Slashdot Mirror

← Back to Stories (view on slashdot.org)

Attackers Can Turn Microsoft's Exploit Defense Tool EMET Against Itself (csoonline.com)

Posted by timothy on from the friends-like-these dept.

itwbennett writes: FireEye researchers have found a way for exploits to trigger a specific function in EMET that disables all protections it enforces for other applications. The researchers believe that their new technique, which essentially uses EMET against itself, is more reliable and easier to use than any previously published bypasses. It works against all supported versions of EMET — 5.0, 5.1 and 5.2 — but Microsoft patched the issue in EMET 5.5, which was released on Feb. 2. So if you haven't upgraded yet, now would be a good time to do it. For more about how the technique works, read FireEye's blog post.

3 of 40 comments (clear)

  1. HUGE patch download! by DoofusOfDeath · · Score: 3, Funny

    For the convenience of Microsoft's customers, the patch for the EMET exploit will also provide a FREE upgrade to Windows 10!

    1. Re:HUGE patch download! by Virtucon · · Score: 3, Funny

      with ask.com as your default home page and chrome as your browser? Win!

      --
      Harrison's Postulate - "For every action there is an equal and opposite criticism"
  2. WTF, Microsoft? by EndlessNameless · · Score: 5, Insightful

    EMET is a baseline requirement if you are focused at all on security.

    As with any security measure, it can cause issues with applications. Because of this, sane people are conservative in deploying new versions.

    The notes on the EMET 5.5 release and download pages mention this vulnerability nowhere.

    A critical flaw in a security tool is a very important thing to know about. This information should be prominent and obvious.

    I even checked the user guide in case it is buried somewhere, and there is not a hint of security-related bugfixes in there either.

    --

    ---
    According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.