4 ms·

That's not enough anymore: good ransomware will look for backup systems and wipe those out before proceeding. You need read-only, airgapped backups before you c

• derekp7 9y ago
  That doesn't help for targeted attacks, which corrupt the backups as they are being written. Not sure how to protect against that though.
  • danarmak 9y ago
    Use a filesystem that lets you take regular snapshots, like zfs.
    • pmlnr 9y ago
      This is good for now, but snapshots are like RAID: they are not backups.
      • tensor 9y ago
        They are if you send them offsite. Backups with version history are great if you can swing them.
        • floatboth 9y ago
          Startup idea: zfssend.net, a place to send snapshots to As A Service :D
          • detaro 9y ago
            I think you are looking for https://rsync.net https://rsync.net
            • floatboth 9y ago
              The name I suggested was a clear reference to them. But they provide storage "accessible with any SSH/SFTP tool", not a place to `zfs send` to.
              • detaro 9y ago
                http://www.rsync.net/products/zfsintro.html http://www.rsync.net/products/zfsintro.html
                • floatboth 9y ago
                  Wow, nice! How did you find that page? http://www.rsync.net/products/platform.html http://www.rsync.net/products/platform.html doesn't link to it
                  • detaro 9y ago
                    It was in my browsing history, somehow. No idea how I got there initially.
  • donald123 9y ago
    They can corrupt one backup but not all backups. And a good backup software should do integrity check.
    • derekp7 9y ago
      I wasn't referring to corrupting the backup directly -- but corrupting the data as it is written to the backup server. This can be done by compromising the backup client, through a rootkit, etc. If this is undetected for a year before the attacker pulls the final trigger, you have a year's worth of bad backups.
  • corford 9y ago
    An easy option is to use an offsite backup service that keeps versioned history (e.g. http://www.rsync.net http://www.rsync.net or http://www.spideroak.com http://www.spideroak.com). Not sure about Spideroak but in the case of rsync.net they duplicate snapshots and store them outside of your main account so even if your account gets compromised and an attacker deletes all your backups you're still safe.
• pizzetta 9y ago
  A continuous back-up system should be enough --as long as it doesn't have the smarts to reset the encryption pwd on the backup set.
  • deleted 9y ago
    [deleted]
• paulpauper 9y ago
  how can they infect an external drive that backed up the data before the infection?
  • tobltobs 9y ago
    Why would the malware care about if it is an external or internal drive?
    • paulpauper 9y ago
      If you back your files up on the usb drive on Tuesday, remove the drive after back u the files, and get infected on Wednesday, the files on the drive obviously are not going to be infected.
      • idlewords 9y ago
        If you remove the drive. Lots of backups are done on to always-connected devices.
        • dkruchok 9y ago
          So, if my external drive was connected to the computer during encryption, will it also be encrypted?
      • thedz 9y ago
        yes, that's exactly what he said: > You need read-only, airgapped backups before you can consider yourself safe.
  • jannes 9y ago
    Only if you connect the external drive again during a silent incubation period.