Backing up to the Cloud

[Murray Foote]

Recently I realised that backing up to the Cloud can be viable - well, at least if you have an unlimited Plan, as I recently acquired in switching to iiNet.

I ended up writing quite a comprehensive review for the Canberra Photographic Society Blog.

[zafra52]

Thank you for sharing it. A sad fact we all have to be aware to prevent loosing our hard work.

[Murray Foote]

What also prompted it was a few months ago when my CPU died and also took out my RAID array. I discovered then that I had a few holes in my backups though I was able to recover most important files from laptop, backup SSD for that, and SD cards.

[Matt. K]

Welcome back Murray! You are a source of wisdom and inspiration! Please come by more often!

[Murray Foote]

Thanks heaps, Matt!

I would have replied yesterday but I changed my email and had to wait for Gary to reinstate me. Hopefully I'll get email notifications now.

[TonyT]

Very timely Murray, been looking at further backup, as the system I'am using is becoming habit of a chore.

[Murray Foote]

Thank you Tony. Once you get everything setup backing up to the cloud is pretty much set and forget.

[Matt. K]

I've been told that having an automatic backup to the cloud can be risky as quite a few people have experianced a ransomeware attack and when attempting to reclaim their data from the cloud have found that the virus had been uploaded to their files there also.

[zafra52]

That's a very good point, Matt.

[gstark]

I've been told that having an automatic backup to the cloud can be risky as quite a few people have experianced a ransomeware attack and when attempting to reclaim their data from the cloud have found that the virus had been uploaded to their files there also.

If you're backing up corrupted data, where you're putting the backup is a moot point; the damage has already been done.

[Murray Foote]

I've been thinking of adding a section on ransomware to the article. I think Cloud backup is actually a valuable protection against ransomware.

Norton is now supposed to be able to protect against WannaCry and so does Acronis's expensive Premium subscription option by preventing malicious changes to your Master Boot Record. Probably nothing can be 100% successful against new ransomware algorithms.

If you get hit by something like WannaCry, you're probably going to need to reimage your PC. If it has spread to your home network, you may need to reimage all the PCs on your home network that were turned on since the attack began. Then you need to restore files from backup.
If you have an online local backup, your backups are probably encrypted too (not merely the files they contain). Offline backups to hard disks may be OK but are are more likely to be out of date than your Cloud backup.

When you then restore files from the Cloud after reimaging, the danger is not reintroducing the ransomware Trojan, it is reinstalling encrypted files. So if this is a problem, you just need to restore files from a date earlier than when the attack started. You could take a few individual files and restore them from different dates to see what works. Most of your photographic directories are not going to have any file changes for some time in any case. CrashPlan shows you the size of individual files stored on the Cloud so you may be able to see when the attack affected a small file by a change in the file size.

If you then have your passwords stored only on the Cloud, including your CrashPlan password, CrashPlan support can help you reset it if you have the standard security level, but if you are using the higher security archive key or custom key settings, you will need to know that password. In any case, it may be as well if you are concerned about this scenario to have your passwords on a USB stick, a disconnected hard drive or a piece of paper.

(I will check with CrashPlan Support on the accuracy of what I have said.)

[zafra52]

I think you are spot on on this point:

If you get hit by something like WannaCry, you're probably going to need to reimage your PC. If it has spread to your home network, you may need to reimage all the PCs on your home network that were turned on since the attack began. Then you need to restore files from backup.

and also in all others you made. And, those backups are even more crucial if they relate to your business files - then daily backups and a backup system are crucial.

Thanks

[Murray Foote]

I have talked to both CrashPlan and Norton Support and present amended comments below. While what I said above was essentially correct, there is some additional detail and I will also incorporate these comments in the article.

...

Cloud backup can be a valuable way to protect against ransomware attacks. Typically you introduce the ransomware to your PC through clicking on an email attachment or a link. All your files may become encrypted and a message appear on your computer demanding a ransom. We have recently seen the explosion of the WannaCry ransomware. According to Wikipedia, over 230,000 computers in over 150 countries were infected within the first day.

Norton now protects against WannaCry and other known ransomware. Acronis's expensive Premium subscription option also does this by preventing malicious changes to your Master Boot Record and to your backup files. Probably nothing can be 100% successful against new ransomware algorithms. Received wisdom says it is not a good idea to have two competing antivirus solutions so running Acronis Premium as well as Norton (or Kaspersky or whatever) may not be a good idea. It is also important to have your operating system up to date.

If you get hit by something like WannaCry, you're probably going to need to reimage your PC. If it has spread to your home network, you may need to reimage all the PCs on your home network that were turned on since the attack began. Then you need to restore files from backup.
If you have an online local backup, your backups are probably encrypted too (not merely the files they contain). Offline backups to hard disks may be OK but are are more likely to be out of date than your Cloud backup.

The standard approach to Cloud backup with CrashPlan is that you back up data files (images, video, music, Word files, Excel files etc.) and not system files. So when you restore files from the Cloud after reimaging, the danger is not reintroducing the ransomware Trojan, it is reinstalling encrypted files. If you find this happens, you just need to restore files from a date earlier than when the attack started. CrashPlan will show you the files you have available to restore at a certain date in a directory structure, including the file names. So if you see encrypted file names, you need to go to an earlier backup and if you don't, they should be all right.

If the ransomware attack means you have lost your CrashPlan password and you have the standard security level, then CrashPlan support can help you reset it and you can access your backups. However, if you are using the higher security archive key or custom key settings, you will need to know that password or you won't get your files back. In any case, it may be as well to have your passwords on a USB stick, a disconnected hard drive or a piece of paper.