News for hackers. Stuff that matters.
Re:Decrypting encrypted files from Akira ransomware using a ... by fragmede on Friday March 14, 2025 @03:27PM (#43366285)
> I expect [the attackers] will change their encryption again after I publish this.

If they realize that, why publish this? Seems irresponsible at best to give a decryptor in such gory detail for what, Internet cred? It's an interesting read, and my intellectual curiosity is piqued, it just seems keeping the details to yourself would be better for the community at-large.

> Everytime I wrote something about ransomware (in my Indonesian blog), many people will ask for ransomware help. ... > Just checking if the ransomware is recoverable or not may take several hours with a lot of efforts (e.g: if the malware is obfuscated/protected). So please don’t ask me to do that for free

So charge them for it?

Re:Decrypting encrypted files from Akira ransomware using a ... by martinsnow on Friday March 14, 2025 @04:04PM (#43366657)
Why don't you do the legwork instead of asking rhetorical questions?
Re:Decrypting encrypted files from Akira ransomware using a ... by charcircuit on Friday March 14, 2025 @04:28PM (#43366936)
Legwork of what? Companies already have done the legwork to make it easy for strangers to send you money.
Re:Decrypting encrypted files from Akira ransomware using a ... by technion on Friday March 14, 2025 @05:13PM (#43367360)
Companies that "do the legwork" of decrypting ransomware for the most part just pay the ransom on your behalf.
Re:Decrypting encrypted files from Akira ransomware using a ... by tsujamin on Friday March 14, 2025 @05:20PM (#43367417)
Presuming this results in a cryptosystem change for Akira, there’s a real number of victims who won’t get their data back as a result of this disclosure.

Whether the number is more than that of victims to date who can recreate this? Who knows

Re:Decrypting encrypted files from Akira ransomware using a ... by bawolff on Friday March 14, 2025 @06:08PM (#43367791)
How would they get their data back if someone theoretically knows how to decrypt but never tells anyone.
Re:Decrypting encrypted files from Akira ransomware using a ... by tsujamin on Friday March 14, 2025 @09:53PM (#43369204)
I can’t remember the example (it was a conference talk a few years ago), but I’m pretty sure there’s LE and DFIR companies who also reverse this stuff and assist in recovery, they just don’t publish the actual flaws exploited to recover the data.
Re:Decrypting encrypted files from Akira ransomware using a ... by bawolff on Saturday March 15, 2025 @01:31AM (#43370228)
Key being generated insecurely is hacking crypto systems 101. The mere fact someone can reverse it probably means this is the first thing to check.
Re:Decrypting encrypted files from Akira ransomware using a ... by not2b on Friday March 14, 2025 @05:29PM (#43367500)
It was already disclosed to the bad guys that someone managed to break their encryption, when they didn't get paid and they saw that the customer had somehow managed to recover their data. That probably meant they might go looking for weaknesses, or modify their encryption, even without this note.

Other victims whose data were encrypted by the same malware (before any updates) could benefit from this disclosure to try to recover their data.

Re:Decrypting encrypted files from Akira ransomware using a ... by dylan604 on Friday March 14, 2025 @03:35PM (#43366377)
once your files are encrypted by ransomware, does the encryption change if the malware gets updated? if not, then anyone currently infected with this version can now possibly recover.

if they don't release their code, then what's the point of having the code? they accomplished their task, and now here you go for someone else that might have the same need. otherwise, don't get infected by a new version

Re:Decrypting encrypted files from Akira ransomware using a ... by IncreasePosts on Friday March 14, 2025 @04:29PM (#43366950)
How would it be better, unless it's widely known to be breakable? And at that point, wouldn't the hackers know that too?
Re:Decrypting encrypted files from Akira ransomware using a ... by cannonpalms on Friday March 14, 2025 @07:04PM (#43368245)
> why publish this?

New versions of Akira and any other ransomware are constantly being developed. This code is specific to a certain version of the malware.

As noted in the article, it also requires:

1. An extremely capable sysadmin 2. A bunch of GPU capacity 3. That the timestamps be brute-forced separately

So it's not exactly a turn-key defeat of Akira.