[討論] Comodo Firewall 已知 Sandbox 的弱點

[fema (Currahee)]

https://www.youtube.com/watch?v=Rf9FwVwywM0

一樣是 cruelsister1 的影片

昨天觀看她測試360的影片 被她底下的一段留言吸引

  Also, I did point out in an earlier Comodo video that malware that is signed
  AND zero day will not be sandboxed.

今天總算找到之前她實證的影片

若惡意軟體具有數位簽章(我非本科 不太懂 digital signature 的機制)

即使 Comodo Firewall(CF) 已開沙盒 系統仍可被此惡意軟體感染

所以管理 Trusted Vendors List(TVL) 還蠻重要的
設定 HIPS 為 Safe Mode 可以掩蓋 Sandbox 此弱點 缺點是使用者自己要懂得如何決定
(記得刪掉清單後不要勾選 Enable Cloud Lookup 免得又被加回來)
(TVL是比對數位簽章 不是比對名字 啊我一開始是這麼認為的 XD)

這影片對 CF 的使用者蠻重要的 我把影片中的文字重現如下

縮寫
RAT: Remote Access Trojans
RasAuto services: Remote Access Auto Connection Manager and Remote Access
                  Connection Manager

Prelude
This video uses Comodo Firewall version 8.4.0.5076. Since it was produced
Comodo has released a beta version(10.0.0.5144) of Comodo Internet Security.
Note two things:
1).The Trusted Vendors List is as extensive as it was in version 8.4 and
2).the results seen in this video would be identical if we used the version
   10 beta.
Fade to the vdieo...

I'd like to finish up both the RAT series and my vidoes for a while with
something I presented to Comodo about 6 months ago:
Today we will run the RAT with the following settings in place:
1).AV on, Sandbox on (Untrusted), HIPS off;
2).AV on, Sandbox on, HIPS on (Safe Mode).
(In each of the above the Firewall is at Safe Mode)

First off, let's change the Sandbox level from the not so good Default level
to the very good Untrusted level:

Note that above in addition to the signed RAT we have been using I've
included an unsigned one. As this would be typical of any malware that you may
come across let's first run that one first while monitoring for the dll drop
into Program Data:

Everything was contained within the sandbox, and the RAT wasn't even allowed
to drop the dll. No reboot is needed as the sytem remains clean.
Now let's try the signed RAT, monitor for the drop then reboot...

Well that sucked, but really isn't surprising. Just like AppGuard the RAT was
trusted because of the quality of the certificate and was able to drop the dll
and call up run32dll.exe to execute it. RasAuto was started and the dll is
operating via svchost.
And the issue of Comodo not being able to start on the reboot? A little added
something was included in the RAT to take Comodo down. It was expedient to do
so as a firewall no longer operating can't be expected to alert, log or 
pervent Outbound connections.
Now on to something that I was delighted to see, and that is (surprisingly)
the HIPS module...

Now to move on to Comodo Firewall with HIPS active. We'll set it at the
Default "Safe Mode" level then run the RAT.
Spoiler Alert!!!- We will be getting a HIPS popup. Please note that added is a
choice to Block, Terminate, and Reverse. This is what we will choose...

Did you notice the dll drop into Program Data, then the HIPS module actually
trashing it after we hit the Block, Terminate, and Reverse function?
Seems very nice, but let's reboot and verify that the the dll is actually gone
and our RasAuto services are not active...

Looks like the Reverse function of the HIPS module worked just fine and gave
us protection in spite of the failure of the Sandbox.
Although the "Block, Terminate, and Reverse" choice of the HIPS alert is not
new (it's been there since at least version 8.2), I've never really seen a
need to enable the HIPS since the Sandbox is normally fine enough by itself.
But for maximum security against my malware it may not be a bad idea to throw
the HIPS into Safe Mode- at least until we see what's in the upcoming major
build of Comodo products.
Finally- I'm off this week on a rather extended assignment, so see you guys
again in the Fall...

--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 180.176.189.187
※ 文章網址: https://www.ptt.cc/bbs/AntiVirus/M.1476713799.A.28B.html
※ 編輯: fema (180.176.189.187), 10/17/2016 22:42:20
推 cg6445: 雖然沒用Codomo，不過還是給個用心推~
※ 編輯: fema (180.176.189.187), 10/17/2016 22:53:28
※ 編輯: fema (180.176.189.187), 10/17/2016 22:56:27
推 liumang: 結論是使用者自己得清楚該讓哪些放行，否則還是有可能會X
→ liumang: DD
→ fema: TVL都砍掉就不用HIPS來救援了 只是都入沙了XD