Recently there's been some discussion about anti-cheats in video games that run at kernel level in the users' computers to ensure no cheating software is being run. My question is: "who" in the operating system have permission to install such software? From my understanding, users can install user-level applications, administrators can install administrator-level applications, operating system operating system and kernel, kernel-level applications. Even if the user were to gain administrator privileges, wouldn't he be able to only install something that would run below operating system level? If admins can in fact install such softwares with such high permissions (which seems to be the case), then what prevents some software from asking the user administrator privileges and then installing some kernel-level malware that wouldn't be detectable even by the operating system and being then undetectable to anti-viruses?


As you suspected admins can install kernel-level software.

The main thing to stop malware hiding in the kernel-level software is that virus scanners often scan programs as they are being run and may catch the malware before it disappears into the kernel.

Note that administrators can scan kernel-level software, so in principle could scan for malware in the kernel. However, it becomes tricky because an infected kernel can lie about what it contains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.