Introducing EMET v3

Discussion in 'other security issues & news' started by ronjor, May 15, 2012.

Thread Status:
Not open for further replies.
  1. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,611
    Location:
    Canada
    I had no issues either until I tried playing some videos off a ctvolympics.ca website.

    *EDIT*

    after some research, the site utilizes MS Silverlight through plugin-container.exe, and when videos do play, a Silverlight-associated DLL, agcore.dll, is using very high CPU cycles as observed under Process Explorer's Threads tab, so this might be the culprit.
     
    Last edited: Aug 5, 2012
  2. subhrobhandari

    subhrobhandari Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    771
    Just in case someone needed, I have uploaded my EMET configuration file here.

    hxxp://flashmirrors.com/files/8hb7znda1vvex1u/subhrobhandari_s%20EMET%20Configuration.xml

    I haven't done extensive testing but been using this since the day this tech preview was released.
     
    Last edited: Aug 7, 2012
  3. Baserk

    Baserk Registered Member

    Joined:
    Apr 14, 2008
    Posts:
    1,321
    Location:
    AmstelodamUM
    Bypassing 3.5 ROP mitigations claimed;

    'It seems MS was aware of this kind of bypasses, so I bypassed EMET ROP mitigations using another EMET’s implementation mistake. EMET team forget about the KernelBase.dll and left all its functions unprotected. so I used @antic0de‘s method for finding base address of kernelbase.dll at run-time, then I used VirtualProtect inside the kernelbase.dll, not ntdll.dll or krenel32.dll. you can get new exploit at the end of this post.

    I have managed to bypass EMET 3.5, which is recently released after Microsoft BlueHat Prize, and wrote full-functioning exploit for CVE-2011-1260 (I choosed this CVE randomly!) with all EMET’s ROP mitigation enabled. ...
    '

    Wordpress link and Twitter link
     
  4. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    It's actually great that Microsoft provides these Release Previews. This way they get a chance for EMET to be tested and solve any issues with it, if it's fixable.
     
  5. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,611
    Location:
    Canada
    Thanks Baserk!

    oh well *shrugs* the exploits are blocked in my vm testing. IE is set via Group Policy to prompt on signed activex download attempts and block anything unsigned. However, I did allow in all attempts but nothing really happened.
     
  6. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,611
    Location:
    Canada
    For those who don't want the EMET notifier running in their system tray and have Task Scheduler available:

    Open Task Scheduler as Administrator, select: Action-> Create Task...

    General tab:
    Run only when user is logged in

    Triggers tab:
    Specific user: Any user
    Begin the task: At log in
    Delay task for: 30 seconds (important because EMET_notifier.exe starts some seconds after log in)
    Actions tab:
    Action: Start a program
    Program/script: Location of your batch file eg in my case: C:\Users\user_name\Desktop\kill_EMET_notifier.bat
    Conditions:
    Defaults are ok
    Settings
    If the task fails resart every 1 minute
    Attempt to restart up to: 3 times

    BAT file:
    Code:
     @ echo off
    Taskkill /IM EMET_notifier.exe
    **Note** if using AppLocker or perhaps a HIPS program,, you'll have to create a Script rule, preferably a Path rule, that allows the .BAT file to run.
     
  7. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Heck!! Why all that? Just use Autoruns and disable it. No more notifier. :D
     
  8. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,611
    Location:
    Canada
    Strange, I could have sworn that didn't work for me using Autoruns the first time I tried it several weeks ago, and that I saw where it was the same for others but it does now o_O

    **EDIT**

    wait, not so fast. how are you going about disabling it in Autoruns? I ask because now I see what happens. If you open EMET it creates another enabled autorun entry even though the previous one's checkbox is cleared. With the Task Scheduler method, the notifier is prevented from running even though the cleared entry is re-created.
     
    Last edited: Aug 14, 2012
  9. malexous

    malexous Registered Member

    Joined:
    Jun 18, 2010
    Posts:
    830
    Location:
    Ireland
    I have disabled the notifier through msconfig Startup tab. Running EMET from Start will create a new autorun entry but running EMET_GUI from the installation folder will not.
     
  10. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Yes, that's how I call it too. I never bothered with it, but I wonder what command line syntax in the EMET's shortcut in the Start Menu? I'm not running as admin, and only admin can see it in the Start Menu.
     
  11. StillAlive

    StillAlive Registered Member

    Joined:
    Dec 29, 2008
    Posts:
    42
    Emsisoft Online Armor 5.5.0.1616 (oadump.exe, oasrv.exe and oaui.exe) is not compatible with Enhanced Mitigation Experience Toolkit v3.5 Tech Preview (Execution flow simulation mitigation (SimExecFlow)).
     
  12. RSpanky

    RSpanky Registered Member

    Joined:
    Feb 27, 2009
    Posts:
    220
    Location:
    Arizona, USA
    I have been trying to install EMET 3 on my Vista Home Premium SP2, I keep getting a error message about it could be a bad package. I find it strange that I can't get it to install. I am running AppGuard set to install and Malwarebytes running RT, Can someone point me in the right direction to get EMET installed. Thanks Rick
     
  13. kupo

    kupo Registered Member

    Joined:
    Jan 25, 2011
    Posts:
    1,122
    Did you add Online Armor's .exe files in the protection of EMET, or it really just affects the operation of EMET?
     
  14. StillAlive

    StillAlive Registered Member

    Joined:
    Dec 29, 2008
    Posts:
    42
    Yes, I did.


    No, it doesn't.



    Online Armor 5.5.0.1616 is working:
    picture1.jpg

    Online Armor 5.5.0.1616 is not working, because all the three files crash on start up:
    picture2.jpg


    [Windows 7 SP1 32-bit (x86)]
     
  15. DX2

    DX2 Guest

    Should I leave EMET settings at default, Application OPT In on all 3?
     
  16. ComputerSaysNo

    ComputerSaysNo Registered Member

    Joined:
    Aug 9, 2012
    Posts:
    1,464
    Set to MAXIMUM protection I find is the best, you can find the setting in the options bar.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.