Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

2/25/2014
11:42 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Beefs Up EMET

Early release of anti-exploit tool shuts down bypass methods created by Bromium Labs

RSA CONFERENCE 2014 – San Francisco, Calif. – Microsoft has enhanced its popular Enhanced Mitigation Toolkit (EMET) with new functions that help halt exploits from hitting endpoint machines. The software giant today released a preliminary, technical review version of the new tool, EMET 5.0.

EMET 5.0 comes with a new feature called Attack Surface Reduction that lets organizations selectively enable Java, Flash Player, and third-party plug-ins. An organization could set EMET to allow Java to run only for internal applications that need it while disabling Java execution in non-internal applications. It does much the same for Flash: "It lets you use Flash in the browser, but blocks Flash from executing in Excel" or other Office files, for example, says Jonathan Ness, principal security development manager for Microsoft Trustworthy Computing.

RSA Conference 2014
Click here for more articles about the RSA Conference.

The new version also comes with a hardened version of EAF (Export Address Table Filtering), and also enables "deep hooks" mitigation by default, which stops the bypass attack demonstrated in research released yesterday by Bromium Labs that pokes holes in EMET 4.1.

"I'm eager to see the feedback on these" new features, Ness said in an interview. The feedback will help shape the tool's final form, he says.

The new features in EMET help block attacks Microsoft has found and analyzed over the past few months. "We've raised the bar for the attacker," Ness says. "Because of the shift in the landscape, it makes exploitation more difficult."

Dan Kaminsky, chief scientist of WhiteOps, says EMET is a useful defense tool for Windows machines because it can update security for Windows at a faster clip than the longer operating system update cycle. "It spurs the development of new features and defenses," Kaminsky says.

But EMET's main limitation is that it relies on known vectors of return-oriented programming (ROP) exploitation methods, says Rahul Kashyap, chief security architect and head of security research at Bromium.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
shjacks55
50%
50%
shjacks55,
User Rank: Apprentice
3/7/2014 | 7:00:06 AM
re: Microsoft Beefs Up EMET
Other than Java and Flash, Win7/8 (~25% of SMB destops)(not counting SOHO/home users) are the only systems getting malware per our helpdesk tickets (2000+ desktops; multiple clients). Ever notice that most updates are security patches for previous updates? The article fails to note that current Java already includes whitelisting. Adobe makes terrible software that even crashes my Linux desktops. Not noted here is Browser options to deny the "must download latest version of Flash" or "are you sure you want to leave this page" messages that nefarious sites use.
Brian Bartlett
50%
50%
Brian Bartlett,
User Rank: Apprentice
2/28/2014 | 11:10:59 PM
re: Microsoft Beefs Up EMET
And doesn't support XP. 'Twould have made a nice going away present.
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5034
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vuln...
CVE-2019-5035
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker c...
CVE-2019-5036
PUBLISHED: 2019-08-20
An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially cr...
CVE-2019-8103
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8104
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...