8

I have a Macbook Air laptop and use Apple's Time Machine program and an AirPort Time Capsule (physically connected to my router via ethernet cable) to periodically back up my data.

If my laptop were to be infected with ransomware, would that also infect the Airport Time Capsule rendering the backups useless?

If so, how would I get around that?

  • 1
    Given that Time Capsule is network connected it may be vulnerable regardless of what's running on your laptop. Not sure if it has the processor or software needed to specifically target, or if that would be viable. Wouldn't a nasty, and inefficient, ransomware be to embed the app in a backup and just wait for someone to restore? – Dave Nov 13 '15 at 23:29
5

Technically, the Time Machine content is as vulnerable as the content on your computer. It depends of course on the exact implementation of the ransomware, but you have to assume that when they target Mac OS X, they will target this well-known backup solution as well.

In fact, I read some reports recently that suggested the ransomware "KeRanger" that became known through a breach on the Transmission website was in fact already trying to encrypt Time Machine backups as well: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

So, you would have to assume that yes, ransomware in the future will do this and you can't rely on your Time Capsule backup. Even if you only sync the backup once a day - it would be trivial for the ransomware to wait until it can encrypt accessible backups as well.

There are some Apple knowledge articles about how to secure your Time Machine backup (below), but they will not be of much help, because they are intended to encrypt your backup from other people. You, as the user, will still have access. It is possible that accessing this data requires user authentication, but the ransomeware could still encrypt the complete backup. This would take time of course, but it's not unthinkable. An alert user may notice this and take counter measures, but the ransomware could also just delete all your backups instead.

https://support.apple.com/kb/PH18852 https://support.apple.com/kb/PH18836

So, you see the weak-point is that this data is easily and constantly accessible. It will only be a matter of how aggressive the attacker wants to be.

Alternative Solutions

  • One counter-measure would be to regularly create CD/DVD/Blue-Ray backups. It may be a bit old-school, but I want to see the ransomware that can break into my Backup - CD collection ;)
  • Another could be to use an online backup service. Ideally, you would want one that stores multiple versions of your files (like Time Machine does), so even if all the old files would be pushed as encrypted copies to the online backup, you would still have older versions accessible. Now, you could say the ransomware may also start trying to delete that online data, but hopefully this would require them gaining access to your backup account.
  • If you want to continue only relying on the Time Capsule, Mac OS X does have a fairly good rights management system - but note that this is worthless if the ransomware manages to gain admin rights through some security vulnerability (I would say that's something most attackers would want to do). Either way, you would first make sure your own primary user account is not an admin. Second, you would setup the Time Machine from your (secondary) admin account. Third, you would require password access to the (encrypted) Time Capsule disk and make sure this password is different to your WiFi password. Then, make sure you never enter that disk password in your primary, limited rights user account.

[EDIT]

Of course this list of alternatives is not(!) exhaustive. There are a million options to secure your files, but in case it helps anyone, I might add a few more options here that you can use for free today.

One thing we will assume is that the attacker is really only interested in your personal files and you are really only interested in protecting your important personal files. Now, the attacker doesn't know which files are important or not, they will just encrypt everything in your home folder ending with .doc / .pdf / etc. That means you don't have to backup your entire hard drive to protect yourself from crypto ransomware.

  • Backing up your important (text) documents really shouldn't be a problem today. You can use countless online storage services with free storage quotas.

If you are using Dropbox or a similar service, make sure that you don't have these folders actually constantly syncing, though or can at least restore deleted files / older versions online somehow. You don't want the attacker to delete your files and then Dropbox to conveniently also delete them on your cloud storage.

  • Collections of smaller project files could easily be put into a git repository and uploaded to Bitbucket (or alternatively to Gitlab or Github).

Make sure you are using a private repository here. Technically, git is intended for version control and works best with simple text files, but nothing prevents you from putting PDF files in here. This option is probably more suitable for advanced users.

  • Photos and Videos can be synced to numerous (free) online storage solutions (including Google Photos, Flickr, Shoebox, etc).

As with the dropbox situation, try to make sure that your online copies can't easily be deleted.

  • Use write-only folders as a primitive measure. Under Mac OS X you may have seen a folder called "Dropbox" in your "Public" folder (long before the other Dropbox Could thingy was a thing), which is Write-only for other users.

The idea would be to have another user on your machine that has one or more of such write-only folders available. You would regularly dump your important files into that folder. The folder can not be read by you, so ransomware running in your primary user account, hopefully won't be able to look inside.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.