I've already asked a question about ransomware on OS X in general. But I failed to get a response regarding whether FileVault protects against it. That is what this question is about. I'm also interested to know whether encrypted Time Machine backups are safe from ransomware.
Ransomware here is defined as malicious software that encrypts the user's data against their will/knowledge and demands a ransom in exchange for the encryption key.
We'll look at three examples:
The malware is running without superuser privileges. The unwitting user may just have ran a compromised/malicious app that they believed was something else, and then let it run in the background for long enough to do damage.
The malware is running with superuser privileges. The user, believing the software to be something else, has granted it root access by giving the root password. The user may even have installed the software by giving the root password.
The user didn't run any app at all, the malware managed to run in some other way. (Is this even possible on OS X?)
In cases 1 and 2 the user would have turned off OS X's "trusted sources only" setting. (Side question: Is it at all possible to be affected by ransomware while this setting is on?)
Looking at 1., 2. and 3. separately, can the malware:
A: Access FileVault protected data?
B: Modify/Delete FileVault protected data?
C: (A combination of A and B) Encrypt FileVault protected data and overwrite (securely delete) the original FileVault data)?
Is there any difference between locally stored FileVault protected data, and encrypted Time Machine backups stored on another drive? I'm also interested in the answer regarding the latter.