Windows 10 Cannot Protect Insecure Applications Like EMET Can

Re:Windows 10 Cannot Protect Insecure Applications Like EMET... by ryuuchin on Monday November 21, 2016 @09:58PM (#13011264)

I think the featureset that Windows 10 provides is good enough as an alternative (see my top level comment[1]). EAF was never that useful because it uses debug registers and the ROP protections have been "replaced" by CFG (control flow guard). Everything else is provided by a vanilla Windows 10 install.

The usefulness of the EMET protections were that they could be used without having to recompile an application where protections like CFG do require recompilation with the latest Visual Studio (and for you to Opt-In to CFG).

[1] https://news.ycombinator.com/item?id=13011211

[ Parent | on HN ]

Re:Windows 10 Cannot Protect Insecure Applications Like EMET... by rincebrain on Tuesday November 22, 2016 @08:09AM (#13013829)

Yeah, but as your comment says, for me, a lot of the value was in adding mitigations for applications that were not pre-compiled with said options.

Yes, some of them can be manually twiddled without recompilation, but it's not nearly as convenient to manage or deploy (though one imagines a GPO template to do all of the heavy lifting that's doable via IFEO would be a feasible thing), and for anyone not using GPOs, then you're reimplementing a poor subset of the EMET GUI over the IFEO parameters.

[ Parent | on HN ]

Re:Windows 10 Cannot Protect Insecure Applications Like EMET... by ryuuchin on Wednesday November 23, 2016 @03:33PM (#13025627)

> poor subset of the EMET GUI over the IFEO parameters.

Is it really though? I guess it depends how much value you place on the EAF and ROP protections. Personally I wouldn't place too much weight on them.

[ Parent | on HN ]