Direkt zum Inhalt

Encryption Feature Appears to Have A Vulnerability

Thread needs solution

One of the reasons I bought Acronis TI 2017 was that it has the ability to encrypt your backups using a password.  This way, if your portable hard drive is stolen by a burglar, then your files are still secure assuming the burglar does not have your password.

However, I performed a file recovery test to see if the application would require a password before proceeding.  I discovered it does not, leaving files unprotected.

My backup routine includes a password and AES128 encryption just in case you're wondering.

Try this simple test to see if you have the same problem.  Open Acronis.  From the backup tab, choose Recover Files near the bottom of the screen.  Navigate to a file on your encrypted backup tree.  Then choose recover.  The app does not ask for the password and allows for the recovery of the file(s) wherever you specify. 

So, if a thief has your "encrypted" data and has his own version of Acronis TI2017, he's got your info and does not need anything special like a password to decrypt it and recover your files.

I hope I'm wrong.  Perhaps some Acronis TI2017 genius can explain why this happens.

 

 

0 Users found this helpful

Trub, this is a known issue in the latest build 8029 version of ATIH 2017 and has been reported to Acronis development who are working on a fix for this.

See forum topic: 128812: No password when restoring encrypted backups in build 8029?

The latest update I received from Acronis a couple of day ago was:

here is Ivan from Acronis support.

I have checked the status of your case and see that the colleagues from quality and testing department were able to reproduce the issue in our testing environment. The issue is now reported to the developers and we plan to fix the issue in the next version.  As we can not do anything else except to wait because the issue should be fixed by developers may I archive the case for this period ? You can be sure that we do not regard the issue as resolved one. The case will temporary be moved to "Not resolved" and "Waiting" queue. As soon as I get internal information that the issue is fixed I will update you automatically. 

Thank you for confirming that for me Steve.  I hope their next version doesn't mean we customers have to wait until Acronis TI 2020 for a solution.  I do have build 8029 so I guess I'm out of luck for now.  I am amazed that the company did not discover this vulnerability in Testing & Evaluation before they released the product.  Seems like such an obvious thing to test.  The feature of being able to encrypt a backup is one of the major reasons I bought the product.  Well, thank you all the same for the quick reply.  I see why you have the MVP Volunteer title!

Regards,

Trub

Trub, hopefully we should see a new build version in the not too distant future for this issue and not need to wait for the next product version!

Regular Poster
Beiträge: 198
Kommentare: 120

Hi,

Has this been resolved? I have the newest ATI version 2019, build 14110 and the issue is still occuring for me.

Adam, this is resolved in ATI 2019 #14110 for me.

Please can you describe exactly what steps you are following that produce the issue that you are seeing?

Regular Poster
Beiträge: 198
Kommentare: 120

Steve, it seems like it works correctly now. Dunno if I typed that password before going to Recovery or something. Anyway, I confirm it does not occur anymore. Thanks.

Thanks for the feedback Adam.