EMET Lends a Hand

I didn’t think Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) made much of a splash when it arrived. I vaguely remember hearing about it, and only decided to check it out when I saw a tweet about it. The basic idea is that it acts as an extra layer of protection against the current generation of exploits in Windows. It has the ability to force processes to use DEP and ASLR, which can significantly lower the success rate of certain attack vectors when used in tandem. Although ASLR has been around for a few years, typically the protection had to be compiled into the code and tested first. So EMET comes in handy for new programs that don’t opt-in to ASLR, and for older programs that were never compiled with ASLR support in the first place.

In the future, I’d expect persistent ASLR to be included as an OS security option (like DEP). Until then, EMET is probably the easiest way to make sure a Windows program has some protection against some of the tools of the opposition.