Hacker News Reader

Comment by nicoburns | Hacker News Reader

> Gangs also have begun encrypting backup systems, including cloud storage services such as Office 365 and Drop-box. Although 56% of the firms surveyed by Sophos regained control of their data through backups, that window appears to be closing. "[Cybergangs] have realized that the ransom demand becomes powerless if you have a full backup set in place and you can revert to it,"

This is why our backups at work write to a storage bucket with permissions such that they can create new files but not delete old ones. I'd definitely recommend this approach to everyone who can afford the storage space.

View on HN

I want this on a simpler scale: an external drive that has a physical switch. In normal operation the switch is in "append only" mode and the drive ensures that nothing can be erased. Only when the switch is temporarily hit to a "unsafe" mode would it allow deleting to make more space. I don't know how easy or difficult this would be (I assume external drives don't typically know about filesystem-level information like this), but it would be a nice product for people with simpler needs than yours. If the backup system can write only incremental changes then the storage requirements would likely be fine for many users.

Yep, not a new concept-

https://en.wikipedia.org/wiki/Write_once_read_many

There are USB drives that do vaguely similar things but it's all in software. It's difficult to do that unless the filesystem has append only functionality, metadata blocks are rewritten all the time even if data isn't.

For anyone who has serious (I.e. $$$) need of that they already have tapes and optical WORM media though.

You can do something conceptually similar with any sort of NAS that provides immutable snapshots as long as the management and control is effectively out of band.

The out of band part is the key. Our SAN data has snapshots. The backups are written to another storage device that only has an API key to write them to B2 storage. An attacker would effectively need to completely compromise multiple admins in the organization to get at all the stages of data duplication, and frankly there is no additional line of defense for total compromise if the attacker is willing to wait for physical tape or disk swaps.

Fortunately for ransomware, time is money for them too.

Are there any NAS devices with out-of-band management actually available, though?

Spin up a FreeBSD box, enable ZFS snapshots and disable SSH? You’d only be able to destroy the snapshots from a monitor and keyboard under normal circumstances.

Well, yeah. I was more asking "does somebody make such a thing purpose-built?"

> There are USB drives that do vaguely similar things but it's all in software.

Sigh. When are people going to accept that software switches are inherently not secure? How many times must these fail?

> It's difficult to do that unless the filesystem has append only functionality, metadata blocks are rewritten all the time even if data isn't.

There's no reason to continue writing anything to a hard drive once the backup to it is finished.

A software switch might as well not exist at all. They are not secure, or useful, because they can just be ignored by the host machine.

GDPR may require active online systems to delete data in response to a stream of realtime requests, so while the availability solution is to make deletion a hard, manual process or a process controlled only by an isolated infrastructure team, as you automate GDPR deletion requests you will need to start exposing deletion APIs accessible to end users. This is why a lot of the comments about making read-only backups or offline backups are very challenging for firms to do if they are taking GDPR seriously.

> with permissions

Even more secure would be hardware write only storage. CD-ROMs fit in this category, but they aren't big enough.

But all we need are hard disk drives with a physical write-enable switch. Turn it on, write your backup, turn it off. No software can then alter it.

A stupidly simple idea, and yet every time I mention it in HN it gets dismissed, denigrated, etc. Apparently people like malware, ransomware, etc. :-(

Perhaps, but I once had two hard drives die on me within the space of a few days (different brands), and since then I like to have a copy of my data in the cloud somewhere. Non-writeable doesn't help much if you can't read it either!

I've had many hard drives fail on me over the decades, and keep multiple backups. Keep in mind your cloud storage service can go dark any time for any reason.

This is one reason I still do manual backups as well as automated backups. The manual backup is to HDDs that sit on a shelf, offline, unplugged.

Yeah, but to read the backup you've got to attach it to your compromised system. Boom, it's corrupted.

A physical read-only switch is required.

Booting to a Live USB/DVD/CD and then doing the backup while in the booted Live OS would minimize the chances of corruption of the backup, either reading from it or writing to it.

Not ironclad but pretty good. Issues with it that first come to mind are the live operating system image was already compromised when it was written to say the USB disk, or compromised firmware, and of course user error (nothing to do with ransomware in this case). I am not familiar with this stuff so I may be missing something very important, if so tell me about it.

There are USB to SATA controllers that default to read only - typically used for forensics reasons. About $250 if I remember correctly.

A physical switch costs what, a nickel?

Just think of all the security issues that would just go away with physical write-enable switches.

Heck, I'd go further, and demand from disk makers a physical write enable switch for a separate volume. Use that volume for the system software.

Similar, rsync.net has historical ZFS snapshots that only cost the diff of the files.

hopefully the cost of reverting full diff (which would be the result of a ransomware attack) won't obliterate the subscription tier a victim is on. the ransom cost might be cheaper!

Reply on news.ycombinator.com