3 ms·

Funny that nightly tape backups, a very old and established technology, would pretty much fix the problem.

GnomeChomsky 6y ago
Except then you're losing hours and hours of data during a restore. CDP, on the other hands, results in data loss of seconds only. Particularly powerful when combined with archiving in, say, AWS with tiering and object locking for immutability.
hsbauauvhabzb 6y ago
For now. If it becomes a common mitigation strategy, malware will start detecting and corrupting those backups.
- sodality2 6y ago
  Write only setting perhaps
  - hsbauauvhabzb 6y ago
    No, because you’re reading the local file system using the local processor, which could corrupt reads or writes. Even DMA reads won’t solve it - malware could encrypt/decrypt transparently for a period undetected, then toss away the decryption key once it’s likely that backups are no longer viably usable..
    - sodality2 6y ago
      I mean, if the malware is in the system before backups are even set up, sure it could be broken..
      - hsbauauvhabzb 6y ago
        Not even before, it just has to exist long enough to trash backups for a while - reverting from a month old backup would be substantially damaging.
chefkoch 6y ago
No they don't if you own a tapelibrary. If the gang thinks you're a big enough target they will make sure your backups are wiped if possible. The only thing that's going to Help is to seperate the backup infrastructur and pull the backups mit push them.
wrycoder 6y ago
Not necessarily. From the article: The encryption process ensues over days, weeks, or months, normally progressing through hard drives, attached drives, and network devices. The C&C server decrypts files as they are needed. Along the way, crooks place a ransom note in every folder that has encrypted files; they might also plant other types of malware on systems. During the final stage of an attack, the ransomware uninstalls itself, the thieves remove the encryption key from the infected system and the victim sees a ransom note on the computer screen. If the encryption goes on over a long enough period, recovery would be a nightmare or even impossible, especially if the tape rotation period is exceeded.

Except then you're losing hours and hours of data during a restore. CDP, on the other hands, results in data loss of seconds only. Particularly powerful when combined with archiving in, say, AWS with tiering and object locking for immutability.

hsbauauvhabzb 6y ago

For now. If it becomes a common mitigation strategy, malware will start detecting and corrupting those backups.

sodality2 6y ago
Write only setting perhaps
- hsbauauvhabzb 6y ago
  No, because you’re reading the local file system using the local processor, which could corrupt reads or writes. Even DMA reads won’t solve it - malware could encrypt/decrypt transparently for a period undetected, then toss away the decryption key once it’s likely that backups are no longer viably usable..
  - sodality2 6y ago
    I mean, if the malware is in the system before backups are even set up, sure it could be broken..
    - hsbauauvhabzb 6y ago
      Not even before, it just has to exist long enough to trash backups for a while - reverting from a month old backup would be substantially damaging.

chefkoch 6y ago

No they don't if you own a tapelibrary. If the gang thinks you're a big enough target they will make sure your backups are wiped if possible. The only thing that's going to Help is to seperate the backup infrastructur and pull the backups mit push them.

wrycoder 6y ago

Not necessarily. From the article: The encryption process ensues over days, weeks, or months, normally progressing through hard drives, attached drives, and network devices. The C&C server decrypts files as they are needed. Along the way, crooks place a ransom note in every folder that has encrypted files; they might also plant other types of malware on systems. During the final stage of an attack, the ransomware uninstalls itself, the thieves remove the encryption key from the infected system and the victim sees a ransom note on the computer screen. If the encryption goes on over a long enough period, recovery would be a nightmare or even impossible, especially if the tape rotation period is exceeded.