November 4, 2015 By Shane Schick 2 min read

Update: This post was updated Nov. 5, 2015, to include a number of corrections provided by Duo Security.

Large enterprises often want backwards compatibility as they migrate from one version of a product to another, but a security issue in a suite known as Microsoft EMET could allow cybercriminals to break into a major Windows subsystem.

According to Threatpost, researchers at Duo Security’s advanced security research team Duo Labs first uncovered the problem with Microsoft EMET, which stands for Enhanced Mitigation Experience Toolkit. The software is supposed to help organizations run 32-bit Windows software in more advanced 64-bit environments.

However, researchers showed how malicious actors could bypass EMET via the Windows subsystem known as WoW64, or Windows 32-bit on Windows 64-bit. This could allow cybercriminals to exploit vulnerabilities on a target system by bypassing EMET mitigations.

Security experts have found holes in Microsoft EMET before. Almost exactly a year ago, SecurityWeek reported that version 5.1 of the toolkit had vulnerabilities exposed about a week after it was released. Simply making the memory page writeable allowed researchers to disable some of the software’s most important protective measures.

This time around, the bypass was demonstrated in a Web browser exploitation scenario using a single instruction, which presents a risk for many Windows users.

Ironically, Microsoft EMET is intended to protect software from memory attacks in addition to allowing 32-bit processes to run in 64-bit environments. The Duo Labs researchers noted that 80 percent of the browsers in their sample were 32-bit processes executing on WoW64, and running this particular bypass wouldn’t require targeting individual mitigations, just a single line of code.

The Register suggested it wouldn’t be easy to make the necessary fixes in Microsoft EMET, but backwards compatibility is too important for many users to avoid using WoW64. The best course of action may be to simply use 64-bit applications whenever possible and look to additional security protections from multiple products and services as part of a defense-in-depth strategy.

Similarly, Microsoft is unlikely to block its customers from using legacy Windows technologies, Softpedia added. And in the long run, the company is bound to continue introducing more of its own security protection within the operating system itself. If WoW64 can be improved over time, organizations won’t have to worry about Microsoft EMET.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today