Several outlets including this ZDNet article are reporting that Alex Lonescu has posted a program on his blog that shows how Vista's protected processes can be used in to compromise systems.
"The fact that the DRM within Vista presents a mechanism through which code may attempt to restrict what other processes — including security applications — are able to do, is a problem in itself. The presence of that problem creates a hive of activity with people trying to hijack the mechanism, either as a proof of concept, or as a malicious attack," Howard [Fraser Howard, a principal virus researcher at security vendor Sophos] said. "In this case, the source code has not been released, just a binary which can be used to demonstrate the issue. Had there been source code, I am sure we would see malware authors trying to add that functionality to malware. As it is, supposing the claims are valid, there will no doubt be authors looking to include such functionality themselves into their malware."
