Why backups might not save you from ransomware.
Hi everyone.
Leo Notenboom here for askleo.com.
So one of the things I talk about frequently, of course, is backing up, and the critically
important nature of making sure you've got yourself completely securely and regularly
backed up.
The other thing, of course it's coming across the radar a lot lately, is ransomware.
One of the things that we've been saying, basically since ransomware started, is that
ransomware, which for the record, is malware that encrypts the data on your machine holding
it ransom.
So that if you want to decrypted you must pay some kind of amount.
We been saying for a long time that the best protection against ransomware, which can effectively
turn it into a nonevent and inconvenience at worst, is to have backups.
If you suddenly have ransomware encrypting files on your machine then you basically restore
those files from backups to the state they were in before the ransomware happened.
There are of course complications, but these are all complications that can be overcome.
First pushback I keep getting whenever I say you do your automated backups leave your drive
connected yada yada, is that ransomware has started to encrypt backups.
In other words, you go through the process of backing up your machine as you should,
the backup image remains on a connected external drive.
Again in my opinion, as it should.
Ransomware comes along and of course it starts encrypting your data files on your C drive,
your primary drive.
But while it's at it, it actually goes out and encrypts your backups, so you can't use
them to recover.
Making ransom or paying the ransom the only potentially viable approach to getting your
files back again.
There are ways around this.
There are ways to prepare for this.
There are two.
Every once in a while at a schedule on your convenience.
Take one of those backups off-line.
Make sure it's inaccessible.
Don't disconnect your backup drive.
Backups protect you from so much more than just ransomware.
You want that to be happening automatically on a regular basis without having to think
about it.
What you want to think about is every once in a while making a copy of your backup, taking
it off-line.
So that if ransomware happens it doesn't encrypt something it can't connect to.
It can't access.
The other solution is use backup software that actually takes proactive steps to protect
against this.
Macrium Reflect is the only one I'm aware of.
Right now they have something called Image Guardian that basically uses Windows security
settings to make absolutely certain that nobody, including you or me, access those files without
going through Macrium Reflect.
In other words, the program does what it needs, starts backups or it updates them.
It creates them.
It deletes them when you run out of space.
Depending on how you got things configured.
But it's all automatic.
It's all handled by Macrium.
If you try to do anything outside of Macrium.
It doesn't work, including trying to encrypt files with ransomware.
That's actually the approach I prefer.
I’m using myself.
I have Macrium Reflect backing up my machine on a regular basis for just that reason.
And I have Image Guardian turned on, again to ensure that the backups should I ever have
malware that happens to be ransomware on my machine, the backups are preserved.
The other problem that people complain about, or at least raise as an issue is what happens
with cloud storage.
If a file in your OneDrive folder gets encrypted well OneDrive dutifully replicates that up
to your cloud and replicates it to the other machines so that all of the files on all of
the other machines all the different copies of the file are automatically encrypted and
held ransom.
OneDrive and Dropbox specifically and maybe some of the others have features built in
that sometimes detect a large number of files have been changed and "Oh by the way, if that
was ransomware would you like me to reset your entire OneDrive to the state it was in
before that happened?
In other words they're providing you a very easy to access backup of your files before
ransomware hit.
So backups are great.
Use them, create them, do them all the time.
And yet, as it turns out ransomware continues to evolve.
One of the ways that it's evolving involves not being able to restore from your backup
because what they're doing actually isn't backup related.
The scenario is this, you end up with malware that is ransomware on your machine.
In the past the malware would only encrypt your files and then hold them ransom.
What the malware is doing now is, before it encrypts your files, it takes a copy.
In other words, they slurped all the data that they can off of your machine and then
in addition to holding your encrypted files ransom, they say effectively.
"It sure would be a shame if your files happen to go public."
In other words they're holding them for ransom.
You pay the ransom and then they promise not to release those files publicly for you and
me as individuals.
This isn't really a huge new threat.
It's something that I wanted to at least mention as being out there, but it is something that
individual consumers rarely need to worry about What it is worth worrying about is if
you have a small or medium or even a large business because that's where the money is.
That's where ransomware authors are targeting.
They want the big data breaches from these companies.
They want to slurp up all that data and threaten to make it all public and hold that ransom.
Realize they don't even have to encrypt the files for that kind of ransom to apply.
They probably do just to make it more annoying and more likely that the business will pay
the ransom, but holding those files hostage and threatening to release what would otherwise
be private information into the public is what really motivates the ransomware authors
to create their ransomware, and hopefully from their perspective, is what motivates
people to pay up.
So what we do about this if backups aren't going to save us?
Well it's the same stuff we've been talking about for years now.
Literally, remember I keep using the word malware.
That is ransomware.
Ransomware is nothing more than malware.
It's malicious software.
It's a virus.
It's a Trojan.
It's a fishing attempt that that became successful.
So what you do to protect yourself from malware?
The same thing you do to protect yourself from any malware.
Keep things up-to-date, have properly configured security software in place and running.
Avoid risky behaviors online and don't fall for phishing attempts.
Don't open the unexplained attachment.
Don't click on the suspicious link, know what to look for, and know not to do those.
Those are the ways that most malware is arriving on machines these days, but like I said there's
nothing specific about about ransomware in that description.
These are the things you should already be doing to keep yourself safe as possible online
and absolutely no matter what.
Whether it's going to save you or not.
Keep backing up because I can guarantee you it will save you from something.
In fact, it's more likely that will eventually end up saving you from something that isn't
ransomware at all.
For updates, for links to related articles, for comments and more visit ask Leo.com/134173.
I'm Leo notenboom.
This is askleo.com thanks for watching.