Further protection from ransomware encryption -- disconnect odrive app

Two previous topics ( Encryption ransomware: How does odrive sync behave? and Protecting cloud backups against crypto trojans? ) indicate that unsynced files will not be affected by ransomware.

However, what if the ransomware is smart enough to sync files (download them to local storage) and then encrypt? These files would then sync with cloud storage, and if there is no versioning in the cloud these files are lost. I am using Amazon Cloud Drive, which does not have versioning (as far as I can tell - I’m new to it as well as odrive).

How can I disconnect my computer from odrive? Exiting the tray app (Windows 8.1) is not sufficient since accessing via Explorer a cloud file will start the odrive app.

Another way, though inelegant, is to rename odrive.exe so that it does not start (except by existing shortcuts, such as in the Start Menu).

Is there an easier way to use odrive when desired (during backups) and then disconnect it or prevent it from running at other times?

1 Like

Hi @Mark_H,
Unsynced files should always be safe from this type of malware, since changing placeholder files doesn’t have any effect on the cloud data. If the ransomeware is somehow sufficiently intelligent enough to know how to sync files down before messing with then, then it will definitely be harder to combat. If this is a large concern of yours I would recommend using cloud storage that has versioning (you are correct, Amazon Drive does not).

You mentioned “backups”. The current version of odrive is not a “traditional” backup solution, since it is a full-blown sync engine with always-on, bidirectional sync. If traditional backup is your primary use case then we recommend waiting for our forthcoming backup feature.

If you are interested in stopping and starting odrive at certain intervals/times, you can take a look at this thread:

We are thinking about adding a “lock” ability in a future version of odrive, which will prevent interaction with odrive files unless they have been “unlocked” by the user. This could also be used to combat the risk of ransomeware, even if it was intelligent enough to navigate odrive-specific behavior.

2 Likes

Hi Tony,

Thank you for the considered reply.

Yes, I am looking forward to your backup feature.

Include my vote for the “lock” capability in a near-term version of odrive.

A note on download performance after two days of trial: odrive is three times faster than the Amazon Drive app for me. And reliable. Amazon Drive app has been almost completely unable to download files larger than 1 GB. Odrive does this 100% of the time (and I am not splitting large files; 7 GB is large for me). Very impressive so far!

Mark

2 Likes

Great to hear. Thanks for reaching out!