- A researcher analyzed how Akira works on Linux and came with a Brute-Force Depleting Tool
- It took $ 1,200 and three weeks to decrypt a system
- The tool is available on GitHub now
A security researcher has managed to break Akira’s ransomware encryption to Linux using cloud-based computing power.
Security scientist Yohanes Nugroho was recently asked for the help of a friend who was beaten with Akira. After analyzing the logs, they decided that Akira generates encryption keys using timestamps in nanoseconds.
Nugroho’s method is a bit expensive to retrieve all the encrypted files, but it still has to be cheaper than paying the demand for ransom.
Cloud Computing for the Rescue
An encryption seed is a starting value used to generate encryption keys that lock a victim’s files. It plays a crucial role in the encryption process, which often determines how the encryption key is derived. In Akira’s case, the cryptor generates dynamically unique encryption keys for each file using four timestamp seeds. The keys are then encrypted with RSA-4096 and added at the end of each encrypted file.
Furthermore, Akira encrypts multiple files at once through multi-threading.
By looking at the logs, however, the researcher was able to determine when ransomware races and through the metadata he decided the encryption time. He was then able to create a brute-force tool that can detect the key to each file. Running the tool on Prem was considered ineffective as both the RTX 3060 and RTC 3090 took too long.
The researcher then chose Runpod & Vast.ai Cloud GPU services, which gave enough computing power at the right price to make the process viable. He used 16 RTX 4090 GPUs to Brue-Force decryption key in about 10 hours. Depending on the number of locked files, the whole process can take less or more time.
In total, the project took three weeks and $ 1,200 but the system was saved, Bleeping computer Reports. The decryptor is available on GitHub and the researcher added that the code can probably be optimized to run even better. It is worth noting that victims, before running such an experiment, first have to create backups of their files, in case something goes wrong.
Via Bleeping computer
