So last week's ransomware mess (the one that took down Maersk's shipping terminals, of all things, container ports running on Windows boxes that hadn't been patched, apparently) finally got me to do something I've been putting off since I started this blog back in 2011. I set up an actual backup system. Not a "backup system," in scare quotes, meaning a folder called backup_old sitting on the same internal drive as everything else. A real one.
I want to be honest about how bad my setup was before this. I had a 2TB external drive I'd plug in maybe once a month if I remembered, usually because I was annoyed at how full my laptop's SSD had gotten. That drive was doing double duty as backup and as the place I dumped stuff to free up space, which if you think about it for more than five seconds is a terrible idea, because half of what was "backed up" only existed on that one drive.
Watching the news about Maersk (and Merck, and that ad agency WPP, and a bunch of others) losing systems to whatever variant of Petya this was made it click in a way that WannaCry back in May somehow hadn't. Maybe because WannaCry felt like it was happening to hospitals in the UK, far away and abstract. This one hit companies I actually deal with. I had a package stuck in transit because of the shipping disruption, which is a weirdly mundane way to feel a global cyberattack.
Both of these things reportedly went through the same leaked NSA exploit, the SMBv1 one, EternalBlue. And both times the fix that would've stopped it was "install the patch Microsoft already shipped months ago." I'd turned off automatic Windows updates on my desktop years ago because one interrupted a render I was three hours into, and I never turned it back on. Lesson learned, I guess, the annoying way.
What I actually did
First, updates. Turned Windows Update back on, for real this time, and actually went through and confirmed the March patch (MS17-010, the one that closes the SMB hole) was installed on every machine in the house, including my dad's ancient Dell that I maintain remotely because he refuses to buy a new one. Five minutes of work I'd avoided for two years.
Second, backups, and I mean actual redundant ones, not the "one drive on the shelf" approach. I signed up for Backblaze, the unlimited-storage one, $50 a year per computer, and let it grind through my initial upload over about four days on my not-great home connection. It just runs in the background; I basically forgot it was happening until I got the email saying the first backup finished.
Then I kept the external drive too, but changed how I use it. It's not for overflow storage anymore — it's a second copy, full stop, using a scheduled task (built into Windows, Task Scheduler, nothing fancy) that runs robocopy with the /MIR flag every Sunday night to mirror my documents and photos folder. So now I've got: original files on the laptop, cloud copy via Backblaze, and a local mirror on the external drive. That's the 3-2-1 rule people always mention (three copies, two different types of media, one offsite), and I'd read about it a dozen times without ever actually doing it.
The part that annoys me is how little effort any of this took once I sat down and did it. The whole setup, including the multi-day initial cloud upload, was maybe forty minutes of actual hands-on work. I'd been avoiding forty minutes of mild tedium for roughly three years, which tracks with basically every piece of home IT maintenance I've ever put off.
If you're running Windows and you're not sure whether you've got the March patch, go check Windows Update right now, don't wait for the next headline to make you feel guilty about it. And if your backup situation is one drive that lives next to your computer, that's not really a backup, it's just a second place for the same disaster to reach. Ransomware doesn't care that your backup drive is plugged in six inches away.
One thing I haven't sorted out yet: my photo library is close to 400GB at this point between two cameras and about six years of phone photos, and Backblaze's upload speed on my connection means a full re-upload from scratch would take the better part of a week. I need to figure out a faster initial-seed option before I actually trust this thing completely. Ask me again in a month.