Ransomware

Jnix,

The answer is YES, your backup files could also be locked by ransomeware.  Read this http://www.cnet.com/forums/discussions/can-my-backup-hard-drives-be-affected-by-ransomware/.  I know Malwarebytes has a new beta anti-ransomeware you might want to look into https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/

Jnix,

If your external hard drive is connected, then it is possible for ransomeware to encrypt or corrupt your ATI files.

There are some precautions you can take to prevent this... 

If your USB hard disk is only used to store backup files, then disconnect the USB drive, unless you are performing a backup.

You can also set up a separate Admin account for admin duties and running ATI.  Create a folder on the USB drive and set permissions so the admin account is the only account that has write permissions on the folder.  Then use another account for normal computer use such as e-mail, surfing, or blogging.

Regards,

FtrPilot

All good and valid suggestions!

I also take an offline backup on occassion with a dedicated USB hard drive that is only plugged in for offline backup and offline restores that are completely outside of Windows .  In the event of malware or ransomware, I can wipe the drive in an external clone dock (just in case), then restore with this dedicated USB drive and offline images if/when necessary.

There is an alternate way to protect your backups.

I use TI 2014 (due to TI 2016 not having good credential management..... not sure if this has been fixed yet?)

I back up to a NAS with a share that is only accessible to a specific user (not my windows user account)

I setup a simple script - power on PC and NAS

TI 2014 uses the credentials to access the NAS backup share, performs backup and then shuts down.

It's not foolproof (once TI accesses the share it will remain accessible for the remainder of that session). It is safer than having the backup share open and vulnerable at all times.

I also have a periodic backup.

Ext HDD is different I know but maybe something similar is possible with folder security settings?

I did a simple edit on my data backup job to try and address the ransomware issue on local backups. I think I gained a certain measure of additional safety from this threat. Here it is:

As a scheduled local backup obviously needs a connected hard drive, I thought that this hard drive could be offline and also set to read only (since it's free :) until Acronis is in need of accessing it.  A nasty caveat is that if the malware happens to be running at the same time as the job, the backup will also be encrypted. Since my backup schedule is once a week, chances are that I will realize the ransoware situation before the malware (or the sheduled job) overwrites my files with encrypted data. Incremental backups and versioning also helps, as Acronis itself will not overwrite old backups with encrypted data but rather append to them (which will be quite long, big and very noticeable, unlike a sneaky malware running silently in the background.

Lastly, I also physically connect a third hard drive that mirrors the backup, in case of catastrophic event, like a backup being overwritten with corrupted data. I don't mirror more that once every few months, as I want to avoid overwriting good data with silently corrupted one.

Pre/post commands are used to invoke a script (diskpart for windows Xp-10) that will put the disk ONLINE and reset the read only flag before backup begins and toggle them back when job done.

I just tested it in True image 2016, up to date as of may 2016 and it works a treat. Minor inconvenience is that the program will not list the offline disk whenever it needs to ask for a destination, for instance at job creation. Keying in the drive letter does the trick.

Any idea for improvement or even a method besting this one is welcome here :)

Roger,

Welcome to the forum. You have obviously done your research and devised a plan...and thanks for sharing.

Regards,
FtrPilot

Thanks:)

I must say that this ransomware thing is scary and it gets easier every day to get taken, even as a security conscious geek. I feel for the not security-conscious-not-geek. Hopefully a few free tricks in the forums will provide some peace of mind.

Now that I think of it, just posting this will probably get the bandits to have the idea of scanning for offline disks and reset them on the fly. I suppose we really need to start using non root accounts and leave UAC on. From now on, sudo everything in Windows... Oh my ...