3 ms·

Since the article cite it, I guess I can make a comment too and raise awareness regarding EMET. EMET is a free application published by Microsoft (http://www.m

by Spittie 13y ago

Since the article cite it, I guess I can make a comment too and raise awareness regarding EMET. EMET is a free application published by Microsoft (http://www.microsoft.com/en-us/download/details.aspx?id=39273 http://www.microsoft.com/en-us/download/details.aspx?id=3927...) that enable advanced protections for many applications, such as DEP and ASRL. It comes out of the box with rules that cover many popular applications, so it's an "install and forget" solution for many users. If anyone is interested, this is the article that made me aware of EMET: http://rationallyparanoid.com/articles/microsoft-emet-3.html http://rationallyparanoid.com/articles/microsoft-emet-3.html (slightly outdates as Microsoft has released EMET 4, but it's still an interesting read, especially the "Does EMET make a difference?" part), and there is also an interesting user guide here: http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4A4C-9192-444810C26F6B/EMET%204.0%20User's%20Guide.pdf http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4... I suggest to everyone to gave it a try, it's very lightweight and it has yet to cause a single problem on my system.

skymt 13y ago
I'd suggest that EMET users should add the Flash plugin to EMET's list, as it's a common target that isn't protected by default. Unfortunately the Flash exe's name changes with every version, so it's not set-and-forget. Adding an application to EMET is simple for a user with some amount of Windows knowledge. Its main window has a list of running processes. Just right-click the one you want to protect and choose "configure process."
maaaats 13y ago
I've skimmed the links, and have some questions: How does it prevent these things? And why isn't it enabled by default in Windows?
- skymt 13y ago
  EMET offers a grab-bag of mitigation techniques that are described in some detail in its manual (PDF download): http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4A4C-9192-444810C26F6B/EMET%204.0%20User%27s%20Guide.pdf http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4... Some of these techniques are enabled by default or on an opt-in basis in recent versions of Windows, and EMET can be used to enable them on older Windows systems. Other techniques would be too easily triggered by the normal operation of badly-written software, making the software unusably crashy.
mappu 13y ago
+1 for EMET. But it doesn't make you bulletproof. http://labs.bromium.com/2014/02/24/bypassing-emet-4-1/ http://labs.bromium.com/2014/02/24/bypassing-emet-4-1/

by Spittie 13y ago

skymt 13y ago

I'd suggest that EMET users should add the Flash plugin to EMET's list, as it's a common target that isn't protected by default. Unfortunately the Flash exe's name changes with every version, so it's not set-and-forget. Adding an application to EMET is simple for a user with some amount of Windows knowledge. Its main window has a list of running processes. Just right-click the one you want to protect and choose "configure process."

maaaats 13y ago

I've skimmed the links, and have some questions: How does it prevent these things? And why isn't it enabled by default in Windows?

skymt 13y ago
EMET offers a grab-bag of mitigation techniques that are described in some detail in its manual (PDF download): http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4A4C-9192-444810C26F6B/EMET%204.0%20User%27s%20Guide.pdf http://download.microsoft.com/download/4/E/9/4E9A5137-F73D-4... Some of these techniques are enabled by default or on an opt-in basis in recent versions of Windows, and EMET can be used to enable them on older Windows systems. Other techniques would be too easily triggered by the normal operation of badly-written software, making the software unusably crashy.

mappu 13y ago

+1 for EMET. But it doesn't make you bulletproof. http://labs.bromium.com/2014/02/24/bypassing-emet-4-1/ http://labs.bromium.com/2014/02/24/bypassing-emet-4-1/