Microsoft To Release Updated EMET Security Tool

Microsoft announced today that it is planning to release a new version of its security mitigation tool for ISVs and Windows users.

Enhanced Mitigation Experience Toolkit (EMET) 2.0, when released in "upcoming weeks," will contain six mitigation protections, according to Microsoft's announcement. The mitigations block general techniques used by hackers that try to exploit vulnerabilities commonly found in software. Version 2.0 will be an update to the Enhanced Mitigation Evaluation Toolkit 1.0.2, which was announced in October.

For this new upcoming release, Microsoft plans to change the name of the tool slightly, dropping the word "evaluation" in the older toolkit name for "experience" in the new one.

The reason for the name change, according to the announcement, is that Microsoft has reoriented the goals for the tool. The new aims are to help prevent active exploits, protect older applications and add centralized management control over applications. To that end, EMET 2.0 will sport a new graphical user interface (GUI), instead of the earlier released console control with a command-line user interface. The GUI lets software developers and IT pros easily turn EMET on or off for various applications, and they can also easily check that status using the GUI.

Anyone can use EMET, but it's primarily designed for users of applications at high risk for attack, such as browser-based apps or line-of business apps, particularly older ones based on Windows XP. EMET brings together some mitigations that were first introduced with Windows Vista and Windows 7, enabling those protections for Windows XP-based apps.

The two new mitigations in EMET 2.0 will be Export Address Table Access Filtering and Mandatory Address Space Layout Randomization, according to Microsoft's announcement. The first mitigation makes it harder for exploits using shell code to locate Windows APIs. The second one makes it more difficult for attackers to locate modules by randomizing the addresses of the modules. Module addresses are randomized every time Windows is rebooted according to a Microsoft video explaining EMET 2.0.

The other mitigations to be included in EMET 2.0 were previously available in version 1.0.2. They are Dynamic Data Execution Prevention, Structure Exception Handler Overwrite Protection, Null Page Allocation and Heap Spray Allocation.

According to Microsoft's video, the majority of Internet Explorer exploits tap into heap spray techniques. The techniques are used to ensure that an exploit can run by placing "copies of shellcode at as many memory locations as possible," Microsoft's announcement explains.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

comments powered by Disqus


  • ML.NET Improves Object Detection

    Microsoft improved the object detection capabilities of its ML.NET machine learning framework for .NET developers, adding the ability to train custom models with Model Builder in Visual Studio.

  • More Improvements for VS Code's New Python Language Server

    Microsoft announced more improvements for the new Python language server for Visual Studio Code, Pylance, specializing in rich type information.

  • Death of the Dev Machine?

    Here's a takeaway from this week's Ignite 2020 event: An advanced Azure cloud portends the death of the traditional, high-powered dev machine packed with computing, memory and storage components.

  • COVID-19 Is Ignite 2020's Elephant in the Room: 'Frankly, It Sucks'

    As in all things of our new reality, there was no escaping the drastic changes in routine caused by the COVID-19 pandemic during Microsoft's big Ignite 2020 developer/IT pro conference, this week shifted to an online-only event after drawing tens of thousands of in-person attendees in years past.

  • Visual Studio 2019 v16.8 Preview Update Adds Codespaces

    To coincide with the Microsoft Ignite 2020 IT pro/developer event, the Visual Studio dev team shipped a new update, Visual Studio 2019 v16.8 Preview 3.1, with the main attraction being support for cloud-hosted Codespaces, now in a limited beta.

Upcoming Events