User Interface Privilege Isolation (UIPI) is a technology introduced in Windows NT 6.0 to combat shatter attack exploits. By making use of Mandatory Integrity Control, it prevents processes with a lower "integrity level" (IL) from sending messages to higher IL processes (except for a very specific set of UI messages). Window messages are designed to communicate user action to processes; however they can be used to run arbitrary code in the receiving process' context. This can be used by a malicious low IL process to run arbitrary code in the context of a higher IL process, which constitutes an unauthorized privilege escalation. By restricting access to some vectors for code execution and data injection, UIPI can mitigate these kinds of attacks.
UIPI, and Mandatory Integrity Control more generally, is not a security boundary. It does not aim to protect against all shatter attacks. UI Accessibility Applications can bypass UIPI by setting their "uiAccess" value to TRUE as part of their manifest file. This requires the application to be in the Program Files or Windows directory, as well as to be signed by a valid code signing authority, but these requirements will not necessarily stop malware from respecting them. Additionally, some messages are still allowed through, such as WM_KEYDOWN, which allows a lower IL process to drive input to an elevated command prompt. Finally, the function ChangeWindowMessageFilter allows a medium IL process to change the messages that a high IL process can receive from a lower IL process. This effectively allows bypassing UIPI from processes other than those run in low IL (e.g. Internet Explorer).
Famous quotes containing the words user, privilege and/or isolation:
“A worker may be the hammer’s master, but the hammer still prevails. A tool knows exactly how it is meant to be handled, while the user of the tool can only have an approximate idea.”
—Milan Kundera (b. 1929)
“It’s the generally accepted privilege of theologians to stretch the heavens, that is the Scriptures, like tanners with a hide.”
—Desiderius Erasmus (c. 1466–1536)
“This [new] period of parenting is an intense one. Never will we know such responsibility, such productive and hard work, such potential for isolation in the caretaking role and such intimacy and close involvement in the growth and development of another human being.”
—Joan Sheingold Ditzion and Dennie Palmer (20th century)