Can Airport Time Capsule encrypted backups be hacked open from internet

From Apple Support Knowledge Base...

Time Capsule, Mac OS X v10.6.3 or later: How to transfer your back up from an existing Time Capsule to a new one

For this process, you should leave your computer in the same room as the Time Capsules, or use one Ethernet cable to connect your Mac to the Ethernet port on the existing Time Capsule, then use another Ethernet cable to connect from the existing Time Capsule to the new Time Capsule.

1. Configure your Time Capsule for your network. See the documentation that came with your Time Capsule for information about setting it up on your network.
2. Open Time Machine preferences in System Preferences.
3. Slide the Time Machine switch to Off.
4. Open a Finder window.
5. Locate both Time Capsules listed in the SHARED section of the navigation pane on the left of the Finder window. Note: If you do not see your Time Capsules in that section, choose Preferences from the Finder menu and make sure "Connected servers" is checked under SHARED.
6. Select the name of the new Time Capsule in the navigation pane. The default name is "Time Capsule xxxxxx", with xxxxxx being the last digits of the ID printed on the bottom of the Time Capsule.
7. Mount the volume by double-clicking the name of the volume in the Finder window's main section. The default drive name is "Data".
8. Open a new Finder window by pressing Command-N, or by choosing File > New Finder Window.

9. Repeat the previous 2 steps with the other Time Capsule, to mount it. Drag your backup disk image from the current Time Capsule to the new Time Capsule. This can take some time to complete because your entire backup will be copied.

10. Open Time Machine preferences in System Preferences.

11. Click "Select Disk...", then select your new Time Capsule.
12. Perform a Time Machine back up.
13. After the back up, you can remove the Ethernet cables if desired and configure your wireless network to your liking.

If You Have a Time Capsule or an AirPort Extreme Base Station with Shared USB Hard Drive

If you have either a Time Capsule (which is basically an AirPort Extreme Base Station with a built-in 500 GB or 1 TB hard drive) or an AirPort Extreme Base Station (AEBS) with an attached USB hard drive, you can share out the Time Capsule/AEBS hard drive and make it accessible via the Internet. To do this:

1. Start the Airport Utility.

2. Select your Time Capsule or AEBS. Make a note of the IP Address shown on the right -- you will need it later.

3. Click Manual Setup.

4. Check your "Connection Sharing" setting under the Internet Tab. The following tutorial is valid if your "Connection Sharing" is to "Share a public IP address", the normal setup for a home network. You will need to have a static IP address, or use a free dynamic DNS service. If you have a different type of "Connection Sharing," you probably don't need a tutorial to set up remote access to your disk; adapt this one as needed.

5. Click Disks (at the top of the dialog box), and then click File Sharing.

6. Select (check) the "Enable file sharing" checkbox and the "Share disks over Ethernet WAN port" checkbox. It is strongly recommended that you also set Secure Shared Disks to "With base station password" and Guest Access to "Not allowed"; not making these changes may allow unauthorized users to access your Time Capsule/AEBS hard drive.

7. Click Airport (at the top of the dialog box), and then click Base Station.

8. Enter a Base Station Password and verify it in the Verify Password box.
9. Click Advanced (at the top of the dialog box), and then click Port Mapping.

10. Click the plus sign (+) to add a new port mapping.

11. In the Public UDP Port(s) and Public TCP Port(s) boxes, type in a 4-digit port number (e.g., 5678) that you choose. In the Private IP Address box, type the internal IP address of your Time Capsule or AEBS that you wrote down in step 2 (for example, 192.168.0.1). In the Private UDP Port(s) and Private TCP Port(s) boxes, type 548. Click Continue.

12. In the Description box, type a descriptive name like "Time Capsule File Sharing" or "AEBS File Sharing". Then, click Done.

13. When you have made all changes, click Update.

Your Time Capsule/AEBS will restart. Once it does, you are now ready to connect to the Time Capsule/AEBS hard drive via the Internet. To do this when your MBA is away from home:

1. In the Finder, click Go > Connect to Server.

2. Type in the correct domain name or external IP address for your network, plus a colon and the port number you specified in step 11. For example, "www.myhomedomain.com:5678" or "123.123.12.123:5678".

3. Click Connect.

4. You will be prompted for your user name and password. The user name can be anything you like; the password should be the password for the Time Capsule/AEBS which you specified above.

5. Click Connect.

Voilà! You are now connected to your Time Capsule/AEBS hard drive from your MBA. You can access files, copy files back and forth between your MBA and the hard drive, delete files, whatever you want, as long as your MBA remains network-connected. The next time you go to connect, it should go even more quickly (especially if you save your password in your keychain, and if you add your home IP address/domain name to your list of Favorite Servers in the Connect dialog box).

Note that the Time Capsule/AEBS will appear in the Shared section of your Finder's sidebar as a server, with the Base Station Name of the Time Capsule/AEBS as the server name.

Taken from http://forums.dealmac.com/read.php?4,2800627

Additional Info:

I know port forwarding can be a big hassle so I thought I would add that you could also use apple's built in "Back To My Mac" feature. This way you can access your Time Capsule's files as well as accessing you home mac files and screen share with your mac over a secure connection.

Try this article: https://support.apple.com/en-gb/HT204618