Slashdot Mirror
Complete Microsoft EMET Bypass Developed
msm1267 writes "Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft's Enhanced Mitigation Experience Toolkit (EMET). Principal security researcher Jared DeMott is delivered a presentation at the Security BSides conference explaining how the company's researchers were able to bypass all of the memory protections offered within the free Windows toolkit. The work is significant given that Microsoft has been quick to urge customers to install and run EMET as a temporary mitigation against zero-day exploits targeting memory vulnerabilities in Windows or Internet Explorer. The exploit bypasses all of EMET's mitigations, unlike previous bypasses that were able to beat only certain aspects of the tool. Researchers took a real-world IE exploit and tweaked it until they had a complete bypass of EMET's ROP, heap spray, SEHOP, ASLR, and DEP mitigations."
EMET is just a bunch of industry-standard mitigations (e.g. the kind of thing you get on Linux with grsecurity) - and several of them poorly implemented at that. They're mitigations - they make exploits harder, not impossible.
If you rely on EMET for security, you're doing it wrong. Stuff like EMET is just a speed bump. It's good to have, it should be enabled by default, and we should stop treating it like some magic "security on" switch.
Is this a general method for bypassing EMET protections, or is it only applicable to one specific IE exploit?
EMET is not a cure all, nor is it pushed as one. EMET is about standard best practises to mitigate many exploits (not all) and is still an excellent toolkit for what it offers, that doesn't mean you should rely on only it. And as usual the Slashdot summary comes across as far more negative than the actual article itself.
These bit-twiddling desperadoes should be arrested at once!
Pre beta I can read the complete (in most cases) text without leaving the main page. With Beta I have to queue the (perhaps interesting) readings in tabs and then review them (in order to avoid the back-and-forth). Bad UI, bad UX, bad design. Takes so much longer that I may just quit reading this site.
Not so well disguised advertisement is not so well disguised.
I disagree. It's the direct descendant of S/360 and has about 50 years of steady product improvements built in. Malware, running with general user access rights cannot affect system processes in any way, and cannot alter(or read) any memory location that it doesn't have access to. The zSeries hardware, with the operating system is a powerful combination, that Windows and commodity hardware can't touch.
I'm a zOS Operating Systems Programmer with 35+ years experience, and while there have been published security and system integrity patches issued on occasion, Windows has it beat by a mile.
You can't even get a Windows computer on the net without a virus scanner, it will be exploited before you can apply the latest patches.
Utter nonesense, when was the last time you installed windows? - 1998?
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
@bloodhawk: "EMET is not a cure all, nor is it pushed as one. EMET is about standard best practises to mitigate many exploits (not all) and is still an excellent toolkit for what it offers, that doesn't mean you should rely on only it. And as usual the Slashdot summary comes across as far more negative than the actual article itself"
.. This is true of EMET and other similar userland protections”
“The impact of this study shows that technologies that operate on the same plane of execution as potentially malicious code, offer little lasting protection,
How dare you criticise MICROS~1 ..
Why do you mention Linux? This sub-thread compared Windows against z/OS. The "market share" for z/OS as a general compute device is, of course, even less than Linux. However, z/OS is arguably much more secure than Windows.
Why is it that Windows criticism is taken as Linux support? Linux has its place (and I use it as my primary OS) but I certainly wouldn't claim it is secure. Windows should be secure, given that it is pre-installed on almost every consumer computing product.
Just another "Cubible(sic) Joe" 2 17 3061
And for a desktop, no one gives a crap.
Everything that matters to a user is sitting in folders that they can, by necessity, access. Your documents, your web browser session, and everything else that is even remotely important to you is available with no escalated privileges whatsoever. Yes they can't necessarily root your device,but to be honest, but unless you're actually running in a true multi user environment(which almost no desktop is), it's cold comfort that your PC works if you data is gone.
Because GP mentioned them, the overall subthread by be about z/os, but this particular branch was arguing that the "no one uses it" was BS because iOS and Linux servers are secure without AV.
That proves the opposite of what people think. It was for a very long time extremely effective. The auto scanning l33t hax0r tools out there only looked for port 22 for SSH. They didn't scan the system. If they didn't find it, they moved on. I saw massive differences in the number of failed logins for servers on 22 and servers not.
Now that has largely changed, but it worked real well for like a decade-ish. That is not worthless. No it wasn't the only layer of security, it wasn't an excuse to ignore everything, but it did a hell of a job reducing attack profile and costs -nothing-.
The problem is geeks seem to think if security isn't perfect, it is worthless, which is stupid because in the physical world there's no such thing, EVER, as perfect security and since all computers are in the end physical entities, the same actually applies to computer security. It is all layers, it is all protection against different levels of threats.
Turns out simple obscurity can be really useful at times. It doesn't make you safe by itself, but it can make a breakin that much harder, and thus less likely.
Cookie Monster was a prank program that required the user to install and run it with their own permissions. It didn't attempt to reproduce, spread or conceal itself.
or more to the point if you want a simple method to get a Windows computer patched and all the "fun" programs installed then you
1 on another computer download unpack and run WSUSOffline and build an update package
2 also visit ninite.com and grab a install loader for your "fun" programs (like firefox libreoffice and such)
3 do the initial setup on your computer and get to the desktop
4 run the WSUSOffline updater
5 run the ninite.com install loader
6 Profit!!
Any person using FTFY or editing my postings agrees to a US$50.00 charge
So... EMET is SHEKER?
Maybe you should read the paper they link in.
Basically, most of the security is incomplete or easily ignored / bypassed.
On a stock system, with EMET defaults enabled, there are certain critical things that aren't done (hooking an old API that marks memory as executable, etc.). Even if they could be done, the way I read through the paper suggests that there are SO MANY alternatives they could have used that it's going to be finger-in-the-dyke hole-blocking rather than a blanket fix.
A lot of the things they try to do (e.g. roll back to the caller of a function, disassemble the code and see if it came from a direct jump or a proper CALL, etc.) aren't done properly or are worthless (in this example, they just get the MS VC runtimes to do the call "properly" with data they control).
They seem to be able to run arbitrary code via their exploits and they don't pick out any one particular exploit. Most of their work is about punching holes AROUND EMET security, not crafting a one-off exploit, and pretty much they appear to succeed. Most of the things they use are merely small tweaks to existing XP exploits and things like that.
At many points they just say "Or you could do this in a million other ways". So it's not that they've found a one-off hole through these things that works 1/256th of the time by chance, they literally walk around all the checks and security by doing some quite simple things.
And, yes, they end up running calc.exe or whatever they want at the end of it, without EMET or any of the listed protections kicking up a fuss.
1996 ;)
I don't read your sig. Why are you reading mine?
Oh, how the mighty slashdot has fallen, when a logged in slashdotter makes the insightful comment that Windows was never designed with security in mind. Although they did better with Vista and 7 than previous OSes it's still the most insecure OS I know of.
Yet he gets modded -1 troll for a factual comment. Do we have more shills than real users? Or are anti-MS comments being modded down by editors on orders of Dice because Microsoft is advertising here?
Either way, it saddens me.
Free Martian Whores!
Someone at Microsoft has a really creepy obsession with the word "Experience." Just stop already!