Introduction

Microsoft has developed several tools that help security professionals in the difficult task to keep Windows operating systems safe, like the Microsoft Baseline Security Analyzer (MBSA) or the Security Compliance Manager (SCM). This time we like to give an overview of another interesting piece of windows security software: the Enhanced Mitigation Experience Toolkit (EMET).

EMET is an utility to help protect the Windows operating system platforms against exploitation of vulnerabilities through a series of security mitigation technologies. As any other security tools, EMET does not replace other information security solutions; it is meant to add an additional layer of defence in the existing security framework.

While it may not prevent all possible security exploits, the mitigation technologies implemented by EMET make exploitation significantly more difficult if configured properly.

Features

EMET supports client and server based operating system. The current version (4.0 beta) allows security mitigation technologies to be configured for the system and applications. Mitigations applied to the system will impact the entire system while mitigations applied to the applications will only impact the specified applications. This provides following key benefits:

• Highly configurable even on single executables base
• Application hardening support for all application without recompiling
• GUI allowing ease of configuration
• Enterprise ready (supports group policy deployment, SCCM and command line interface)
• Ongoing improvement and updates

Further, following are the most interesting new features in EMET 4.0:

• Detecting attacks that uses suspicious SSL/TLS certificates
• Allowing customers to test mitigations with an Audit Mode

Below is a table listing the used mitigation technologies:

For more information please refer to the well written EMET 4.0 user manual available via Help menu on the EMET GUI.

Not all mitigation option are supported on all operating systems and application, but Microsoft is continuously improving the software and providing support for all important platforms and application executables.

Here a short overview on supported features on platform and executables:

Another limitation is bound to the web Certificate Trust, it works only with following browsers:

• Internet Explorer 32bit desktop mode
• Internet Explorer mixed 32/64bit desktop mode

Unsupported are by now following versions:

• Win8 APP mode
• Internet Explorer in full 64bit desktop mode (security enhanced mode)

How it works

EMET is not a fire and forget toolkit, it requires you to carefully configure the policy and thoroughly test it before it can be used for production environment; also EMET is not an end-user tool like an anti-virus.

After the installation (that requires .NET Framework 4 and eventually a restart) you can begin using EMET by starting its GUI. It will the show something like this:

In the first window half you’ll see the available system features and its related status: Enabled, Application Opt-In, Application Opt-Out or Disabled; in the second half the are the systems running processes and related active mitigation features. The system mitigation settings are configurable via this panel:

The application mitigation settings are configurable on this other panel:

To add an application specific mitigation settings just push to the add button or right-click in the list of running processes, you’ll then be able to select the mitigation settings checkbox.

All action are written into the Windows application log and reported by the tray icon so if you need to analyze what happens you can filter for EMET log source there; this is important if you are running in audit mode and don’t kill processes that are violating the policy. By default processes are killed here are the configuration settings:

Certificate Trust (configurable certificate pinning)

EMET 4 provides a crypto extension module that will add additional checks during the certificate chain trust validation process. When browsing to an HTTPS website, EMET will validate the end-entity SSL certificate and the Root CA that issued that certificate against the rule configured.

Depending on the rules configured for a specific domain, EMET will detect when a variation of the issuing Root CA for a specific SSL certificate occurs. In this case EMET will only detect the anomaly, but the connection will not be stopped. Exceptions can be also configured on some properties of the Root CA certificate, such as key size, hashing algorithm, and issuer country. For example you can rise a warning if the certificate key length is lower that 2048 bit.

As a short test we can define a pinning policy that has following settings in CONFIGURE/CERTIFICATE TRUST/PINNING RULES/ADD:

• Name: TRUSTED.SSL
• Certificate: click and import GeoTrust
• Minimum Key Size: 2048
• Allowed Country: N/A
• Blocked Hash: MD2,MD4,MD5

Now go to Protected Web Site tab and add a site to test:

• Website: www.google.com
• Select the Pinning rule: TRUSTED.SSL
• be sure to check the Active checkbox

Well, this will ensure that Man in the middle attacks will generate an EMET agent warning message. Now if you like to test it just change a parameter in the pinning rule, like the key length from 2048 to 4096 or just change the Trusted Root CA.

After the changes try to access the site again and a message like this should pup up:

And the following entry inside the application log:

Conclusion

EMET is a powerful toolkit but need to be well configured and tested before going to production. Security on this level is pretty much the last layer of defense. We would recommend to use EMET to finalize your security strategy on very critical components like:

Invest time to create a policy that fits the specific machine usage; don’t try to. Once it’s done, you’ll get a very useful toolkit against Malware… and all for free!!

About the Author

Andrea Covello has been working in information security since the 1990s. His strengths are in engineering, specializing in Windows security, firewalling and advanced virtualization.

Links

• http://www.microsoft.com/en-us/download/details.aspx?id=16776
• http://www.microsoft.com/en-us/download/details.aspx?id=38761
• http://www.microsoft.com/en-us/download/details.aspx?id=7558