Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Currently we are using ReadyNAS by NETGEAR to hold all our images from all our machines. My question is can viruses expand from the machines and infect the NAS drive and the backups?

We are using AOMEI Backupper.

EDIT: Basically, I want to keep my clean backups clean. I keep Daily, Weekly, Monthly achievable backups, my worry is a virus might attempt or try to infect these backups making using them worthless.

share|improve this question

4 Answers 4

A backup is a backup, a file is a file. If a file is infected with a virus, and you backup it, then the backupped file contains the virus, and when you restore it the virus is still there. From the point of view of the backup system, a virus is just a bunch of bytes.

This is why recovery after a virus infection is hard: you have to restore a backup which predates the infection.

On the other hand, while the backup will gleefully save and restore viruses, the NAS itself (which is, internally, a computer with its own operating system) should be safe from such viruses, because it will not try to execute the files it copies, and in any case probably uses a distinct architecture (ARM, Sparc... but not x86).

share|improve this answer

It can... usually a virus can't infect the NAS itself, but it could infect a computer you restore to. The usual thinking is that when recovering from a virus infection, you will update your anti-virus signatures so it can detect the virus - and then the restore is safe. During such a restore you may restrict the type of files that you restore, for example not restoring any executable files. Of course, viruses can propagate through non-executable files. As Tom Leek rightly says: recovering from a virus infection is hard!

share|improve this answer

Yes, if it is in the file system - or intelligent enough to directly subvert your backup application. Perhaps even the NAS if the NAS firmware is not on ROM and susceptible to buffer overflows and the like (most NAS are glorified RAID controllers and thus ROM firmware).

Two things you can do to reduce the viruses and trojans contaminating your backups (both add cost):

  1. Use a "haircomb" backup. Where one in each 7 daily backup is preserved as the weekly backup, one in each 4 weekly backups becomes the monthly backup and so forth. Thus you have a fairly well-defined set of backups reaching back a distance. This costs more than a single rolling backup.
  2. Write backups to ROM or at least sign the hash of the backups with a TSA secure timestamp handshake. Have the backup restoration process check the TSA server before trusting that the backup was restored from when you thought it was (e.g. just after a virus scan/company audit, instead of some other time).
share|improve this answer

From my experience with Trojans such as Cryptowall everything attached with a drive letter is substitutable to attack. Personally I lost everything including my cloud backup as it encrypted all files, even those sitting in the cloud. The best solution to protect your data is non-network connected mediums such as tape or Blue-Ray (small backups). Tape being the industry standard for archiving because it is safe from a virus outbreak. Just as mentioned above if you backup a virus than you will recover the virus which is why you need multiple versions. Don't be fooled thinking that your Disk to Disk backup is safe because you are doing daily, weekly and monthly backups as they are all located on the same disk.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.