Read more...Microsoft has put many defensive technologies, like ASLR, DEP and SAFESEH into Windows over the years to mitigate against the exploitation of vulnerabilities in Windows and applications. But Microsoft is rightfully very conservative about making such changes for all Windows users. There are other things that can be done which Microsoft has not seen fit to roll into Windows.
Instead, Microsoft puts these in the Enhanced Mitigation Experience Toolkit (EMET - pronounced with two soft e's). EMET is a tool you install on a Windows system which allows you to impose additional restrictions on specific applications on that system. It's common, when Microsoft discloses a vulnerability, for them to announce that use of EMET would mitigate it.
Most recently, in MS14-080, the December Cumulative Security Update for Internet Explorer, 11 of the 14 vulnerabilities were memory corruption vulnerabilities and the bulletin says that "EMET helps to mitigate these vulnerabilities in Internet Explorer on systems where EMET is installed and configured to work with Internet Explorer."
Enhanced Mitigation Experience Toolkit (EMET) - Windows 7 Help blog
I cannot get EMET 5.2 certificate pinning to work in Windows 10.
When I test EMET by pinning an incorrect Root CA certificate to the website, Windows 10 does not block website access like Windows 8.1 does.
Has EMET certificate pinning been disabled in Windows 10 ? If so, has this functionality been superceded by a better technique ?
I have searched high and low, and this anecdotal reference is the only thing I can find:
"Windows 10 does not use certificate pinning, means someone can easily apply a man-in-the-middle-attack for each Microsoft cloud-access for example"
..... Para Dox
I partially resolved the problem.
I noticed 'Event ID: 42' registered in the Event Log:
"EMET detected that the SSL certificate for "www.mybank.com.au" is not trusted by the rule "My Custom Rule-MybankCA" associated with the domain "www.mybank.com.au"
I had not checked the EMET checkboxes for "PublicKey Match" and "Blocking Rule".
However, even when I check these checkboxes, then test using an incorrect Root CA certificate, it still only blocks access to the website and records Event ID 42 using IE11, but not when using Edge, Firefox, or Chrome browsers. This behavior is the same in both Windows 8.1 and Windows 10.
Firefox and Chrome have the green light to indicate that they are running EMET. Edge does not have a green light even though it is configured to run EMET.
Does anybody know how to get EMET certificate pinning to work using Edge, Firefox, or Chrome browsers ?
.... Para Dox
Page 28 of the EMET User Guide has instructions for 3rd Party browsers.
I just configured the registry in both Windows 10 and Windows 8.1 as per those instructions .
It still does not work for either Microsoft Edge, Firefox, or Chrome browsers.
The EMET manual does say that the API support for 3rd party browsers is still experimental. I guess we will have to wait until the next EMET release for Edge support . Firefox and Chrome support .... anybody's guess.
