Use EMET's ASR feature to block access to large part of kernel with Firefox

[Windows_Security]

Windows 10 introduced some strong mitigations to reduce the attack surface of vulnarable applications. On Windows 10, about flags of Chrome offers an option to enable the Win32k-lockdown to prevent access to large part of the kernel (hence reducing the risk of exploits doing something malicious to your system).

Firefox always had a good reputation in regard to compatibility with security applications, so I wondered could I use EMET's ASR (Attack Surface Reduction) to prevent access to important system DLL's. To my surprise I could block kernel32.dll, kernelbase.dll and ntdll.dll and firefox still kept working as attached image shows?

Browsing with rich media (video, sound) and downloading of files (liek PDF) seems to work OK, the only thing that does not work (as far as I noticed) is uploading of files (firefox becomes inresponsive and seems to crash). Strangy Chrome does crash while it had options in about://flags to enable this Windows 10 mitigation.

I also tried to block ole32.dll, but than sound does not work (remains silent) and firefox won't download files (won't crash).

 

[Handsome Recluse]

Are you gonna do MemProtect+EMET+Shade right now?

 

[Windows_Security]

Are you gonna do MemProtect+EMET+Shade right now?

No, sharp observation

On wife's laptop (with Windows 7 ultimate) I have MemProtect only, on my desktop I have Shade Sandbox. De-installed Shade for this test.

Tried Firefox against HPMA testtool and Firefox with EMET+ASR failed against
- Unpivot Stack
- ROP VirtualProtect() via CALL gadget
- ROP WinExec() via anti-detour
- Heap Spray 1
- Anti-VM - Mware (it blocked VirtualPC)
- Hollow process

 

[Handsome Recluse]

Not to mention Microsoft's killing it. MBAE and MemProtect are a smaller download.

 

[Windows_Security]

Yep, MemProtect blocks all HPMA testool exploit attacks with near zero CPU strain because it uses OS-mechanism, but I use my Desktop for business now (so can't use the free version of MemProtect nor Shade Sandbox).

 

[SHvFl]

Does Chrome still have that option? Tried checking it today and couldn't find it. Maybe they do it by default now?

 

[shmu26]

Does Chrome still have that option? Tried checking it today and couldn't find it. Maybe they do it by default now?

It's still there:

 

[SHvFl]

It's still there:

Talking about Win32k-lockdown not appcontainer. It's 2 different things.