Security researcher Yohanes Nugroho has released a decryptor for the Linux variant of Akira ransomware, which utilizes GPU power to retrieve the decryption key and unlock files for free.

Nugroho developed the decryptor after being asked for help from a friend, deeming the encrypted system solvable within a week, based on how Akira generates encryption keys using timestamps.

The project ended up taking three weeks due to unforeseen complexities, and the researcher spent $1,200 on GPU resources to crack the encryption key, but eventually, he succeeded.

Using GPUs to brute force keys

Nugroho’s decryptor does not work like a traditional decryption tool where users supply a key to unlock their files.

Instead, it brute-forces encryption keys (unique for each file) by exploiting the fact that the Akira encryptor generates its encryption keys based on the current time (in nanoseconds) as a seed.

An encryption seed is data used with cryptographic functions to generate strong, unpredictable encryption keys. Since the seed influences the key generation, keeping it secret is critical to prevent attackers from recreating encryption or decryption keys through brute force or other cryptographic attacks.

Akira ransomware dynamically generates unique encryption keys for each file using four different timestamp seeds with nanosecond precision and hashes through 1,500 rounds of SHA-256.

These keys are encrypted with RSA-4096 and appended at the end of each encrypted file, so decrypting them without the private key is hard.

The level of timing precision in the timestamps creates over a billion possible values per second, making it difficult to brute force the keys.

Also, Nugroho says that Akira ransomware on Linux encrypts multiple files simultaneously using multi-threading, making it hard to determine the timestamp used and adding further complexity.

The researcher narrowed down the possible timestamps to brute-force by looking at log files shared by his friend. This allowed him to see when the ransomware was executed, the file metadata to estimate the encryption completion times, and produce encryption benchmarks on different hardware to create predictable profiles.

Initial attempts using an RTX 3060 were far too slow, with a ceiling of only 60 million encryption tests per second. Upgrading to an RTC 3090 didn’t help much either.

Eventually, the researcher turned to using RunPod & Vast.ai cloud GPU services that offered enough power at the right price to confirm the effectiveness of his tool.

Specifically, he used sixteen RTX 4090 GPUs to brute-force the decryption key in roughly 10 hours. However, depending on the amount of encrypted files that need recovery, the process may take a couple of days.

The researcher noted in his write-up that GPU experts could still optimize his code, so performance can likely be improved.

Nugroho has made the decryptor available on GitHub, with instructions on how to recover Akira-encrypted files.

As always, when attempting to decrypt files, make a backup of the original encrypted files, as there’s a possibility that files can be corrupted if the wrong decryption key is used.

BleepingComputer has not tested the tool and cannot guarantee its safety or effectiveness, so use it at your own risk.

Recently, NVidia announced in their blog that the company is implementing a new “feature” to their RTX 3060 and future cards. This new implementation will detect mining-related operations and limit the GPU resources, thus reducing mining speed.

What’s going on?

So far, the only affected cryptocurrency is Ethereum. The hashrate reduction is a solid 50%. According to NVidia, the reason for this ‘nerf’ is to decrease the demand for new-gen GPUs in the mining community, and fight the current gaming GPU shortage.

NVidia however still wants to support the mining community. In order to do that, the company announced the NVidia CMP – a GPU-like card without any output ports designed specifically for mining GPU-minable coins.

We have already seen something similar with the Nvidia P102-100 GPUs , though never before NVidia has forced miners away from using gaming GPUs so openly.

The Downsides

As a gamer myself, I would love to see the gaming GPU shortage issue solved. In fact, the only reason I’ve got into mining a few years ago was so I could game on a high-end GPU and have it pay for itself over time.

Having gaming gear that pays for itself is any gamer’s dream. Now, do these actions by NVidia get us any closer to that dream?

The answer is probably no. Here’s why:

#1. Big Mining Facilities Will Still Deplete Gaming GPU Stocks

Some people zealously defend NVidia for its decision. What they don’t understand is that mining is a GPU sink. Big mining facilities will keep buying GPUs in bulk as long as mining is somewhat profitable.

And here’s the thing – NVidia is more than happy to supply miners with gaming GPUs.

Some of you already noticed that NVidia is using the term ‘Mining community’ a bit too vaguely, which makes some of their public statements misleading. Let me explain.

We need to understand that the mining community is comprised of two groups of people. The first group are the home miners, most of which are gamers, the ones NVidia is supposed to be defending.

The second group are the big mining facilities. They are the ones that buy most of the GPU’s and cause the gaming GPU shortage to begin with. I am talking about the multimillion companies, most of which are located in China, Iceland and other countries with free electricity. Those companies can afford to buy a big share of the available GPU stock for their farms.

If you wonder how big they are, we are talking about several companies that are worth billions of dollars that operate huge mining facilities with millions of gaming GPU’s in them.

#2 Big Mining Facilities Will Bypass the Hashrate Restrictions

NVidia stated that this hashrate limitation is implemented in the “RTX 3060 software drivers”. Thing is, custom drivers are a thing, and so are custom BIOS flashes.

Big mining companies have their own teams of IT engineers who make their own drivers for optimized mining. Only amateur miners (most of who are gamers) mine under Windows using official NVidia drivers.

This point begs a question: who will get affected by the hashrate nerf, then?

#3 Gamers Are the Only Ones Getting ‘Nerfed’ Here

Think about this: as a gamer who bought the new RTX 30xx card, you will no longer be able to mine in your spare time to make some extra money with your GPU. Not as efficiently as before anyway.

A lot of gamers are getting into mining to make up for the insanely high costs of graphic cards. Now, this alternative will become less viable.

Also, if the mining craze calms down, you might no longer have the option to go to eBay and buy a used new-gen GPU for a fraction of the price as you could back in 2019. Instead, you will have a million offers of used CMP cards you cannot use for gaming.

#4 Is Ethereum Really the Issue Here?

Another thing to consider is that NVidia is nerfing the mining hashrate of only one algorithm, which is ethash. This again rises questions on who’s going to get affected by the nerf the most. Ethereum is one of the most known coins, and it’s one of the easiest ones to mine, too. There are a lot of user-friendly miner software for the coin like CudoMiner, which makes it easier for amateurs (i.e. gamers) to get into mining.

With Ethereum mining no longer being profitable on the newest GPU’s, more experienced users will still find ways around this issue. We can always switch to non-ethash altcoins that are just a bit less profitable to mine, or use custom drivers under Linux to bypass the hashrate limitation.

The average joe however might think that GPU mining is straightforward over.

#5. NVidia’s Decision Might Affect Ethereum Decentralization

 The sole idea of GPU-minable cryptocurrencies is that anyone with a gaming GPU at home can contribute to the safety of the blockchain. This is called decentralization, and it’s is what makes cryptocurrencies so appealing. 

Obviously, the more experienced users will find their way around this issue. However, the fewer average gamers are mining the currency, the less decentralized it becomes.

On the bright side, this might open new possibilities for AMD and maybe even Intel. Besides, the GPUs we have right now will not be affected by these limitations, and they might still be profitable to mine with for a few years from now.

Will We Have Less GPU’s Now?

We are currently experiencing a global semiconductor shortage. This leads us to a question: what chips will NVidia use on their CMP’s?

First of all, developing a new chip costs hundreds of millions of dollars, so there’s little chance that NVidia will actually do that for a mining GPU. The mining scene is very unpredictable, and the insane demand in mining gear might end abruptly any day.

According to the company, they will use dice that weren’t good enough for gaming GPU’s, but that will do just fine for mining.

As The Verge pointed out though, the official shot of a CMP chip looks nothing similar to that of an Ampere-based RTX 3080/3090, or the GA104 used in the RTX 3060Ti/3070. Maybe NVidia is putting old Pascal architecture chips to use.

I’m not going to speculate on whether those sub-performing dice could still be used for gaming GPU’s. I know there are a lot of talk regarding how NVidia and other companies managed to give bad dice a second life in the past. All I’m going to say is that the new CMP will not mine as fast as the RTX 30xx cards. They might however be more power-efficient.  That we will know once third-party testing becomes possible.

In Conclusion

I’m not here to bash on NVidia for their marketing decisions. The only takeaway here is that I would personally not expect this decision by NVidia to solve any issues with gaming GPU supply.

The new CMP cards might be interesting if they get sold for cheap. Just keep in mind that they have zero resale value so they still might not be the best option for home miners.

Thank you for reading. As always, your comments, suggestions and questions are welcome.

Subscribe and stay tuned for further updates!

To receive the latest updates follow me on social media!