Microsoft To Release Updated EMET Security Tool

Microsoft announced today that it is planning to release a new version of its security mitigation tool for ISVs and Windows users.

Enhanced Mitigation Experience Toolkit (EMET) 2.0, when released in "upcoming weeks," will contain six mitigation protections, according to Microsoft's announcement. The mitigations block general techniques used by hackers that try to exploit vulnerabilities commonly found in software. Version 2.0 will be an update to the Enhanced Mitigation Evaluation Toolkit 1.0.2, which was announced in October.

For this new upcoming release, Microsoft plans to change the name of the tool slightly, dropping the word "evaluation" in the older toolkit name for "experience" in the new one.

The reason for the name change, according to the announcement, is that Microsoft has reoriented the goals for the tool. The new aims are to help prevent active exploits, protect older applications and add centralized management control over applications. To that end, EMET 2.0 will sport a new graphical user interface (GUI), instead of the earlier released console control with a command-line user interface. The GUI lets software developers and IT pros easily turn EMET on or off for various applications, and they can also easily check that status using the GUI.

Anyone can use EMET, but it's primarily designed for users of applications at high risk for attack, such as browser-based apps or line-of business apps, particularly older ones based on Windows XP. EMET brings together some mitigations that were first introduced with Windows Vista and Windows 7, enabling those protections for Windows XP-based apps.

The two new mitigations in EMET 2.0 will be Export Address Table Access Filtering and Mandatory Address Space Layout Randomization, according to Microsoft's announcement. The first mitigation makes it harder for exploits using shell code to locate Windows APIs. The second one makes it more difficult for attackers to locate modules by randomizing the addresses of the modules. Module addresses are randomized every time Windows is rebooted according to a Microsoft video explaining EMET 2.0.

The other mitigations to be included in EMET 2.0 were previously available in version 1.0.2. They are Dynamic Data Execution Prevention, Structure Exception Handler Overwrite Protection, Null Page Allocation and Heap Spray Allocation.

According to Microsoft's video, the majority of Internet Explorer exploits tap into heap spray techniques. The techniques are used to ensure that an exploit can run by placing "copies of shellcode at as many memory locations as possible," Microsoft's announcement explains.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

comments powered by Disqus


  • AI for GitHub Collaboration? Maybe Not So Much

    No doubt GitHub Copilot has been a boon for developers, but AI might not be the best tool for collaboration, according to developers weighing in on a recent social media post from the GitHub team.

  • Visual Studio 2022 Getting VS Code 'Command Palette' Equivalent

    As any Visual Studio Code user knows, the editor's command palette is a powerful tool for getting things done quickly, without having to navigate through menus and dialogs. Now, we learn how an equivalent is coming for Microsoft's flagship Visual Studio IDE, invoked by the same familiar Ctrl+Shift+P keyboard shortcut.

  • .NET 9 Preview 3: 'I've Been Waiting 9 Years for This API!'

    Microsoft's third preview of .NET 9 sees a lot of minor tweaks and fixes with no earth-shaking new functionality, but little things can be important to individual developers.

  • Data Anomaly Detection Using a Neural Autoencoder with C#

    Dr. James McCaffrey of Microsoft Research tackles the process of examining a set of source data to find data items that are different in some way from the majority of the source items.

  • What's New for Python, Java in Visual Studio Code

    Microsoft announced March 2024 updates to its Python and Java extensions for Visual Studio Code, the open source-based, cross-platform code editor that has repeatedly been named the No. 1 tool in major development surveys.

Subscribe on YouTube