Hacker News Reader

Comment by rsync | Hacker News Reader

ZFS snapshots are immutable (read-only) for normal users.

So, if you had your data stored on a cloud storage platform that created and maintained ZFS snapshots, Mallory could gain all of the credentials and still not be able to touch your daily/weekly/monthly snapshots.

Now, if only there were a cloud backup platform that included zfs snapshots ...

View on HN

> ZFS snapshots are immutable (read-only) for normal users.

Unless you've given them "destroy" that is.

> Now, if only there were a cloud backup platform that included zfs snapshots ...

I see what you did there...

Yup, he's the guy behind https://www.rsync.net/

I wonder when ransomware will get smart enough to detect backups and insinuate themselves into them to foil the "just restore from backups" strategy.

Most likely they already do that if its on the same computer. Details aren't out yet, but I would guess the backups came from other computers.

There are many known cases of ransomware attacks that have deleted backup repositories.

They already do, I worked a case last week where that happened.

Trickbot for example will be on a machine for 2-5 months so that it's in your backups, and is commonly followed by Ryuk ransomware.

So if you get hit with Ryuk and just restore from backups without re-mediating anything you will likely be hit with Ryuk again.

Yes. They are often targeting IT providers of SMBs by phishing/otherwise compromising their credentials, and deleting backups before encrypting. It works sometimes, 2FA hygiene and secondary site redundancy are usually good enough to protect you.

2FA is so overrated. You can so easily do a sim swap to get access to a particular phone number and bypass 2FA.

The problem isn't with 2FA, the problem is with SMS-based 2FA.

True, and that's why you shouldn't use SMS 2FA. The unfortunate part is when that's the only method offered.

TOTP and HOTP 2FA are unbreakable and supported by literally everyone. Who still does SMS 2FA anymore?

Lots, unfortunately. With no way to opt out

If you inject the ransomware into a system that is subsequently backed up and wait a significant period of time, you could potentially lock all backups as they are restored. Then people have to decide between paying up or restoring to a time before the ransomware was injected.

I'm not sure if it's feasible to have ransomware lock backups as they're restored, however.

What if someone uses the credentials to file a support request in that platform asking the snapshots to be deleted?

Hopefully anyone with the ability to delete them would decline such a request.

So the platform would keep data against the wishes of the client? That doesn't sound good.

More like it would include a more elaborate, person to person process.

A better interpretation is that there might be multiple channels used for different identification purposes (a la 2-factor authentication) and the provider can ask for confirmation in a higher security channel. Whether this is done/feasible in practice is debatable.

Is ZFS really that popular in the enterprise? Amazon GovCloud is not that old and I doubt municipalities have switched to AWS. They might not have the same FedRamp requirements as federal agencies.

I don't know about the Enterprise, but Datto is a very popular backup appliance provider among small/medium businesses and some smaller municipal governments, which uses zfs snapshots as it's storage backend.

Datto is interesting. I suppose small to medium businesses and governments could just use off the shelf NAS products.

Reply on news.ycombinator.com