News

Microsoft To Release Updated EMET Security Tool

• By Kurt Mackie
• 07/28/2010

Microsoft announced today that it is planning to release a new version of its security mitigation tool for ISVs and Windows users.

Enhanced Mitigation Experience Toolkit (EMET) 2.0, when released in "upcoming weeks," will contain six mitigation protections, according to Microsoft's announcement. The mitigations block general techniques used by hackers that try to exploit vulnerabilities commonly found in software. Version 2.0 will be an update to the Enhanced Mitigation Evaluation Toolkit 1.0.2, which was announced in October.

For this new upcoming release, Microsoft plans to change the name of the tool slightly, dropping the word "evaluation" in the older toolkit name for "experience" in the new one.

The reason for the name change, according to the announcement, is that Microsoft has reoriented the goals for the tool. The new aims are to help prevent active exploits, protect older applications and add centralized management control over applications. To that end, EMET 2.0 will sport a new graphical user interface (GUI), instead of the earlier released console control with a command-line user interface. The GUI lets software developers and IT pros easily turn EMET on or off for various applications, and they can also easily check that status using the GUI.

Anyone can use EMET, but it's primarily designed for users of applications at high risk for attack, such as browser-based apps or line-of business apps, particularly older ones based on Windows XP. EMET brings together some mitigations that were first introduced with Windows Vista and Windows 7, enabling those protections for Windows XP-based apps.

The two new mitigations in EMET 2.0 will be Export Address Table Access Filtering and Mandatory Address Space Layout Randomization, according to Microsoft's announcement. The first mitigation makes it harder for exploits using shell code to locate Windows APIs. The second one makes it more difficult for attackers to locate modules by randomizing the addresses of the modules. Module addresses are randomized every time Windows is rebooted according to a Microsoft video explaining EMET 2.0.

The other mitigations to be included in EMET 2.0 were previously available in version 1.0.2. They are Dynamic Data Execution Prevention, Structure Exception Handler Overwrite Protection, Null Page Allocation and Heap Spray Allocation.

According to Microsoft's video, the majority of Internet Explorer exploits tap into heap spray techniques. The techniques are used to ensure that an exploit can run by placing "copies of shellcode at as many memory locations as possible," Microsoft's announcement explains.