Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why assume that no-one who ever got caught by ransomware had any backups? As far as I know, the way most ransomware works is that it not only encrypts your entire drive, but also any network drives it has access to, any external drives, and so on. It's quite possible someone with a backup regiment was still affected because they left a link to their backup system open, encrypting that as well. I think most people mainly care about backups being off-site, not them being "de-linked" and unaccessible.


> I think most people mainly care about backups being off-site, not them being "de-linked" and unaccessible.

Then they don't understand backups - what's the use of backups if rm -rf / erases them as well because they're permanently mounted at /srv/backup?


Good point.

I would format any disk that has had ransomware on it before I did anything else (like plug in the usb drive with my backup). In the meantime use another PC to access the files.

However yes it is probably worth having 2 backups for this reason, just incase you get caught short.


This should remind you that a safe backup should be pulled from the backup server. Alternatively you keep an incremental backup on your server and give other computers limited privileges (they shouldn't have write access to snapshots).


Do your backups to DVD and you're guaranteed ransomeware can't touch them.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: