18 ms·
Decrypting encrypted files from Akira ransomware using a bunch of GPUs
- fragmede 2y ago[flagged]
- dylan604 2y agoonce your files are encrypted by ransomware, does the encryption change if the malware gets updated? if not, then anyone currently infected with this version can now possibly recover. if they don't release their code, then what's the point of having the code? they accomplished their task, and now here you go for someone else that might have the same need. otherwise, don't get infected by a new version
- martinsnow 2y agoWhy don't you do the legwork instead of asking rhetorical questions?
- charcircuit 2y agoLegwork of what? Companies already have done the legwork to make it easy for strangers to send you money.
- technion 2y agoCompanies that "do the legwork" of decrypting ransomware for the most part just pay the ransom on your behalf.
- tsujamin 2y agoPresuming this results in a cryptosystem change for Akira, there’s a real number of victims who won’t get their data back as a result of this disclosure. Whether the number is more than that of victims to date who can recreate this? Who knows
- not2b 2y agoIt was already disclosed to the bad guys that someone managed to break their encryption, when they didn't get paid and they saw that the customer had somehow managed to recover their data. That probably meant they might go looking for weaknesses, or modify their encryption, even without this note. Other victims whose data were encrypted by the same malware (before any updates) could benefit from this disclosure to try to recover their data.
- bawolff 2y agoHow would they get their data back if someone theoretically knows how to decrypt but never tells anyone.
- tsujamin 2y agoI can’t remember the example (it was a conference talk a few years ago), but I’m pretty sure there’s LE and DFIR companies who also reverse this stuff and assist in recovery, they just don’t publish the actual flaws exploited to recover the data.
- bawolff 2y agoKey being generated insecurely is hacking crypto systems 101. The mere fact someone can reverse it probably means this is the first thing to check.
- IncreasePosts 2y agoHow would it be better, unless it's widely known to be breakable? And at that point, wouldn't the hackers know that too?
- deleted 2y ago[deleted]
- cannonpalms 2y ago> why publish this? New versions of Akira and any other ransomware are constantly being developed. This code is specific to a certain version of the malware. As noted in the article, it also requires: 1. An extremely capable sysadmin 2. A bunch of GPU capacity 3. That the timestamps be brute-forced separately So it's not exactly a turn-key defeat of Akira.
- __alexander 2y agoNote: Someone commented on the “limited shelf-life” of ransomware and why this doesn’t hurt other victims. They deleted their comment but I’m posting my response. You are incorrect. What is limited is the number of attacks that can be used for victims to recover their files. If you think the author is the only person that was using this attack to recover files, you are incorrect again. I’d recommend checking out book The Ransomware Hunting Team. It’s interesting book about what happens behind the scene for helping victims recover their files.
- BestHackerOnHN 2y ago[dead]
- w-ll 2y agoIm confused, are you saying that you think building a method for anyone to break/brute the ransomeware is bad?
- comex 2y agoThey're saying that publicly disclosing the vulnerability is bad because now it will be fixed.
- hassleblad23 2y agoThis is a game of cat and mouse, like it has always been. Cannot rely on security by obscurity.
- throw10920 2y agoThis is a highly ignorant response. There is no relying on security by obscurity - that concept doesn't even apply here, because we're not describing the defenders of a system under attack. This is ransomware that has already infected the system that you're supposed to be securing. Failing to realize that if you don't publicize the method of bypassing the weakness in the ransomware then you'll be able to save more victims indicates extreme stupidity and ignorance of the basics of the field. Moreover, "This is a game of cat and mouse" suggests that it's not valuable for more victims to have their files decrypted, which is somewhere between malicious and insane.
- bawolff 2y agoAnyone know why they are using timestamps instead of /dev/random? Dont get me wrong,im glad they don't, its just kind of surprising as it seems like such a rookie mistake. Is there something i'm missing here or is it more a caseof people who know what they are doing don't chose a life of crime?
- __alexander 2y agoRolling your own crypto is still a thing.
- mschuster91 2y agoIf it works (reasonably) it works, and it throws wrenches into the gears of security researchers when the code isn't the usual, immediately recognizable S boxes and other patterns or library calls.
- deleted 2y ago[deleted]
- emmelaich 2y agoMight be a bit a paranoia about official crypto libs backdoors, too.
- dherls 2y agoCharitable, use of system level randomness primitives can be audited by antivirus/EDR.
- hassleblad23 2y agoI wonder at what point would the antivirus kick in. It doesn't require reading /dev/urandom for too long.
- 0cf8612b2e1e 2y agoEven if the attackers used a fully broken since 1980s encryption-how many organizations have the expertise to dissect it? I assume that threat detection maintains a big fingerprint databases of tools associated with malware. Rolling your own tooling, rather than importing a known library, gives one less heuristic to trip detection.
- throwaway48476 2y agoRansomware would be less of a problem if applications were sandboxed by default.
- gblargg 2y agoOr if people backed up more often.
- XorNot 2y agoSandboxed how? Applications generally are used to edit files, and those are the valuable files to a user. Ransomeware wouldn't be a problem at all if copy-on-write snapshotting filesystems were the default.
- charcircuit 2y agoLike Android and iOS. The user manually has to grant access to files.
- XorNot 2y agoWhich doesn't scale to office workstations or workplaces with network drives, where users needing to search and update hundreds of files at a time is the norm. Developers with 1 project open have potentially hundreds to thousands of open, quite valuable files. Now of course, we generally expect developers to have backups via VCS but that's exactly the point: snapshotting filesystems with append semantics for common use cases is an actual, practical defense.
- econ 2y agoI'm the old days we had mechanical write protect. I find it hard taking modern security seriously. It should be pretty simple to [say] make a hardware solution to allow only writing out new files. I also find it comical that my production database has instructions to conveniently delete or modify all rows in my table. That would be at the top of the list of features I don't want. I have backups of course, backups on writable usb drives. Like, when I lose everything it is really nice to be able to delete files from my backup drive. This is such a great idea. Excuse my ignorance but is one really updating hundreds of files the day round? On some factory machines that do dangerous things you have to hold down two buttons.
- heavensteeth 2y agoWhat could explain encrypting the first 65k with KCipher2 and the rest with something else? Seems odd.
- Ameo 2y agoThis was a great read and had just the right amount of detail to satisfy my curiosity about the process without being annoying to read. Huge props to the author for coming up with this whole process and providing such fascinating details
- 1vuio0pswjnm7 2y ago"On my mini PC CPU, I estimated a processing speed of 100,000 timestamp to random bytes calculations per second (utilizing all cores)." Would like more details on the mini PC. Processor, RAM, price. Is it fanless.