7

I use Acronis backup software to create images of my system, have a copy of important stuff in the cloud and all other backup related things.

As Acronis states, their software uses AES encryption which happens locally.

But I have found that Acronis have some catch in EULA: EULA

So does it mean that their encryption worth nothing?

2
  • 2
    Your final question is by definition opinion-based, and opinion-based answers are off-topic here. Please edit your question to remove that.
    – user13695
    Mar 11, 2017 at 14:04
  • Do you still consider it 'insecure' if they have the power to decrypt? There are a lot of assumptions in your questions and it is difficult to provide an answer that makes sense.
    – schroeder
    Mar 11, 2017 at 15:14

5 Answers 5

5

The 'worth' of the encryption in this case (which has nothing to do with the actual encryption as I'll explain below) is completely opinion-based, so you better rephrase that. But I'll try to explain the meaning of the EULA:

This means that they have the symmetric AES key to do the decryption. Their encryption isn't worth nothing per se, it is worth as much as you are willing to trust Acronis. Meaning, the AES encryption is in place, but they have the ability to decrypt your data. The question is do they? or will they? These are questions no one on this site will be able to answer. And the decision of trusting them is yours to make.

2

Acronis True Image lets you encrypt client-side, too. The password you set creates a private key that only you know. So, if you set that up, Acronis won't be able to decrypt your data even under a court order. To set a private key, from the desktop tool "backup" pane, go to "option" > "advanced." Set your password under the "backup protection" heading.

If you don't set private encryption, the company still encrypts your data at rest, but they have the encryption key.

1
  • 2
    Do you have any sources for this?
    – vidarlo
    Oct 6, 2019 at 17:44
2

If the question is regarding the Acronis True Image cloud : it is not "zero-knowledge".

If you already have an encrypted backup in the Acronis Cloud, here is an easy way to check that :

  1. Log in to the Acronis Cloud web portal
  2. click on "Recover" on one of your backups
  3. Don't type your password yet ; instead press F12 in your web browser
  4. In the troubleshooting window that appears, click "network"
  5. Now type your encryption key for this backup, in the Acronis portal, then click "OK"
  6. in the troubleshooting window, click on the "POST" request that appeared
  7. click on the "parameters" tab
  8. there, you can see that your encryption key has been fully sent to the Acronis server
  9. (you can now press F12 to close the troubleshooting window)

Thus, your encryption key is fully sent to the Acronis server, and they can use it to decrypt your data.

Now, it's up to you to trust them that they did not memorize your encryption key. For example, by order of a judge, they could be asked to sniff your encryption key. Or an employee who has access to the server could capture / log the traffic and see your private key.

0
1

Acronis True Image appears to indicate that the company does not have access to the user's encryption key. Their documentation page here says: "Warning! A password of an online backup cannot be retrieved. Please memorize the password that you specify for backup protection."

0

In the subroutine responsible for generating encryption key in Acronis True Image 2017 i found interesting OpenSSL library calls (EVP_PKEY_, d2i_X509). These are used for encrypting "something" which appears to be randomly generated encryption key with public key embedded inside Acronis.

The use of public key encryption inside function responsible for generating secure random encryption key is rather suspicious. There's possibility that after the "random" key is generated - it's then encrypted using acronis public key and stored inside TIB file. Which means the owner of corresponding private key (Acronis), might in theory decrypt that data, and gain access to the real "random" encryption key.

ida1enter image description here

The functionality is currently disabled at least in 2017 version of acronis, however presence of such code might mean that it can be reenabled in custom builds in some regions and countries.

By default, the public key encryption is skipped for now and following code at the bottom is executed:

enter image description here

Full decompilation results are available here: https://pastebin.com/3x0WnGiF

So based on that, you can decide whether acronis encryption is secure or not.

2
  • this does not appear to answer the question
    – schroeder
    Jun 19, 2017 at 16:47
  • Noone can answer that question without having access to acronis source code. However by analysing the binary you can see how it's working under the hood, and it might help you decide whether the code found which is responsible for encryption process can be called "secure".
    – Mike Cors
    Jun 19, 2017 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.