5 ms·
IMO the only way to perfectly protect yourself against Ransomware Attacks is with CD-Rs, because it's something not even hardware can alter. A skilled take over
by quantadev 2y ago
IMO the only way to perfectly protect yourself against Ransomware Attacks is with CD-Rs, because it's something not even hardware can alter. A skilled take over of the root level of a machine can be encrypting everything and you'd never know it, until the day it denies your access, by deleting an encryption key until you pay up to get it back...you hope.
- berbec 2y agoi use dropbox
- quantadev 2y agoSpeaking of that...I need to look into online storage solutions myself. I mean even a zip file on Google Drive! Not doing that currently. I always rotate thru literally 20 different devices for my backups, but if a meteor hits my house it's all gone. So many non-technical people think "a backup" is enough. I learned long ago to keep 20.
- fbnlsr 2y agoI personally use a hard drive in my house, and a cold storage solution (Glacier) from a reputable provider.
- throwup238 2y agoI use FTP.
- esafak 2y agoThis would have been a great comment if you were that original 'why not use FTP?' guy :)
- t90fan 2y agoThings like RDX backup cartridges have a physical write protect lever on them A few years ago (before affordable cloud backup offerings) this was fairly common for Small Businesses to use, for this reason.
- amelius 2y agoOnly works if the software cannot circumvent it (implemented fully in hardware).
- WalterBright 2y agoDisk drives used to have a write-enable jumper on them. No more.
- koolba 2y agoIIRC, those were more of a suggestion from the drive to prevent writing. It didn’t actually physically prevent it from being overwritten.
- rasz 2y agoDrives? I havent seen one yet. Floppies yes, but just like SD cards its just a plastic piece being read by controller GPIO and a mere suggestion to the hardware. There are forensic Write blockers for drives tho starting at around $200 for SATA/IDE solution.
- numpad0 2y agoSome of really old SCSI and (I think)IDE HDDs did have "WP" jumper positions. I don't know practically how it was implemented, though.
- theamk 2y agoModern backup systems use reference counting mechanisms, which means you can set up any old versions policy you want. Something like "last 3 annual backups + last 12 monthly ones + last 8 weekly ones + last 30 daily ones" will help a lot against slow encryptors. You'll want to ensure the malware can't destroy your backup, but that is possible too. A traditional way is to have a separate backup machine that runs backup program and pulls files remotely. Some backup apps can store directly to cloud storage and can work with "append only" permissions, to ensure that client can't delete existing backups. In this configuration, a separate trusted machine must run pruning periodically.
- freosam 2y agoThat's all true, and probably a better system overall, but burning an optical disk, labelling it, and putting it on a shelf does feel like a more accessible backup regime for many people. :-)
- theamk 2y agoFair enough! The danger with disks however is that it's an entirely manual operation which is easy to forget. Something setup-once-and-forget - local server or a cloud-based one like backblaze - is more likely to actually have the latest data when you need it. (Another reason is that the disks do bit rot however, and you'll never know until it's too late. Meanwhile, my ZFS fileserver sends me a email every weekend that it's scrubbed all the disks and found no errors - this warms my heart :) )
- quantadev 2y agoAnd what they say in the industries that need to take this ultra seriously (Banking and Insurance companies, for example) an untested backup is not considered a good backup. And the only way to truly test a backup is install a fresh image of the entire OS (using checksums on the image too), so that you can read the data and make sure no clever ransome-ware software is secretly encrypting EVEN your backups. oh, btw. "Blockchains solve this" haha.
- 2y ago
- ryao 2y agoWhat about DVD-Rs and DVD+Rs?
- extraduder_ire 2y agoOr BD-Rs. 50GB on a single dual layer disc. Haven't finished the last spindle I bought, but I assume they're the cheapest per GB by now.
- pronoiac 2y agoChecking diskprices.com - https://diskprices.com/?locale=us&condition=new,used&disk_types=bdrw,bdr,dvdrw,dvdr,cdrw,cdr https://diskprices.com/?locale=us&condition=new,used&disk_ty... - there's a cheaper outlier for DVD-R, then it's 25GB BD-Rs for a bit. LTO tape can be cheaper, but the cost of the drives has long been an obstacle to dabbling.
- megous 2y agoYeah, the prices don't seem to be correct. New 16TB HDD for $200. DVD+R 25x pack for $2, etc. Clicking the links shows different prices on amazon, etc.
- Dwedit 2y agoYou don't need to worry about ransomware destroying the data on your writable DVDs, the discs themselves can do that fine.
- fbnlsr 2y agoYeah disc rot is a real problem. CD/DVD-R are great when it comes to physically store drives (they don't take much space on a shelf and are easely sent via mail) but I'd rather use a hard drive and the cloud for my backups now.
- daneel_w 2y agoThe problem goes away if you burn slow, no faster than half the disc's max speed, to adequately affect the dye. I have CD-Rs and DVD-Rs that are 20 years old and work great. Inherent rot is mainly a problem with pressed discs which use aluminum instead of silver or gold for the reflective layer.
- Dwedit 2y agoCan a CD-R drive force a second pass burning over existing data to make the disc unusable? Perhaps with drive firmware modification.
- rasz 2y agoAfaik you can "erase" contents of a disk with open session. Data is still there just invisible without specialized tools, enough to fool non nerds.
- dist-epoch 2y agoIt would be safer to use a read-only drive when reading back the backups.