> ZFS snapshots are immutable (read-only) for normal users.

Unless you've given them "destroy" that is.

> Now, if only there were a cloud backup platform that included zfs snapshots ...

I see what you did there...

Yup, he's the guy behind https://www.rsync.net/

I wonder when ransomware will get smart enough to detect backups and insinuate themselves into them to foil the "just restore from backups" strategy.

Yes. They are often targeting IT providers of SMBs by phishing/otherwise compromising their credentials, and deleting backups before encrypting. It works sometimes, 2FA hygiene and secondary site redundancy are usually good enough to protect you.

If you inject the ransomware into a system that is subsequently backed up and wait a significant period of time, you could potentially lock all backups as they are restored. Then people have to decide between paying up or restoring to a time before the ransomware was injected.

I'm not sure if it's feasible to have ransomware lock backups as they're restored, however.

2FA is so overrated. You can so easily do a sim swap to get access to a particular phone number and bypass 2FA.

The problem isn't with 2FA, the problem is with SMS-based 2FA.

True, and that's why you shouldn't use SMS 2FA. The unfortunate part is when that's the only method offered.

TOTP and HOTP 2FA are unbreakable and supported by literally everyone. Who still does SMS 2FA anymore?

Lots, unfortunately. With no way to opt out

They already do, I worked a case last week where that happened.

Trickbot for example will be on a machine for 2-5 months so that it's in your backups, and is commonly followed by Ryuk ransomware.

So if you get hit with Ryuk and just restore from backups without re-mediating anything you will likely be hit with Ryuk again.

Most likely they already do that if its on the same computer. Details aren't out yet, but I would guess the backups came from other computers.

There are many known cases of ransomware attacks that have deleted backup repositories.

What if someone uses the credentials to file a support request in that platform asking the snapshots to be deleted?

Hopefully anyone with the ability to delete them would decline such a request.

So the platform would keep data against the wishes of the client? That doesn't sound good.

A better interpretation is that there might be multiple channels used for different identification purposes (a la 2-factor authentication) and the provider can ask for confirmation in a higher security channel. Whether this is done/feasible in practice is debatable.

More like it would include a more elaborate, person to person process.

Is ZFS really that popular in the enterprise? Amazon GovCloud is not that old and I doubt municipalities have switched to AWS. They might not have the same FedRamp requirements as federal agencies.

I don't know about the Enterprise, but Datto is a very popular backup appliance provider among small/medium businesses and some smaller municipal governments, which uses zfs snapshots as it's storage backend.

Datto is interesting. I suppose small to medium businesses and governments could just use off the shelf NAS products.