Operating System (OS) processes requests at different levels. This layered architecture is called a protection ring, which comprises of 4 hierarchical levels. Requests are allocated resources based on the process and priority levels. Ring0 [highest in priority] is the kernel-mode/kernel land, where kernel processes run. Ring 1 and 2 are for various device drivers to run on, though many OS [including Windows] never use these 2 levels of the ring. Ring 3 is the user-mode/user land, where the user processes run.
Figure 1. Protection Ring
Why is protection ring important? Well, let us look at an analogy that explains this architecture in simpler terms. Consider the outer-most ring as your perimeter/fencing around the house. Many can attempt to cross the fencing and a few can succeed depending on the deterrence, detection and prevention techniques used. Warning boards and video surveillance warning messages act as deterrence. Video cameras and [pressure, motion, etc.] sensors could be used for detection. Security guards could help in prevention mechanism. In the protection ring architecture, Ring 3 is the least privilege mode and runs user program. Attackers would target this ring to start with, to enter the system. Client-side exploits such as buffer overflow, ActiveX exploits, and other exploits that run on client system.
Once the attacker has crossed the fence, in the golden days it was more secure. Since the fence was around the village and then the villagers acted as human sensors. Once the attacker crossed the villagers, he would then be facing a swamp of alligators and then forts layer after layer. But then, in the modern days there is no water for swamp or space for alligators. Things have become so small that we use only 2 layers out of the 4, or at least Windows does. Hence, if the attacker crosses the fence, the only other hurdle is the house itself. In the protection ring, this is the kernel. This is where the highest privileged processes run.
It does sound complicated, but it is really simple to understand with the following figure [2] that shows layered interaction from a user process to the hardware:
Figure 2. Interaction between layers - User, Kernel and Hardware
Just like translators in the real world, users need different levels of translation when they would have to interact with the hardware. Hardware understands machine language [1's and 0's], which is not easy for a user to talk. Hence, user codes in languages that is understandable to human [combination of English and system instructions]. This then has to be converted to assembly, and some humans know how to read and write assembly. Assembly language then gets translated to machine code. Even though this could seem like communication between the various layers, the true aspect of protection levels is to run processes of specific privileges at their respective layers, to provide resources based on requirement and for various other security reasons.
Spy DLL Remover
Tools-SpyDLLRemover
Rootkit Analytics
Hidden Process Detection
Tools-Elfstat
Spy DLL Remover32264
Elfstat1054
KsiD670
SHC504
dwtf415
