3 ms·
AFAIK, Windows has support for snapshotting as well (Volume Shadow Copy Service¹), and (again AFAIK) certain malware disables it. The whole point is that if ma
by pizza234 5y ago
AFAIK, Windows has support for snapshotting as well (Volume Shadow Copy Service¹), and (again AFAIK) certain malware disables it.
The whole point is that if malware gets root access (or anything that can manipulate the disk at will), there's nothing that can be done.
EDIT: briefly searched, and indeed, my suspicions were correct: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies https://redcanary.com/blog/its-all-fun-and-games-until-ranso....
¹=https://docs.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service https://docs.microsoft.com/en-us/windows-server/storage/file...
- jjav 5y ago> The whole point is that if malware gets root access Strictly true, in that if it does get root access, and is aware of zfs snapshots and deletes them, then yes. Nothing you can do. More typically, the malware runs as the user id and has no awareness of zfs, so it just overwrites files the user owns. Which can be trivially undone with snapshots. As with everything related to security there is no absolute, but every layer helps.
- Geezus_42 5y agoThat's why you need another system to pull snapshots to for backup.
- dragontamer 5y agoIf that system is online, then it can be hacked. Even if the backup system isn't hacked, you can hack the original system in such a way that the pulled snapshots look like they work, but in fact did not work (ex: hack the rsync data requests to be encrypted with the ransomware key). You gotta stop them from having root access to begin with. Hard in this day of zero-days, but a lot of these ransomware attacks don't seem very hard to pull off these days...