How useful is Backup against Ransomware

[bob123]

Cloud-Based Backup creates copies of all your files

I would definitely not upload wallets to cloud storage, that's like the opposite of cold storage.

I'm sort of undecided on this one. If you have a fully encrypted backup, then sure upload it to the clous (by fully encrypted I mean assymetrically encrypted using a public key-private key pair that is at least the strength of encryption system Bitcoin is based upon - the file is generally a few megabytes in size at most).

Encrypting the file asymmetrically would require a way larger key compared to encrypting it symmetrically.
The advantage of asymmetric encryption is the solution of the key exchange. It doesn't need one. But if you are only encrypting it as a backup for your own, using symmetric encryption is favorable.
Asymmetric keys have to be 10 (or more!) times larger than symmetric keys to have an equal bit strength.

Theoretically, a proper encrypted file with a key which is long enough to be considered safe should be absolutely fine. Even stored offline.
But the devil is in the detail. You have to rely on the software you use to encrypt the data to be correctly implemented (e.g. entropy).

In case of a data leak (on the cloud provider side) AND an incorrectly implemented algorithm, your keys are at risk. This scenario is pretty unlikely. But it should be considered nevertheless.

[1715107194]

1715107194

[1715107194]

1715107194

[1715107194]

1715107194

[1715107194]

1715107194

[jackg]

Encrypting the file asymmetrically would require a way larger key compared to encrypting it symmetrically.
The advantage of asymmetric encryption is the solution of the key exchange. It doesn't need one. But if you are only encrypting it as a backup for your own, using symmetric encryption is favorable.
Asymmetric keys have to be 10 (or more!) times larger than symmetric keys to have an equal bit strength.

Theoretically, a proper encrypted file with a key which is long enough to be considered safe should be absolutely fine. Even stored offline.
But the devil is in the detail. You have to rely on the software you use to encrypt the data to be correctly implemented (e.g. entropy).

In case of a data leak (on the cloud provider side) AND an incorrectly implemented algorithm, your keys are at risk. This scenario is pretty unlikely. But it should be considered nevertheless.

It is a fairly tiny file though in comparison to some backups if you get everything to be a gigabyte in size then it's not too much of an issue.
The idea with assymatry is that you can keep a unencrypted copy of the public key on your computer and then easily find the private key by putting it into an electrum client on an offline computer for example so you know the exact key (especially if there are multiple wallet files you're trying to back up)...

Symmetric encryption also works but you might have to keep reusing private keys or get stuck remembering which you used for which file.

[Thirdspace]

~
If your drive is plugged in and mounted the ransomware will simply also encrypt the backup.

Quite a few people seem to forget about this point
Keeping the backup drive plugged in is always a bad idea (e.g. ransomware, lightning strike, .. ).

Not really, Backup wont help much against the ransomware virus as they block the system altogether.

@UKUSA22 if you have your backup (attached) in the same system, then you have done it wrong
backup really does help against ransomware as long as you are doing it properly
bob123 is correct, always detach your backup drive off the main system
btw, I heard there's a ransomware variant that makes the drive unformattable, any true to that?

[jackg]

Not really, Backup wont help much against the ransomware virus as they block the system altogether.

We're discussing cloud backups? So you'd use a service that offer the avaliability of backups which will keep the data more secure (hopefully) or at least keep another copy you can rely upon, care must then be taken when encrypting the file.

[Kakmakr]

My best practice is to do incremental backups, where previous backups are not being over-written by newer data that are added later. I also keep a hard copy of previous backups, separate from newer backups to stop cross infection.

You need to keep the copies of your backups as total separate copies. Once you access previous copies, those backups can be infected too. So only use copies of original backups, when you do the restore. <not the originals>

The cost of the backups might be more, but the re-installation will not be from infected originals that are being overwritten over and over again. 

[bob123]

btw, I heard there's a ransomware variant that makes the drive unformattable, any true to that?

Making a hard drive unformattable per se is not possible. Especially not on a software level.
With root access on a machine, you have full control over the hardware. Formatting is always a possibility.

But malware could theoretically flash the firmware of a hard drive to make it unusable.
This damage can still be repaired by a person with enough understanding, but most probably this would result in replacing the hard drive because of failure.
Especially since such a damage would be non-standard and probably more costly to let it fix by IT repair services, than to simply buy a new one.

[seoincorporation]

What are your practices to ensure a safe data keeping including all of your wallets (not talking about normal malware which can redirect your copy paste BTC address to another one) but I am talking in a situation where all your data is locked from a Ransomware. In case you did a backup every week of the entire image disk, the only thing you would lose is a week of data. Of course keep the image recovery in an external hard drive.

Any better security practices against Ransomware ?

The backups are important, not only to save your ass from a ransomware, there are one hundred ways your pc can get fucked up, Ransomware is just one of those ways. But i'm here with a solution for you.

Use Linux and avoid Ransomware, you can have a pc with half disk on linux and half disk on windows, that way of you are doing some job stuff you can use windows, and if you want to navigate on the web or do something 'risky' then you can use linux. Good security practices are the way to avoid all kind of viruses...