Originally Posted by
Uranium - 235
They're the like the opposite of Dante's Inferno - Instead of Ring 9 being where Satan chews on Brutus, Judas, and Ted Kaczinsky, it's Ring 0. Except Satan is giving it to you in *YOUR* "ring 0".
More specifically, you know how there's that "hidden system files" option? Have you ever tried to look inside certain folders ("System Volume Information", for example) even as administrator just to be told 'Access is denied'? These files operate on a lower 'ring', thereby superseding admin access.
Windows operates on Rings, each specifying a level of access. User-level is Ring 3. I'm unsure how administrator accounts work, they may be Ring 3 as well. It's easier to think of levels of access. Above Ring 3 and you're operating on a restricted diet. You can't do certain things, see certain things, etc. As you get closer to Ring 0 you can do more and more.
Ring 0 is the eye of the storm. You can see and do everything from Ring 0. Everything is a-go from there. No joke, there is absolutely nothing you can't see, do, break into, modify, or override from Ring 0.
Ring 0 is where critical process and hardware/firmware typically runs. The code that tells your sound card how to behave? Ring 0. The code that makes your DVD drive run at all? Ring 0.
It's important to remember that rings only work upwards. Ring 1 cannot modify Ring 0, for example, but Ring 0 can modify Ring 1.
Bioshock runs on Ring 3, as it's a user-level application.
Securom has processes that run on Ring 0 so it's can spy on you, to make sure you don't have stuff Securom doesn't like hiding below Ring 3 (Daemon Tools, for example).
In order for a Ring 3 process to work with a Ring 0 process, it has a little leash, so both can talk to each other. Bioshock tells Securom when to do its malware thing, and Securom tells Bioshock not to run for no ☺☺☺☺☺☺☺ reason at all.
That's the vulnerability, that leash. You get a piece of code that targets Bioshock's leash, it travels down the leash and compromises Ring 0. Next thing you know, your entire system is absolutely ☺☺☺☺☺☺, to the point where it can even compromise firmware itself. It's theoretically possible that with an extremely nasty Ring 0 infection, certain hardware (ie: a sound card) could have the firmware modified in a way where the card will no longer function.
Sounds like an acceptable risk to stop the pirates from cracking the game for a whole of 1 day, right?
Bioshock installs does not installs a rootkit type that runs in RING0 <TrojanKIT>
Thanks for the post.
. I had no clue its been used that much.
