Feeds

Free Microsoft security tool locks down buggy apps

No assembly required

Boost IT visibility and business value

Microsoft has released a free tool designed to harden software applications against attacks that exploit common security vulnerabilities.

EMET, short for Enhanced Mitigation Evaluation Toolkit, allows developers and administrators to add specific security protections to applications. Unlike mitigations released in the past, EMET doesn't require programs to be recompiled, so it can be used to fortify applications even when the source code isn't available.

EMET also allows specific mitigations to be applied to a particular application process, a granularity that helps when a given process isn't compatible with a given control.

Over the past few years, developers have increasingly focused on adding measures to their applications that make it harder for attackers to exploit vulnerabilities. The approach makes a lot of sense given the inevitability of buffer overflows and other garden-variety vulnerabilities in complex software. Rather than trying to weed out such bugs, mitigation intends to neutralize their harmful effects.

At the moment, EMET is shipping with just four mitigations, including SEHOP, which prevents many structured exception handling exploits; DEP, or data execution prevention, which marks certain parts of process memory as non-executable; NULL page allocation, designed to block NULL dereference exploits in user mode; and heap spray allocation, which pre-allocates certain memory addresses to make it harder for attackers to predict the location of malicious payloads.

Microsoft plans to add new protections to EMET over time. The program adds to the list of free security tools Microsoft has released over the past year, including its threat modeling tool, the !exploitable Crash Analyzer and the Microsoft Minifuzz file fuzzer.

No doubt, EMET shouldn't be viewed as a substitute for baking such security controls into applications at the time of compilation. But the utility makes sense for shops that rely on large amounts of legacy software or commonly used third-party titles that are prone to abuse.

"For applications that haven't turned on some of these security settings, it looks like it gives you the ability to add those security controls after the fact," said Rich Mogull, CEO of security firm Securosis. "I think that's great, because those are some of the better defenses that we have these days."

Microsoft engineers say that, had SEHOP been in use, an exploit targeting MS09-034 earlier this year would have failed. But they are quick to point out that EMET isn't for newbies, because many applications rely on precisely the behavior the utility is designed to block. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?