While having "too much time" and after some careful thinking from my side, I kinda "found" that if you authenticate at application level, ransomware would have to carefully analyze all known settings files to recover login credentials and then implement backend-access protocols to actually also take this data ransom.
So far for the introduction and the "TL;DR", now for a more specific description:
- Assume we have a computer which we want to secure from ransomware.
- Assume further this computer runs regular backups.
- Assume these backups are done by an application or service on the computer to a server, this application may be very popular (but not shipped with the OS).
- Assume the OS isn't directly involved in the backup process / doesn't provide the target drive as mapped drive.
- Assume the application authenticates itself (with PK auth or username+password) to the backend server.
- Assume the authentication credentials are stored clear-text on the computer to be secured (as is usual).
- Finally assume the server itself is guaranteed to be clean from ransomware.
Is the computer's backup now safe from being successfully attacked by (non-targeted) ransomware?