User Interface Privilege Isolation

User Interface Privilege Isolation (UIPI) is a technology introduced in Windows Vista and Windows Server 2008 to combat shatter attack exploits. By making use of Mandatory Integrity Control, it prevents processes with a lower "integrity level" (IL) from sending messages to higher IL processes (except for a very specific set of UI messages).^[1] Window messages are designed to communicate user action to processes. However, they can be used to run arbitrary code in the receiving process' context. This can be used by a malicious low IL process to run arbitrary code in the context of a higher IL process, which constitutes an unauthorized privilege escalation. By restricting access to some vectors for code execution and data injection, UIPI can mitigate these kinds of attacks.^[2]

UIPI, and Mandatory Integrity Control more generally, is a security feature, but not a security boundary. UI Accessibility Applications can be allowed bypass UIPI by setting their "uiAccess" value to TRUE as part of their manifest file. However, for this flag to be honored by Windows UIPI, the application must be installed in the Program Files or Windows directory, and the application must be signed by a valid code signing authority. To install an application to either of these locations requires at least a user with local administrator privilege running in an elevated process with high integrity level.

Thus, malware trying to move into a position from where it can bypass UIPI must:

1. use a valid code signing certificate issued by an approved code signing authority,
2. perform the attack against a user with administrator privileges
3. convince the user to grant use of their administrative privileges in the UAC prompt.

Microsoft Office 2010 uses UIPI for its Protected View sandbox to prohibit potentially unsafe documents from modifying components, files, and other resources on a system.^[3]

References[]