4 ms·
My solution for ransomware is to have a canary file. Write a script that automates the backup and hardcode a known SHA digest of the file (I like to make it a
by tuxxy 9y ago
My solution for ransomware is to have a canary file.
Write a script that automates the backup and hardcode a known SHA digest of the file (I like to make it a photo). Before the backup happens, compare the SHA digests. If they match, go ahead with the backup.
- AlexCoventry 9y agoWhat if the encryption has begun, but hasn't reached your canary yet?
- codewritinfool 9y agoThis is a great question. It takes some time for the ransomware script to encrypt everything, so it is possible that you catch it in the middle of the encryption but not before it reaches the canary. You could put hard links to your canary in all of the crucial locations, I suppose. Or you could use rsnapshot on the destination side and freeze the backup schedule if something looks amiss.