Hello Rob,
Am 25.03.2021 um 15:33 schrieb Rob Berendt <rob@xxxxxxxxx>:
I get the concept that some are concerned that someone could ransomeware a Virtual Tape Library.
Question: A VTL exposes its content never as random access media (aka: disks) via Network, but only via FC, or iSCSI LUN of type SEQUENTIAL. Correct?
If I'm correct with my assumption, then I'd say a ransomware attack is extremely unlikely. All ransomware commonly known relies on direct access to files, via stock OS facilities.
Some explanation to my claim. It not only applies to VTLs but also to real tape libraries. I don't know how VTLs internally handle what ends up as files on local disks, so I'll explain as if it was real tape.
Tapes are sequential devices by nature. First, "special" commands are needed to read and write data. You can't open a tape like a disk file. (There is software which emulates a filesystem on tape. If you utilize this, you'll be vulnerable if such a tape is mounted *and* an attack happens just then.)
Next, the *format* how single disk files are gathered and stored on tape differs from software to software. Possible attackers would need to either know some common formats to successfully extract individual files locally (to the machine having FC or iSCSI access to the tape LUN), encrypt it, and write it back with the given format to tape. Or they just read one blob from tape, encrypt while reading, writing back later. This means to need local space for the complete tape content to be cached. Sounds to me like a lot of work to implement correctly in software needing to act stealthy.
It's way easier to send the drive a SCSI command to just erase whatever is written on whatever tape is loaded in the drive, from beginning to end. A slow process, and it can be easily seen on admin web interface. Or, one sends just realtime generated garbage to the drive to write onto tape, thus overwriting the content.
The SCSI commands to interact with the loader mechanism is also standard, like the SCSI commands to read and write tape data. Some libraries might have an auto-change mode: If one tape is full, the next one will be loaded automatically, and can be overwritten.
It's also possible to instruct the tape drive to write an EOT marker at the beginning of the tape, by rewinding and opening the tape for write, and write no data. This overwrites probably important metadata. I don't know which tape technology can be forced to read behind that EOT marker. The data is physically still on the tape but can't be accessed.
If there is access to the web interface of the library which allows access without any authentication (HP did this), there might be possibilities to erase tapes from there. To me, this sounds more like something done by a human attacker, instead of being scripted and executed by Software.
HTH.
:wq! PoC
midrange.com
