Microsofts Enhanced Mitigation Experience Toolkit (https://www.microsoft.com/downloads/details.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04&displayLang=en) (EMET) vereinfacht in Version 2.0 die Bedienung durch eine grafische Oberfläche und unterstützt neue Schutzfunktionen. EMET soll es Entwicklern, Administratoren und experimentiertfreudigen Anwendern möglich machen, bestimmte Schutzmechanismen in fertigen Binaries zu aktivieren, auch wenn der Quellcode des Programms gar nicht vorliegt.
(http://www.heise.de/imgs/18/5/6/4/7/7/7/e6440c9f9a7b6711.png)
Mit EMET lassen sich Teile des Exploit-
Schutzes Systemweit erzwingen oder
per Opt-In auf einige
Anwendungen begrenzen.
EMET kann mehrere Angriffstechniken verhindern oder erschweren. Mit Structured Exception Handler Overwrite Protection (SEHOP) will Microsoft das Überschreiben von (Structured) Exception-Handlern (SEH) auf dem Stack oder im Datensegment verhindern. Anders als beim Überschreiben von Rücksprungadressen mit Buffer Overflows führen Angreifer hierbei eigenen Code durch das Verbiegen von Funktionszeigern aus.
Darüber hinaus soll EMET Null Page Allocation verhindern können, die sich in Zusammenhang mit Null-Pointer-Dereferenzierungen ausnutzen lassen. Mit Microsofts Tool lässt sich auch Dynamic DEP (DDEP) in Anwendungen aktivieren. Damit kann man die Datenausführungsverhinderung zur Laufzeit an- und abschalten.
Neu sind im Vergleich zur Vorgängerversion die Optionen zur Speicherverwürfelung (ASLR) und Export Address Table Access Filtering (EAF) zum Blocken der Zugriffe von eingeschleustem Shellcode auf bestimmte APIs. Zu strenge Einstellungen können jedoch dazu führen, dass einige Anwendungen nicht mehr funktionieren. Einige der Schutzvorkehrungen lassen sich auch aushebeln, wie die Redmonder in der Dokumentation freimütig zugeben. Microsoft hat ein Video-Tutorial für EMET 2.0 zur Verfügung gestellt, das die Grundlagen und die Bedienung von EMET erklärt.
(http://www.heise.de/imgs/18/5/6/4/7/7/7/3eb385bfad14dda3.png)
Für einzelne Anwendungen lassen sich auch
nur bestimmte Schutzfunktionen aktivieren,
falls es Kompatibilitätsprobleme gibt.
Damit sollten sich letztlich auch Anwendungen gegen Angriffe härten lassen, die von Hause aus keine der Exploit-Schutzmechanismen moderner Windows-Versionen nutzen. Der Sicherheitsdienstleister Secunia hatte Anfang Juli bemängelt, dass viele Anwendungen von Drittherstellern weder DEP noch ASLR nutzen, obwohl sie Exploits unzuverlässiger machen können.
Das bestätigen auch unabhängige Sicherheitsexperten und Exploit-Schreiber wie Charlie Miller, Jon Oberheide und Dino Dai Zovi in einem Interview auf Threatpost mit Dennis Fisher. Es sei immer schwieriger, klassische Sicherheitslücken auszunutzen, woran auch die Anti-Exploit-Funktionen ihren Anteil hätten. Man müsse immer häufiger mehrstufig vorgehen und zudem logische Fehler ausnutzen, um zum Ziel zu kommen.
Quelle : www.heise.de
Release Notes
Today, we’re releasing the Enhanced Mitigation Experience Toolkit (EMET) 5.2, which includes increased security protections to improve your security posture. You can download EMET 5.2 from microsoft.com/emet or directly from here.
Following is the list of the main changes and improvements:
Control Flow Guard: EMET’s native DLLs have been compiled with Control Flow Guard (CFG). CFG is a new feature introduced in Visual Studio 2015 (and supported by Windows 8.1 and Windows 10) that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects. Since we strongly encourage 3rd party developers to recompile their application to take advantage of this very latest security technology, we have compiled EMET with CFG. More information on CFG are available at this Visual C++ Team blog entry.
VBScript in Attack Surface Reduction: the configuration for the Attack Surface Reduction (ASR) mitigation has been improved to stop attempts to run the VBScript extension when loaded in the Internet Explorer's Internet Zone. This would mitigate the exploitation technique known as “VBScript God Mode” observed in recent attacks.
Enhanced Protected Mode/Modern IE: EMET now fully supports alerting and reporting from Modern Internet Explorer, or Desktop IE with Enhanced Protected Mode mode enabled.
Your feedback is always welcome, as it helps us improve EMET. Feel free to reach out to us by sending an email to emet_feedback@microsoft.com.
3/16/2015 UPDATE: We have received reports of certain customers experiencing issues with EMET 5.2 in conjunction with Internet Explorer 11 on Windows 8.1. We recommend customers that downloaded EMET 5.2 before March 16th, 2015 to download it again via the link below, and to uninstall the previous EMET 5.2 before installing the new one.
Quelle & Download -> http://blogs.technet.com/b/srd/archive/2015/03/12/emet-5-2-is-available.aspx
Release Notes
The Enhanced Mitigation Experience Toolkit (EMET) benefits enterprises and all computer users by helping to protect against security threats and breaches that can disrupt businesses and daily lives. It does this by anticipating, diverting, terminating, blocking, or otherwise invalidating the most common actions and techniques adversaries might use to compromise a computer. In this way, EMET can help protect your computer systems even from new and undiscovered threats before they are formally addressed by security updates and antimalware software.
Today we are pleased to announce the release of EMET 5.5, which includes the following new functionality and updates:
Windows 10 compatibility
Improved configuration of various mitigations via GPO
Improved writing of the mitigations to the registry, making it easier to leverage existing tools to manage EMET mitigations via GPO
EAF/EAF+ pseudo-mitigation performance improvements
Support for untrusted fonts mitigation in Windows 10
Mitigations in Windows 10
EMET was released in 2009 as a standalone tool to help enterprises better protect their Windows clients by providing an interface to manage built-in Windows security mitigations while also providing additional features meant to disrupt known attack vectors used by prevalent malware. Since that time, we have made substantial improvements to the security of the browser and the core OS. With Windows 10 we have implemented many features and mitigations that can make EMET unnecessary on devices running Windows 10. EMET is most useful to help protect down-level systems, legacy applications, and to provide Control Flow Guard (CFG) protection for 3rd party software that may not yet be recompiled using CFG.
Some of the Windows 10 features that provide equivalent (or better) mitigations than EMET are:
Device Guard: Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. Device Guard provides hardware-based zero day protection for all software running in kernel mode, thus protecting the device and Device Guard itself from tampering, and app control policies that prevent untrusted software from running on the device.
Control Flow Guard (CFG): As developers compile new apps, CFG analyzes and discovers every location that any indirect-call instruction can reach. It builds that knowledge into the binaries (in extra data structures – the ones mentioned in a dumpbin/loadconfig display). It also injects a check, before every indirect-call in your code, that ensures the target is one of those expected, safe locations. If that check fails at runtime, the operating system closes the program.
AppLocker: AppLocker is an application control feature introduced in Windows 7 that helps prevent the execution of unwanted and unknown applications within an organization's network while providing security, operational, and compliance benefits. AppLocker can be used in isolation or in combination with Device Guard to control which apps from trusted publishers are allowed to run.
Quelle & Download -> http://blogs.technet.com/b/srd/archive/2016/02/02/enhanced-mitigation-experience-toolkit-emet-version-5-5-is-now-available.aspx