The tool in your backups nobody patches

· · Security Infrastructure

Think about how your business backs up its files. There is probably a job that runs overnight, copying data from one place to another. A network drive that mirrors itself to a second one. A script a former colleague set up that has worked so reliably nobody has looked at it in years.

There is a decent chance that under all of it sits a piece of software called rsync. You almost certainly never chose it. It came bundled inside a backup appliance, a network storage box, or a hosting setup, doing the actual work of copying files from A to B. It is a good tool, which is exactly why it is everywhere and why almost nobody thinks about it.

What happened

On 13 August, rsync released version 3.5.0 with 33 security fixes in a single update. The developers ran a focused audit of how the tool handles file paths and how it talks to other machines, added automated testing to hammer at it, and folded in reports from outside researchers. Each fix comes with a test that proves the problem is gone.

Thirty-three at once sounds alarming. In context it is reassuring: this is what a deliberate, honest security review looks like, and the project published the lot with a test for every one. Most of the issues are a specific technical class involving symbolic links, a kind of shortcut that points from one file to another, which attackers can abuse to make a copy operation touch files it should not.

The practical takeaway is ordinary. There is a newer, safer version, and the machines running rsync should get it. For the tools you manage directly, that is a routine update. The interesting question is the tools you do not manage directly, because that is most of them.

The real issue is ownership, not rsync

Here is the part that outlives this particular update. In a lot of small businesses, the software that matters most is the software nobody owns.

Everybody knows who looks after the laptops and the email. Far fewer can say who is responsible for patching the backup box in the cupboard, the network storage everyone saves to, the router the internet provider installed, or the little server that syncs two systems together. These things were set up once, they worked, and they became furniture. They still run software. That software still has flaws. But no name is attached to keeping it current, so nothing does.

rsync is a clean example because it hides inside so many of these. A network storage device from any of the big brands very likely uses it. A backup appliance probably does. A hosting account may. When rsync ships fixes, the update reaches you only if the maker of that box ships an update, and you install it. If the box is a few years old, out of support, or simply never checked, the fixes never arrive, and the thing quietly holding all your backups keeps running the old version.

That is the uncomfortable symmetry. The backup, the one thing meant to save you when everything else fails, is often the least maintained system you own.

What to do

You do not need to go hunting for rsync by name. You need to close the gap that lets any tool go unpatched for years.

  • Write down what runs your backups and file storage. The backup appliance, the network drive, the sync job, the box in the cupboard. You cannot patch what you have not named, and most businesses have never made this list.
  • For each one, answer two questions. Whose job is it to update this, and how would we know if it stopped getting updates? If the honest answer is "nobody" and "we would not", that is the finding, and it is more valuable than any single patch.
  • Check that the boxes doing quiet work are still supported. A network storage or backup device that the manufacturer no longer updates will never receive fixes like these, however diligent you are. Knowing which of your kit has aged out of support tells you where the real risk sits.
  • Test that a backup actually restores. Separate from patching, but it belongs in the same conversation, because it is the same neglected corner. A backup nobody has restored from is a hope, not a control. We wrote about that in test your backups before an attacker does.

The specific fixes in rsync 3.5.0 will matter to very few readers directly. The habit they should prompt matters to almost everyone: give every piece of software that does important work a name against it, or accept that one day it will be running a version from years ago and nobody will have noticed.

How Steelwise can help

Working out what software quietly runs your business, which of it is out of support, and whose job it is to keep each piece current, is the kind of practical security review we do with smaller firms. Get in touch.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.