Does Secure Zone defeat latest malware?

Thread needs solution
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Forum Member
Posts: 16
Comments: 26

Hi Forum Members,

There a lot of discussion about a recent malware. Here's one link on the subject:
http://bit.ly/HMJsTo

I've purposely not mentioned the name of the malware in this post to hopefully deter the perpetrators from benefiting from this discussion. I propose that replies to this post also refer to it simply as the "malware".

Question: If backups were created with a password, would placing the backups in the Secure Zone prevent this malware from touching those backups?

I look forward to your thoughts and comments.

Regards,
Bret

Thu, 07/19/2012 - 16:15
0 Users found this helpful
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Forum Star
Posts: 27
Comments: 1940

It doesn't matter if these backups are password-protected (according to its description, this malware just deletes all .tib files) but as backups on ASZ are not accessible as a part of file system, it should not delete them. Unless it starts to mount all volumes without letter and probe them.

Thu, 07/26/2012 - 04:59
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Forum Member
Posts: 16
Comments: 26

Thank you for the reply dev-anon. Here's a heads-up if anyone's interested:

I ran a test on a USB attached disk as follows:
Created a Secure Zone.
Put some files in the SZ (ie. a 40MB File Backup with password).
Using a common disk manager/editor, I was able to change the SZ partition type from 0xBC to 0x0B (FAT32 LBA).
With no reboot required, I was then able to see/copy/open (with password)/ and yes, delete the tib file in the SC via Windows Explorer.

Upshot: Nothing's sacred anymore. Since the backup is password protected, someone/something wouldn't be able to examine the backup's contents, but they/it would be able to delete it or further tamper with it.

An afterthought: If someone can get access to the console (ie. physical, RDP/etc) because of weak passwords, it's going to be hard to keep them from doing damage. Only bullet-proof solution I can think of right now, is to physically unplug the backup drives and secure them off-site when not in use. A better idea is frequent rotation off-site (at last weekly or better yet daily) of at least two backup drives. That would help reduce the pain if the on-site drives were erased or tampered with. Perhaps someone else has a better idea ?

Regards,
Bret

P.S. Here's a related KB: http://forum.acronis.com/forum/18154

Thu, 07/26/2012 - 17:32