Sign in / up

back to article Redmond's EMET defense tool disabled by exploit torpedo

Microsoft's Enhanced Mitigation Toolkit (EMET) tool can be deactivated andbypassed according to Offensive Security researchers. The exploit struck dead the latest standard and updated version 4.1 of EMET designed to make attacks more complex and expensive through the use of Address Space Layout Randomisation and Data …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. Destroy All Monsters Silver badge
    Paris Hilton

    EMET needs to be downloaded and activated for each application?

    Wait, I thought that was part of the OS??

    1 2 Reply
    1. Steve Davies 3 Silver badge
      Reply Icon
      Thumb Up

      Re: EMET needs to be downloaded and activated for each application?

      The word 'activated' is enough to send the Black Hats into orgasm mode.

      for them 'activated' means 'bypass this stupidity ASAP'.

      1 1 Reply
    2. Roland6 Silver badge
      Reply Icon

      Re: EMET needs to be downloaded and activated for each application?

      Yes, in exactly the same way as your HIBS firewall and security suite downloads profiles for applications and websites.

      However, outside of the few applications supported out of the box, EMET does require the user to add an application, explicitly create rules and enable rather than doing all this in background automatically.

      What is odd is that EMET doesn't seem to be protected against being disabled - my security suite requires a password if I wish to do anything with it.

      0 0 Reply
    3. Adam Piggott
      Reply Icon

      Re: EMET needs to be downloaded and activated for each application?

      You might be drowning in the acronym soup surrounding this area! There are specific "mitigations", such as DEP and ASLR and then there's the free, downloadable tool EMET which forces programs on the system to use the mitigations.

      Windows XP got DEP support built into it and Vista onwards also supported ASLR which may be where the confusion lies. EMET lets you choose which programs enjoy ASLR (it's supported but not enforced by default) and a load of other exploit mitigations. Some of the mitigations break programs, hence the choice.

      1 0 Reply
      1. Destroy All Monsters Silver badge
        Reply Icon

        Re: EMET needs to be downloaded and activated for each application?

        Thanks, that makes some sense at least.

        0 0 Reply
    4. Gis Bun
      Reply Icon

      Re: EMET needs to be downloaded and activated for each application?

      Nope. Separate from the OS.

      By default it will "protect" various Microsoft applications, plus Adobe Acrobat/Reader, Java, and I think a few others. These are included because they are common to attacks.

      If you want to apply it to heavy vulnerable applications like Google Chrome, you have to add it.

      0 0 Reply
  2. Anonymous Coward
    Anonymous Coward

    Nothing was ever 100% with EMET or Windows, it was just one more added precaution. Use throwaway VMs when needed for unsafe activities.

    3 0 Reply
    1. Robert Helpmann??
      Reply Icon
      Childcatcher

      Nothing was ever 100%

      Nothing was ever 100% with EMET or Windows, it was just one more added precaution. Use throwaway VMs when needed for unsafe activities.

      Nothing is ever 100%. Better to use throwaway VMs for all or most activities in addition to other precautions. Many enterprises are moving to a VD environment for this among other reasons. Qubes OS is another implementation of this idea, though for standalone workstation users. None of it is bullet proof - you still have to protect the data, for example - but it is a really good start.

      0 0 Reply
  3. Gordon 10
    FAIL

    Eh?

    Surely the safest method MS should have adopted is to apply EMET to all apps as a default and then let local IT bods write exception rules as necessary?

    And to echo other posters points - shouldn't it be as nestled as closely to system processes as Anti-V and Firewalls are?

    0 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Eh?

      But, as noted, (1) there's too much app break potential, and a broken app is the next-worst thing to an exploited one, especially if said app is system-critical and can't be updated (probably because the vendor no longer exists), and (2) what if someone exploits EMET itself?

      0 0 Reply
    2. jason 7
      Reply Icon

      Re: Eh?

      As mentioned it can't be enabled by default as then thousands of in house business software packages and loads of software that isn't coded properly or written before say 2005 will fall over instantly.

      I've installed it on quite a few customer machines and even today modern software like Firefox and Chrome still cock up updates that trigger it.

      Again its the human element that lets it down.

      0 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like