Parallels Forums
> Archives > Parallels Desktop for Mac  
Big security risk with global sharing  
  

Big security risk with global sharing

Jan 24, 2007, 12:21 PM
#1  

goron
Junior Member


Join: Apr 2006
Posts: 13
Big security risk with global sharing
In Parallels Desktop 3120, there is an option (on by default) to "enable global sharing for drag-and-drop."

Whilst this is a nice feature, it seems to be implemented by having a semi-hidden (ie, not in the list) shared folder called ".Mac".

This folder gives read/write access to the entire Mac boot drive :eek:

Given the amount of viruses and other malware on Windows, the last thing I want is the virtual XP having full read/write access to my Mac!

This feature should be turned off by default and a big warning shown before turning it on.
Jan 24, 2007, 01:28 PM
#2  

ATXP
Member


Join: Dec 2006
Posts: 66
Agreed. Should have been turned off by default.

I asked this question when RC1 came out but no one gave me the right answer. Then I have to figure all this out by poking around the configuration.
Jan 24, 2007, 01:33 PM
#3  

dkp
Senior Member


Join: May 2006
Posts: 1,415
This has been discussed and solved for RC1. Search the recent archives. The solution is to disable global sharing and to scream like hell to the beta@parallels.com mailbox to turn this crap off.
Jan 24, 2007, 02:07 PM
#4  

DerekS
Member


Join: Sep 2006
Posts: 61
Couldn't agree more, this feature is extremely dangerous and I won't use it. The only benefit it brings, as far as I can tell, is that you get WinXP progress dialogs for file copies in/out of the VM as oppposed to MacOS progress dialogs in the Parallels window.
Jan 25, 2007, 12:18 PM
#5  

Stitch
Junior Member


Join: Jan 2007
Posts: 3
Thanks for bringing this to attention!

Someone could design a virus to ravage OS X for parralels users. That would quite easily put off a lot of potential buyers eh...
Jan 25, 2007, 01:15 PM
#6  

neosublime
Member


Join: May 2006
Posts: 62
OK... TOO MUCH. You people are as bad as cnn with it's, "be afraid of cookies", and it's, "better have a firewall", scare tatitics. Granted it mat be a posibility some day for some sort of security risk, but if any of you can go into \\.PSF\.Mac\private and create, or delete files and folders, let me know.

I thought right away that this was a major mistake on the part of Paralles Team, but it seems to be pretty safe by me. It's the same as if you were to map your home folder to your drive. Yes anything that you have read and write access to may be at risk, but isn't that the "World of Windows" for you?

The reason I use a Mac is because I was sick of Windows security, usability, and licensing. So... therefore, I no longer use Windows. BUT, there are a few programs I use that are windows only.

If you are concerned about security and a big bad virus, disable your networking. Don't let windows have Internet access, and for god sake don't surf along blindly clicking away with IE. I can run an unpatched Windows 95 system all day long with no virus software and not have a thing to worry about... AS LONG AS IT'S NOT CONNECTED TO THE INTERNET!

So please don't buy into the same fear that christians, and politicians try to sell. Don't be so scared, just more cautious. Educate yourself.
Feb 12, 2007, 08:45 AM
#7  

dm3
Member


Join: Aug 2006
Posts: 46
Quote:
Originally Posted by goron
This feature should be turned off by default and a big warning shown before turning it on.
Agreed. I've also expressed this concern, but I don't think Parallels gets it, I don't think they understood me.

I'm overall concerned with the evolution to build 3120. Parallels is putting too much focus on making Windows run well within the Mac at the expense of running Mac programs. This is very bad strategy. I am using a Mac running Mac OS X first and foremost. Running WIndows is a nice addon, but you cannot break my ability to use the Mac. If all I wanted to do was run Windows, I'd use bootcamp and not buy Parallels. If you make the Mac run poorly enough, I won't run Parallels and won't buy it.

Parallels: Make sure whatever feature you add doesn't hurt the ability to run Mac programs.

My specific issues:
- The security issue mentioned here. I run a Mac so that I don't have to worry about viruses. WIth this scary feature turned on, Parallels have managed to instantly make my Mac OS X machine totally open to viruses and spyware. Completely unacceptable.
- I have experienced very high CPU utlitization rates even when the WIndows VM is idle. When Windows 2000 is reporting 0% CPU util, Parallels consumes 25-60% of my Mac's CPU while doing NOTHING. This again is totally unacceptable.

I also have an issue with the coherance mode. I don't really want my WIndows programs running seamlessly within the Mac, because of viruses etc. Too much focus on hacking specific hooks into WIndows while basic Parallels tools don't exist for Linux.

Because of the CPU utilization problem, I've reverted back to build 1970 and have been pretty happy. I am also giving VMWare a more serious look as I'm in the beta. Good video support is more important than some of the new Parallels features.
Feb 12, 2007, 09:02 AM
#8  

dm3
Member


Join: Aug 2006
Posts: 46
Digg it
Thread pointer on digg
 


Thread tools Display modes
Hybrid Mode