7

According to Heise (German) Time Machine backups can be encrypted by Ransomware. Sorry I didn't find an English source, please use Google translate. KeRanger had an inactive module _encrypt_timemachine, which was able to modify backups as normal user (not admin).

How to secure Time Machine backups? I don't wish to unplug the disk.

  • 1
    Afaik TimeMachine has different snapshots, depending on each other. You could at least remove write access from the older ones. But that will not offer full protection. Unplug your disk and be sure. – Tobi Nary May 16 '16 at 8:22
1

If you use a NAS server for your time machine backups then you could potentially use a filesystem on that server that supports periodic readonly snapshots. This would ensure that previous backups aren't encrypted by ransomware. FreeNAS with ZFS is probably the easiest way to set this up, though you could also accomplish the same thing on any OS that supported ZFS.

To be honest, even with FreeNAS UI, this isn't the easiest. Administrating ZFS is not straightforward and you would definitely need to read up on ZFS Snapshots. Additionally, it's expensive, as now you need a server for backups as opposed to just an external disk.

There is potentially a much better solution coming soon. Apple's new filesystem, APFS, has already rolled out to iOS 10.3. I can't find confirmation that it will be in macOS 10.13, but I am imagine it's right around the corner.

APFS supports snapshotting natively, and if Apple does this right, Time Machine backups should use readonly snapshots that should hopefully be ransomware proof. We will have to wait and see what happens though.

  • One problem with this: Ransomware should be assumed to have access to (and control of) any service or admin interface that the user or administrator can access from the machine in question. Therefore, in order to secure the snapshots, you would have to ban administrative access to the NAS from the machine being backed up. Merely flagging snapshots as read-only will not work... it requires a privilege separation policy that must be followed. – tasket Mar 26 at 11:31
  • As an example, ransomeware could sniff the NAS password from the browser or app used to administer it, then access the NAS itself and do the following: 1. create a writable snapshot of the ro snapshot, 2. encrypt the writeable snapshot, 3. create a new ro snapshot from the encrypted copy, 4. delete all snapshots except for the encrypted ro copy, 5. rename the encrypted snapshot to the name used for the original. – tasket Mar 26 at 11:46
8

Probably the best low-impact solution is to use multiple disks. OSX supports it already.

You could keep a regular disk plugged in, and use the second disk on a weekly basis (keeping it unplugged and in a safe location). If your backup gets compromised you only risk losing a week's worth of work.

Also, keep your backups encrypted!

  • 2
    OP mentioned he doesn't wish to unplug the disk, furthermore, while encrypting backups is a good security practice, it doesn't help with the ransomware case. – Silverfox May 16 '16 at 11:55
  • 1
    @Silverfox I never said the OP should unplug the main disk - just plug in the secondary backup every week. The suggestion to encrypt backups is not relevant in this case but always worth mentioning. – lorenzog May 16 '16 at 13:17
  • A high degree of security for the backup could be achieved with this method if a second, largely network-isolated computer were used to check that the additional copy could still be accessed after being updated. Otherwise, the malware could wake up whenever the additional volume was attached and attack it by encrypting the contents or even destroying key parts of its filesystem in order to make it non-recoverable -- the latter type of attack would be fast and relatively unnoticeable. – tasket Mar 26 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.