Windows 上的 Ring 0 如何受到保护？或者，为什么我关心媒体播放器是否被利用？
我更熟悉 *nix 环境，但我正在尝试从 Windows 角度了解安全性。我在 Windows 安全领域看到了很多漏洞利用和补丁，它们似乎针对的是外围程序，例如媒体播放器或其他（我认为）用户模式程序。通过控制这些用户程序来获得 root 访问权限是不是很简单？我预计攻击会针对特权程序，例如 *nix 上的 telnetd。
I'm more familiar with the *nix environment, but I'm trying to learn about security from the Windows perspective. I see a lot of exploits and patches in the Windows security realm that seem to target peripheral programs such as Media Player or other (I would assume) user-mode programs. Is it trivial to gain root access from controlling these user programs? I would have expected exploits to target privileged programs, like telnetd on *nix.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
“特权程序”是什么意思？
有两个不同的东西：
仅当某些驱动程序存在错误时，(1) 才可能被“破坏”。也就是说，根据定义在内核模式下运行的代码中的错误，理论上可能会被利用。除此之外，没有任何漏洞。
如果驱动程序中存在特定错误，则 (2) 也可能会被破坏。也就是说，驱动程序应该在调用进程/线程的上下文中验证用户权限，但可能并不总是这样做。
大多数 Windows 漏洞都与在用户模式下运行的代码中的问题有关。与 unix/linux 不同，Windows 的“成长”并没有固有地关注帐户权限等。因此，当需要将内容分为免费/受限时，就会出现许多问题。
What do you mean by "privileged programs"?
There are two distinct things:
The (1) may be "breached" only in case there's a bug in some driver. That is, bug in the code that by definition runs in the kernel mode, this theoretically may be exploited. Besides of this there are no vulnerabilities.
The (2) also may be breached if there're specific bugs in the driver. That is, a driver is supposed to verify the user permissions in the context of the calling process/thread, but may not always do this.
Most of the windows vulnerabilities are related to the issues in the code that runs in the user mode. Unlike unix/linux, Windows "grew up" without inherent concern to account permissions and etc. Hence when the time came to split things into free/restricted - many problems arose.
传统上，Unix 系统上的大多数用户都在其“正常”用户 ID 下运行程序。当他们需要 root 访问权限（以执行操作系统认为敏感或特权的操作）时，他们需要 root 权限或在 sudo 下运行这些程序。普通应用程序以普通用户身份运行，无权执行某些操作（触摸系统文件、打开某些类型的资源等）。
在 Windows 端，用户传统上使用具有管理员权限的帐户（基本上是 Windows 的 root）来运行。造成这种情况的原因有很多，但最主要的一个是，Windows 最初是一个单用户操作系统，没有用户角色的概念，而且，今后，通过不破坏应用程序来保留功能，使得让用户在没有管理员权限的情况下运行变得非常困难。难的。当前版本的 Windows（Vista 和 Win7）默认使用非管理员帐户，并使用用户帐户控制< /a> 让用户知道他们正在运行的某些内容何时需要此类访问权限，并且需要他们进行确认。
TL;DR - 大多数 Windows 用户都以管理员权限运行，因此在许多情况下，针对普通用户应用程序确实可以为您提供特权访问权限。
Traditionally, most users on Unix systems ran programs under their "normal" user IDs. When they need root access (to perform operations that the OS deems sensitive or privileged), they su to root or run those programs under sudo. Normal applications run as the normal user which doesn't have permissions to do certain things (touch system files, open some kinds of resources, etc).
On the Windows side, users have traditionally run using accounts that have Administrator privileges (basically, root for Windows). There are a number of reasons for this but the primary one is that Windows started as a single-user operating system with no concept of users roles and, moving forward, preserving capabilities by not breaking applications has made getting users to run without Administrator privileges very hard. Current versions of Windows (Vista and Win7) default to a non-Administrator account and use the idea of User Account Control to let users know when something they are running requires such access, which they are required to confirm.
TL;DR - Most Windows users run with Administrator rights, so targeting normal user applications does give you privileged access in many cases.
许多媒体程序依赖于 DirectX 以及其他以较低的成本紧密集成到操作系统中的 Windows 库level 以最小化传输字节时的用户空间开销。
http://news.cnet.com/8301-1009_3-9992926-83.html
Many media programs depend on DirectX, and other Windows libraries that are tightly integrated into the OS at a low level to minimize user-space overhead in shipping bytes around.
http://news.cnet.com/8301-1009_3-9992926-83.html
在用户上下文中运行的恶意软件通常比管理模式或内核模式恶意软件更容易找到和删除，因为它不能轻易干扰安全软件和 Windows 更新等内容。但这并不意味着它无法实现其目的：它仍然可以渗透您的浏览器来干扰、拦截或修改您的网页浏览，它仍然可以发送垃圾邮件，它仍然可以记录击键，等等。
Malware running in your user context is typically somewhat easier to locate and remove than admin- or kernel-mode malware, because it can't as easily interfere with things like security software and Windows Update. But this doesn't mean it can't achieve its purpose: it can still infiltrate your browser to interfere with, intercept or modify your web browsing, it can still send spam, it can still log keystrokes, and so on.