Mac OSX security and Windows

[jdwingnut]

We all love our Mac's for the security it gives us, especially knowing the issues concerning a Windows machine.

Are there any concerns relating to running Windows using Paralleles Desktop and secure data contained within the Mac OS. In other words, does Windows act as a portal for the Mac OS since they are both running at the same time, and if someone were to gain control of the Windows enviroment, could the secure/senative data be obtained/compromise from within your Mac OS.

Thanks for any input.

 

[unused_user_name]

The answer to this one is.... maybe.

The answer got a bit complex so forgive me for ranting....

Given that XP in parallels has ways of communicating with the outside OS through parallels tools, an attacker could, potentially, create an exploit that specifically looks for this and exploits it.

There are previous examples of such exploits (mostly proof of concept stuff) for VMware.

If parallels has any security vulnerabilities in either the file-sharing protocol or in the parallels tools application it is possible that an exploit could be found that would take over the Parallels application. Since Parallels uses kernel extensions it is possible that an exploit could be found that would "root" your Mac. (Well "root" that kernel extension, but that gets a bit complex considering that Mac uses a micro-kernel)

Now, all that being said. It is **extremely** unlikely that any of this would happen. Most people are not running XP on parallels. Most of the exploits that are floating around are incredibly dumb, they rely on holes that were fixed 6 or more months ago (or are simply metasploit scripts). They get people who are too lazy to update, or who are unaware of the issues. A virus writer would have to specifically target XP under parallels on Mac. I would also guess that a good portion of people that run XP in this way are not even venerable to this type of an attack. My XP under parallels does not have a network card.... as the programs I run on it don't need one.

The bottom line: Everything connected to a network, or that installs new software is possibly venerable. Nothing is perfectly secure.

A secure computer is one that does not install new software, and is not connected to any network.

Also: Don't be too paranoid. Most "hackers" are idiots.

Do note though: I don't think Mac OS meets the security requirements for some secure computing evironments. I would not run software that uses HIPAA information under Parallels.

 

[MicroDev]

We all love our Mac's for the security it gives us, especially knowing the issues concerning a Windows machine.

Are there any concerns relating to running Windows using Paralleles Desktop and secure data contained within the Mac OS. In other words, does Windows act as a portal for the Mac OS since they are both running at the same time, and if someone were to gain control of the Windows enviroment, could the secure/senative data be obtained/compromise from within your Mac OS.

Thanks for any input.

IMO, at best, the Windows side becomes infected with some undesireable. Fortunately, because Windows does not play well with Unix, the options are fairly limited in attacking a remote Unix host from within Windows once access is gained. Now add to that the additional strength added by OSX, and the fact that most Unix hacks are for Linux (currently), and the final odds of OSX being affected are less than being hit by a falling coconut while walking around in NY City.

This doesn't mean that your nice shiney secure Mac can't contribute to the forces of ill will however. Assuming your Windows side has a bot of some kind, it can be used for malicous intent while the Mac is up. The bottom line is that Windows is a pain to secure and keep secured and if you choose to use it, you have to deal with that fact regardless of the platform it lives on.