Researcher: Companies Must Use Microsoft EMET

Companies can by installing the Microsoft Enhanced Mitigation Experience Toolkit (EMET) make it more difficult for attackers to gain access to systems and networks. That says researcher Grant Willcox . He decided to look for his thesis on the effectiveness of EMET 5.1.

EMET is a free tool from Microsoft that makes it harder for attackers to use both known and unknown vulnerabilities in applications. Wilcox decided to modify three exploits to see if he could bypass the security of EMET this. With one operates succeeded the researcher. But he had made ​​the assumption that it was possible to bypass all three exploits EMET. Since this was not successful as the late Wilcox see the effectiveness of the security tool.

Featured

The researcher says that on the basis of the results it is recommended that companies EMET 5.1 or later use, since it is a "very effective solution" is to prevent attackers use common problems within programs. "It probably will not prevent a determined attacker will use exploits to gain access to the corporate network, but it will put less determined attacker and force them to use alternative solutions."

Companies that choose to roll must be used within the recommended profile of EMET EMET. EMET has different profiles for programs to help determine the level of security. By performing tests can then be examined or higher levels of security are possible without crashing programs. "Although the security of EMET is not waterproof, it raises the bar quite to attack programs," concludes Wilcox.

FBI Warns Of Malicious Hackers US Government

The FBI has a bulletin distributed among companies that warn of malware that attackers have used to break up the network of a US government agency and, where possible, the sensitive data of tens of millions of civil servants were stolen.

It's about the burglary at the Office of Personnel Management (OPM), where attackers managed to steal twice data. At the first break of the personal data of 4.2 million former and current officials were stolen. The second burglary has a much greater impact. There did attackers to gain access to the system where information on screenings and background checks are stored. It involves highly sensitive data, such as mental health problems, drug and alcohol use, arrests by police and bankruptcies. Also, persons in completing the screening form names fill acquaintances and contacts, as well as the social security number.

This week it was announced that 32 million of potential officials this highly sensitive private data are captured, reports the Washington Times . The attackers made ​​via stolen credentials of an outside company to gain access to the system. The company is responsible for background checks of officials who should be given a "security clearance", said OPM Director Katherine Archuleta this week at a hearing of a Senate committee to know, according to USA Today .

Sakula

In early June the FBI circulated a information bulletin ( pdf ), which warned of the Sakula Remote Access Tool (RAT), reports Public Intelligence . Through the tool attackers had stolen personal identifying information. The warning was published a day after the OPM had the first break on the network warned . Last week left sources told Reuters that the OPM hackers a "special tool" called Sakula were used to control the computers of the administration remotely, making the link between the FBI warning and OPM burglary could be laid. The malware was already at the intrusion on the network of US health insurer Anthem are used. Since the data of 80 million were former and current customers stolen.

In addition to the technical characteristics of the malware also gives the FBI the information bulletin several tips to businesses what they should do after detecting Sakula and what measures can be taken to secure systems preventive heavier. This involves things like the use of reduced duties, limiting local accounts, network segregation, logging and monitoring admin accounts, deploy whitelisting and using the Microsoft Enhanced Mitigation Experience Toolkit ( EMET ). Via this free software from Microsoft it more difficult for attackers to use both known and unknown vulnerabilities.

Microsoft Tightened Security Windows With EMET 5.2

Microsoft has released a new version of the free security tool released EMET, which should make it more difficult for attackers to attack Windows computers through both unknown and known vulnerabilities. EMET stands for Enhanced Mitigation Experience Toolkit and adds an extra layer of security to Windows and installed applications increase, so often exploits software vulnerabilities no longer work.

EMET 5.2 includes several fixes and improvements. EMET so now supports warnings and reports of Modern Internet Explorer and IE desktop with Enhanced Protected Mode. There is an added measure to prevent attacks using VBScript. It is an attack technique called "VBScript God Mode", which was used by attackers in recent attacks. This allows an attacker to execute malicious script with elevated privileges.

Additionally, the DLL files are EMET now with Control Flow Guard compiled. This is a new feature that hijacking code must exist. In the past, researchers have demonstrated several times that EMET circumvented can be. In practice, however, it appears that attackers in a different way take into account EMET. So last year was a zero-day attack on IE10 discovered .The attackers, however, decided not to execute the exploit on computers that EMET was installed, probably to avoid detection of the exploit. EMET 5.2 is through this page ( msi download).

Prize For Hacking Chrome During Pwn2Own

During a hacker contest next month in Vancouver held hackers and researchers can win the grand prize by hacking Google Chrome. Who a vulnerability in Google's browser on Windows 8.1 knows how to find can earn $ 75,000.

This is more than for leaks is offered in other browsers. The game in question is the annual Pwn2Own contest, which takes place during the CanSecWest conference. Every year, researchers and hackers at the event to test the security of browsers.After the prize for Google Chrome follows Internet Explore 11 where a reward of $ 65,000 to be offered. Apple Safari on Mac OS X Yosemite follows with $ 50,000 in the third. Finally provides a successful hack of Mozilla Firefox at $ 30,000.

Besides the four browsers will be tested also the security of Adobe Reader and Adobe Flash Player. A successful attack on both programs make $ 60,000 on. This year, the difficulty for participants is much higher than previous years because the exploits that should be developed with Microsoft's free security tool EMET works.

The Enhanced Mitigation Experience Toolkit (EMET) is precisely designed to neutralize the effect of exploits. As a result, researchers now take two hurdles. Researchers who through their exploits on a Windows computer code with SYSTEM privileges can perform get an extra $ 25,000 reward. In addition, Google will in the case of a Chrome hack pay an additional reward of $ 10,000. Pwn2Own will take place on 18th and 19th March.

XP users should avoid Internet Explorer

Windows XP users should not use Internet Explorer now there is a new leak was discovered in the browser. That suggests Mikko Hypponen of the Finnish F-Secure. This weekend it was announced that a new leak in IE is present that is deployed. Limited extent in targeted attacks

The vulnerability in Internet Explorer 6 to 11 present, although the attacks were directed only. Against users of IE9, IE10 and IE11 Since Microsoft no longer supports Windows XP, except for organizations with an extended service contract available, run IE users on the platform risk because there is no patch will be released which fixes the leak more.

Symantec also recommends that XP users to use another browser, but notes that this is a temporary measure until Microsoft has released a patch. A notable addition, because most XP users will receive. No more updates For XP users that IE can not do without the use of Microsoft's free Enhanced Mitigation Experience Toolkit (EMET) 4.1 option.

This program adds additional security to the system and also works on Windows XP. The tool prevents attackers newly discovered IE vulnerability to exploit, according to Symantec. Besides XP users also users of other Windows versions can protect themselves through EMET against the vulnerability.