News for hackers. Stuff that matters.

A comment on QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack. Parent comment

Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by srfilipek on Friday July 19, 2019 @01:37PM (#20480774)
I use FreeNAS (FreeBSD NAS with ZFS). The ZFS snapshotting feature effectively gives me protections from this type of issue.

My home computers push backups regularly throughout the day, and every day I create snapshots of each volume (how long to keep the snapshots is another question). This snapshot can only be accessed or managed on the NAS itself.

This effectively creates an append-only backup NAS thanks to the periodic snapshots.

[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by geoka9 on Friday July 19, 2019 @01:53PM (#20480911)
Do those snapshots somehow benefit from the incremental nature of daily backups?
[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by corwin7 on Friday July 19, 2019 @01:58PM (#20480956)
Yes, ZFS snapshots only contain data that changed. ZFS is very efficient, elegant, and reliable.
[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by jacobgreenleaf on Friday July 19, 2019 @04:23PM (#20482119)
To be more precise, ZFS snapshots are mostly just a timestamp reference, similar to how a git commit is just a reference to a git object. Writes don't change the value of the files in the snapshot because they're stored in new places rather than overwriting the existing files on disk.

https://blogs.oracle.com/ahrens/is-it-magic

[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by geoka9 on Friday July 19, 2019 @02:03PM (#20481006)
Even with ZFS deduplication off?
[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by srfilipek on Friday July 19, 2019 @02:05PM (#20481023)
Yes.
[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by CrazyMusicians on Friday July 19, 2019 @03:10PM (#20481583)
These are all good ideas. It seems to me part of the problem with these ransom attacks is the intruders aren't pouncing the minute they get inside the victim's network. They take their time, figure out where everything is (including backups) and then only force-spread the ransom malware after they have staged everything just-so.
[ Parent | on HN ]
Re:QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware At... by jhgorrell on Friday July 19, 2019 @06:03PM (#20482826)
yes - new writes consume space.

https://docs.oracle.com/cd/E23824_01/html/821-1448/gbciq.htm...

[ Parent | on HN ]