Geeks in Phoenix

Geek Blog


Harden / Mitigate the security of your Windows programs with Microsoft EMET

*** Revised 19, February 2016 ***
This article has been revised for EMET v5.5

Enhanced Mitigation Experience Toolkit 5.5

Let's face it, some of the software we use on a daily basis has become subject to security vulnerabilities and exploits. Software manufacturers do their best to develop and test fixes / patches as fast as possible, but this can take time. A lot of users just cannot keep up with all of the updates and hotfixes. A few years ago Microsoft released the Enhanced Mitigation Experience Toolkit (EMET) to deal with just this issue.

View of the main screen inside EMET 5.5
View of the main screen inside EMET 5.5

So what is EMET? EMET monitors selected programs (Internet Explorer, Microsoft Office, etc.) for known attack actions and techniques. When one of the several pseudo mitigation technologies is triggered, EMET will either block the programs' access to the resouce it is trying to reach or just terminate it. EMET expands on the technologies that Microsoft implemented with Data Execution Prevention (DEP), which has been included in the Windows operating system since Windows XP SP2. It will also validate digitally signed SSL certificates inside of Internet Explorer.

View of the application configuration screen inside EMET 5.5
View of the application configuration screen inside EMET 5.5

So how does EMET work? EMET acts as a shim between the program being monitored and the operating system. The monitored program thinks it's talking directly to the operating system, but it's actually talking to it through EMET. EMET comes with predefined profiles for some of the more common programs like Microsoft Office, Internet Explorer, Adobe Acrobat and Java. You can also add to the predefined profiles or create your own. I recommend that you monitor any program that can open files on or from the Internet.

What security exploits are currently covered

Here's is the current list of mitigations EMET 5.5 currently looks for.

  • Attack Surface Reduction (ASR) Mitigation
  • Export Address Table Filtering (EAF+) Security Mitigation
  • Data Execution Prevention (DEP) Security Mitigation
  • Structured Execution Handling Overwrite Protection (SEHOP) Security Mitigation
  • NullPage Security Mitigation
  • Heapspray Allocation Security Mitigation
  • Export Address Table Filtering (EAF) Security Mitigation
  • Mandatory Address Space Layout Randomization (ASLR) Security Mitigation
  • Load Library Check - Return Oriented Programming (ROP) Security Mitigation
  • Memory Protection Check - Return Oriented Programming (ROP) Security Mitigation
  • Caller Checks - Return Oriented Programming (ROP) Security Mitigation
  • Simulate Execution Flow - Return Oriented Programming (ROP) Security Mitigation
  • Stack Pivot - Return Oriented Programming (ROP) Security Mitigation
  • Windows 10 untrusted fonts

What programs should you harden / mitigate

You only want to harden / mitigate certain programs that are targeted on a regular basis. Web browsers like Chrome, Firefox and Internet Explorer, production / office programs like Microsoft Word, Excel and PowerPoint, e-mail clients like Outlook and Windows Live Mail are some of the few. I recommend that you harden any program that can open files on or from the Internet.

What programs should you not harden / mitigate

You should never configure EMET to monitor anti-virus, anti-malware, intrusion prevention / detection software, debuggers, software that handles Digital Rights Management (DRM) technologies or software that uses anti-debugging, obfuscation, or hooking technologies.

Installation notes

New installation: Just download EMET and install

Upgrade install: Since the registry keys for EMET changed with this version, you can either export your existing EMET settings using the method in the 'What's new' section below, download the converter or reconfigure all of the program settings. With the drastic change with the EMET data format inside of the registry, I think that it would be just easier to reconfigure EMET then try the export / import method. Either way, remember to uninstall any older version of EMET and restart your computer before you install this version.

What's new in EMET 5.5?

  • Full-featured GPO management, compatible with reporting and compliance requirements
  • Command line: new syntax and options
  • Implementation of certificate pinning now based on root CA thumbprints. Exceptions logic removed.
  • Export and Import now memorize path
  • EMET registry has been refactored. To convert settings from previous versions of EMET (including EMET 5.5 Beta), registry values must be saved in a file then imported back with the use of the converter PowerShell script after EMET 5.5 is installed. Here are the steps to follow:
  1. Export settings. With elevated PowerShell, run the following command:
    .\Migrate-EmetSettings.ps1 -RegFile .\NewEmetSettings.reg -MissingCertCsv .\MissingCerts.csv PowerShell script Migrate-EmetSettings.ps1 is provided with EMET 5.5 RTM. It includes documentation about its usage.
  2. Uninstall former version of EMET.
  3. Install EMET 5.5 RTM. When asked to choose between Use recommended settings and Configure manually later, chose option Configure manually later.
  4. Import settings. With elevated PowerShell, run the following command:
    reg.exe import .\NewEmetSettings.reg

Supported Operating Systems

Windows 10 , Windows 7, Windows 8.1, Windows Server 2008, Windows Server 2012, Windows Server 2012 R2, Windows Vista

  • EMET 5.5 requires .NET Framework 4.5.
  • For Internet Explorer 10 on Windows 8 you need to install KB2790907 - a mandatory Application Compatibility update that has been released on March 12th, 2013 or any other Application Compatibility updates for Windows 8 after that

For more information on EMET, just follow the links below.

Enhanced Mitigation Experience Toolkit
Download Enhanced Mitigation Experience Toolkit (EMET) 5.5
Download Enhanced Mitigation Experience Toolkit (EMET) 5.5 User Guide
Download Enhanced Mitigation Experience Toolkit (EMET) 5.5 converter

Upgrading to Windows 7 from Windows XP

Windows XP currently the most popular operating system with Windows 7 quickly catching up. As more and more people are moving from Windows XP to Windows 7, I thought I would spotlight a series of articles that I wrote a little while back. My move from Windows XP to Windows 7 was a 'side-by-side' migration, with two separate systems.

I, be leave it or not, never used Windows Vista on any of my production systems. I ran Windows XP up until Windows 7 was released. I did run Windows 7 Release Candidates on a test system for several months prior to it's release and was very happy with it. I even wrote a series of articles about it too. Here they all are.

Upgrading to Windows 7 from Windows XP

Beta testing Windows 7

Resetting your network adapter in Windows 7

Network shell (Netsh) is a tool an administrator can use to configure and monitor network devices on Windows based computers at a command prompt. A common use of Netsh, is to reset the TCP/IP stack back to default settings.

But not only will Netsh reset the TCP/IP stack, but it can also completely reset your network adapter(s). It will also reset the Windows Firewall in Windows 7 too.

Using Netsh in Windows 7

To use Netsh, you will need to open a Command Prompt as an administrator. There are two ways to do this:

  • Click the Start button, then All Programs, then Accessories, then right-click Command Prompt, and then click Run as administrator. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
  • or

  • Click the Start button. In the search box, type Command Prompt, and then, in the list of results, right-click Command Prompt, and then click Run as administrator. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Netsh commands in Windows 7

The following is a list of the Netsh commands you can use to reset your Windows 7 network adapter:

Restores the Windows Firewall with Advanced Security policy to the default policy. The current active policy can be optionally exported to a specified file. In a Group Policy object, this command returns all settings to notconfigured and deletes all connection security and firewall rules.netsh advfirewall reset

Resets the BranchCache service. Flushes the local cache. Every configuration parameter of BranchCache will be reset to its default value.netsh branchcache reset

Resets TCP/IP and related components to a clean state.netsh int ip reset c:\resetlog.txt

Resets IPv6 configuration state.netsh int ipv6 reset

Resets Winsock Catalog to a clean state. All Winsock Layered Service Providers which were previously installed must be reinstalled. This command does not affect Winsock Name Space Provider entries.netsh winsock reset

Managing Virtual Memory / Pagefile in Windows 7

Your computer has two types of memory, Random Access Memory (RAM) and Virtual Memory. All programs use RAM, but when there isn't enough RAM for the program you're trying to run, Windows temporarily moves information that would normally be stored in RAM to a file on your hard disk called a Paging File. The amount of information temporarily stored in a paging file is also referred to as virtual memory. Using virtual memory, in other words, moving information to and from the paging file, frees up enough RAM for programs to run correctly.

The more RAM your computer has, the faster your programs will generally run. If a lack of RAM is slowing your computer, you might be tempted to increase virtual memory to compensate. However, your computer can read data from RAM much more quickly than from a hard disk, so adding RAM is a better solution.

If you receive error messages that warn of low virtual memory, you need to either add more RAM or increase the size of your paging file so that you can run the programs on your computer. Windows usually manages this automatically, but you can manually change the size of virtual memory if the default size isn't large enough for your needs.

Change the size of virtual memory

If you receive warnings that your virtual memory is low, you'll need to increase the minimum size of your paging file. Windows sets the initial minimum size of the paging file equal to the amount of random access memory (RAM) installed on your computer, and the maximum size equal to three times the amount of RAM installed on your computer. If you see warnings at these recommended levels, then increase the minimum and maximum sizes.

To open the System Properties, press Windows logo key + Pause

Windows 7 Pagefile Settings 1

In the left pane, click Advanced system settings. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Windows 7 Pagefile Settings 2

On the Advanced tab, under Performance, click Settings.

Windows 7 Pagefile Settings 3

Click the Advanced tab, and then, under Virtual memory, click Change.

Windows 7 Pagefile Settings 4

Clear the Automatically manage paging file size for all drives check box.

Under Drive [Volume Label], click the drive that contains the paging file you want to change.

Click Custom size, type a new size in megabytes in the Initial size (MB) or Maximum size (MB) box, click Set, and then click OK. There is a formula for calculating the correct pagefile size. Minimum pagefile size is one and a half (1.5) x amount of memory. Maximum pagefile size is three (3) x minimum pagefile size. Say you have 4 Gb (4,096 Mb) of memory. 1.5 x 4,096 = 6,144 Mb would be the min. pagefile size and 3 x 6,144 = 18,432 Mb would be the max. pagefile size.

Note:
Increases in size usually don't require a restart for the changes to take effect, but if you decrease the size, you'll need to restart your computer. It is recommend that you don't disable or delete the paging file.

My five favorite Windows tips for maintaining your computer

In this article, I am going to share my five favorite tips for maintaining Microsoft Windows.

  1. Checkdisk. This is the first thing I do when I get a system here in the shop. Errors do occur and files do get damaged. Best to take care of this first thing. And yes, this can take a while, so I always recommend leaving your system on and let Checkdisk run over night. That way your computer is ready to go first thing in the morning.

    For more information on how to perform a Checkdisk, just select your operating system below:
    Windows 7 Checkdisk
    Windows Vista Checkdisk
    Windows XP Checkdisk

  2. Delete Temporary files. This is the first place to look when you need to free up some hard disk space. These files served their propose at one time, but for some unknown reason, the program that used them did not delete them. When deleting temporary files, some may be still in use. I recommend deleting all files / folders that are over a week old. See below for the location of temporary files folder on your version of Windows:

    Windows 7 / Vista - C:\Users\username\AppData\Local\Temp
    Windows XP - C:\Documents and Settings\username\Local Settings\Temp

  3. Delete the Internet Explorer cache. This is the second place to look when you need to free up some hard disk space. I have seen systems with over 9 Gb of temporary files. Open Internet Explorer and go to Tools > Internet Options and change the following settings:

    Internet Explorer Temporary Files
    Internet Explorer Temporary Files

  4. Pagefile optimization. This one often gets over looked. There is a formula for calculating the correct pagefile size. Minimum pagefile size is one and a half (1.5) x amount of memory. Maximum pagefile size is three (3) x minimum pagefile size. Say you have 4 Gb (4,096 Mb) of memory. 1.5 x 4,096 = 6,144 Mb would be the min. pagefile size and 3 x 6,144 = 18,432 Mb would be the max. pagefile size.

    Windows Pagefile Settings

    To change the pagefile size, you need to access the System Properties dialog box. Press Windows logo key + Pause (Windows 7 / Vista users select 'Advanced' system settings). Then select the 'Advanced' tab and under 'Performance' click on Settings. Then select the 'Advanced' tab and under 'Virtual memory' click on Change.

    For more information on how to change the pagefile size, just select your operating system below:
    Windows 7 Pagefile Settings
    Windows Vista Pagefile Settings
    Windows XP Pagefile Settings

  5. Disk Defragmenter. Probably the best single thing you can do to speed up your computer. Imagine a filing cabinet where all of the folders were out of order and files were misplaced through out the cabinet. How could you find anything? Same thing with your hard drive. Disk Defragmenter takes care of that for you. And you can run it as a scheduled task too.

    For more information on how to use Disk Defragmenter, just select your operating system below:
    Windows 7 Disk Defragmenter
    Windows Vista Disk Defragmenter
    Windows XP Disk Defragmenter

Give these five tips a try and see how much more performance you can get from your computer,
Scott

Customer service is #1

Here at Geeks in Phoenix, we take pride in providing excellent customer service. From computer repair, virus removal and data recovery, we aim to give the highest quality of service.

Bring your computer to us and save

Our in-shop computer repair service  is based on the time we work on your computer, not the time it takes your computer to work!

Contact us

Geeks in Phoenix
4722 East Monte Vista Road
Phoenix, Arizona 85008
(602) 795-1111

Like Geeks in Phoenix on Facebook

Follow Geeks in Phoenix on Twitter

Watch Geeks in Phoenix on YouTube

Geeks in Phoenix is an IT consulting company specializing in all aspects of Computer Repair / PC Repair / Laptop Repair. Since 2008, our expert computer repair technicians have been providing outstanding Computer Repair, Virus Removal, Data Recovery, Photo Manipulation and Website Support.

Geeks in Phoenix have the best computer repair technicians providing computer repair and service in Phoenix, Scottsdale and Tempe Arizona. We offer In-Shop, On-Site and Remote (with stable Internet connection) computer repair service.

Copyright © 2017 Geeks in Phoenix LLC