Is this backup / security strategy valid on NAS?

Question

I have a Synology NAS, with several shared folders, and several users. These users have on their PC a network drive letter, linking to their NAS shared folders (using their credentials) + the "everybody" folder.

I also have an Hyper Backup task set up, which creates a backup every night of all my NAS content, and stores it in a /Backup folder only "admin" user (me) has access to. /Backup is on the same volume as the other shared folders. I usually keep the last 5 backups.

My questions : if one of my (regular, non-admin) users get a cryptovirus, leading to data corruption on their PC & NAS folders : - is there any scenario where the /Backup folder could be compromised too ? (knowing the users does not have access to it) - am I correct to assume that, if the backup task was succesfull, i'll be able to revert corrupted data to previous save, thus making it healthy again ?

Answer 1

With current Ransomware you probably don't have to worry but that's not necessarily true in future.

As an example, WannaCry used a flaw in SMB1 to infect Windows machines, this means your Synology NAS (Linux) would have been OK even if it used SMB1. However NASs are becoming more popular so maybe the next Ransomware will target currently unknown flaws in the Synology NAS as well as the originating Windows machines. There has also been a "Synlocker" Ransomware that specifically targetted Synology machines, although a patch was released for this fairly quickly.

The only way to be 100% safe is to have a disconnected/remote backup as well so if Ransomware manages to infect your NAS you still have a valid backup.

(edit) As of today there appears to be a vulnerability in Samba on Linux (and Synology, affecting SMB). I got a patch this morning, update your DSM! More at Arstechnica.