Dropbox safe ?

Hello,

I didn't find any information or details about a virus protection on Dropbox servers so I can't confirm if they have a virus protection on their servers but I supposed yes.

In case you suspected infected files, you still have the history of your files and you can restore the last safe file.

If you are not sure, you can use an anti-malware to scan your files.

Here an article from Dropbox explaining the process in case of Ransomware :

https://www.dropbox.com/help/security/ransomware-recovery

Here are specifics on how Dropbox handles malware and Virus: https://www.dropbox.com/help/security/viruses-malware

Remember ransom-ware does not infect your files, it encrypts them...

If your computer gets infected and your data is encrypted, you can open a call with Dropbox and give them the change number to revert Dropbox back to.

I have done this many times, mainly in demos to people on how to secure data against Ransom-ware.

Dropbox give you 30 days of file versions as standard but I have Extended Version History feature (was pack-mule) on  top of that that gives me a year of file versions.

I make it a practice to have a good and separate backup of Dropbox files. That will protect you in case of an issue.

@Shaun Vermaak : What is the "change number" ?
@John Hurst : Are you talking about "offline backup" ? If yes then the problem would be that you are never "up-to-date"

Dropbox maintains versions (30 days).  You can recover older versions
https://www.dropbox.com/help/security/recover-older-versions#web

Are you talking about "offline backup"   <-- The backups will not be always up to date but the main Dropbox contents are up to date. I am just saying you should back up Dropbox like any other system.

My Dropbox files are on all my computers and so backups occur at my computer level.

As long as you spot the issue within 30 days, then you're covered. Whether you're hit with a virus that infects your files or with ransomware the encrypts your files as Shaun has pointed out. Or even if you accidentally delete files.

As Shaun stated, Ransomware encrypts your files.

If your Dropbox files are mounted in a way Ransomware can see them, then these files will also be encrypted.

Likely people may trounce me for my next comment.

If you're time is valuable, consider running OSX or Linux.

I use to use Windoze, till I kept track of my time running virus + registry cleaners every day to keep my system fast + clean-ish.

Came out to an average of 1.5hrs/day or 547 hours/year.

My realization was the value of 547 hours/year easily covered the cost of upgrading all my office machine to Macs.

Now I spend... 0 hours/day mucking about with OS level nonsense.

That is precisely why I keep separate backups (although never had any encrypted files).

Upside of David's comment: Macs and Linux machine tend to get targeted less frequently (but this does not mean that they don't). So a smaller market share can sometimes be an advantage (granted both Mac OS and Linux are also far more secure in their architectures than Windows).

Downside: Availability of software and learning curve. I've also seen software available for each OS that is also on Windows, but has far fewer features. The Mac by far has the shorter learning curve for someone switching away from Windows (even though you might go nuts initially having only one mouse button).

So really, at the end of the day, what type of computer/OS you should have depends on your needs and who you need to work with.

I do not believe in traditional backups for user data. The average user usually overwrite previous backup when backing up and they can (and do) inadvertently overwrite their backups with encrypted data.

If your backup method, whatever your chose, do not give you version by version file backups, you are not protected against ransom-ware.

As for Linux etc. I love almost all operation systems but will say this, in the past 20 years I have not had a single infection on any of my own Windows computers or any of the servers I manage

What is the "change number" ?

It is a number used by Dropbox to group events that happened, for example, changed 12817 files at 13h32
Do not overly concern yourself with it, you can ask them to revert to a date

few comments
1-Linux or MacOS - Less targeted because simply less market share.
why not move to Linux ? if u are a programmer and 95% of ur time is in Visual Studio... i find it difficult..


2-Suppose I have a dropbox acxount synced across 3 PCs.
Can we all agree that I can ALWAYS recover from anything by simply getting back the Dropbox cloud data ? (of course within. 30 days or more if I have a subscription. for more retention).
So dropbox IS Safe from ransomware. correct ??

there is ransomware that specifically attacks OSX, and Linux Distro's

The ransomware attacked more than 153 Linux servers that South Korean web provider Nayana hosted, locking up more than 3,400 websites on June 10. In Nayana's first announcement a few days later, it said the hackers demanded 550 bitcoins to free up all the servers -- about $1.62 million.

https://www.cnet.com/news/largest-ransomware-ever-demand-south-korea-web-host/

Can we all agree that I can ALWAYS recover from anything by simply getting back the Dropbox cloud data ? (of course within. 30 days or more if I have a subscription. for more retention).
So dropbox IS Safe from ransomware. correct ?? Provisionally I'd agree with this statement. Though I can think of ways to get around this 30 day period.. i.e. don't rename the files and start off by attacking the least used files (older than 30 days) and wait 30 days and then go after the rest.. The downside is the payout doesn't occur quickly and increases the length of time for detection and remediation.

DROPBOX IS NOT A BACKUP!

You need to use real versioning backup like crashplan or druva insync.

You need to use real versioning backup

I have a year of file versions with Dropbox all my applications are junctioned with Dropbox folder sync and most of my applications are portable and stored in Dropbox

That may be true,  but Dropbox is still not backup. It is somewhat similar to day that you have a year of copies of your files.  Copies are just copies,  not backups.  And Dropbox is not DR in anyone's imagination.

Thomas
the idea is not for dropbox to be a DR site....
but if have some excel files word files that i need to keep safe then we agree that dropbox is a fair-enough tool ??

Copies are just copies,  not backups.

@Thomas: What it your definition of a backup? Mine is "a copy of a file or other item of data made in case the original is lost or damaged" which just happens to be the international accepted definition. Dropbox is a backup solution for user data and more than suited for the context of OP's question.

By your definition, one could say dropbox is a backup,  but by snia's definition:  https://www.snia.org/education/dictionary/b I don't believe out does. A copy is a copy while a backup can and should be much more. There is also a difference between a backup and an archive. I would point to my rather extensive article on the subject, but it is part of my ransomware course.

Dropbox is better than nothing, but it will not protect you well against something like ransomware. Yes you can go back, but it is significantly more difficult with only dropbox than with a solution like Crashplan.

Define the "can and should be much more"
Also explain how that definition is different to the other.

Dropbox is better than nothing, but it will not protect you well against something like ransomware.

Yes, it does and I can (and have) prove it. I have more than once demo'ed it to clients by manually infecting it with ransomware, rebuilding computer and then get Dropbox support to revert to previous state.

I have dealt with Dropbox support re ransomware.  While Dropbox support took several days to recover files it took me a couple of hours using Crashplan.

That was my experience.

Were all the files recovered with Dropbox or not? You are mixing support issues with technical capabilities.

Maybe my opinion about Dropbox is influenced by some personal experience.  I havea 1tb personal Dropbox plan.  One day discovered that 500gb of files had vanished (I had not deleted the files from any machine connected to Dropbox, nor on the website).  When I attempted to recover these files, Dropbox wouldn't let me - it said that the number and size of the files I wished to recover wad too large.  It took over a week before those files were recovered and then only because I happened to have local backups (Dropbox support wanted examples of the files deleted.  Had I not had separate backups,  the only examples would have been the files that I no longer had access to!

During the first 2 days of this problem files continued to disappear from my account.  It went from close to 600gb of files to less than 2mb of files.

To answer your question Dropbox did eventually recover the files,  but eventual recovery is frankly not good enough.

If this helps here is the text of my article on backup.  

Backing Up: More Than a Necessity

By: Thomas Zucker-Scharff
STORAGE
Backing Up: More Than a Necessity?
I write often about backup and invariably comment about backup in some way when answering questions on Experts Exchange.  When presented with the opportunity to make some micro tutorials for EE, I ended up making a series on ways to backup.  I may go a little overboard on this subject, but I have never known a situation where there were too many backups; in my experience there is no such animal.  As long as you keep your backups straight, you can’t have too many.
 
I mention backing up before you do anything enough, that I thought I should write an article explaining my thinking and some of the ways to go about doing what I suggest.  It also makes it easier to refer to the article instead of retyping the same advice over and over again.

The first thing you might ask is what is backup, at least what does it mean to me?  The definition I use is that backup is basically the way in which you store a copy of your current working data.  But why should you backup up at all?  It can be summed up in a single sentence, “Any files you do NOT have backed up in at least two places, are files you do not care about.” This means two places OTHER than the originals. And the reasons you might sometime want those backups are too many to list, but several of the categories the reasons would come under are:
 
Catastrophic loss
Irreparable harm
Virii
Accidental deletion
But, you ask, how does one backup?  What software should you use? What about hardware?  In terms of Software, there are a plethora of options available, but there are several Free tools you should not miss using (especially if you are a home user).
DriveImageXML from Runtime software
CrashPlan local from Code42
Windows built-in backup tools (Microsoft)
Windows 7
Windows Backup which also creates an image to restore from
You can also create restore disks from this tool
System Restore is your friend – never turn it off, but remember that it won’t save those restore points indefinitely. And SR is generally the first thing that is targeted by virii.
Windows 8.x
Does everything that Windows 7 tools do
File Backup acts like MAC Time Machine, but only for specified files
Windows 8.x can go back to factory defaults even if you have never backed up.
Paragon (depending on who you are and what you do, this software may be free for you - Experts Exchange members with at least 50k points can request free copies from here)
Paid (to name a few)
Paragon
Novabackup
Crashplan
Hardware
Raid - RAID is a type of automatic backup.  It is setup, depending on the type of RAID, to allow you to have multiple disks so that if one fails you can replace it and the other disks will repopulate it with the data it needs.
Where should one backup to (in all cases storage space is the limiting factor)
Local
USB drive - larger and larger external USB drives are available for very little money.
Network drive
Thumbdrive - unless you have a very large thumbdrive and a small hard drive/SSD you will most likely not be able to make a complete backup with this method.
Cloud (most cloud plans have an unlimited storage option), I have listed a few
Amazon Web Services (AWS) http://aws.amazon.com/
Crashplan http://www.code42.com/crashplan/
Spideroak https://spideroak.com/
Carbonite http://www.carbonite.com/
Comodo http://www.comodo.com/home/backup-online-storage/comodo-backup.php
Druva inSync http://www.druva.com/products/insync/
How often should I backup
Before making any major changes
If possible, before any changes
At least once a week
What is the difference between backups and archives? This may sound like semantics, but the difference is important. Most general users only create backups, while most professional information technology people use both backups and archives. Whatever someone does, a specific and exact plan is a necessity.
Definitions
According to SNIA’s online dictionary, the terms are defined as follows:
Backup: A collection of data stored on (usually removable) non-volatile storage media for purposes of recovery in case the original copy of data is lost or becomes inaccessible; also called a backup copy.
Archive: A collection of data objects, perhaps with associated metadata, in a storage system whose primary purpose is the long-term preservation and retention of that data.
From ironmountain.com blog (read more from this blog)
Backup – When backing up your data, you are protecting both active and inactive information which encompasses all of your production data.  As part of the process, you are copying your vital information to a backup target such as disk or tape.  It is critical to recognize that a backup is a copy of production information and the actual data still resides on the production storage systems.  Thus, if your backup system suffers a catastrophic data loss, your operations could still continue normally since your production data would not be impacted; however, you would be operating at an elevated risk.
Archive – Archive solutions solve a different problem.  These technologies are typically used to maintain older or inactive data for extended periods of time.  Archive systems typically move older or inactive information off of primary storage to dedicated systems which are optimized for low cost long-term storage.  A key differentiator from backup is that the data stored in an archive is actual production data and hence a loss of an archive system will result in permanent loss of production information. (To be fair, the information will likely be older and less active, but unlike backup, it is the only copy of the data.)
Plans/Planning - No matter what you do, you will need to plan out how you will implement your backup strategy. There are various ways to backup, the most common is disk to disk backup. Disk to disk backup means just that, backing up from one disk to another. The second disk is many times not quite as good as the "working" disk, whether this is because of speed, capacity or something else, in this case it doesn't really matter. The second disk is usually a USB external drive for home users, that should be kept away from the computer when not in use (preferably in a separate room). Disk to cloud is another very common option (crashplan, spideroak, comodo, etc.). Many times D2D and D2C are combined (for instance, disk to disk to cloud).  D2C has the added benefit of keeping another copy at a physically different place than the original. Some Information Technology professionals (at least those concerned with backup) will implement either disk to disk to cloud or disk to disk to tape backup scenarios. In many cases the final archive is stored at a place like Iron Mountain.
Bare-metal versus File Backup - I include this section because all too often people confuse these two types of “backup”. Many programs that can do BM backups can also do file backups, but not necessarily the other way around. For instance,
Paragon software can do
Partition/disk backup which can then be extracted file by file
Partition to Virtual machine (P2V) backup
Bare-metal backup
DriveImageXML can do both
It creates a bare-metal backup which can be extracted in toto or file by file.
Bare-Metal Restore definition on Wikipedia
Bare Metal restores can be made to the same or different hardware (depending on the software that creates the bare metal backup), but either way the restore contains the Operating system and all programs and setting that were on the system that was backed up (imaged).
File Restore is a file by file restore of data to the same system or to a different system, but either one must already have an operating system installed.
Testing
Whether you are a home user or an IT professional, a backup is only good if it works. It is imperative to test out your backup and restore plan to completion. If your backup strategy is an excellent one, but when it comes time to restore and it doesn’t work, you have been wasting your time and resources. This doesn’t have to be gut-wrenching.  If you don’t have a second system you can test this out on, make a backup of your primary system then test it that way. The best time to do this is when you just buy a system, so that if it doesn’t work there is not a lot to do to rebuild it (most of the time there is a recovery partition that will do it for you, if there isn’t one you can create one with a tool like Paragon suite or Acronis home edition).

TL/DR: Like you said, you are "influenced by some personal experience". It works perfect for me. Nobody is talking about system state or bare metal restore