User Interface Privilege Isolation (UIPI) is a technology introduced in Windows NT 6.0 to combat shatter attack exploits. By making use of Mandatory Integrity Control, it prevents processes with a lower "integrity level" (IL) from sending messages to higher IL processes (except for a very specific set of UI messages). Window messages are designed to communicate user action to processes; however they can be used to run arbitrary code in the receiving process' context. This can be used by a malicious low IL process to run arbitrary code in the context of a higher IL process, which constitutes an unauthorized privilege escalation. By restricting access to some vectors for code execution and data injection, UIPI can mitigate these kinds of attacks.
UIPI, and Mandatory Integrity Control more generally, is not a security boundary. It does not aim to protect against all shatter attacks. UI Accessibility Applications can bypass UIPI by setting their "uiAccess" value to TRUE as part of their manifest file. This requires the application to be in the Program Files or Windows directory, as well as to be signed by a valid code signing authority, but these requirements will not necessarily stop malware from respecting them. Additionally, some messages are still allowed through, such as WM_KEYDOWN, which allows a lower IL process to drive input to an elevated command prompt. Finally, the function ChangeWindowMessageFilter allows a medium IL process to change the messages that a high IL process can receive from a lower IL process. This effectively allows bypassing UIPI from processes other than those run in low IL (e.g. Internet Explorer).
Famous quotes containing the words user, privilege and/or isolation:
“A worker may be the hammer’s master, but the hammer still prevails. A tool knows exactly how it is meant to be handled, while the user of the tool can only have an approximate idea.”
—Milan Kundera (b. 1929)
“People feel fame gives them some kind of privilege to walk up to you and say anything to you, of any kind of nature—and it won’t hurt your feelings—like it’s happening to your clothing.”
—Marilyn Monroe (1926–1962)
“The only happy talkers are dandies who extract pleasure from the very perishability of their material and who would not be able to tolerate the isolation of all other forms of composition; for most good talkers, when they have run down, are miserable; they know that they have betrayed themselves, that they have taken material which should have a life of its own, to dispense it in noises upon the air.”
—Cyril Connolly (1903–1974)