Feeds

Free Microsoft security tool locks down buggy apps

No assembly required

Providing a secure and efficient Helpdesk

Microsoft has released a free tool designed to harden software applications against attacks that exploit common security vulnerabilities.

EMET, short for Enhanced Mitigation Evaluation Toolkit, allows developers and administrators to add specific security protections to applications. Unlike mitigations released in the past, EMET doesn't require programs to be recompiled, so it can be used to fortify applications even when the source code isn't available.

EMET also allows specific mitigations to be applied to a particular application process, a granularity that helps when a given process isn't compatible with a given control.

Over the past few years, developers have increasingly focused on adding measures to their applications that make it harder for attackers to exploit vulnerabilities. The approach makes a lot of sense given the inevitability of buffer overflows and other garden-variety vulnerabilities in complex software. Rather than trying to weed out such bugs, mitigation intends to neutralize their harmful effects.

At the moment, EMET is shipping with just four mitigations, including SEHOP, which prevents many structured exception handling exploits; DEP, or data execution prevention, which marks certain parts of process memory as non-executable; NULL page allocation, designed to block NULL dereference exploits in user mode; and heap spray allocation, which pre-allocates certain memory addresses to make it harder for attackers to predict the location of malicious payloads.

Microsoft plans to add new protections to EMET over time. The program adds to the list of free security tools Microsoft has released over the past year, including its threat modeling tool, the !exploitable Crash Analyzer and the Microsoft Minifuzz file fuzzer.

No doubt, EMET shouldn't be viewed as a substitute for baking such security controls into applications at the time of compilation. But the utility makes sense for shops that rely on large amounts of legacy software or commonly used third-party titles that are prone to abuse.

"For applications that haven't turned on some of these security settings, it looks like it gives you the ability to add those security controls after the fact," said Rich Mogull, CEO of security firm Securosis. "I think that's great, because those are some of the better defenses that we have these days."

Microsoft engineers say that, had SEHOP been in use, an exploit targeting MS09-034 earlier this year would have failed. But they are quick to point out that EMET isn't for newbies, because many applications rely on precisely the behavior the utility is designed to block. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.