I have all Apple products in my household, and am very security conscious. But the recent articles about ransomware infecting all sorts of computers got me thinking. Even if I was foolish enough to find a Mac ransomware program, download it, disable Sophos, disable SIP, and give said ransomware program my admin credentials, could it infect my iCloud Drive? I have regular hourly backups to my Time Machine so I am not worried about my data stored locally, but iCloud Drive items are stored on Apple's Servers as well as on my computer. So if ransomware encrypted all of my content in my iCloud Drive folder on my computer, would it update the files on the server, making recovery not possible?

For clarification, my questions are these:

  1. Does the iCloud Drive folder get backed up to my Time Machine?
  2. Does Apple make regular accessible backups of their user's content?
  3. Would the encrypted data be uploaded to iCloud replacing the old files on the server?

In short, yes, it is quite possible for ransomware to encrypt the contents of your iCloud Drive. It is possible for the ransomware to encrypt the data of your iCloud Drive, and then your computer would sync the changes to Apple's cloud, requiring decryption to access the data again.

To answer your questions:

  1. Probably. The iCloud Drive folder is stored locally on your computer in /YourUserName/Library/Mobile Documents. It would be getting backed up unless you have specifically told Time Machine to not back up this directory.

  2. No. Apple does not make backups of a user's iCloud Drive accessible. It is unclear if Apple even keeps copies of user's iCloud Drive, but they are most certainly not accessible to the users.

  3. Yes. If ransomware encrypts the files in the directory /YourUserName/Library/Mobile Documents then the changes would be applied to your iCloud Drive, rendering the information useless without decrypting the data.
  • I agree. However I'd take my hat off to the malware developers if they'd manage to infect all his hourly TM backups. I could be wrong... – EDP Mar 13 '16 at 3:23
  • The amount of coding require to encrypt one file or every file is one line of code. So encrypting every backup forget is not any more difficult than just the last backup. – user1048138 Mar 13 '16 at 4:19
  • Yes, I agree with you EDP. Theoretically the OP could just go back to his last non-encrypted TM backup and restore from that without issue. – aidanb.01 Mar 13 '16 at 12:13
  • TM drives (network or direct) are accessible just as regular drives are, and can be encrypted by the same ransomware. TM doesn't protect you against ransomware. It might help if the ransomware didn't get to it before you caught it out, but it's out of your hands. – hraban Dec 1 '17 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .