Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Windows in a virtual machine on my mac (via Parallels).

Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)?

I don't care about data in the virtual machine since I'm using Windows just to run some software which I can't in OSX. So if something goes wrong I can just re-install windows from scratch.

Conversely I care about the data I have on my mac and even though I do regular backups it will be really bad if I happen to lose them.

share|improve this question
2  
You don't want a VM. You want something like docker on steroids. You want completely unprivileged hosting of processes to do things that you know already are going to be a problem for you. That is a clear sign that whatever you are doing is about to be accompanied by the software development equivalent of "here, hold my beer". Just remember, a virtual machine is still of class machine, so this is a computer, just not on the bare metal. What I use VMs for day-to-day are development, and I run AV and all the rest all time. Yes, it's an impediment. But I still do it. – jcolebrand Feb 21 at 20:55
up vote 23 down vote accepted

Your virtual Windows is on the same network with your OSX, so the same threats of having an infected device on a network applies to this VM. Your VM is equivalent to a PC in your network its not much different. The same security practices that apply to your PC also applies to your VMs.

  • Although OSX does not run the same malicious apps that run on windows machines, that VM can still be a threat to rest of the devices on the network.
  • It can also consume your machine's resources in case it becomes infected and make your host machine slow too.
  • At times you may login to your email/cloud account on the VM to download something and in case the VM is infected with a keylogger, your data can be stolen.
  • You may connect a USB Flash drive to the VM to transfer files elsewhere and infection can spread this way.

Try to keep the guest operating system along with softwares used in it updated at minimum. If you use it moderately get a free antivirus like microsoft's Windows Defender.

One other threat is Ransomwares, Parallels Desktop has a feature that shares some of your OSX folders with windows. If your windows VM gets infected with a ransomware, it can possibly encrypt your shared files causing damage to your important data.


Looking at Virtualbox's manual chapter 13, Security guide. Other than the points mentioned above plus the clipboard which SilverlightFox mentioned, it says:

13.3.4. Potentially insecure operations

Enabling 3D graphics via the Guest Additions exposes the host to additional security risks; see Section 4.5.1, “Hardware 3D acceleration (OpenGL and Direct3D 8/9)”.
...
When Page Fusion (see Section 4.9.2, “Page Fusion”) is enabled, it is possible that a side-channel opens up that allows a malicious guest to determine the address space layout (i.e. where DLLs are typically loaded) of one other VM running on the same host. This information leak in it self is harmless, however the malicious guest may use it to optimize attack against that VM via unrelated attack vectors. It is recommended to only enable Page Fusion if you do not think this is a concern in your setup.
...

While you're using a different hypervisor, it is imaginable that same type of risks also apply to that.

share|improve this answer
2  
It depends on virtual machine networking config - it's not necessary that guest is on "real" network. – el.pescado Feb 21 at 17:31
    
@el.pescado Parallels desktop has "Bridged", "Shared" and "Host-only" networking modes and in the first 2 modes, the VM is on the same network with other devices and in the Host-only case its on the same network with your host OS. You can also go ahead and turn off/remove its networking adapter to completely isolate it but in case you need an internet connection on your VM you will have to put it on the network with other devices. – Silverfox Feb 21 at 17:49
    
I didn't notice that Parallels is used. Virtual Box, for example, uses NAT-like networking by default. – el.pescado Feb 21 at 17:51
2  
@el.pescado: Even with NAT, the VM can still talk to devices on the real network. NAT doesn't protect the network from the VM, it protects the VM from connections from the network. – SilverlightFox Feb 21 at 18:17

In addition to Silverfox's excellent answer, if you're sharing the clipboard with your Mac, then any malware that logs clipboard contents could steal something sensitive copied to the clipboard from your Mac.

There is also the possibility that malware could traverse from the VM and execute on your Mac. The Pwn2Own competition is looking for such escapes as they have put a $75K bounty on any VMware Workstation bypass. This is very unlikely to happen, although it is theoretically possible should any such vulnerabilities exist in Parallels.

There could also be malware that would make your VM part of a botnet without you necessarily realising. For example, it might be participating in DoS attacks or it could be sending out spam. The main indicator of this would be reduced performance, however any anti-virus/malware products could alert you ahead of any performance drop.

share|improve this answer

Whether the OS runs on virtual or physical hardware, is quite irrelevant. It's still a PC on your network, and needs to be secure. Regarding reformatting if something goes wrong. The same can be said for any physical computer. Also this implies that you are aware that something has gone wrong. If you have no security software on it, then you most likely will have no idea what might be running on it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.