Can ransomware write to unmounted drives?

tyee · May 6, 2020

Question - Can ransomware write to an unmounted drive? I have in the last week started to turn off my HD docks but I'm not sure if just turning them off is enough? Turning off removes the Windows drive letter. Is this ok, or should I just remove the drive from the dock? I was playing with Partition Wizard a couple of days ago and from what I remember, it was partitioning while my drive was not mounted, meaning a hacker could also, yes/no?? Also remember, in Disk Management drives can also be seen without being mounted (without drive letters).

tyee · May 7, 2020

Since no one seems to know.... I have just removed my drives from the docks, solved!

The Hammer · May 7, 2020

Posting in a different forum category might yield the answer you seek.

itman · May 7, 2020

1. Mount and Unmount The Backup Drive

The "mountvol" command using an administrative command line can unmount a hard drive used for backups, whether that drive is external or internal.

Once the drive is unmounted, the drive letter assigned to that drive is no longer viewable via "This Computer" or "My PC", nor is the drive letter accessible using a command prompt. In essence, ransomware would not be able to spread to the drive because the drive is technically "offline", though it is still attached to the system.

The only way to have the drive available again is to use the mountvol command to remount the drive according to its global unique identifier (GUID). In terms of backups, it is possible to keep the drive unmounted until the backup script is run, then remount the drive during the backup, then unmount it afterward.

Caveats

Depending on how sophisticated the ransomware is, it is possible to supersede this protection. For example, the ransomware may begin its operations by scanning all available drives using the mountvol command, mount all available drives, then encrypt data on all drives.

One way around this would be to rename the mountvol command to something arbitrary, thus denying the ransomware program the ability to issue the mountvol command in the first place. This may require booting into safe mode or another operating system as the mountvol command is protected by the operating system, resulting in 'access denied' error if a rename is attempted.

Optionally it may be possible to deny access to the mountvol command by modifying its permissions (using icacls, described further down). This would deny administrators access to the command (unless permissions were reset). That said, denying access to mountvol may break parts of the operating system itself.

Another caveat is that if the system is already infected with ransomware, it may simply spread to the drive as soon as it's mounted. This risk would be significantly diminished if the backup was stored in a separate location (NAS or network central storage) with access privileges restricted on the backed up destination folder in order prevent ransomware from spreading across the entire drive.
Click to expand...

https://www.infopackets.com/news/10422/8-ways-protect-your-backups-ransomware

brians08 · Aug 21, 2020

I have wondered similar things. One option I was thinking about was to backup to NAS that was under control from of the backup software. For example, the backup software would execute a command on the NAS to power down when the backup was done. Then when the next backup was scheduled, a program would be run that would command a network relay to cycle power and force the NAS to start. Of course there is no end to this. The backup software could send a command to the NAS to mark completed backup files as read only, and on and on....

Log in or Sign up

Can ransomware write to unmounted drives?

tyee Registered Member

tyee Registered Member

The Hammer Registered Member

itman Registered Member

brians08 Registered Member

Log in or Sign up

Can ransomware write to unmounted drives?

tyee Registered Member

tyee Registered Member

The Hammer Registered Member

itman Registered Member

brians08 Registered Member

Useful Searches