2

I've already asked a question about ransomware on OS X in general. But I failed to get a response regarding whether FileVault protects against it. That is what this question is about. I'm also interested to know whether encrypted Time Machine backups are safe from ransomware.

Ransomware here is defined as malicious software that encrypts the user's data against their will/knowledge and demands a ransom in exchange for the encryption key.

We'll look at three examples:

  1. The malware is running without superuser privileges. The unwitting user may just have ran a compromised/malicious app that they believed was something else, and then let it run in the background for long enough to do damage.

  2. The malware is running with superuser privileges. The user, believing the software to be something else, has granted it root access by giving the root password. The user may even have installed the software by giving the root password.

  3. The user didn't run any app at all, the malware managed to run in some other way. (Is this even possible on OS X?)

In cases 1 and 2 the user would have turned off OS X's "trusted sources only" setting. (Side question: Is it at all possible to be affected by ransomware while this setting is on?)

Looking at 1., 2. and 3. separately, can the malware:

A: Access FileVault protected data?

B: Modify/Delete FileVault protected data?

C: (A combination of A and B) Encrypt FileVault protected data and overwrite (securely delete) the original FileVault data)?

Is there any difference between locally stored FileVault protected data, and encrypted Time Machine backups stored on another drive? I'm also interested in the answer regarding the latter.

Improve this question

2 Answers 2

Reset to default
2

Ransomware works by selecting certain files (normally by type - like docs, bitcoin wallets, etc), encrypting those individual files and forcing you to pay up for a key to decrypt them.

FileVault protects your data on your Mac by encrypting the whole disk. When you boot up your Mac, you put in a password that effectively "decrypts" the drive and allows it to run as-is. That said, once you've put the key in the lock, so to speak, FileVault wouldn't be protecting you from ransomware. You'd still be just as vulnerable as the ransomware would be running after FileVault had been unlocked.

As for the Time Machine backups, this is more complicated. Those backups are stored encrypted at rest, and only decrypted when they're accessed. This means the files inside the backups themselves would not be individually identifiable to ransomware that was running - however the entire backup could be. So the ransomware could encrypt the whole thing as a unit, instead of just the individual files.

As for OSX's "trusted sources" setting, there have been multiple exploits against this feature as of late and it's not as trustworthy as it seems. I couldn't say for certain it wouldn't protect you, but I wouldn't count on it.

I'd recommend some kind of cloud-based or off-computer backup if you really want to protect your data running through a third party application. In other words, don't connect to a network share and backup your data there, use an application to do it. It's unlikely that ransomware would be sophisticated and specific enough to know about specific backup applications, how they connect to their third party service, and how to encrypt the files on that service. Dropbox is a simple example here if you pay for their cloud backup service -- even if the ransomware did encrypt your files in Dropbox, they keep versions backed up so you'd have something to revert to.

Improve this answer
7
  • Great answer. In Windows, I've heard about ransomware entering through .doc and other non-executable files. Is that possible on OS X? Or does it have to be through an executable app?
    – Fiksdal
    Apr 13, 2016 at 16:04
  • Also, is it any different if the Time Machine backup is located in a Time Capsule, connected through WiFi but not physically connected to the Mac?
    – Fiksdal
    Apr 13, 2016 at 16:11
  • There's not really a good answer to that. I'd say it's less likely through a .doc in OSX because of the absence of things like vbscript in OSX, however anything that's opened by an application could potentially exploit a security weakness in that application and install something malicious. The best defense is to backup your data regularly to something that's complicated enough for an attacker to access. I also didn't mention - I use Arq for Mac to backup to Amazon S3. The likelyhood of ransomware wiggling its way into that I feel is very small.
    – Jimmy Mooney
    Apr 13, 2016 at 16:12
  • To answer your other question - I think OSX treats a time capsule Time Machine just like a local one so I don't think there's an advantage there one way or another. Encrypting them on TC keeps other users of that TC out of your stuff (since they potentially share a network) - but not ransomware.
    – Jimmy Mooney
    Apr 13, 2016 at 16:14
  • 1
    Wow - what an interesting situation I haven't thought of. Offline backups are certainly your friend. I might have multiple drives that I rotate out, if I had something so critical. maybe 7 drives, one for each day of the week. Therefore if something bad happens you have up to 7 days of backup, and up to 7 days to realize you're infected before you potentially impact your last backup.
    – Jimmy Mooney
    Apr 13, 2016 at 16:25
0

A macOS feature that can help against ransomware is System Integrity Protection (SIP). This feature is enable by default on new versions of macOS. SIP prevents changes to system files even if you are root. To disable this, you need to go into macOS Recovery (Reboot then Command + R) then select Utilities > Terminal. Once you are in Terminal, type csrutil disable. To check the status, csrutil status (you can check the status is macOS itself). To enable, csrutil enable (you need to be in macOS Recovery). Note that in macOS Catalina (10.15 and up), system files are stored in a separate APFS Ready Only so even if SIP is disabled, you can't write to system files.

Improve this answer
1
  • 1
    This doesn't answer the question being asked; it's about FileVault. Your first three sentences are correct, but I don't understand why you would describe how to disable the feature which at minimum, isn't being asked, and mostly, opens you up to a ton of threats. Please take a look at How to Answer for a guide on writing good answers.
    – Allan
    Mar 31, 2020 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .