4

I have several Windows machines that do automatic backups to external or internal backup drives. This happens automatically during off hours, and it needs to stay that way with no manual intervention required. For example, disconnecting and reconnecting external drives isn't an acceptable option.

However, since those drives are connected, ransomware is a very real threat to them. As a defense, I am considering mounting the backup volumes only when needed to do a backup and then dismounting them immediately after the backup is done.

I know this isn't a perfect defense since malware that gains admin privileges could mount those drives just as easily as I can, but that seems like an unlikely thing for malware to do since unmounted drives aren't normally of much interest. (Or they're of great interest, I'm not sure which.)

I'm willing to take the risk of encountering zero day malware capable of doing that, but would that behavior really be zero day? Or has malware that scans for and mounts unmounted volumes already been seen in the wild?

Improve this question
10
  • The whole point is that ransomware doesn't need administrator privileges. If your system gets compromised by malware running with the elevated privileges it means you don't manage your system properly or have a powerful adversary.
    – techraf
    Aug 9, 2016 at 1:38
  • Isn't the term "zero day" usually used in reference to an actual exploit and not a behavior of malware? Even if no malware has exhibited this behavior (which is very doubtful), I wouldn't take this to mean you don't have to worry about it.
    – mittmemo
    Aug 9, 2016 at 2:03
  • 1
    I tried to tell you that your question shows a lack of understanding how permissions in Windows work. The fact that ransomware runs on a local user account, domain user account, or from the fact that ransomware runs with administrator privileges on a user workstation does not mean that ransomware magically has access to all the data stored in your network. If you think of protecting the data, I'd suggest focusing on data and permissions to access the data, not on malware. If your backup solution utilises the same account as users log on to, it's simply lame.
    – techraf
    Aug 9, 2016 at 3:40
  • 1
    It doesn't matter what you know. You are taking part in a public community and the only thing visible here is your writing.
    – techraf
    Aug 9, 2016 at 4:05
  • 1
    @techraf My word you're a pompous little twit who likes to hear himself talk. Fortunately, I've been on SE a few years so I'm familiar with your brand. How about you post an answer? If you can't manage that, then go find a question that actually is about Windows permissions instead of trying to make this one something it clearly isn't.
    – Carey Gregory
    Aug 9, 2016 at 13:36

1 Answer 1

Reset to default
2

Ransomware (specifically Locky comes to mind) is able to attack unmapped network shares. I am not aware of any malware that is able to mount an unmounted drive, though I imagine that it's not outside the realm of possibility. Most variants I've seen or heard of use a dropper file to download a payload - this payload has the potential to change so just because it's not being done now doesn't mean it won't be in the future.

I know this isn't a perfect defense since malware that gains admin privileges could mount those drives just as easily as I can, but that seems like an unlikely thing for malware to do since unmounted drives aren't normally of much interest.

I would disagree with this statement. The reason ransomware is so effective is that it manages to monetize data that is intrinsically worthless. Your data matters to you; you're likely willing to pay for it and that's enough to make it a target for ransomware.

I would advise always having a truly offline backup. Back in the day when more people were backing up to tape this was almost always the case, however as many have switched to drives these offline backups are not as common any more. If you truly want to protect yourself you'll have a truly offline backup (unplugged and not network accessible) with a RPO that meets your organization's business requirements.

Improve this answer
4
  • I do have true offline backups, but those are only made monthly so the potential loss is 30 days, whereas daily backups are the concern here.
    – Carey Gregory
    Aug 9, 2016 at 1:42
  • @CareyGregory Can you set up a server to perform the backups and install agents on the machines that need to be backed up to reduce threat exposure? If you're not browsing / working off your backup server then the backups should remain safe as most (if not all) of ransomware requires manual interaction to infect.
    – DKNUCKLES
    Aug 9, 2016 at 1:44
  • That's one of the possible solutions but it's obviously much more involved. The attractiveness of dismounting volumes is it's very cheap and easy. As with all things involving security, the decision is a tradeoff between cost and risk. An imperfect defense for daily backups might be acceptable for now since secure monthly offline backups exist, but when and if malware that's known to mount volumes becomes known, then clearly I would need to find another solution.
    – Carey Gregory
    Aug 9, 2016 at 2:10
  • Your paragraph beginning with "I would disagree with this statement" doesn't seem to have anything to do with the likelihood of ransomware mounting drives by itself. Care to clarify this opinion?
    – Cauterite
    May 15, 2017 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .