Decrypting encrypted files from Akira ransomware using a bunch of GPUs

https://tinyhack.com/2025/03/13/decrypting-encrypted-files-from-akira-ransomware-linux-esxi-variant-2024-using-a-bunch-of-gpus/

by costco • 1 year ago

257 47 1 year ago

tinyhack.com

__alexander2• 1 year ago

Note: Someone commented on the “limited shelf-life” of ransomware and why this doesn’t hurt other victims. They deleted their comment but I’m posting my response.

You are incorrect. What is limited is the number of attacks that can be used for victims to recover their files. If you think the author is the only person that was using this attack to recover files, you are incorrect again. I’d recommend checking out book The Ransomware Hunting Team. It’s interesting book about what happens behind the scene for helping victims recover their files.

w-ll• 1 year ago

Im confused, are you saying that you think building a method for anyone to break/brute the ransomeware is bad?

comex• 1 year ago

They're saying that publicly disclosing the vulnerability is bad because now it will be fixed.

PUSH_AX2• 1 year ago

What use is a counterattack if it’s inaccessible, either by another cost or because it’s only known by a few experts?

This feels like a net win.

stavros2• 1 year ago

What use is a counterattack if it's immediately fixed? Then absolutely nobody can use it, not even a few experts.

bawolff• 1 year ago

Anyone know why they are using timestamps instead of /dev/random?

Dont get me wrong,im glad they don't, its just kind of surprising as it seems like such a rookie mistake. Is there something i'm missing here or is it more a caseof people who know what they are doing don't chose a life of crime?

__alexander2• 1 year ago

Rolling your own crypto is still a thing.

mschuster91• 1 year ago

If it works (reasonably) it works, and it throws wrenches into the gears of security researchers when the code isn't the usual, immediately recognizable S boxes and other patterns or library calls.

dherls• 1 year ago

Charitable, use of system level randomness primitives can be audited by antivirus/EDR.

hassleblad234• 1 year ago

I wonder at what point would the antivirus kick in. It doesn't require reading /dev/urandom for too long.

0cf8612b2e1e• 1 year ago

Even if the attackers used a fully broken since 1980s encryption-how many organizations have the expertise to dissect it?

I assume that threat detection maintains a big fingerprint databases of tools associated with malware. Rolling your own tooling, rather than importing a known library, gives one less heuristic to trip detection.

int0x29• 1 year ago

They used this with the IVs mucked with: https://www.gnupg.org/software/libgcrypt/index.html

Retr0id2• 1 year ago

afaik the majority of ransomware does manage to use cryptography securely, so we only hear about decrypting like this when they fuck up. I don't think there's any good reason beyond the fact that they evidently don't know what they're doing.

econ3• 1 year ago

In case the tool is used against them.

ulrikrasmussen• 1 year ago

My unqualified hunch: if they did that, then a mitigation against such malware could be for the OS to serve completely deterministic data from /dev/random for all but a select few processes which are a priori defined.

zerd• 1 year ago

You can do the same with time though, just return a predefined sequence of timestamps.

throwaway48476• 1 year ago

Ransomware would be less of a problem if applications were sandboxed by default.

gblargg• 1 year ago

Or if people backed up more often.

XorNot3• 1 year ago

Sandboxed how? Applications generally are used to edit files, and those are the valuable files to a user.

Ransomeware wouldn't be a problem at all if copy-on-write snapshotting filesystems were the default.

charcircuit3• 1 year ago

Like Android and iOS. The user manually has to grant access to files.

edoceo• 1 year ago

Feels like a case where ZFS would help mitigate?

fennecbutt• 1 year ago

Sandbox, user specifies access to certain files (like you can do limiting access to certain gallery items on android).

Then changes made to files should be stored as deltas to the original.

But realistically a good readonly/write new backup solution is needed, you never know when something bad might happen.

TacticalCoder• 1 year ago

Of course, there are many things a company can do to be a bit more assured it can access its data: CoW snapshots, backups on read-only medium (e.g. DVD or BluRay discs), HDDs/SSDs offline on shelves, and certainly many other things could help companies.

That's not incompatible with sandboxing applications to limit the damage a malware can do.

Even on a regular user's "workstation" there's no need for every single app to access every single directory / every single network drive with rw permission etc.

P.S: FWIW the backup procedure I put in place doesn't just encrypt/compress/deduplicate the backups, it also compares the backup to previous backups (comparing size gives an idea, for example), then also verifies that the backup can be decrypted, using a variety of metrics (for example if, after decrypting then decompressing the backup a Git repo backup is found, it'll run "git fsck" on it, if a file with a checksum is found, it'll verify that file's checksum, etc.). Already helped us catch not a malware but a... bitflip! I figured out that if a procedure can help detect a single bitflip, it probably can help detect malware-encrypted data too. I'm not saying it's 100% foolproof: all I'm saying is there's a difference between "we're sandboxing stuff and running some checks" vs "we allow every single application to access everything on all our machines because we need users to access files".

gosub100• 1 year ago

Or if non-trusted/signed apps only had COW disk access.

heavensteeth• 1 year ago

What could explain encrypting the first 65k with KCipher2 and the rest with something else? Seems odd.

Ameo• 1 year ago

This was a great read and had just the right amount of detail to satisfy my curiosity about the process without being annoying to read.

Huge props to the author for coming up with this whole process and providing such fascinating details

1vuio0pswjnm7• 1 year ago

"On my mini PC CPU, I estimated a processing speed of 100,000 timestamp to random bytes calculations per second (utilizing all cores)."

Would like more details on the mini PC. Processor, RAM, price. Is it fanless.

Decrypting encrypted files from Akira ransomware using a bunch of GPUs

Related Stories