.

I wanted to test CIS with default settings.

Enabling that option, the file is sandboxed.
It’s strange Comodo doesn’t enable it by default.

the auto mode is terminated when you install firewall only

You can set the configuration as CIS, and then the problem is solved.

[AyeAyeCaptain]

So to the OP, can you confirm your problem is no longer and now resolved/solved? ;D

[HeffeD]

@pykko post:10

You’re right, I didn’t do it.

I wanted to test CIS with default settings.

Enabling that option, the file is sandboxed.
It’s strange Comodo doesn’t enable it by default.

The Internet Security configuration is the default configuration when you install CIS. The sandbox is enabled in this configuration. The sandbox is only disabled if you switch your configuration to Firewall Security.

I’m confused because your latest post contradicts your original post. Your original post says the sandbox was enabled and CIS was bypassed.

@pykko post:1

I’ve tested CIS 5.8 against ZeroAccess rootkit, two days old sample.

CIS had sandboxing enabled, but when I run the malware the only alert from Defence+ was: “malware.exe is trying to launch explorer.exe”.

This would seem legit for many users and hit Allow.

In that moment Comodo is deactivated.

Now you are saying the sandbox was in fact disabled, but when it is enabled, CIS is not bypassed? ???

Which is it? :-\

[egemen]

As a256886572008 pointed out, you probably did not use the default settings. In default settings, CIS can NOT show you execution alerts. You probably used some other mode.

@pykko post:1

I’ve tested CIS 5.8 against ZeroAccess rootkit, two days old sample.

CIS had sandboxing enabled, but when I run the malware the only alert from Defence+ was: “malware.exe is trying to launch explorer.exe”.

This would seem legit for many users and hit Allow.

In that moment Comodo is deactivated.

[lordraiden]

@egemen post:15

As a256886572008 pointed out, you probably did not use the default settings. In default settings, CIS can NOT show you execution alerts. You probably used some other mode.

I remember that when I installed CIS FW5.8 beta the setting that a256886572008 pointed out was not active by default. Can anybody check this too?

[a256886572008]

I hope that the default configuration for “comodo firewall” will be CIS but not CFS.

;D

CIS: autosandbox enabled

CFS:autosandbox disabled

[lordraiden]

If you don’t install the AV the setting is disabled by default.

I installed CIS FW with default settings (I just choose, not to install the AV, Geekbuddy, and DNS)
The profile active by default is Firewall security.

Why a user that does not install the AV get a lower protection in D+? does not make any sense since is not related at all with the AV

[attachment deleted by admin]

[egemen]

Most of the users who install firewall only are looking for a firewall i.e. network based filtering. They dont want an anti-malware solution from CFW. All they want is a strong firewall which has good indirect internet access control while they let other antivirus solutions to protect them.

COMODO Firewall can well be turned into an antimalware solution with one click configuration switching though if its what you need.

@lordraiden post:18

If you don’t install the AV the setting is disabled by default.

I installed CIS FW with default settings (I just choose, not to install the AV, Geekbuddy, and DNS)
The profile active by default is Firewall security.

Why a user that does not install the AV get a lower protection in D+? does not make any sense since is not related at all with the AV

[lordraiden]

@egemen post:19

Most of the users who install firewall only are looking for a firewall i.e. network based filtering. They dont want an anti-malware solution from CFW. All they want is a strong firewall which has good indirect internet access control while they let other antivirus solutions to protect them.

COMODO Firewall can well be turned into an antimalware solution with one click configuration switching though if its what you need.

what?? comodo fw comes together with the HIPS

Thats is the excuse to offer a weak and easily to bypass settings using the default settings of CIS fw?

It’s so hard to admit it and change the default settings? I can’t even believe that you wrote all those paragraph to say that instead to spend the same time changing the default settings on CIS FW.

In fact you argumentation doesn’t make any sense, if they want a strong protection (proactive mode) why offer by default the weakest one (fw protection), CIS fw should be configured by default like CIS is the only thing that make sense.