Microsoft to discontinue EMET in July 2018

Microsoft announced yesterday that it has extended the support end data of the Enhanced Mitigation Experience Toolkit from January 2017 to July 2018.

Microsoft introduced EMET in 2009 as a standalone security program for Windows designed to block certain exploits from being executed successfully.

EMET was designed as a last line of defense against attacks carried out against Windows devices.

We reviewed Microsoft EMET back in 2012 for the first time, and published news updates whenever Microsoft released a new version of EMET that introduced new features. We have published a collection of EMET tips, and covered the latest release, EMET 5.5 as well here on Ghacks.

It appears that EMET 5.5 will be the last version of the Enhanced Mitigation Experience Toolkit that Microsoft will release.

EMET End of Support

EMET was born out of necessity according to Microsoft. Major operating system updates shipped every three or four years back then, and that was simply to long of a time to react quickly to new threats (read integrate defensive measures natively).

EMET provided users and companies with options to protect Windows machines from some of these attack forms.

And thus, EMET was born as a stop-gap solution to deliver tactical mitigations against certain zero-day software vulnerabilities.

While EMET was useful in this regard, and for security innovations that Microsoft integrated into its operating systems directly, it had serious limitations as well according to Microsoft.

One being that EMET was not integrated in Windows which meant that its features were not "developed as robust security solutions". While EMET blocked techniques in the past, methods to bypass EMET entirely or partially were discovered eventually.

EMET had a serious impact on a system's performance and reliability on top of that due to its hooks into low-level areas of the operating system.

Windows 10 enters the picture

Microsoft integrated all mitigation features of EMET in Windows 10 directly according to Jeffrey Sutherland, the company's lead program manager for operating system security.

The company did add "many new mitigations" on top of that to Windows 10 that EMET does not support.

And, of course, Windows 10 includes all of the mitigation features that EMET administrators have come to rely on such as DEP, ASLR, and Control Flow Guard (CFG) along with many new mitigations to prevent bypasses in UAC and exploits targeting the browser.

Considering that Microsoft's sole focus is on Windows 10, it comes as no surprise that the decision was made to end support for EMET. The main reason why the end of support has been extended by another 18 months is that Microsoft's enterprise customers who deployed EMET on previous versions of Windows demanded more time to cope with the new situation.

While EMET won't receive any new updates anymore, it is not the only anti-exploit software available for Windows. This is especially important for Windows machines who are not updated to Windows 10. Windows 7 and 8 are supported until 2020 and 2023 respectively for instance. Since Windows 10 is the only Microsoft operating system the mitigations were integrated in, other means of protection may need to be found for previous versions of Windows.

There is Malwarebytes Anti-Exploit and HitmanPro.Alert for instance that support previous versions of Windows and will continue to do so long after Microsoft ends support for EMET.

Now You: Do you run anti-exploit software on your Windows machine?

Advertisement