Ransonware Vulnerability?

[JustinH]

I'm really enjoying this suite of software which I am playing around with at the moment (on 30 day trial). Currently I copy much of my local data to cloud storage using something called Air Explorer, and therefore I am comparing it to StableBit CloudDrive. One fairly significant weakness is that any ransomware would just encrypt all my cloud storage as well as local, because they are just drive letters with StableBit.

I know you can make a drive "Read Only" but as this is not available at the command line or via a schedule, I can not integrate with with my backup software.

Is there any solution to this?

[Shane]

Fair enough. Hmm. In the meantime, I did a quick search and you can use a DISKPART script to make a disk volume read-only or writable via the command line, for example:

diskpart /s z:\make-readonly.txt and diskpart /s z:\make-writable.txt

where make-readonly.txt would be a text file consisting of

select volume driveletter
attributes volume set readonly
exit

and make-writable.txt would be a text file consisting of

select volume driveletter
attributes volume clear readonly
exit

where "driveletter" would be the drive letter of your cloud drive (e.g. "select volume p").

Give it a try on a test cloud drive? It doesn't work with DrivePool, but maybe it will work with CloudDrive?

[Christopher (Drashna)]

Just a heads up, the Set-Disk command is effectively doing the same thing that the diskpart commands are doing.  Both are interfacing with the "Virtual disk service", which manages the drives/volumes/etc.

Also, it should be noted that Windows Defender also has a number of ransomware prevention options that can be configured.  And it may be worth looking into those. 

[JustinH]

Does StableBit have no view over this pretty important issue?

[Shane]

You could use the Contact form to submit a feature request to Stablebit for such a command line / scheduled operation, but I'm not sure how effective such a thing would be; if your computer can be scripted or scheduled to toggle the read-only state of a cloud resource, so can any ransomware potentially be written to do the same.

Edit: I can see some value in a "lock this drive (make it read-only) until I manually enter a password to unlock it" command.

[JustinH]

But I think it is very unlikely a ransomeware gang would write specific code for StabelBit users.  Simply not worth their time.

I am sure they do the 80:20 rule and StabeleBit is a lot less than 20 when it comes to % of their target audience using it.

I have submitted an RFE via the contact for,

[JustinH]

Of course - good find. I will investigate that.

Thanks!

[JustinH]

StableBit have very promply got back to me and said you can do it via Powershell and specifically this command:

Set-Disk -Number X -isReadOnly $true

They will also pass on my RFE to the developer for consideration.