I've been reading about ransomware and how it can infect not only the main drives but also backup drives if they're connected to the network, and that Linux, although more secure than Windows, is not 100% risk-free from infection.

I've developed a daily habit of doing backups to an external USB drive, so I' can recover quickly if I need to reimage my system. However, my backup is mounted to my system at boot and continuously accessible, and I'm concerned about my backups become infected or not accessible.

I'm wondering if clearing the write bit on all directories and files on my backup drive is an adequate level of security, should some malware get on my computer. I created the aliases in .bashrc

backup-protect="chmod -R ugo-w ${HOME}/Backup"

backup-unprotect="chmod -R u+w ${HOME}/Backup"

I only enable writes for user as I don't want anyone else to have access, anyway.

I would then run "backup-unprotect" before doing a backup, or if I need to recover, and run "backup-protect" after the backup or recover is complete. Is this adequate from a security perspective?

  • It'll only protect you from malware that isn't coded to enable write mode first (or use elevated privileges; ie. I sure wouldn't rely on it). Your backup devices should not be mounted if you want them 'protected' – guiverc May 12 at 4:48

Your proposal is not really secure, and will only protect against simple/non-complex malware.

First and foremost, the write bit is less a "security" feature for the owner of the file than it is an "accident prevention" measure. If you're the owner of the file, you can edit permissions freely. As any malware on your system will (probably) first run as your own user, it would be trivial for it to attempt to gain write permissions to the backup directory.

Furthermore, the root user can still write to the file if it wants. It can further change permissions if it wants. As a lot of malware tries to escalate to a root user (for obvious reasons), your write bit won't do much.

However, there's something else to take in to consideration: malware trying to delete your backups won't do it file by file and/or overwrite it with "lol get pwned k3d". It will instead opt to format the drive, which is a rather simple command. The benefit to formatting or overwriting the drive itself is that it doesn't matter if the drive is mounted or not - as long as the drive is plugged into the computer, it will expose a /dev/sdX interface. Regardless of the mount state, malware can (well, if root) start dumping zeros into that file.

If you truly want to keep your backups secure, you're going to have to give up some convenience and actually unplug your backup drive. Besides, offline backups are generally considered "best practice" anyways.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.