Slashdot Mirror

← Back to Stories (view on slashdot.org)

Complete Microsoft EMET Bypass Developed

Posted by Unknown on from the just-a-teeny-tiny-bug dept.

msm1267 writes "Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft's Enhanced Mitigation Experience Toolkit (EMET). Principal security researcher Jared DeMott is delivered a presentation at the Security BSides conference explaining how the company's researchers were able to bypass all of the memory protections offered within the free Windows toolkit. The work is significant given that Microsoft has been quick to urge customers to install and run EMET as a temporary mitigation against zero-day exploits targeting memory vulnerabilities in Windows or Internet Explorer. The exploit bypasses all of EMET's mitigations, unlike previous bypasses that were able to beat only certain aspects of the tool. Researchers took a real-world IE exploit and tweaked it until they had a complete bypass of EMET's ROP, heap spray, SEHOP, ASLR, and DEP mitigations."

4 of 116 comments (clear)

  1. Is anyone surprised? by Anonymous Coward · · Score: 5, Interesting

    EMET is just a bunch of industry-standard mitigations (e.g. the kind of thing you get on Linux with grsecurity) - and several of them poorly implemented at that. They're mitigations - they make exploits harder, not impossible.

    If you rely on EMET for security, you're doing it wrong. Stuff like EMET is just a speed bump. It's good to have, it should be enabled by default, and we should stop treating it like some magic "security on" switch.

    1. Re:Is anyone surprised? by cheater512 · · Score: 5, Insightful

      I disagree. It is like changing the SSH port.

      It gives the *illusion* of security, which makes people slack.
      E.g. My SSH password is 123456 but don't worry its ok! I changed the SSH port to 1234 so I'm safe.

      I avoid smoke and mirrors security as much as possible.

    2. Re:Is anyone surprised? by Tanktalus · · Score: 5, Insightful

      So, you don't use a club on your steering wheel, you don't bother hiding valuables in your trunk, leaving them in plain view, and, really, since a professional can get in the car anyway, just leave the doors unlocked. It's all smoke and mirrors anyway.

      If a malicious attacker/user is portscanning your system and finds that port 22 is open, they're going to assume an ssh attack. If they find port 1234, they may move on to another target that has port 22 open instead. Of course, if they're really after you, and not just throwing a wide net, then such shenanigans aren't going to stop them, though it might slow them down for a little while while they try to figure out what's listening on which non-standard port.

      If a script kiddie is doing the same, most likely port 1234 would be enough to fool them, and they'd never get in.

      Seems like smoke and mirrors are a useful tool in a secure system's administration, but should never be the sole tool.

    3. Re:Is anyone surprised? by marsu_k · · Score: 5, Funny

      Shhhh, quiet, you'll summon APK. I've heard if you say "HOSTS file" in front of a mirror three times he'll appear in person.