[Fury]

Or simply put, a tool to protect against 0-day exploits from Microsoft.. This tool has been around for years but it is not well known by any measure. Not too long ago version 4.0 of the tool was released and I hadn't used it since I moved from WinXP. Decided to try it out again and I've now used it about a month.

What this tool does is harden individual applications with protection mechanism the application may or may not support natively. If the application already supports some or all of the protection mechanisms, then no harm done either way. But if it doesn't, EMET forces it on at the expense of a small chance of application crashing on launch. No big deal, when this happens all you have to do is to go through all protection mechanism to find the one (or two) that doesn't work and leave the rest enabled.

It all sounds more involved and a head-ache than it really is. When you install EMET, it offers to set things up with recommended settings which is probably enough for most people. Microsoft was kind enough to also include a file containing some of the most popular applications which you can import to EMET to increase number of applications even further.

Since EMET supports exporting and importing of settings with ease, I expanded upon MS' own list of popular apps and I will share it here. You normally want to include only apps that connect to the internet such as web browser, email client, instant messenger client, irc client. Or apps that you use to open files downloaded from internet. such as Adobe Reader, Photoshop, 7-Zip, Word, Excel, media player. Or apps that contain sensitive private data such as KeePass. So don't bother trying to go through the trouble to add every possible executable on your computer to EMET.

You can download EMET 4.0 here. The download includes user's guide but it can also be downloaded separately if you want to look at it before downloading EMET itself. I would recommend reading through the users guide at least once to gain understanding what EMET really does. My expanded list of applications can be downloaded here. The file includes everything EMET 4.0 has plus apps added by me.

Unfortunately I did not download every app that I added and test whether they work without crashing with all protections enabled. On the off chance that any of the apps added by me crashes with EMET, you should open the Apps list in EMET and disable protections one by one until the app in question works again. Then let me know and I will edit the file accordingly. Thanks. I am also willing to expand on the list I built further if you provide me with necessary details.

List of apps in MS' popular apps list:

Code: [Select]

7-Zip
Adobe Acrobat
Adobe Reader
Google Chrome
Firefox
MS Office
MS Lync Communicator
MS Office Communicator
Foxit Reader
Google Talk
Internet Explorer
iTunes
Java
mIRC
Opera
Adobe Photoshop
Pidgin
QuickTime
WinRAR
Real Player
Safari
SkyDrive
Skype
Thunderbird
WinAmp
VLC
Windows Media Player
WordPad
and few other MS software

List of apps added by me:

Code: [Select]

Dropbox
Foobar2000
HexChat
Irfanview
KeePass
MPC-HC
Notepad++
Opera (v15+)
Origin
Paint.Net
LibreOffice
OpenOffice
Steam
UPlay

So really, EMET offers rather easily set-up additional protection against exploits. Not really much reason not to use it.

[redsniper]

So, disclaimer, I don't know how this stuff works but, what if someone found a zero day exploit for EMET?

[Fury]

It is highly unlikely anyone would bother because there is nothing to gain by exploiting EMET. Unless you count deleting all EMET settings as such. Of course there is always possibility that by exploiting an app you can gain access elsewhere, but that goes for any app installed on your computer.

As for how this stuff works, please read the user's manual and you'll understand it a bit more at the very least. And the tool is made by Microsoft in case anyone missed that by not clicking the download link. Perhaps I should add that info to the original post.

[niffiwan]

We rolled out version 3 across most of the PCs at work to protect IE.  Only side-effect we noticed were that a small number of websites (maybe Java based?  I can't recall right now) stopped working, unfortunately being business critical we had to remove the protection from those PCs.  That aside, EMET is a good idea