Microsoft To Release Updated EMET Security Tool

Microsoft announced today that it is planning to release a new version of its security mitigation tool for ISVs and Windows users.

Enhanced Mitigation Experience Toolkit (EMET) 2.0, when released in "upcoming weeks," will contain six mitigation protections, according to Microsoft's announcement. The mitigations block general techniques used by hackers that try to exploit vulnerabilities commonly found in software. Version 2.0 will be an update to the Enhanced Mitigation Evaluation Toolkit 1.0.2, which was announced in October.

For this new upcoming release, Microsoft plans to change the name of the tool slightly, dropping the word "evaluation" in the older toolkit name for "experience" in the new one.

The reason for the name change, according to the announcement, is that Microsoft has reoriented the goals for the tool. The new aims are to help prevent active exploits, protect older applications and add centralized management control over applications. To that end, EMET 2.0 will sport a new graphical user interface (GUI), instead of the earlier released console control with a command-line user interface. The GUI lets software developers and IT pros easily turn EMET on or off for various applications, and they can also easily check that status using the GUI.

Anyone can use EMET, but it's primarily designed for users of applications at high risk for attack, such as browser-based apps or line-of business apps, particularly older ones based on Windows XP. EMET brings together some mitigations that were first introduced with Windows Vista and Windows 7, enabling those protections for Windows XP-based apps.

The two new mitigations in EMET 2.0 will be Export Address Table Access Filtering and Mandatory Address Space Layout Randomization, according to Microsoft's announcement. The first mitigation makes it harder for exploits using shell code to locate Windows APIs. The second one makes it more difficult for attackers to locate modules by randomizing the addresses of the modules. Module addresses are randomized every time Windows is rebooted according to a Microsoft video explaining EMET 2.0.

The other mitigations to be included in EMET 2.0 were previously available in version 1.0.2. They are Dynamic Data Execution Prevention, Structure Exception Handler Overwrite Protection, Null Page Allocation and Heap Spray Allocation.

According to Microsoft's video, the majority of Internet Explorer exploits tap into heap spray techniques. The techniques are used to ensure that an exploit can run by placing "copies of shellcode at as many memory locations as possible," Microsoft's announcement explains.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

comments powered by Disqus


  • Edit Local Images/Text from a .NET MAUI Blazor Hybrid App

    With .NET 6 and the latest Visual Studio 2022 preview, developers can create a hybrid Blazor/.NET MAUI app that can work with local machine resources in ways that ordinary Blazor (web) apps can't.

  • In VS 2022, WinForms Designer Still Chasing Parity with .NET Framework Version

    Microsoft provided an update on its years-long effort to bring the new Windows Forms designer up to speed with the old .NET Framework version.

  • See What's New for Git in Latest Visual Studio 2022 Update

    Four new Git features have been added to Visual Studio 2022 in the latest update, Preview 2, including the ability to compare branches and multi-repo branching.

  • Infragistics Adds 17 Controls to Blazor/Web Components Libraries

    Infragistics Ultimate 21.2 is out with an integrated low-code App Builder and 17 new controls for the Blazor and Web Components libraries of Ignite UI, the company's web-based UI toolkit.

Upcoming Events