Some keylogging methods not detected with Comodo Firewall 3 also installed

[MrBrian]

There seems to be an interaction issue between Comodo Firewall 3 and ThreatFire that results in some keylogging methods not detected. I did keylogging testing with AKLT (http://www.firewallleaktester.com/aklt.htm), Comodo Firewall v3.0.14.276 (issue also happens with latest version), and ThreatFire v3.0.14.16. These 3 AKLT tests failed to give appropriate alerts in either program: GetKeyState, GetAsyncKeyState, and GetRawInputData. Without ThreatFire installed, Comodo Firewall gives appropriate alerts for all 3. With ThreatFire installed and Comodo Firewall not installed, ThreatFire, if my memory is correct, alerts on at least GetKeyState and GetAsyncKeyState. The other 4 AKLT keylogging tests - GetKeyboardState, DirectX, LowLevel Hook, and JournalRecord Hook - triggered appropriate alerts in Comodo Firewall with ThreatFire also installed.

There is a thread at Comodo forums about this issue - http://forums.comodo.com/bug_reports...-t20301.0.html.

Interesting. We will have a look into this. Thanks

[MrBrian]

Thank you for looking into this issue

[MrBrian]

This issue has been fixed in Comodo Firewall v3.0.20.320.

[MrBrian]

This appears to be an issue again with Comodo Firewall Pro v3.0.21.329. Perhaps it was still an issue with 3.0.20.320, but an intermittent one.

[Lusher]

Hmm that's the problem with layering..

You want to have as much as possible without slowing the system...

But you don't know if there are any negative interactions... which defeats the purpose of adding more layers..

Perhaps KISS is best?

[MrBrian]

Issue appears to be fixed with Comodo Firewall Pro v3.0.22.349. However, I tested only in a virtual machine. Perhaps somebody could test in a physical machine.