Reducing Exploitation of Failed Security with EMET

Reducing Exploitation of Failed Security with EMET

Objective

This article aims to demonstrate how to install and configure the EMET to reduce the exploitation of flaws in security on your computer quickly and easily.

Overview

Virtually all software has had some vulnerability and security for those who have not had is just a matter of time before some hacker or technology student discover the vulnerability and make it public. Thinking about that Microsoft created the EMET (Enhanced Experience Mitigation Toolkit).The EMET was created to reduce the exploitation of security holes used by hackers to gain access to systems that have vulnerabilities known and the Zero-day Attack .

A major challenge for users today is to keep their computers updated and safe and I’m not talking here only of the operating systems from Microsoft, but all the other thousands of software programs that are installed on the computers, such as Adobe Reader , Winzip, Firefox, Apple QuickTime, etc..

The big software vendors like Microsoft has released security updates constantly to prevent their software from being exploited by hackers, but in some cases these vulnerabilities are discovered and before the manufacturers become public without prior notice. When this happens the software is vulnerable to Zero-day Attack until a patch is created and distributed by the manufacturer. As aworkaround you can use the EMET to protect your system until a patch is available.

Note

The EMET allows you to force the use of DEP , ASLR and SEHOP throughout its system, which prevents some common programming errors result in exploitable vulnerabilities. Application level can force the use of DEP, SEHOP, NullPage, HeapSpray, EAF, MandatoryASLR.

Installing EMET

1 – To install the EMET do first download at:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04

2 – Click on download and wait until the download is completed.

3 – Double-click the file EMET Setup.msi. Will load the dialog box as shown in Figure 1.1.

Figure 1.1

4 – In the dialog box EMET Welcome to the Setup Wizard click the Next button to continue. Will load the dialog box as shown in Figure 1.2.

Figure 1.2

5 – In the Select Installation Folder dialog select the location where it will be installed and setEMET who can use it and then click the Next button. Will load the dialog box as shown in Figure 1.3.

Figure 1.3

6 – In the License Agreement dialog box, read the license terms and select I Agree and then click the Next button. Will load the dialog box as shown in Figure 1.4.

Figure 1.4

7 – On the Confirm Installation dialog box, click Next to install the EMET. Will load the dialog box as shown in Figure 1.5.

Figure 1.5

8 – In the User Account Control dialog click the Yes button to allow the EMET is installed on your computer. Will load the dialog box as shown in Figure 1.6.

Figure 1.6

9 – In the Installation Complete dialog box, click the Close button to close the installation program.

Configuring the EMET

EMET After installing on your computer, the next step is to configure, but before setting out all the software from your computer to use the EMET, it is important that you do before all the tests required for each software individually because depending on the software or settings that you make with theEMET it can cause outages in using the software. Then enable the first software to EMET are considered major vectors of attacks by hackers, such as PDF readers, web browsers, instant messaging programs, and any other software that has Internet connectivity.

1 – Click Start, All Programs, Enhanced Experience Mitigation Toolkit and click the EMETprogram 2.0. Will load the dialog box as shown in Figure 1.7.

Figure 1.7

2 – In the User Account Control dialog click the Yes button to enable the implementation of theEMET program on your computer. Window will be loaded as shown in Figure 1.8.

Figure 1.8

3 – At the top of the window click the Configure button EMET System. Will be charged the dialog box as shown in Figure 1.9.

Figure 1.9

4 – In the System Configuration dialog box you have options DEP, ASLR and SEHOP, which will affect the entire system.

The recommended option is to keep the Application Opt-In Mitigation of the three options, which is the criterion of EMET enable protection or not in your system. If you want to set the maximum security, you can enable the Maximum Security Settings in the Profile Name. Selecting this option you may have some additional locks on your system, in which case you need to return the configuration to Opt-In Application. Choose the desired setting and then click the OK button. In our example, we will not change this setting.

Note

In Windows XP and Windows Server 2003, only DEP is available.

5 – At the bottom click the Configure button Apps. Window will be loaded as shown in Figure 1.10.

Figure 1.10

6 – In the Application Configuration dialog box, click the Add button to add an application to be configured by EMET. Will load the dialog box as shown in Figure 1.11.

Figure 1.11

7 – In the Add Application dialog box, locate the software to be configured by EMET and then clickOpen. In our example we will select the Adobe Reader software. Window will be loaded as shown in Figure 1.12.

Figure 1.12

By default the EMET will mark all the options (DEP SEHOP, NullPage, HeapSpray, EAF, MandatoryASLR), but depending on what software you have added a list of options may be incompatible, which could cause a crash of the software, then make several tests before starting production.

8 – In the Application Configuration dialog box, click the OK button. Window will be loaded as shown in Figure 1.13.

Figure 1.13

Note

At the end of the window displays the message EMET The changes you made May Require Have restarting one or more applications.

9 – Run the program that you configured in previous steps, in our example we will run the Acrobat Reader. The window displays the process of EMET Adobe Reader as shown in Figure 1.14.

Figure 1.14

As you can see the Adobe Reader (AcroRd32 process) is running with the protection of EMET.Now just repeat the same procedure to add other software on the list.

Luciano Lima
[Enterprise Security MVP] – [MCSA Security] – [MCSE Security]

www.ticlassificados.com (New)
www.guiamcitp.com.br
www.guiamcse.com.br
www.guiamcse.com.br / forum (New)
www.guiacissp.com.br
www.guiacissp.com.br / forum (New)

 

Find More Adobe Apple Articles