Feeds

Free Microsoft security tool locks down buggy apps

No assembly required

Providing a secure and efficient Helpdesk

Microsoft has released a free tool designed to harden software applications against attacks that exploit common security vulnerabilities.

EMET, short for Enhanced Mitigation Evaluation Toolkit, allows developers and administrators to add specific security protections to applications. Unlike mitigations released in the past, EMET doesn't require programs to be recompiled, so it can be used to fortify applications even when the source code isn't available.

EMET also allows specific mitigations to be applied to a particular application process, a granularity that helps when a given process isn't compatible with a given control.

Over the past few years, developers have increasingly focused on adding measures to their applications that make it harder for attackers to exploit vulnerabilities. The approach makes a lot of sense given the inevitability of buffer overflows and other garden-variety vulnerabilities in complex software. Rather than trying to weed out such bugs, mitigation intends to neutralize their harmful effects.

At the moment, EMET is shipping with just four mitigations, including SEHOP, which prevents many structured exception handling exploits; DEP, or data execution prevention, which marks certain parts of process memory as non-executable; NULL page allocation, designed to block NULL dereference exploits in user mode; and heap spray allocation, which pre-allocates certain memory addresses to make it harder for attackers to predict the location of malicious payloads.

Microsoft plans to add new protections to EMET over time. The program adds to the list of free security tools Microsoft has released over the past year, including its threat modeling tool, the !exploitable Crash Analyzer and the Microsoft Minifuzz file fuzzer.

No doubt, EMET shouldn't be viewed as a substitute for baking such security controls into applications at the time of compilation. But the utility makes sense for shops that rely on large amounts of legacy software or commonly used third-party titles that are prone to abuse.

"For applications that haven't turned on some of these security settings, it looks like it gives you the ability to add those security controls after the fact," said Rich Mogull, CEO of security firm Securosis. "I think that's great, because those are some of the better defenses that we have these days."

Microsoft engineers say that, had SEHOP been in use, an exploit targeting MS09-034 earlier this year would have failed. But they are quick to point out that EMET isn't for newbies, because many applications rely on precisely the behavior the utility is designed to block. ®

New hybrid storage solutions

More from The Register

next story
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.