Feasibility of RPi as fileserver to avoid ransomware?

[#1]

---

@Anonymous wrote:

The only way that would happen is if the exploit could ‘talk’ FTP or the extended HTTP protocol of WebDav. These are protocols remember so in order to get a file from FTP they’d either need to know the name or do a LISTing parse it and request the files or MGET all the files only to MPUT them back after encryption, and the assumes they can get your login credentials. So I suspect you’d be save with either. But of course the same caveat as noted before still applies.

---

But you yourself also said that malware does mutate and gain new abilities.. so even FTP and WebDav aren't completely safe (though i think it's safe to assume most malware authors probably won't bother with this in the belief that the percentage of FTP or WD users will be very low).

Anyway I think i'm going to roll with the RPi idea at least on a trial basis and see if i can get WD working on it and then access it via windows explorer like you can with cPanel.

I've also been mulling over a RPi chain of backups... EG.. the main files are kept on one machine... once a day (eg 3am) another RPi will then initiate a backup and "pull" the predecessors files off that first device and keep a copy. Then another daisy chained device will do the same.. and so on. Each one having no write access to any other but the ability to read. Trouble is that ain't cheap either! lol

[#2]

You're really just making a larger attack surface if you are planning on accessing the RPi over SMB(445/139). Your windows account will have read/write access and if you get infected with ransomware or any other malware which spreads over SMB, the RPi will be impacted all the same. 

I'd say un-mounting the share when not in use would help but if the malware has the ability to scan the network it will find it anyway. 

If the objective is create something more secure against anything which might come out in the future then off line back ups will always be the best option. There is a way to turn the Pi in to a web drop box, that might be more suitable. 

[#3]

Even off-line backups can be hit though. If the malware is already in the network and has got onto the machine performing the backup..

At least over an SMB / network connection the malware won't have direct access to the file tables on the disk(s) although it will have slower access to the files themselves.

As mentioned earlier, I'll also doubt many malware authors bother to include web dav in their creations..

[#4]

There is another option and that is to write your backup to what becomes RO media, i.e. CD, DVD or BlueRay. Maintaining it and cataloguing it would be an interesting task, maybe even a chore, but once the archive is written and finalised its permanent no matter what the malware authors come up with.

With a bit of thought you could script your archiver to prompt for media, write the data, then eject it automatically.

[#5]

Try RPi running rsync - this will only transfer changed data, which will speed things up.

If you unmount your backups after use then they will be completely safe.

I understand that the RPi supports LVM, so you could have a big disk and a large number of Logical Volumes.
I use this to do full backups of several PC's onto a single hard disk.
LVM is a bit complicated though.

[#6]

Read Only media?  Maybe it might still be possible to corrupt the MFT?  But if the data files are written contiguously to the media then it ought to be straightforward tor recover the files even if the MFT were absent.  Are all files written to  CD/DVD/etc contiguous?

[#7]

There's a new feature being introduced to Windows - Controlled folder access in Windows Defender Antivirus:

In this build, we’re making it easier for you to protect valuable data from malicious apps and threats, such as ransomware. To enable the feature, search for and open the Windows Defender Security Center from Start, go to the Virus & threat protection settings section, and set the switch to On:

It's available in the latest Insider Preview build (16232.1000) and the full release notes can be found here.

[#8]

@ReedRichards, if the MFT stream has been compromised then the archive would contain the content of the contaminated stream, and any recovery would still produce corrupt results, so the layout order of the media is academic at this point.

But to answer your question then yes writes are contiguous as far as I am aware. Well as contiguous as block size will allow.

[#9]

---

@Anonymous wrote:

There is another option and that is to write your backup to what becomes RO media, i.e. CD, DVD or BlueRay. Maintaining it and cataloguing it would be an interesting task, maybe even a chore, but once the archive is written and finalised its permanent no matter what the malware authors come up with.

With a bit of thought you could script your archiver to prompt for media, write the data, then eject it automatically.

---

Yes I agree, that's my thinking too. It is a pain, as you will have to keep backups up to date. For the cost of CD's/DVD's and even Blu Rays I would burn a couple of copies and leave some at mine, and some at my parents. Do it every week, for example and the worst case is you've lost a weeks worth of data, better than losing years worth.

Anything in the meantime which is important e-mail it to yourself, or photos leave on the memory card until you have backed them up. For me, it is the stuff personal you can't replace, and download elsewhere.

I tried an on-line backup company which worked for a few months, then sent me an e-mail saying "We are not an archiving company" (err.. actually I think you are). Then my files disappeared. I was paying them per year and the account was in order. So I sent them a strong worded message to cancel. They ignored me.

Lession I learnt is don't just assume an on-line backup company will be adept. Irony is as a backup use physical media too.

[#10]

@Anonymous, I am remembering my experience of trying to recover files where the MFT has been damaged (because one or more of its sectors has gone bad) or files have been permanently deleted or a partition removed.  File recovery software can often achieve quite good results but large files like photographs can have a poor recovery rate, which I think is because they are frequently not stored contiguously.  I believe non-contiguous files can be difficult to piece together again without the necessary information from the MFT.  

I am not aware of any OS where you can force data to be written contiguously but if it happens 'naturally' then it might aid file recovery, when needed.

[#11]

So you actually mean FAT or MBR then so MFT does not mean Managed File Transfer then?

It certainly can be done. You can do it yourself but you need to reserve the space on the device first and of course have a way of knowing where the files starts and ends.

[#12]

MFT = Master File Table

[#13]

Ah! A Windowsism, that explains a lot.

[#14]

MFT = Index - effectively; the thing that tells the computer where each file is located on the storage medium.  I looked it up and it seems the term Master File Table is specific to the NTFS file system but all file systems must surely have something equivalent, whatever the OS.

[#15]

I did the same search myself when the ? appeared above my head earlier, hence my reference to Microsoft.

Every OS does have an equivalent, but it's layout, name etc, can be dependent on the file system used.