Microsoft To Release Updated EMET Security Tool

Microsoft announced today that it is planning to release a new version of its security mitigation tool for ISVs and Windows users.

Enhanced Mitigation Experience Toolkit (EMET) 2.0, when released in "upcoming weeks," will contain six mitigation protections, according to Microsoft's announcement. The mitigations block general techniques used by hackers that try to exploit vulnerabilities commonly found in software. Version 2.0 will be an update to the Enhanced Mitigation Evaluation Toolkit 1.0.2, which was announced in October.

For this new upcoming release, Microsoft plans to change the name of the tool slightly, dropping the word "evaluation" in the older toolkit name for "experience" in the new one.

The reason for the name change, according to the announcement, is that Microsoft has reoriented the goals for the tool. The new aims are to help prevent active exploits, protect older applications and add centralized management control over applications. To that end, EMET 2.0 will sport a new graphical user interface (GUI), instead of the earlier released console control with a command-line user interface. The GUI lets software developers and IT pros easily turn EMET on or off for various applications, and they can also easily check that status using the GUI.

Anyone can use EMET, but it's primarily designed for users of applications at high risk for attack, such as browser-based apps or line-of business apps, particularly older ones based on Windows XP. EMET brings together some mitigations that were first introduced with Windows Vista and Windows 7, enabling those protections for Windows XP-based apps.

The two new mitigations in EMET 2.0 will be Export Address Table Access Filtering and Mandatory Address Space Layout Randomization, according to Microsoft's announcement. The first mitigation makes it harder for exploits using shell code to locate Windows APIs. The second one makes it more difficult for attackers to locate modules by randomizing the addresses of the modules. Module addresses are randomized every time Windows is rebooted according to a Microsoft video explaining EMET 2.0.

The other mitigations to be included in EMET 2.0 were previously available in version 1.0.2. They are Dynamic Data Execution Prevention, Structure Exception Handler Overwrite Protection, Null Page Allocation and Heap Spray Allocation.

According to Microsoft's video, the majority of Internet Explorer exploits tap into heap spray techniques. The techniques are used to ensure that an exploit can run by placing "copies of shellcode at as many memory locations as possible," Microsoft's announcement explains.

About the Author

Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.


  • Office 365 Attack Simulator Now Supports Attachments

    The Attack Simulator in Office 365 tool has been updated and now has the ability to include message attachments in targeted campaigns, according to a Friday Microsoft announcement.

  • How To Disable Touch Input in Windows 10

    When the touchscreen on your Windows 10 laptop goes bad, there's no reason to throw that baby out with the bath water.

  • Microsoft Previews Windows VM Authentications via Azure Active Directory

    Microsoft on Thursday announced a preview of remote authentications into Windows-based Azure virtual machines (VMs) using Azure AD credentials.

  • Windows Server 20H1 Getting Smaller Containers and Faster PowerShell

    Microsoft is promising to deliver a smaller container size and improved PowerShell performance with its next release of Windows Server.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.