Is Dropbox a safe haven from ransomware?

https://www.dropbox.com/help/400

https://www.dropbox.com/help/296

https://www.dropbox.com/help/11

1) If you have files in your local Dropbox folder they would become encrypted as well. If you then have the Dropbox software running, those files would then sync to the cloud and any other devices you have.

2) No place is safe once you're infected with ransomware. If the files are on your system they can be encrypted regardless of which service you're using.

3) See here:

Andrew J.3

1) In case of ransomware encryption, are all--even older versions of--files encrypted. In other words, would there be an unencrypted backup version of my files on Dropbox from which I could restore even if some files had only the one version I originally stored on Dropbox? I'm trying to distinguish between frequently updated files where a recent version change has taken place (as I assume the instructions at https://www.dropbox.com/help/11 refer to), and static files that have not been updated in a long time.

2) is Dropbox working on a defense strategy against ransomware encryption?

Thanks for your advice.

1) When a file becomes encrypted and is synced to Dropbox, it is synced as a change, so the previous unencrypted version would be available for recovery.

2) If I had to guess, probably not, and it's not really their responsibility to do so (IMHO). Dropbox provides a file sync service; nothing more. Any antivirus, anti-malware, etc., is the responsibility of the end user. Protect your system and you won't have to worry about it.

It seems that if you pay for the Pro version they should provide protection against ransomware encryption.

It does look like the "extended version history" option may cover you in case of ransomware because all versions of files are kept for 1 year without counting toward your quota, but this option obviously adds a lot to the cost.

It seems that if you pay for the Pro version they should provide protection against ransomware encryption.

How? Dropbox can't see that the files are encrypted (files uploaded to Dropbox are split into 4MB chunks), and even if it could, how could it differentiate between those encrypted by ransomware and those purposefully encrypted by the user?

Simply put, the security of your computer and the data stored on it is your responsibility. There are ways to protect your system from ransomware. Use them.

One option that comes to mind would be if Dropbox detects all files on the entire accoint have suddenly changed at once they could keep a backup of the old files for a week and notify the user of the suspicious activity. If the cost of this gives you heartache then they could add it as an option for an additional fee.

Dropbox already keeps all files for a period of 30 days, no extra costs involved, and you can request a rollback of your account to a point prior to the infection. An option for one year of recovery does cost extra, as you mentioned previously.

https://www.dropbox.com/help/8408

Steve R.15

Oh cool, I didn't know that. They should just add a notification for suspicious activity (ie: all files were changed within an hour or 2) with a prompt to roll back your files/quarantine the encrypted ones for 30 days if desired. I may have to upgrade to Pro to protect my photos, Dropbox camera upload works so well!

(I missed the comment you had above Rich where you said "so the previous unencrypted version would be available for recovery")

They should just add a notification for suspicious activity (ie: all files were changed within an hour

When a crypto attack takes place, the files are usually renamed. Dropbox sees this as a delete and an add (original file is deleted and the encrypted version is added). When it sees that a large number of files have been deleted it will send you an email notification, assuming you have that option enabled on your Account page. Look for the Email notifications section on the bottom left.

"Simply put, the security of your computer and the data stored on it is your responsibility. There are ways to protect your system from ransomware. Use them."

My computer is a Mac. It's immune from ransomeware. All of the files in my Dropbox folder were overwritten as .ecc files and since the folder was cold-storage I didn't notice it until after 30 days so I'm screwed.

My computer wasn't infected because it's immune. The infection must have occurred on Dropbox's servers which then overwrote my files. I was responsible for my own computer's security. My connection to Dropbox was the problem.

Mark

Thats not correct.

Something has happened on your machine.

Mac's are most certainly not immune from viruses.

My computer is a Mac. It's immune from ransomeware.

No, it's not.

http://www.nytimes.com/2016/03/08/business/mac-ransomware-attack-exposes-vulnerability-of-apple-users.html

Frank P. - I'd be interested to know if your setting under settings-profile-preferences-email notifications for "Many files deleted from my Dropbox" is turned on. I'm counting on that setting notifying me after ransomware attack so I can take action within 30 days.

For more information see Rich R.'s comment on March 10, 2016 13:46

My computer is a Mac. It's immune from ransomeware.

No, it's not.

http://www.nytimes.com/2016/03/08/business/mac-ransomware-attack-exposes-vulnerability-of-apple-users.html

Hi Rich R.

Thank you for pointing that out. Your point is well very well taken and none of us can afford to be complacent. But in this particular case I don't believe your observation applies .

1. The files in my Dbox folder were all changed in February of 2015, a year before any reported Mac incidents.

2. Only the files in my Dbox folder were affected. This infection did not originate on my Mac. If it had the whole machine would have been borked.

3. I run Sophos antivirus on my Mac because I'm not quite that complacent. I do understand that winter is coming, the night is dark and full of terrors and Macs are no longer as secure as they once were. The advice on the Sophos site about ransomeware includes:

"Here’s what the crooks and their malware do:

Trick you into opening a file you are inclined to trust.
When you do so, install and run the ransomware program."

If I'd been fooled and clicked on a Mac-capable version of the software my entire machine would be bricked and I'd have gotten a message to pay to have them restored. I'm not a crypto or coding expert, but it seems to me the only way this could have happened is through a malware attack on Dbox's servers that corrupted my files there and, since they were newer, were then over-written in my local Dbox folder.

"Steve R.Today at 13:51

For more information see Rich R.'s comment on March 10, 2016 13:46"

Hi Steve,

I deleted the application so I can't tell you what the settings were and I don't see that choice available in my security settings on the web side. If the files are over-written and not deleted would you necessarily get an email notice?

Mark

Dropbox doesnt store files on its servers as editable Frank so its impossible the servers are compromised. Each file is stored in unusable blocks. So a 20mb file is stored in 5 totally independent files. Its only when you download or use them they are 'reconnected'.

Something has happened on your machine, or, on a shared machine connected to it. Alternatively dont forget the virus could be on a totally separate machine and transfer to shared folders (and only then effect that folder)

Mark Mc,

Examining folders on my Dropbox web interface I notice a windows machine linked to my account "about a year ago" that I cannot identify.

Mark

Thats more than likely where the issue has come from then.

I'd suggest unlinking it and if you get an option to do so remove files locally from it (although that maybe a Pro option only).