security

[maxamy]

This question may have been asked I just probably cant find it........If I install Windows on my mac will I have security issues like on a windows machine...I purchased a mac so I would less likley get exposed to viruses hacking and such....If windows is on there can the same thing happen......or does the virtual environment make it safer....Thanks

[admin]

A virtual environment does not make Windows inherently safer. You should take the same precautions as you would with an actual PC, e.g. antivirus, firewall, and automatic updates. You should also be aware of any access you grant from the host to the virtual machine - the most common example would be a writable shared folder. If the guest gets infected, it could use the shared folder to affect files on the host (just as a physical PC could affect files on a network share). The Easy Install does set up a shared folder by default, but it also defaults to read-only.

[dp_fusion]

Windows binaries do not run in the OS X environment so you're protected there. But virtual machines do create interesting opportunities. For example if you share your OS X home directory out to your Windows world with write permissions then a clever Windows malware can create a hidden directory in your OS X home dir and write a malicious perl script there. So far, so good - Windows can't start perl in OS X from Fusion (yet). But suppose that clever malware adds a little snippet to your shell rc scripts (http://en.wikipedia.org/wiki/Bash#Startup_scripts), that launches the perl script? So the next time you run bash the perl script fires off.

So what can it do? Well, how about writing a cron or 'at' job that lights off after you've gone to bed that shuts down your Fusion session if it's running, and then tars up your home directory and ftp's it to a remote site? So now they have your virtual machines, all of which will run fine in their new home. Did you install a password on your Windows account? They also have the entire contents of your home directory. Anything in there you'd rather not share?

Imagine the carnage enabled by Parallels's global sharing which was once enabled by default.

If things get to the point where Windows apps running in a VM can launch OS X apps then you have no limit to the damage that can be done both to your vm and to your host system.

Full disclosure: I'm not aware of any exploits in the wild that can do what has been described here. But I wrote one to test the theory and it worked perfectly and it wasn't difficult to do. I've since destroyed it. Then I uninstalled Parallels.

[admin · Accepted solution]

Actually, it's slightly worse than that - remember, your virtual machines also live in your home directory by default. And .vmx config files are just plain text. A guest with write access can theoretically modify itself to escalate access to your entire drive on subsequent runs. I'm not aware of anything which tries to do this, but it's possible.

Moral of the story - if you don't trust the guest (and even if you do), don't give it access to the host. If you must, limit the access as much as possible.

[maxamy]

would it be possible to set my virtual stuff to read only or would that be helpful as far as security goes.........if so how....

[maxamy]

This sounds scary...Im not sure I want VMware on my machine at all........

[admin]

It sounds scary, but as far as I know, it's all theoretical. Anyway, the default is read-only, so you should be safe If you want to be extra paranoid, disable shared folders entirely.

[hassiman]

Dear ETung,

I choose Fusion over parallels because it seemed that Parallels now has just to much sharing going on with the host MAC OS. I am only running XP so I can print with Qimage.. and possibly scan with Nikon Scan and my CoolScan.

How should I set Fusion up so that is is completely isolted from my Host MAC OS? Even if I have to transfer files from a thumb drive from MAC to Fusion/XP that would be fine.... All I need to do is access the network in Windows to update XP and download my Nikon Scan ware and have my Scanner able to access FW400 ports on the MacPro.

[maxamy]

you said if you dont trust the guest...do you mean guest os....I want win 98 on my virtual vmware...i know it is not supported by microcrap.....excuse me...microsoft anymore.....can i safely install win 98.....

[admin]

As I said in reply to another one of your posts, I'm afraid you Firewire scanner won't work. You can get complete (well, as close to complete as I know) by adding the following line to the .vmx config file:

monitor_control.restrict_backdoor = "TRUE"

This disables the communications channel that the guest can use to talk to the host, but also disables many useful features (like dynamic screen resizing, soft ungrab, and Tools).

Slightly less draconian is to disable specific features, like shared folders or drag-and-drop. For example, those would correspond to the following config lines:

isolation.tools.hgfs.disable = "TRUE"
isolation.tools.dnd.disable = "TRUE"

A very simple solution would be to just not enable shared folders. You could not install Tools in the first place (shared folders requires Tools), but as with the first suggestion, you'll miss out on many features.

I brought up the shared folder possibility to point out that security is definitely on our minds, not to scare anyone. Personally, I don't worry about this theoretical vulnerability - my approach is to not use shared folders, but when I do need to, I enable them for specific folders. I don't feel the need for more restrictive settings, though they exist if you want them.

[admin]

you said if you dont trust the guest...do you mean guest os....

Yes, "guest" and "guest OS" mean the same thing to me.

I want win 98 on my virtual vmware... can i safely install win 98.....

There's nothing special about Windows 98 (apart from being older, and with more security vulnerabilities) than other guests as far as what I've said (well, I don't remember if it supports shared folders). Personally, with something like Win98, I would keep it disconnected from the network entirely if possible since Microsoft won't provide any more patches. However, this is more for guest safety than host safety.

[hassiman]

Dear Etung,

Where do I go in Fusion to disable shared folders?

Thanks.

[admin]

Virtual Machine > Settings > Shared Folders

You can also disable them on a per-folder basis, or just don't define any in the first place.