App Review Comodo's killer.

[Andy Ful]

If u disable Cloud then how will Xcitium rate the files as Malicious or Safe?

The signature detection still works, so malicious files are detected. All other files will be Unrecognized for Comodo, except files Trusted by the user or Trusted Vendor.
Such a setup is common in Enterprises where AppLocker or Windows Defender Application Control is applied.

Will it be Unknown forever?

Yes, except when the user adds the vendor to the Trusted Vendors or Trusted files.
Of course, the user can enable Cloud Lookup from time to time if necessary.

 

[Andy Ful]

Can / should @Andy Ful FWH be run with CF 12.3.4.8162 (@cruelsister settings), fully compatible?

FirewallHardening can be used with CF (any configuration).

, and if yes, does FWH add anything not covered by CF? Running CF with MS Defender.

Yes.
However, the user can manually add (with some effort) similar rules to Comodo and skip FirewallHardening tool.

 

[Nikola Milanovic]

The signature detection still works, so malicious files are detected. All other files will be Unrecognized for Comodo, except files Trusted by the user or Trusted Vendor.
Such a setup is common in Enterprises where AppLocker or Windows Defender Application Control is applied.



Yes, except when the user adds the vendor to the Trusted Vendors or Trusted files.
Of course, the user can enable Cloud Lookup from time to time if necessary.

i keep Cloud on everytime because i like Xcitium to rate files as Malicious or Trusted

 

[Andy Ful]

i keep Cloud on everytime because i like Xcitium to rate files as Malicious or Trusted

There is always a trade between usability and security.

 

[bazang]

- using the 7-Zip trick for disk images and archives,
- disabling execution from flash drives,
- disabling macros in office applications,

These should be used by default on Windows no matter what AV is used.

Enterprises and governments are 99% of the office macro users in the world today; consumers do not need macro capabilities built-in to Office and Microsoft should remove them and make macros a separate application plug-in or module. But it won't because even Microsoft has admitted the office code is one crap layer on top of another. Security has been bandaided onto Office.

Of course, Administrators in organizations, should not forget about Microsoft Administrative Templates to adjust more restrictions.

Once the current batch of Administrators dies off, there will not be anyone around to know what Microsoft Administrative Templates are.

Microsoft CoPilot will run peoples' online lives (and security).

 

[Andy Ful]

Once the current batch of Administrators dies off, there will not be anyone around to know what Microsoft Administrative Templates are.

This can take some time.

 

[rashmi]

The signature detection still works, so malicious files are detected.

Comodo Cloud Antivirus detection relies on Cloud Lookup, if I remember well.

 

[bazang]

This can take some time.

The last real Administrator was born on December 31st, 1999.

By 2075 either AI runs the world's IT infrastructure or else there won't be enough Admins to even figure out how to connect the power chord into the power socket.

Heck, people will not even have to go to school anymore. When someone asks them a question they can just have that person ask their personal phone - which the AI on it will provide the correct answer to the person asking the question.

AI will talk to AI and just cut-out the real nuisance - the people.

I really do think people (the world, humanity, whatever you want to call them) are stupid enough that this is the sort of future dystopia the world is headed towards. That's if the hoomans don't kill each other first.

 

[Andy Ful]

Comodo Cloud Antivirus detection relies on Cloud Lookup, if I remember well.

If local signatures do not detect the file, it is checked against the cloud backend (cloud lookup). To maximize the detection with disabled cloud lookup, it might be necessary to use the full signatures locally.

 

[Andy Ful]

The last real Administrator was born on December 31st, 1999.

By 2075 either AI runs the world's IT infrastructure or else there won't be enough Admins to even figure out how to connect the power chord into the power socket.

Heck, people will not even have to go to school anymore. When someone asks them a question they can just have that person ask their personal phone - which the AI on it will provide the correct answer to the person asking the question.

AI will talk to AI and just cut-out the real nuisance - the people.

I really do think people (the world, humanity, whatever you want to call them) are stupid enough that this is the sort of future dystopia the world is headed towards. That's if the hoomans don't kill each other first.

Predicting the future for the next 50 years is virtually impossible.
One cannot be certain that there will be any future after 40 years. Let's hope for the opposite.

 

[Nikola Milanovic]

Static Analysis: Malware
Behaviour
Kill Chain Report(Red circle right up)
Link: Valkyrie Verdict

 

[Andy Ful]

@Nikola Milanovic,

It is not necessary to post examples of malware detected by Comodo. We already know that it can detect many malware.
By the way, your example cannot convince anyone that Comodo has a good singnature detection.

We can see the detection from 7 hours ago (3 days after the sample was first seen in the wild ).



(.....) skipped AVs that detected the sample. The below AVs missed the sample:

 

[Nikola Milanovic]

@Nikola Milanovic,

It is not necessary to post examples of malware detected by Comodo. We already know that it can detect many malware.
By the way, your example cannot convince anyone that Comodo has a good singnature detection.

We can see the detection from 7 hours ago (3 days after the sample was first seen in the wild ).

View attachment 287223
(.....) skipped AVs that detected the sample. The below AVs missed the sample:
View attachment 287224

Still Xcitium 95% of the time returns a verdict in under 45 seconds

 

[bazang]

Predicting the future for the next 50 years is virtually impossible.
One cannot be certain that there will be any future after 40 years. Let's hope for the opposite.

The future will be worse than today. It is not very difficult to make that determination.

 

[vitao]

If local signatures do not detect the file, it is checked against the cloud backend (cloud lookup). To maximize the detection with disabled cloud lookup, it might be necessary to use the full signatures locally.

but this will not bring any difference in detection, as anybody can see here:



Edit.: If somebody need, please, say so and I can create subtitles for this video, instead of you guys using the automatic ones...

 

[Andy Ful]

but this will not bring any difference in detection, as anybody can see here:



Edit.: If somebody need, please, say so and I can create subtitles for this video, instead of you guys using the automatic ones...

In your video, you showed, that for a few-day-old malware samples, the difference can be small. But, that is how the reduced set of signatures is selected. It probably does not contain less than few-hour-old and more than few-month-old malware.

 

[vitao]

In your video, you showed, that for a few-day-old malware samples, the difference can be small. But, that is how the reduced set of signatures is selected. It probably does not contain less than few-hour-old and more than few-month-old malware.

well, if 500 malwares are just "a few"...

anyway, with these 500 malwares cis manual scan detected exacly the same malwares by using its full signature database and the lite database. this proves that there is no difference between the full or the lite signature databases.

maybe another lie from comodo? or just another bug? i dont know. what i know is that there is no point using the full database. this will just use more hd space for no gains...

you said that the difference can be small but youre wrong. there is no difference.

 

[Andy Ful]

anyway, with these 500 malwares cis manual scan detected exacly the same malwares by using its full signature database and the lite database. this proves that there is no difference between the full or the lite signature databases.

Your test strongly suggests that older samples are mainly not reused in the attacks (I believe that this is true).
If you want to see the difference you must test one-year-old samples or few-hours-old samples.
A few days-old samples are useless for that.

 

[vitao]

If you want to see the difference you must test one-year-old samples or few-hours-old samples.
A few days-old samples are useless for that.

ohhh i understand now. ok. ill do it soon..

 

[Vitali Ortzi]

ohhh i understand now. ok. ill do it soon..

Benefits of Full signatures are usually for older threats in av software would be interesting to see if that the case here too