Enhanced Mitigation Experience Toolkit #EMET #security

The Enhanced Mitigation Experience Toolkit (EMET) helps raise the bar against attackers gaining access to computer systems. EMET anticipates the most common actions and techniques adversaries might use in compromising a computer, and helps protect by diverting, terminating, blocking, and invalidating those actions and techniques. EMET helps protect your computer systems even before new and undiscovered threats are formally addressed by security updates and antimalware software. EMET benefits enterprises and all computer users by helping to protect against security threats and breaches that can disrupt businesses and daily lives.

 

Download The Enhanced Mitigation Experience Toolkit (EMET) : http://www.microsoft.com/en-us/download/details.aspx?id=41963

 

EMET 5.0 Technical preview introduces a mitigation that can be used to reduce the exposure of components at risk to remote attackers. ASR is a new feature that can be used to block the usage of specific modules or plugins within an application. For example, EMET can be configured to prevent Microsoft Word/Excel from loading the Flash plugin, or, with the support of security zones, can be used to prevent Internet Explorer from loading the Java plugin on an Internet Zone website while continuing to allow Java on Intranet Zone websites. The mechanism simply prevents DLL loading in a selective way per-process and it essentially adds the benefit of the “killbit” mechanism to any application without need of complicated CLSID.
NOTE: The list of blocked modules for ASR and the zones with exceptions (where the modules are allowed to be loaded) should be manually defined by the user in the following registry key per-application:

HKLM\SOFTWARE\Microsoft\EMET\_settings_\{CLSID}\asr_modules = “…”
HKLM\SOFTWARE\Microsoft\EMET\_settings_\{CLSID}\asr_zones = “…”
In EMET 5.0TP the feature is enabled only for the following combinations of processes and modules:

The list of security zones is the standard one used by Internet Explorer: Local (0), Intranet (1), Trusted (2), Internet (3), Untrusted (4).

EMET offers the “Early Warning Program” reporting feature. When an exploitation attempt is detected and blocked by EMET, a set of information related to the attack will be sent back to Microsoft through the standard Windows Error Reporting channel.

This information will help Microsoft to obtain information related to 0day exploits and will facilitate the remediation of the issue before it becomes a large scale threat. If the vulnerability is related to a software from a third party vendor, Microsoft will work with the affected vendor through the Microsoft Vulnerability Research program to remediate the issue.

The Early Warning Program reporting feature will also send back to Microsoft information related to suspicious SSL certificates related to Microsoft online services. Please refer to the “Privacy Statement.rtf” file, available also through the “Help” ribbon in EMET GUI, and at http://aka.ms/emet41ps, for more information on the type of data that will be sent to Microsoft.