2 ms·

What if the ransomware has been hiding for a few months before it activated? You'd either have overwritten the last clean backup by then or you'd restore the ra

• KirillPanov 5y ago
  The article addresses this: “That is still somewhat rare,” Wosar said. “It does happen but it’s more the exception than the rule. It's something that very high-value targets will eventually have to worry about. But figuring out how to corrupt the backups without disrupting the production systems (and being discovered) is not likely to ever be a fully automatic process for the randomware goons. They'll have to invest serious time in understanding how the victim's systems work. For high-value targets, that will happen. I just walked through a telecom colo last week and saw a weird new box in somebody else's cage I'd never seen before. Later, I did a web search for the brand name. Apparently this company sells a network filer that keeps local daily/monthly/annual backups and doesn't let you delete them. Probably a good idea for an organization that just wants to throw money at the problem. Of course you can build this yourself with "btrfs sub snap" except for the part about not letting yourself (even as root) delete them.
  • Aulig 5y ago
    Ah, I interpreted "corrupt backups aswell" as encrypting them aswell.