5 ms·
ZFS snapshots are immutable (read-only) for normal users. So, if you had your data stored on a cloud storage platform that created and maintained ZFS snapshots
by rsync 7y ago
ZFS snapshots are immutable (read-only) for normal users.
So, if you had your data stored on a cloud storage platform that created and maintained ZFS snapshots, Mallory could gain all of the credentials and still not be able to touch your daily/weekly/monthly snapshots.
Now, if only there were a cloud backup platform that included zfs snapshots ...
- masklinn 7y ago> ZFS snapshots are immutable (read-only) for normal users. Unless you've given them "destroy" that is. > Now, if only there were a cloud backup platform that included zfs snapshots ... I see what you did there...
- nikolay 7y agoYup, he's the guy behind https://www.rsync.net/ https://www.rsync.net/
- icebraining 7y agoWhat if someone uses the credentials to file a support request in that platform asking the snapshots to be deleted?
- jdnenej 7y agoHopefully anyone with the ability to delete them would decline such a request.
- icebraining 7y agoSo the platform would keep data against the wishes of the client? That doesn't sound good.
- TomMarius 7y agoMore like it would include a more elaborate, person to person process.
- afiori 7y agoA better interpretation is that there might be multiple channels used for different identification purposes (a la 2-factor authentication) and the provider can ask for confirmation in a higher security channel. Whether this is done/feasible in practice is debatable.
- VectorLock 7y agoI wonder when ransomware will get smart enough to detect backups and insinuate themselves into them to foil the "just restore from backups" strategy.
- mkagenius 7y agoMost likely they already do that if its on the same computer. Details aren't out yet, but I would guess the backups came from other computers.
- AnIdiotOnTheNet 7y agoThere are many known cases of ransomware attacks that have deleted backup repositories.
- LoveKebabble 7y agoThey already do, I worked a case last week where that happened. Trickbot for example will be on a machine for 2-5 months so that it's in your backups, and is commonly followed by Ryuk ransomware. So if you get hit with Ryuk and just restore from backups without re-mediating anything you will likely be hit with Ryuk again.
- emmp 7y agoYes. They are often targeting IT providers of SMBs by phishing/otherwise compromising their credentials, and deleting backups before encrypting. It works sometimes, 2FA hygiene and secondary site redundancy are usually good enough to protect you.
- ev0lv 7y ago2FA is so overrated. You can so easily do a sim swap to get access to a particular phone number and bypass 2FA.
- therealrootuser 7y agoThe problem isn't with 2FA, the problem is with SMS-based 2FA.
- wil421 7y agoIs ZFS really that popular in the enterprise? Amazon GovCloud is not that old and I doubt municipalities have switched to AWS. They might not have the same FedRamp requirements as federal agencies.
- emmp 7y agoI don't know about the Enterprise, but Datto is a very popular backup appliance provider among small/medium businesses and some smaller municipal governments, which uses zfs snapshots as it's storage backend.
- wil421 7y agoDatto is interesting. I suppose small to medium businesses and governments could just use off the shelf NAS products.