Last week, we decided to take a look onto the EMET library provided by
Microsoft. This library is intended to introduce several security features to
applications which are not explicitly compiled to use them.
It also adds an additional layer to protect against typical exploiting
techniques by filtering library calls, preventing usage of dangerous
functions/components and inserting mitigation technologies.
As EMET is already a target for many researchers, we currently only started to
get an overview of it’s structure and how the different components are
interacting with each other. Today we would like to share some of our results
with you.
At the Troopers 16 Casey Smith has given a talk about the gap in Application
Whitelisting.
Application Whitelisting is a technique that should prevent malware and
unauthorized applications from running. Broadly speaking this is implemented by
deciding if an application is trusted or not before executing it. Casey’s talk
gave an understanding where this whitelisiting fails down.
In his introduction about the architecture he reminded us: There is no perfect
defense. It is important to understand how the defenses work and where they
fail. In the difference to exploits, which can be patched, there is no
possibility to patch architecture flaws.
In the light of the recent release of version 5.0 of Microsoft’s Enhanced
Mitigation Experience Toolkit (EMET) on July 31, it seems to be more than
appropriate to talk a bit about the new features and some general things to take
into account when using EMET (for the new certificate pinning feature of EMET
4.0, see
Friedwart’s comment).
For all of you who don’t know EMET, in short, it’s a free mitigation tool for
Windows developed by Microsoft, helping the user by preventing vulnerabilities
in software from being successfully exploited. The tool works by protecting
applications via a number of security mitigation technologies, vastly extending
Windows operating system mitigation capabilities as Data Execution Prevention
(DEP) and Address Space Layout Randomization (ASLR).
Microsoft released
EMET v4.0 with
a new (security) feature that enables protection against fraudulent websites or
compromised root certification authorities (do you remember Comodo, DigiNotar,
DigiCert, Turktrust et al. ;-)?)
EMET defines via “certificate trust“ a trust chain between the domain name of a
website (and its associated website certificate) and a root CA certificate. This
is done through so called “pinning rules”. Here is one of the default pinning
rules of EMET 4.0 for the domain name login.live.com: