14 Comments

Summary:

The recent Conficker virus scare had me warning relatives to protect their PCs, while also simultaneously gloating about how lucky I am to not be affected, since I’m a Mac user. You could say it bordered on the obnoxious, and you’d be right. But it looks […]

bxsht_fusion2_q308_medres

The recent Conficker virus scare had me warning relatives to protect their PCs, while also simultaneously gloating about how lucky I am to not be affected, since I’m a Mac user. You could say it bordered on the obnoxious, and you’d be right.

But it looks like I may have to eat some humble pie now that a bug has been found in VMware Fusion that could potentially allow malicious code to be run on your Mac using a virtualized Windows machine as a conduit. Obviously, Windows is still the weak link here, but it doesn’t make your Apple machine any less vulnerable.

Luckily, the flaw was discovered by Immunity Inc. exploit researcher Kostya Kortchinsky, and not by some malicious hacker eager to steal your credit card information. The vulnerability allows the virtual machine display function to read and write code in the host operating system, including OS X. Kortchinsky demoed the flaw using a Vista machine running a guest OS of Windows XP, but said the flaw is just as easy to exploit in OS X running Fusion, though they hadn’t yet actually run live tests of such a scenario.

Not one to be caught slouching, VMware has already responded with an update to Fusion, version 2.0.4, to fix the bug and block the exploit. It’s a free update for all Fusion 2 owners.

Even if Windows is actually the conduit for the malicious code in this case, this is a good reminder that Macs are not invulnerable to attack, despite what we may sometimes think. There’s a variety of security software out there to consider, but as always, smart and safe usage is your best bet for avoiding most ills.

  1. Luckily the Conficker virus didn’t infect my computer either. I wish those criminals wouldn`t develop such malware.

    Share
  2. SpaceFlightOrange Thursday, April 16, 2009

    I Wonder is parallels vunerable in a similar way?

    I was a bit concerned when Conficker came on the scene, because the smartmount feature of parallels means your mac drives are writable by windows, and this is on by default.

    Unless absolutley necessary i recommend completely isolating your Windows vm from any mac drives

    Share
  3. Still not worried.

    Share
  4. Here’s something funny.

    Before I switched to Mac back in 2004 I ran a Windows box on a static DSL line, on 24/7. I hosted five domains (mostly family sites). I didn’t run AV software. Before I packed it into the garage I did a virus scan and it came clean.

    I’m not worried about my Mac. Though it would/will be funny if I get infected.

    Share
  5. [...] (5) If you run Windows in VMWare Fusion on your Mac then be sure to upgrade to 2.0.4 to block up an attack vector for viruses like Conficker. § [...]

    Share
  6. You state that Windows is the weak link here and you are wrong. VMware is the weak link here. They’ve been releasing security bug fixes for the last week and it’s yet another security flaw in VMware’s code. This doens’t speak well to their isolation or security testing.

    Share
  7. I thing someone spelled Conficker wrong.

    Share
  8. If you have a powerful antivirus you don’t have problems with Cornflicker.

    Share
  9. horrifying news..but what’s the purpose of software security testing tools than. aren’t they worthy to use.

    Share
  10. horrifying news..but what’s the purpose of software security testing tools than. aren’t they worthy to use.

    Share

Comments have been disabled for this post