New Enhanced Mitigation Experience Toolkit (EMET) 5.1 available

[Brink]

New Enhanced Mitigation Experience Toolkit (EMET) 5.1 is now available.


Supported Operating System

Windows 7 Service Pack 1, Windows 8, Windows 8.1, Windows Server 2003 Service Pack 2, Windows Server 2008 R2 SP1, Windows Server 2008 Service Pack 2, Windows Server 2012, Windows Server 2012 R2, Windows Vista Service Pack 2

- EMET 5.1 requires .NET Framework 4.
- For Internet Explorer 10 on Windows 8 you need to install KB2790907 – a mandatory Application Compatibility update that has been released on March 12th, 2013 or any other Application Compatibility updates for Windows 8 after that.

EMET 5.1 supports the following operating systems and service pack levels:

Client Operating Systems
• Windows Vista Service Pack 2
• Windows 7 Service Pack 1
• Windows 8
• Windows 8.1

Server Operation Systems
• Windows Server 2003 Service Pack 2
• Windows Server 2008 Service Pack 2
• Windows Server 2008 R2 Service Pack 1
• Windows Server 2012
• Windows Server 2012 R2

See: http://www.sevenforums.com/tutorials/133386-enhanced-mitigation-experience-toolkit-emet.html

 

[Tookeri]

I posted this in the EMET thread, but I'll post it here too:

I've been testing 5.1 and I like it. I can enable more mitigations than in 5.0, mostly StackPivot.

Good to know:
I had lots of problems with 5.0 and I've now learned that EMET itself is not necessarily the reason for these problems(crashes). It's very likely that another security product is causing conflicts. In my case it was the HIPS functionality in my AV software. With that disabled, or at least the dll injection/monitoring part of the HIPS, I wouldn't have had to disable ANY mitigation for the "Popular Software" import XML file in EMET 5.1

 

[Tookeri]

Latest Patch Tuesday(Windows Updates - November) might cause incompatibility issues with EMET 5.0

If you are using Internet Explorer 11, either on Windows 7 or Windows 8.1, and have deployed EMET 5.0, it is particularly important to install EMET 5.1 as compatibility issues were discovered with the November Internet Explorer security update and the EAF+ mitigation. Alternatively, you can temporarily disable EAF+ on EMET 5.0. Details on how to disable the EAF+ mitigation are available in the User Guide. In general we recommend upgrading to the latest version of EMET to benefit from all the enhancements.

 

[Callender]

EMET 5.1 installation

Does EMET 5.1 install over the old version or is removal of the old version required before installing the new version?

Thanks.

 

[Brink]

Hey Chris,

EMET 5.1 installed over and replaced EMET 5.0 for me.

 

[andrew129260]

As brink stated, you should have no problems doing a inplace upgrade.

 

[Callender]

EMET 5.1 in place upgrade

EMET 5.1 installed fine over the old version. Thanks for letting me know.

 

[Brink]

 

[Tookeri]

Usually all minor upgrades will work, but also some major upgrades. For future reference, check the User Guide - section FAQ at the end:

Is my configuration from EMET 4 compatible with EMET 5?
Yes, EMET 4 configuration is compatible with EMET 5.

I have EMET 4 installed. Should I uninstall it before installing the new version?
You don’t need to uninstall EMET 4 before installing EMET 5. EMET 5 installer will automatically uninstall EMET 4 and install EMET 5. The Configuration Wizard provides an upgrade experience to safely migrate current settings from EMET 4.

I have an old version of EMET installed. How do I upgrade to EMET 5?
If you have a version of EMET older than 3, it is recommended that you first uninstall the old version via the Windows Control Panel, and then manually delete the HKLM\Software\Microsoft\EMET and HKLM\Software\Policies\Microsoft\EMET keys.
If you have EMET 3 or EMET 4 and want to upgrade to EMET 5, you can run the installation package and follow the instructions to either maintain your old configuration or apply the recommended one.

So it can upgrade even an EMET 3 version.
In my case I'd created a batch file in the EMET 5.0 folder. After upgrade to EMET 5.1 I noticed I still had a 5.0 folder and thought something went wrong. But when I looked inside it all that was there was my batch file. Nice to see it removed everything but my own file

 

[A Guy]

Tried to update again from 4.1. Launching any application covered by EMET results in a popup that so and so exploit is detected, and closing that application. Went back to my newly created system image and back on 4.1, working fine. Can't be bothered to troubleshoot when the same settings on 4.1 work fine. A Guy

 

[Tookeri]

Tried to update again from 4.1. Launching any application covered by EMET results in a popup that so and so exploit is detected, and closing that application. Went back to my newly created system image and back on 4.1, working fine. Can't be bothered to troubleshoot when the same settings on 4.1 work fine. A Guy

In that case, I think you made a good choice. However, I've done this troubleshooting and for me it paid out.

From what I've read in blogs and forums for EMET, MBAE and HMPA, the most important mitigation to have enabled is Caller. And EAF and StackPivot. If you can't have these 3 enabled some people claim you might as well uninstall EMET.

In this case it's better to go back to EMET 4.1 if these mitigations were compatible there. Or try a different solution like MBAE or HMPA.

So to sum up: it's not as important how many mitigations you can have enabled, but more important which mitigations are enabled.

As I mentioned earlier I managed to solve all EMET problems by making exceptions in my AV (post #2)

 

[A Guy]

I have MBAE as well. Same happened when V5 came out. All browsers, and my Howard email notifier threw up the exploit/closing popup. IE wouldn't even launch. Since I have never caught a thing, and EMET may even be unnecessary, I'll stick with my current setup. A Guy

 

[Tookeri]

Disarming and Bypassing EMET 5.1

This didn't take long..... but the conclusion sounds promising at least.

Last week Microsoft released EMET 5.1 to address some compatibility issues and strengthen mitigations to make them more resilient to attacks and bypasses. We, of course, were curious to see if our EMET 5.0 disarming technique has been addressed by the latest version of the toolkit.

After a quick analysis of the EMET.dll function that verifies which protection needs to be applied whenever a critical function is called, it is clear that now the global variable (EMET+0xF2A30 in EMET 5.1) we used in our previous techniques to disarm EMET 4.X and 5.0 is better protected.

Conclusion

We started looking at EMET since version 4.0 and it’s come a long way since. There’s no doubt that Microsoft are stepping up their efforts at making EMET ever more effective. This sort of layered defense goes a long way in disrupting commodity attacks and increasing the level of effort required for successful exploitation.

Disarming and Bypassing EMET 5.1