3 ms·

No you shouldn't. 1. It breaks a lot of stuff. 2. It isn't very good: http://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf http://bromiumlab

by bananas 12y ago

No you shouldn't. 1. It breaks a lot of stuff. 2. It isn't very good: http://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf http://bromiumlabs.files.wordpress.com/2014/02/bypassing-eme... At best it's a dose of Tamiflu. As many people before have said, you can't retrospectively apply security mitigations properly; you have to design them in from the start.

Spittie 12y ago
1. Really? I've been using it for a while, and no breakage. Sure, I just use the default rulelist instead of applying rules to everything (which imo is what most people should do). 2. Sure, but it's better than nothing. As parent said, this exploit is mitigated by EMET. See http://rationallyparanoid.com/articles/emet-testing.html http://rationallyparanoid.com/articles/emet-testing.html for more tests Yes, it's a bandaid. But since it help and it's free, why not?
- bananas 12y ago
  We've had a couple of older COM-based applications that target Windows 5.1 (2003/XP) platforms fail unpredictably with it on later operating systems. Whether these are just badly behaved applications or compilers or a faulty design in EMET we don't know as it's all closed source and when you're left with a steaming minidump (because you can't catch these unless you use ADplus) it's not easy to work out why a process failed from that if EMET shot it. As for the better than nothing, yes until your phone starts ringing like a cheesy sci-fi flick because half your MSMQ sinks are crashing... My comment above probable shouldn't have been: no you shouldn't use it until you've soak tested your applications on it.
  - noinsight 12y ago
    EMET should show a notification when it blocks something and it should also make an event log entry. (These are configurable iirc.)
eps 12y ago
Who said to apply EMET to "a lot of stuff"? It is meant to plug holes in apps that handle untrusted data. For a vast majority of people that would be a browser, a mail client and various document viewers. IE, Firefox, Chrome, Flash player, Outlook, Thunderbird and Acrobat Reader all run A-Ok under EMET and most of them are on its default list. Remeber the RTF zeroday from a couple weeks ago? It too was mitigated with EMET. That's two zerodays in two weeks. The Bromium labs bypass was addressed in EMET 5.0, not few weeks after their announcement. The bottom line is that it the most effective zeroday protection available at the moment. Is it perfect? No. Does it work? Yes.
lawnchair_larry 12y ago
Terrible advice. You should definitely run EMET.

by bananas 12y ago

Spittie 12y ago

1. Really? I've been using it for a while, and no breakage. Sure, I just use the default rulelist instead of applying rules to everything (which imo is what most people should do). 2. Sure, but it's better than nothing. As parent said, this exploit is mitigated by EMET. See http://rationallyparanoid.com/articles/emet-testing.html http://rationallyparanoid.com/articles/emet-testing.html for more tests Yes, it's a bandaid. But since it help and it's free, why not?

bananas 12y ago
We've had a couple of older COM-based applications that target Windows 5.1 (2003/XP) platforms fail unpredictably with it on later operating systems. Whether these are just badly behaved applications or compilers or a faulty design in EMET we don't know as it's all closed source and when you're left with a steaming minidump (because you can't catch these unless you use ADplus) it's not easy to work out why a process failed from that if EMET shot it. As for the better than nothing, yes until your phone starts ringing like a cheesy sci-fi flick because half your MSMQ sinks are crashing... My comment above probable shouldn't have been: no you shouldn't use it until you've soak tested your applications on it.
- noinsight 12y ago
  EMET should show a notification when it blocks something and it should also make an event log entry. (These are configurable iirc.)

eps 12y ago

Who said to apply EMET to "a lot of stuff"? It is meant to plug holes in apps that handle untrusted data. For a vast majority of people that would be a browser, a mail client and various document viewers. IE, Firefox, Chrome, Flash player, Outlook, Thunderbird and Acrobat Reader all run A-Ok under EMET and most of them are on its default list. Remeber the RTF zeroday from a couple weeks ago? It too was mitigated with EMET. That's two zerodays in two weeks. The Bromium labs bypass was addressed in EMET 5.0, not few weeks after their announcement. The bottom line is that it the most effective zeroday protection available at the moment. Is it perfect? No. Does it work? Yes.

lawnchair_larry 12y ago

Terrible advice. You should definitely run EMET.