18Jun 13 Windows Security 101: EMET 4.0 Several years ago, Microsoft released the Enhanced Mitigation Experience Toolkit (EMET), a free tool that can help Windows users beef up the security of third-party applications. This week, Microsoft debuted EMET 4.0, which includes some important new security protections and compatibility fixes for this unobtrusive but effective security tool. The main window of EMET 4.0 First, a quick overview of what EMET does. EMET allows users to force applications to use several built into Windows — including (ASLR) and (DEP). Put very simply, DEP is designed to make it harder to exploit security vulnerabilities on Windows, and ASLR makes it more difficult for exploits and malware to find the specific places in a system’s memory that they need to do their dirty work. EMET can force a non-Microsoft application to perform ASLR on every component it loads, whether the program wants it or not. Please note that before you install EMET, you’ll need to haveinstalled. And while EMET does work on Windows XP (Service Pack 3 only), XP users cannot take advantage of mandatory ASLR and a few other notable protections included in this tool. However, EMET includes several important security features that can help fortify third-party applications on XP. Namely, its “Structured Exception Handler Overwrite Protection,” or , which guards against the most common technique for exploiting on Windows. Microsoft says this mitigation has shipped with Windows ever since Windows Vista Service Pack 1. In addition to a revised user interface, EMET 4.0 includes a handful of new features that were bundled with the , such as novel methods of blocking an exploit technique called (ROP). Attackers can leverage ROP to bypass DEP protections by using snippets of code that are already present in the targeted application. One of the much-hyped is its “certificate trust” feature, which is designed to block so-called “man-in-the-middle” attacks that leveragecounterfeit SSL certificates in the browser. The past few years saw several attacks that impersonated Webmail providers and other top Internet destinations using fraudulent digital certificates obtained by certificate authorities, including , and . This feature is a nice idea, but it seems somewhat clunky to implement, and only works to protect users who browse the Web with Internet Explorer. For tips on configuring and using this feature of EMET, check out . To proceed with EMET, and install it (if you are upgrading from an older version of EMET, uninstall the older version first before proceeding with the EMET 4.0 install). This new version of EMET gives users an option to allow a pre-set group of applications to be automatically protected by EMET, including Java, Adobe Acrobat, Internet Explorer and any Office apps that may be installed. Alternatively, users can start from scratch and select their own applications to put behind EMET. To wrap EMET’s protection around a program — say,Mozilla Firefox — launch EMET and click the “Apps” button in the upper portion of the main EMET window. Selecting the “Add Application” button in the next box brings up a program selection prompt; browse to C:\Program Files (x86)\Mozilla Firefox, and then add the “firefox.exe” file. It should be okay to accept all of the defaults that EMET adds for you. While you’re at it, add the rest of your more commonly used, Internet-facing apps. But go slow with it, and avoid the temptation to make system-wide changes. Changing system defaults across the board – such as changing ASLR and DEP settings using the “configure system” tab – may cause stability and bootup problems. I’ve been using EMET on a 64-bit Windows 7 system and phasing in some of my most-used applications one-by-one with the “configure apps” button just to make sure the added security doesn’t crash the programs. Microsoft’s support forum has on applications that may not play nice with EMET’s default protection settings. Forexample, a handful of applications will simply crash or not work with EMET’s “export address table access filtering” (EAF) mitigation turned on. Skype is one well-known example here. I’ve also experienced issues with running EAF on Google Chrome. This is really where EMET’s unobtrusiveness can be a blessing and a curse. Unlike some security and antivirus tools that periodically pop-up annoying warnings or notifications to let you know they’re still there and doing their job, EMET is likely to do its job unnoticed by most users. I say curse because on one occasion (I can’t recall the name of the application at issue) I spent a few days scratching my head over an app that wouldn’t work properly, only to remember later that I’d set it to use EMET months before. If you have questions about EMET or run into issues with the program, check out , which lets you to submit questions to the user community if you don’t see your problem addressed in a previous support thread. The chart aboveindicates which system- and application-specific protections in EMET 4.0 are available for each supported version of Windows. Visit to download EMET 4.0, as well as a detailed user guide on the software. Tags: , , , , , , , , , , , This entry was posted on Tuesday, June 18th, 2013 at 1:42 pm and is filed under . You can follow any comments to this entry through the feed. Both comments and pings are currently closed.