Incident Score: Analysis & Impact (COM1780575842)

In this Rankiteo incident briefing, we review the 株式会社comodo breach identified under incident ID COM1780575842.

The analysis begins with a detailed overview of 株式会社comodo's information like the linkedin page: https://www.linkedin.com/company/comodo, the number of followers: 2245, the industry type: Professional Training and Coaching and the number of employees: 4 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 767 and after the incident was 746 with a difference of -21 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on 株式会社comodo and their customers.

Comodo Group (Comodo Internet Security) recently reported "Critical Zero-Day Vulnerability in Comodo Internet Security Exposes Windows Systems to Remote Crashes", a noteworthy cybersecurity incident.

A severe zero-day vulnerability, dubbed *ComoDoS*, has been discovered in Comodo Internet Security’s firewall driver, *Inspect.sys*, allowing attackers to remotely crash Windows systems with a single maliciously crafted IPv6 packet regardless of firewall rules.

The disruption is felt across the environment, affecting Windows systems with Comodo Internet Security installed.

In response, and stakeholders are being briefed through Public disclosure by researcher (Marcus Hutchins) and ZDI; no official response from Comodo.

The case underscores how Publicly disclosed; unpatched by vendor, teams are taking away lessons such as Critical vulnerabilities in security software can bypass protections and remain unpatched for extended periods, highlighting the need for timely vendor responses and proactive mitigation strategies, and recommending next steps like Users should consider disabling IPv6 or replacing Comodo Internet Security until a patch is released, Vendors should prioritize addressing critical vulnerabilities disclosed by researchers, especially those with public PoCs and Organizations should monitor for updates from Comodo and apply patches immediately upon release, with advisories going out to stakeholders covering Users and organizations relying on Comodo Internet Security should assess their exposure and consider alternative solutions.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.