Windows Security — User Interface Privilege Isolation (UIPI)
User Interface Privilege Isolation (UIPI) was introduced in Windows 2008/Vista with the goal of mitigating "Shatter Attacks". Those types of attacks leverage the Windows’s message passing system which can be used to inject arbitrary commands/code to any application/service running in the same session, those we are using a "message loop" (https://www.slideserve.com/milek/shoot-the-messenger-win32-shatter-attacks-by-brett-moore).
UIPI allows isolating processes running as a full administrator from processes running as an account with lower permissions than an administrator on the same interactive desktop. UIPI is specific to the windowing/graphic subsystem (aka Windows USER). Thus, a process with lower privileges can’t perform operations on a process with higher privileges like: DLL injection, thread hooks for attaching, journal hooks for attaching, use window messages API (SendMessage/PostMessage) and more (https://learn.microsoft.com/en-us/previous-versions/aa905330(v=msdn.10)).
However, there are still resources that are shared between processes at different privilege levels like: clipboard, global atom table, desktop window and the desktop heap read-only shared memory. Also, painting on a screen is not controlled using UIPI, so a lower privilege application can paint over the surface region of a higher privilege application window — the GDI model does not allow control over painting surfaces (https://learn.microsoft.com/en-us/windows/win32/gdi/painting-and-drawing).
Lastly, we can control the configuration of UIPI using the "EnableUIPI" value under the "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\" registry path — as shown in the screenshot below (https://www.tipandtrick.net/fix-third-party-input-language-method-editor-ime-issues-in-ie-and-windows-vista-by-disabling-uipi/). A value of "0" disables UIPI, and if the value is not present by default it means UIPI is enabled (http://pferrie.epizy.com/papers/antidebug.pdf).
See you next time ;-) You can also follow me on twitter — @boutnaru (https://twitter.com/boutnaru).