Hey everybody and welcome to the next video of the operating system internals module.
In this video we're going to be talking about rings.
So there is this concept inside of the kernel called Ring levels.
Now you can see how they all wrap from lowest to highest number.
So we have ring to negative two in the middle followed wrapped around by ring negative 1.
Then ring 0 then ring 1 2 and 3.
Now these rings all are also called protection rings or rings of protection.
They can be called a lot of different ways just understand that if someone's referring to protection
rings rings of protection or ring levels.
This is what they're referring to.
Each level or each ring level offers a different privilege level so the lower the level is the higher
the privilege allowed is.
And these can also be seen as a type of game.
So for example negative two in this particular case has the highest privilege in the most access out
of all of the levels.
And again level negative 1 has every has the most privileges minus what level two negative to us.
So what is ring Level Three this is the application level.
This is where most user applications reside such as normally this is also called user space.
It's important to know that this has the least amount of privilege and no direct access to the kernel
itself.
The the only way it can access any type of useful features is through this course.
So this is we've all we've commonly went through this particular space as such as user space and run
levels.
Now we have ring Level 2 and 1 both of these are where device drivers tend to sit.
They're not allowed full access at ring Level 0 because of the least privilege rule.
There is no reason why a driver needs full access to memory if it's only interfacing with a mouse let's
say.
So you don't you only want provided the privilege that it's requiring and nothing more.
So this has a special ring level of two and one because it doesn't need full control or the freedom
that the kernel itself will have.
Now the least privilege rule doesn't just apply to drivers it can be used for user accounts or services
or anything else like that always give something the least amount of privileges it needs to run.
Now ring Level 0 this on physical systems.
We'll get into virtual in the next slide.
However on physical systems such as the machine that's in sitting in front of you the operating system
that that's running at if it's a Linux One is that is has a ring level zero as the hot as the highest
privileged ring that's available.
Now this is where all kernel code lives it provides the full access to the kernel the hardware and everything
in between.
Now this is useful for attackers because if you're able to go from user a ring level three down to a
ring zero that's full permanent escalation and own this complete compromise of the system.
And there are exploits out there that have done that.
So be aware that getting to ring Level Zero isn't attacker's goal from a privilege escalation standpoint
now negative one.
When you start getting into negatives things can be up for interpretation.
So for example bring negative one tends to be when it's a virtualize operating system.
So a hypervisor runs virtualize operating system.
Now virtual box is running Ubuntu in this in our case so.
So a virtual box is the hypervisor for Ubuntu.
So virtual boxes accessing Ubuntu at ring negative 1.
So it has full control over everything.
The hardware the operating system every ring level pass that so it's important to understand that and
virtualize the environments.
Negative One is there in physical environment that stops at zero.
Now there is a use case where in previous DEF CON talks that there is something called a negative three
which does not always interface with a virtualize operating system where the CPSU itself has its as
an internal instruction set that allows it full access to everything.
Now that is.
I'll leave that up to you guys to find the talk on that.
I believe it was in 2018 this year.
So go ahead and find that out.
It's a pretty interesting talk but that is where he is suggesting that we provide in ring Level 3.
Now it's not official ring like one two and three is but understand that it's there and ring Level 2
is a special type of ring that allows for system management motor s and then this means the CPE you
can stop all operations to the operating system and perform a different action such as handling chipset
errors physically on the machine or reducing heat that's ahead reducing heat it's supposed to be at
heat but understanding these ring levels is important specifically Level 1 2 3 0 are going to be the
ones that you're going to want to pay the most attention to.
Now if you want to specialized into attacking virtualizing operating systems and trying to break in
during that negative one that's when you're going to want to start being able to focus on more information
on ring Level 1.
So I'll leave that to you guys for homework.
So go ahead and look up a little bit more about the ring level that interests you the most.