116
New ransomware wipes every file larger than 128 KB (mashable.com)
submitted 4 months ago by to c/technology@lemmy.world
18 comments fedilink hide all child comments
 

For larger files, the malware generates four of these codes. But due to a programming error, it keeps overwriting each new code with the previous one in the same slot, like writing four different combinations on a single sticky note and keeping only the last one. By the time it's done, three of the four codes are gone forever. The scrambled data they correspond to is permanently unreadable for the victim, security researchers, and the attackers themselves.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 4 months ago (1 child)

The “tested” part is really key. Until you have successfully restored from a backup, it is basically Schrödinger’s Data. Just an amorphous blob of data that may or may not be a good backup. So many companies set up backups to check an item off a list, and then never actually revisit it to confirm those backups are actually working.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 4 months ago

    It isn't that key - most backups do work. Backup program creators test that everything works. and there are consultants who can help restore - for a price - in an emergency.

    However if you want to restore fast you better have tested the process recently - all the staff needs to have experience in what to do.

    If you want to be 100% sure you got everything backed up you need to do a real test as well. That means you regularly tell everyone no working this weekend, leave your computer behind - when you return it will be wiped to factory and restored from backup. I don't think anyone does this.

  • permalink
  • fedilink
  • source
  • parent