How to keep Flash secured with EMET?

2

I use EMET to secure a number of applications on my computer - web browsers, Office suite applications, PDF readers, as well as Adobe Flash. Overall it's working great, except that the Flash executables contain the version number in the file name, so every time there's an update, the file names change and I have to remember to re-add them manually to EMET.

Is there a way to streamline this process? EMET does support wildcards, but only in the path itself, not the file name, so something like %windir%\system32\Macromed\Flash\*.exe wouldn't work.

Is there any other way to add a whole folder to EMET so that any new executables in that folder are automatically secured?

Indrek

Posted 2012-10-22T16:28:51.670

Reputation: 21 756

Answers

5

EMET includes a command-line tool, EMET_Conf.exe. This can be used to configure pretty much any setting in EMET, including adding and removing applications.

The following code should add all Flash-related executables to EMET:

cd %windir%\system32\Macromed\Flash
for %f in (*.exe) do EMET_Conf --set %f

cd %windir%\SysWOW64\Macromed\Flash
for %f in (*.exe) do EMET_Conf --set %f

(The last two lines are only needed on 64-bit Windows. For more information, see the EMET User's Guide in the installation directory.)

This has to be run from an elevated command prompt, and assumes that your PATH environment variable contains the location where EMET was installed. If it doesn't, and you cannot or don't want to add it, replace EMET_Conf in the above code with the full path, e.g.:

for %f in (*.exe) do "C:\Program Files (x86)\EMET\EMET_Conf.exe" --set %f

The above code can be saved in a .bat file and then configured to run as a scheduled task. Choose whichever schedule you want (once a day seems like a good choice, since that's how often Flash updates are checked for), and be sure to check the "Run with highest privileges" option, because EMET requires admin privileges.

The only downside of this approach is that old entries aren't cleared, so after a while you end up with a lot of non-existent executables in your EMET configuration that have to be cleaned up manually. With a bit of tweaking, though, the code can be modified to log each executable it adds to a text file, and then on the next run call EMET_Conf --delete for each of those files before adding the new ones:

for /F "tokens=1" %%f in (log.txt) do EMET_Conf --delete %%f
type nul > log.txt
for %%f in (%windir%\system32\Macromed\Flash\*.exe) do EMET_Conf --set %%f && echo %%f >> log.txt
for %%f in (%windir%\SysWOW64\Macromed\Flash\*.exe) do EMET_Conf --set %%f && echo %%f >> log.txt

Indrek

Posted 2012-10-22T16:28:51.670

Reputation: 21 756