A security researcher has found another way to attack Windows Vista's UAC (User Account Control) feature.

Robert Paveza, a web application developer with Terralever, has published a paper:

iconUAC exploit white paper

The PDF demonstrates a two-stage attack which allows malicious code to infect Windows Vista systems - even from accounts running under the limited privileges afforded by UAC.

The UAC attack takes advantage of the fact that UAC permissions are porous. Programs are able to ride on the coat-tails of other processes that are commonly granted higher privileges.

However, Mark Russinovich, a Technical Fellow in Microsoft's Platform and Services Division, already answered such criticisms back in February by explaining that UAC is not to be considered a security mechanism.

Rather, it is a way of prompting developers to build more secure applications, he said.

"Vista makes tradeoffs between security and convenience, and both UAC and Protected Mode IE have design choices that required paths to be opened in the IL wall for application compatibility and ease of use," he wrote.

Because the boundaries defined by UAC and Protected Mode IE are designed to be porous, they can't really be considered security barriers, he said.

Paveza's flaw is related to one of the flaws in UAC pointed out by security researcher Joanna Rutkowska in February. Rutkowska pointed out that the ILs (integrity levels) put into place by UAC are designed to allow certain breaches.

During Paveza's attack, the malicious code would ride on seemingly innocuous software that could, in fact, run as advertised and without any elevated privileges needed, leaving the work of infection for later.

"For instance, if users believe they’re downloading a 'Pac-Man' clone, such a game could be run while the malicious software did its work in the background," Paveza wrote. "It is important to note that, realistically, once the proxy infection tool has been run on the target machine, the target is effectively infected."

Meanwhile, the program could create an "executable stub" pointing to a target program that runs at a higher level. The stub would be stored in a place such as the Start menu where the user would click on it thinking to run the original, legitimate higher-level program.

When the user eventually clicks on the stub, the higher-level program is launched and the malicious program is loaded into the process, Paveza explained. By authorising the higher-level program the user also authorises the malicious code.

"The original target process and the malicious process then run in parallel," he wrote.

Microsoft in a statement downplayed the risk of the attack, pointing out that the attack requires significant user interaction and that not all users will have the privileges to authorise the malicious code.