-2

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the latest Hacking Team Adobe Flash 0-day exploit?

  • I mean, was the Microsoft EMET effective in protecting user from Hacking Team Adobe Flash 0-day exploit before Adobe patched that vulnerability?
  • How effective was Microsoft EMET in prevention of attack with Hacking team Adobe Flash 0-day exploit before Adobe patched that vulnerability?

Malwarebytes' Anti-Exploit was able to prevent that kind of attack. And the big part of Malwarebytes Anti-Exploit is based on Microsoft EMET technology. So it is interesting if Microsoft EMET is able too to prevent that kind of attack as Malwarebytes Anti-Exploit can.

I am NOT asking this question because of some interest in using old version of Adobe Flash. Instead I am asking this questions to get an idea about the effectiveness of Microsoft EMET against 0-day exploits on this particular example of the Hacking Team Adobe Flash 0-day exploit.

5

EMET software participates in a defence-in-depth approach of security. It adds an effective supplementary security layer when an attacker manages to successfully exploit a vulnerable software without being blocked by the anti-virus.

However, in such domain is an endless race, since while EMET is getting more popular, attackers will try to craft their exploit attempting to bypass it.

As per Hacking Team, they seemed to have very regular tests against anti-virus detection, but EMET was apparently not part of it. The only Microsoft's security products targeted in these tests were Microsoft Security Essentials and Microsoft Defender.

Their exploit acquisition form however does contain a question regarding EMET avoidance capabilities of submitted exploits.

Hacking Team remains after all just a commercial software development company. So their new features development (EMET avoidance is just one feature among others) are mostly driven by customer requests. So it is sufficient for a customer to request it (and of course pay for it) for EMET avoidance to become part of Hacking Team portfolio.

I think it is in prevision of such a move that HT was already recording in their database EMET avoidance capabilities of their exploits, however EMET being not installed by default in Windows and no red flags inciting the end-user to install it (as opposed to firewall and anti-virus software, side-effects being better handled in these case) it remains for now too much a niche domain to invest significant amount of money into development and maintenance of such functionality.

With such an analysis, as far as we are talking about plain unmodified Hacking Team exploits, EMET should bring an effective security layer (I firmly highlight the should since only thorough tests against each and every exploit as presented in the first link would prove anything in that regard). However since these exploits are now published, nothing prevents another hackers teams to modify them to include anti-EMET features. In such case you will be screwed...

0

EDIT:

The OP has TOTALLY modified his question by reediting it AFTER I answered him, so my actual answer seems to be an answer to an other question. So please stop being chatty and take time to read the comments above before you add yours and restart the same conversation with me.

was the Microsoft EMET effective in protecting user from Hacking team Adobe Flash 0-day exploit before Adobe patched that vulnerability?

Before saying yes or not, you have to know that using an old version of Adobe Flash is really, really a bad idea.

  1. First of all, you are trying to avoid the July 2015 vulnerability (published under CVE-2015-5119 CVE-ID) whereas all previous Adobe Flash versions suffer from it as you can see here:

enter image description here

  1. The second reason for which I say it is a bad option to use an earlier version is that it exposes you to all former severe vulnerabilities and risks of which Microsoft EMET can not surely protect you necessarily.

  2. The third reason why this is a bad option is that CVE-2015-5119 vulnerability appeared on July 2015 whereas the latest version of Microsoft EMET was released on July 31, 2014 and worse, its support is supposed to end 12 months later, so a month before this vulnerability was published:

enter image description here

  1. The fourth reason I say this is a bad idea is because you can not rely that much on Mircrosoft EMET as Microsoft confesses this by itself:

The security mitigation technologies that EMET uses have an application-compatibility risk. Some applications rely on exactly the behavior that the mitigations block. It is important to thoroughly test EMET on all target computers by using test scenarios before you deploy EMET in a production environment. If you encounter a problem that affects a specific mitigation, you can individually enable and disable that specific mitigation. For more information, refer to the EMET user's guide.

The solution is to follow the steps required to patch your current version as explained on Adobe Flash official website. But this is only if you are forced to use Adobe Flash for some very specific reason, otherwise the best thing you can do is to use HTML5 instead and forget totally about Adobe Flash.

  • Thanks for your answer. But it does not answers the main question which is about effectiveness of Microsoft EMET in preventing threat from particular 0-day exploit. Maybe my question was not clear as it should be so, I have edited the last part of my question to make it more clear. "I am NOT asking this question because of some interest in using old version of Adobe Flash. I am asking this questions to get an idea about effectiveness of the Microsoft EMET against 0-day exploits on the particular example of the Hacking team Adobe Flash 0-day exploit. " – vasili111 Aug 8 '15 at 6:56
  • @vasili111 Sorry, you mentioned Adobe Flash vulnerability even in the title so I thought that was your main interest. However, what you underlined through this comment is covered by the last point I mentioned (4). – user45139 Aug 8 '15 at 6:59
  • @vasili111 Also, it was good you mentioned Flash for your actual question because it is a good example that answers your main question: it is not effective as this vulnerability (which always existed but not detected by EMET) shows. And no software could pretend to protect you from 0-day vulnerabilities. – user45139 Aug 8 '15 at 7:07
  • For example Malwarebytes Anti-Exploit was able to prevent that kind of attack (blog.malwarebytes.org/zero-days/2015/07/…). The big part of Malwarebytes Anti-Exploit is based on Microsoft EMET technology. So it is interesting if Microsoft EMET is able too to prevent that kind of attacks as Malwarebytes Anti-Exploit can. – vasili111 Aug 8 '15 at 7:13
  • I also understand that no software can guarantee full protection for 0-day attacks. But some can make you more secure and I am trying to understand which ones and in which cases. – vasili111 Aug 8 '15 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.