News for hackers. Stuff that matters.

A comment on Decrypting encrypted files from Akira ransomware using a bunch of GPUs. Parent comment

Re:Decrypting encrypted files from Akira ransomware using a ... by ulrikrasmussen on Saturday March 15, 2025 @03:46AM (#43370794)
My unqualified hunch: if they did that, then a mitigation against such malware could be for the OS to serve completely deterministic data from /dev/random for all but a select few processes which are a priori defined.
[ Parent | on HN ]
Re:Decrypting encrypted files from Akira ransomware using a ... by zerd on Saturday March 15, 2025 @01:15PM (#43373832)
You can do the same with time though, just return a predefined sequence of timestamps.
[ Parent | on HN ]
Re:Decrypting encrypted files from Akira ransomware using a ... by Retr0id on Sunday March 16, 2025 @12:15PM (#43380128)
And from a "defensive" perspective, if you don't trust any single entropy source, the paranoid solution is to combine multiple sources together rather than to switch to another source entirely.

If it were me, I'd combine urandom (or equivalent), high-res timestamps, and clock jitter (sample the LSB of a fast clock at "fixed" intervals where the interval is a few orders of magnitude slower than the clock resolution), and hash them all together.

[ Parent | on HN ]