Hacker News Reader

Comment by amelius | Hacker News Reader

Question: my colleague has a Mac with a Timemachine and thinks he is safe for ransomware. Is that, in a practical sense, true?

View on HN

Absolutely not. Time Machine is just a SAMBA share with a nice UI on the client side. If the backup directory gets encrypted, all the versions of your files will also be encrypted.

There is a different opinion here:

https://discussions.apple.com/thread/8282686

Not sure what to make of it.

Is it possible to reach the server side of the Time Machine from the Mac itself? Has such a breach been demonstrated?

My Time Machine server doesn’t run an Apple OS. Someone would have to compromise my laptop and then pivot to separately attack my NAS. A state level actor could probably do that. The people running spray-and-pray ransomware ops almost surely couldn’t, or at least wouldn’t bother.

According to Darknet Diaries there are gangs that focus on backup server first, because with backups in place ransomware is not as effective. There are examples of backup software companies being compromised to get to their clients.

This is for attacks against bug companies. But maybe it's just a matter of time before "ordinary" ransomware is updated with destroy-backups function.

But to come back to the original question, is there any evidence against Apple Time Machine being secure?

Afaik, my colleague has a setup with regular Apple hardware and software.

I don’t know about timemachine but I have some anecdotal experience with Dropbox and ransomware. Essentially one person’s computer was infected which encrypted all the files for everyone in Dropbox. Because Dropbox had versioning on the files I was able to restore all the files back to the point before they were encrypted after removing and wiping the infected machines.

So if timemachine has versioning then maybe then you probably have some options, I’m not sure I’d call this being “safe” from ransomware.

Reply on news.ycombinator.com