Bagle virus makes a return

TalkBack 21 of 25:

Next »

« Previous

• Thread View
• Flat View

That's just not true.

See my message "It takes more than that" above.

Or, do a query at the Microsoft Knowledge Base on just how many Windows vulnerabilities involve programs being able to grant themselves administrative permissions even when launched from a non-administrative account, usually through buffer and stack overflow exploits (XP SP2 does help a lot here, especially when used in conjuction with a CPU supporting ED [Execute Disable, in the latest Intel Xeons] or NX [No eXecute, used in all Athlon64s and Opterons] status bits).

The problem is that Windows is simply fatally flawed at the foundation and plumbing level. It will take a complete rewrite (Longhorn?) to thoroughly fix it.

Case in point: Intel CPUs since the 386 (and even before, when used with an Intel Paged Memory Management Unit [80285 PMMU used with an 80286 CPU and optional 80287 FPU, for instance]) implement four nested "Rings" of privilege. Each code module runs in a specific Ring.

Ring 0 is the most highly privileged, powerful level, with no protections at all. Ring 0 code can do ABSOLUTELY ANYTHING: access hardware directly, read and write anywhere in memory, etc.

Ring 1 adds some very basic protections, but is otherwise still very powerful and with limited protection.

Ring 2 adds still more protections and thus has more reduced privileges.

Ring 3 is the most protected, least privileged level. User-level application code runs in Ring 3.

A properly-designed OS would use all four of those Rings, with each code module running only in the highest-numbered Ring that gives it the privileges that it absolutely needs. If a module needed to do something that Ring 3 couldn't do but Ring 2 could, it would run in Ring 2, NOT Ring 1 or 0.

Windows DOES NOT USE Rings 1 and 2, AT ALL, PERIOD! Everything is either Ring 0 or Ring 3! Microsoft calls Ring 0 "Kernel Mode" and Ring 3 "User Mode." If a part of the OS needs to do something that cannot be done in User Mode / Ring 3, it runs it all the way down into Kernel Mode / Ring 0, with WIDE-OPEN privileges and ABSOLUTELY NO PROTECTIONS AT ALL!

Since Windows NT 4.0, even your VIDEO CARD DISPLAY DRIVER runs in Ring 0 (Kernel Mode) -- in NT 3.x, it ran in Ring 3 (User Mode). This was done for SPEED purposes, to gain a few percentage points in screen redraws! And yet it opens up MAJOR security problems -- if a worm can find an expoitable vulnerability (say, a buffer overflow) in some third-party display driver, BOOYAH!! It has FULL ACCESS to RING 0 and can do ABSOLUTELY ANYTHING, **EVEN IF THE USER IS NOT AN ADMINISTRATOR!!**

Call up Windows Task Manager under any NT version of Windows (NT, 2k, XP, or 2003 Server to date). Click on the "Performance" tab. You should now see a green bar on the left showing CPU non-idle usage real-time current level, and a large line chart with a green line showing CPU non-idle usage recent history to the right of that.

Now click on the "View" menu and select "Show Kernel Times" (if it isn't already checked). You should now see a RED bar (line) in the bottom of both charts. This represents the portion of the non-idle CPU usage that is spent in Kernel Mode, which as you now know is Ring 0. The green part of the bar, or the space between the red and green lines of the line chart, represents the portion spent in User Mode, Ring 3. Notice that there are no colors representing time spent in Rings 1 and 2. Windows doesn't USE them.

Posted by: Joel R   Posted on: 01/28/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now