Using EventLog objects can cause security holes?

Question

While reading the Traning Guide for the 70-536 exam written by Tony Northup and friends, I came across the following:

CAUTION - Avoid EventLog objects in partial trust environments
Use of EventLog objects in a partial trust environment can cause serious security holes and should be avoided if at all possible

He basically indicates that because the EventLogPermission is required for a lot of the EventLog usage, this can open a serious security vulnerability. Mischievous code running with this permission granted could, for example, shut down antivirus or spyware detection applications yet make it appear as if it's still running. "The potential is endless".

Is this a serious concern?

Answer 1

Yes, you explained yourself why; a malicious program could shutdown an antivirus program without having an "antivirus shutdown!" event sent to the system's eventlog (like it normally would).

This doesn't mean "don't use Eventlog," it just means "don't pass an Eventlog object to less-trusted processes"