0

I have OSX. Time machine takes periodic backups. This backup is encrypted.

If my machine were to be infected and locked by ransomware, what prevents the backup from also being comprised as it is just attached storage? I believe that once decrypted (after prompt) it is just as vulnerable as the main SSD. It could be attached and encrypted without risk.

Other than rotating out a volume periodically (either physically, or cloud), what other methods are employed currently for small businesses if the above is an accurate risk assessment?

6
  • 1
    What makes you think if it is attached and encrypted there is no risk? If you want backups for ransomware, you never leave them attached, and you test the backups. Otherwise, the ransomware will encrypt the backups too
    – nobody
    Jun 14, 2021 at 17:37
  • Ransomware will encrypt the encrypted backups ...
    – schroeder
    Jun 14, 2021 at 17:54
  • Tape drives are generally used to make backup which is more secure than backup on SSD/HDD because of air gap.
    – saurabh
    Jun 14, 2021 at 20:32
  • @saurabh, isn't the air-gap a result of tape cartridges being cheaper, so it is possible to rotate them less frequently? I guess you can have air-gaps with SSD or HDD too if you really want to.
    – reed
    Jun 14, 2021 at 20:39
  • Yes, this is one of the reasons but not the only reason I see. Tape drives has statistically shown to be more reliable than HDD and SSD. Also, you are right SSD or HDD can also be air gaped.
    – saurabh
    Jun 14, 2021 at 20:51

3 Answers 3

1

Physical separation is how businesses deal with this threat. Unplug or unmount the backups once the backup is complete.

0

Apart from air-gapping the storage, the simplest approach is to reverse the access policy. This is straightforward to setup on Synology NAS and QNAP devices alike.

The ransomware runs on the PC and has access to its storage. The same access is granted to the backup unit. The PC does not write its files to the backup unit; rather, it is the backup unit that reads the files from the PC through a backup agent (or, at worst, a read-only access to the drive through any network file system available). The PC has a read-only access to the Time Vault storage, and no more.

This means that if a ransomware encrypts my ~/VeryImportantDocument.odt, this will be "seen" by the backup system as "Leonardo has modified ~/VeryImportantDocument.odt", and the next copy that will be taken will be useless to me (being ransomware-encrypted). But I will still be able to restore the version immediately previous to that one. The ransomware will be unable to delete or encrypt those data.

Also, when running the backup, the backup unit makes a plan - it has to, to ensure there is sufficient storage for a consistent snapshot. Since I have confirmed that I never change more than 1% (and that's a gross exaggeration) of my files every day, I have set up things so that as soon as the daily changed files counter goes beyond this limit, a warning is issued.

1
  • Let's remember that this method only works if the backup server cannot be administered by the infected machines, or if the backup server doesn't get infected in some way as well.
    – reed
    Jun 14, 2021 at 20:30
0

Disk air gaps work fine. One can simply turn off the power to controllers or the routers (using physical switches).

However, since cloud-backup is the trend, people are relying on "virtual" air-gaps. These are combinations of WORM (write-once, read-many) disks with the backup and encryption operations separated from the data paths. All of these suffer from inherent cloud-security issues. As such, virtual gaps do not pass military requirements, some government and financial requirements, and some corporate requirements.

How might this apply to Macs?

Initial level: iCloud Drive or Google Drive real-time mirroring. This is easy enough for most people to use without knowing much about data protection. It's a massive step over the public not having any redundancy at all.

Next level: A Time Machine disk. Ransoming the active data would not ransom the older Time-Machine backups. But one could attack both. Few to none ransomers would work that hard for the peanuts consumers would pay.

Next level: Multiple Time Machine disks with some in use and some on the shelf, rotating them periodically. Real-physical air-gaps. (Not many people take this much effort. Clouds are easier.)

Consumer "virtual" air-gap level: iCloud/Google Drive plus Carbonite or similar solutions. I expect Carbonite has thought long and hard about ransomware issues. (Carbonite costs $75/year to backup any size Windows or Mac system disk. That's pretty affordable for decent ransomware protection. Carbonite does not backup non-system disks. Time Machine does, but with issues.

"Virtual" air-gaps for Macs: BitDefender malware protection offers a "Safe File" feature that supposedly limits unauthorized modifications to files. I'm not sure how that works. Similarly, they supposedly prohibit changes to Time Machine disks other than from Time Machine. I'll not argue if these are foolproof, but I expect they are effective.

What do I do? For my Mac I combine iCloud Drive real-time mirroring with a TM spinning-disk on my router (always on), with a TM-USB flash drive, and a Carbon Copy Cloner USB flash drive. So I have four backups across two prems using three different software implementations. Two of the backups have air gaps. Having written this reply, I think I'll replace the TM-USB flash drive with Carbonite.

Disclosure: I've implemented Secret-Level data centers (with air-tapes disks, air-gap disks, network isolation...). I've also invented backup systems: Cray supercomputer backups, and (while at Apple) the technology prototype for Time Machine. In addition, I have implemented ransomware protection for large enterprises after they had suffered such attacks (hard sell before, easy sell after). I always included air-gap tapes and/or air-gap disks plus virtual air-gaps in clouds (if allowed).

Did I mention it was complex?

1
  • 1
    Welcome to the site. Unfortunately, this looks like a response to a comment and not an Answer to the Question. As a Q&A site, we're different from a discussion site. Answers need to address the Question directly. This looks like a tangent based on the comment section.
    – schroeder
    Jan 8, 2022 at 9:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .