4 ms·

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything ba

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...

edflsafoiewq 6y ago
Your data has still been leaked. A few days ago there was a story about a ransomware gang threatening to expose police informants if they didn't get paid.
- djoldman 6y ago
  Yes, definitely that. But I think a lot of businesses really have a problem with the mechanics of just getting their business running again, like the one in the article. This seems fairly straightforward to defend against.
- walshemj 6y ago
  Seems a bit risky attacking other criminals - you never know if they might have contacts in the hard to extradite countries they work in.
- bluGill 6y ago
  But my data isn't that sensitive. I'd prefer to keep it secret, but the value decays fast.
deleted 6y ago
[deleted]
toss1 6y ago
The threat to that is a silent encryptiion on that goes on for weeks before the alert/ransom is demanded. Your mirrors are now full of encrypted trash, or you need to go back a month or more. This could be managed with a backup that maintains 'fingerprint' hashes of all the files, tracks the changes and alerts if there are too many, or alternatively, the user/admin litters the system with a set of canary files of the same type that should never change, and the backup system halts and alerts if any of them do. I'd like to see a utility to just check a set of canary files for changes. Anyone know of one?
usrusr 6y ago
If you mirror systems then you will find yourself in a halting problem world of restoring older and older backups only to discover that they, just like all the younger ones you tried so far turn out to be exact reproductions of a state already breached. If you store only content, rebuilding the environment will be quite a feat.

edflsafoiewq 6y ago

Your data has still been leaked. A few days ago there was a story about a ransomware gang threatening to expose police informants if they didn't get paid.

djoldman 6y ago
Yes, definitely that. But I think a lot of businesses really have a problem with the mechanics of just getting their business running again, like the one in the article. This seems fairly straightforward to defend against.
walshemj 6y ago
Seems a bit risky attacking other criminals - you never know if they might have contacts in the hard to extradite countries they work in.
bluGill 6y ago
But my data isn't that sensitive. I'd prefer to keep it secret, but the value decays fast.

deleted 6y ago

[deleted]

toss1 6y ago

The threat to that is a silent encryptiion on that goes on for weeks before the alert/ransom is demanded. Your mirrors are now full of encrypted trash, or you need to go back a month or more. This could be managed with a backup that maintains 'fingerprint' hashes of all the files, tracks the changes and alerts if there are too many, or alternatively, the user/admin litters the system with a set of canary files of the same type that should never change, and the backup system halts and alerts if any of them do. I'd like to see a utility to just check a set of canary files for changes. Anyone know of one?

usrusr 6y ago

If you mirror systems then you will find yourself in a halting problem world of restoring older and older backups only to discover that they, just like all the younger ones you tried so far turn out to be exact reproductions of a state already breached. If you store only content, rebuilding the environment will be quite a feat.