Slashdot Mirror
Researchers Disarm Microsoft's EMET
wiredmikey (1824622) writes "Security researchers have found a way to disable the protection systems provided by the latest version of Microsoft's Enhanced Mitigation Experience Toolkit (EMET), a software tool designed to prevent vulnerabilities from being exploited by using various mitigation technologies. Others have managed to bypass EMET in the past, but researchers from Offensive Security have focused on disarming EMET, rather than on bypassing mitigations, as this method gives an attacker the ability use generic shellcodes such as the ones generated by Metasploit. The researchers managed to disarm EMET and get a shell after finding a global variable in the .data section of the EMET.dll file. Initially, they only managed to get a shell by executing the exploit with a debugger attached, due to EMET's EAF checks. However, they've succeeded in getting a shell outside the debugger after disarming EAF with a method described by security researcher Piotr Bania in January 2012. The researchers tested their findings on Windows 7, Internet Explorer 8 and EMET 4.1 update 1."
Here in Brazil Emet is a bitter medicine, that stops you from throwing up.
Researchers Disarm Microsoft's EMET : tha did scare me a lot!
Jose T Oliveira Jr.
There is also the devil's advocate here: Every black hat, criminal organization, and national intel department is focusing on Microsoft's stuff with a passion, because a 0-day that is big enough could mean billions of revenue from extortion, blackmail, or just malicious mischief.
Before Microsoft was the leader, people said the same exact stuff about Sun. They whined that Solaris had too many holes, talked about how slow the fixes came out, and so on.
Microsoft has a lot of bad guys hunting them down every second of every day. Well heeled bad guys.
I'm amazed that they don't get nailed more often with 0-days with all the pressure the bad guys can bring to bear.
>managed to disarm EMET and get a shell after finding a global variable in the .data section
What is wrong with storing variables in the data section? Isn't that where you're supposed to keep data?
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Torah joke.
I want more details here. I generally have a disdain for Microsoft but here it seems they built a custom target to exploit.
If they did this against say, IE or some other app in the wild, sure lets ask if we should pack it up. Until then...
Non impediti ratione cogitationus.
I'm no lawyer but I feel certain that if you manage to get billions out of an exploit the words "malicious mischief" will not appear in the indictment...
At the very least I would expect "felonious tomfoolery"!
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Well the first step in exploiting IE or other apps on a system in the wild is to bypass EMET. Remember, EMET is a mitigation technology designed to make it harder to exploit a vulnerability in IE, Flash, Acrobat Reader, etc. by adding extra protections. So if you are able to turn EMET off, you can then get back to your normal exploit.
If you are able to arbitrarily modify system .DLLs, aren't you already in the system?
Sounds an awful lot like today's Old New Thing post: http://blogs.msdn.com/b/oldnew...
but then IT pros go union and get licenses so they can't be pushed around by MBA's and PHB's to do stuff in an cheap and non secure ways..
Trying to get Flash to fall under all of EMET's protections is like trying to hit three moving targets. As soon as Flash gets updated, the executables it uses run under different file names and any specific mitigations are then lost. Thankfully, most applications that are easy meat for EMET's good work are a one-off config.
Emetic.
I'm no lawyer but I feel certain that if you manage to get billions out of an exploit the words "malicious mischief" will not appear in the indictment... At the very least I would expect "felonious tomfoolery"!
My God man! There are women and children present! Break out the smelling salts.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
All these abbreviations are technically like humanitarian sciences. Far, far away from CPU's instruction execution.
I'm no lawyer but I feel certain that if you manage to get billions out of an exploit the words "malicious mischief" will not appear in the indictment... At the very least I would expect "felonious tomfoolery"!
My God man! There are women and children present! Break out the smelling salts.
That's why I didn't go with "assiduous asshatterie".
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Your missing the point. If you have administrator rights, why even bother disabling EMET. Just uninstall it. Here is a quick exploit code for that:
Get-WmiObject Win32_Product | Where-Object{$_.Name -match "EMET"} | ForEach-Object{$_.Uninstall()}
If the attacker has admin rights then game over. Any other exploit after that is just smoke and mirrors.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.