Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

NVIDIA Hit By Major Cyberattack That May Have 'Completely Compromised' Parts of Its Business (wccftech.com) 48

Posted by BeauHD from the suspicious-timing dept.
An anonymous reader quotes a report from Wccftech: NVIDIA has seemingly been hit by a major cyberattack that may have completely compromised parts of its business, reports The Telegraph. In their exclusive report, The Telegraph reports that the cyberattack was initiated at the same time as the Russian cyber warfare division started their offensive against Ukraine. All Nato allies have announced major sanctions on Russia and this could potentially be why Russia has decided to target major companies such as NVIDIA.

The report further states that the cyberattack on NVIDIA has completely compromised parts of their business and there are already reports from several users coming in regarding services disruption. The scale of this attack is currently unknown but it clearly seems to be a major one as NVIDIA had to take several systems offline to pacify the intrusion before it could spread further: "'The ultimate concern is that somebody may have put something in one of the software updates,' Dr Woodward said, pointing to the devastating SolarWinds hack that exploited American software companies to gain access to US government computer systems. 'They'll be going through trying to make sure to see if there's any indication that anything has been changed in their software that they then shipped to their clients.'" NVIDIA's mail servers were also partially operational during this time so it's entirely likely that there might have been a breach in confidential documents. But it is not confirmed yet if any data was stolen. In a brief statement, an Nvidia spokesperson confirmed the report, saying: "We are investigating an incident. We don't have any additional information to share at this time."
This discussion has been archived. No new comments can be posted.

NVIDIA Hit By Major Cyberattack That May Have 'Completely Compromised' Parts of Its Business More

NVIDIA Hit By Major Cyberattack That May Have 'Completely Compromised' Parts of Its Business

Comments Filter:

  • Asking on behalf of the millions still waiting on one at the MSRP.

  • Oh no, GeForce Now players wil have to join... (Score:5, Funny)

    by ffkom ( 3519199 ) on Friday February 25, 2022 @05:09PM (#62304535)
    ... the army, now that they can't play "Battlefield" online anymore. I'm sure the Ukrainian Army offers more immersive graphics and sound to volunteers, anyway. No micro-transactions, great force feedback, and challenging perma-death await!

  • Luckily for us, the Nintendo generation was tough enough to survive the breach unscathed. Take that Pentagon haters!

  • Terrible! (Score:4, Interesting)

    by Gravis Zero ( 934156 ) on Friday February 25, 2022 @05:19PM (#62304569)

    At this rate, the source code to their proprietary drivers could get out and someone could now add support to hardware in the open source drivers which are part of mainline Linux. This is just awful! ;)

  • To form a comment at this time.

    Ironically, here is a comment.

  • Hard to understand what military advantage this would convey in exchange to moving Russia towards pariah status worldwide.. Perhaps an uncoordinated action by a patriotic Russian?
    • Would this not impact bitcoin mining, and bitcoin futures? And if you can install trojans on every NVIDIA machine through drivers?

      • Nobody has been mining Bitcoin with GPUs for the last decade or so.

      • 1. GPUs are used to mine Ethereum, and other altcoins.
        2. I guarantee right after the attack was done, they probably started rolling back commits in git if the committing author either wasn't recognized, or if the tagged author looked at the code and says "no I didn't commit that today."
        3. As they probably do not commit directly to the main branch, the main branch should still have the same code as what is made available for download. Build it and compare it. Then, if it checks out, turn public download ba

        • You assume competent employees with unrestricted budgets in a large corporation. This does not sound likely.

          • It takes an unrestricted budget to have a backup solution? Because you can't buy LTO autoloader libraries on eBay for a couple hundred bucks?

            Just because some organizations are incompetent, doesn't mean all organization are incompetent. I assure you as a publicly traded company, Nvidia regularly schedules at least some DR tests, because they are required by Sarbanes-Oxley for "material" systems for reporting accounting. Are you claiming that Nvidia is in violation of SOX?

    • Information wants to be free. Information wants to be sold. Information wants to be ransomed.

      Vlad is not going to waste an ounce of energy assisting with the prosecution of these people. We may soon bear witness to Russia's full criminal potential.

    • Re: (Score:2, Insightful)

      by Otis B. Dilroy III ( 2110816 )
      This may in fact benefit Ukraine
      Russia will be blamed for this whether they did it or not
      Currently, the governments in the US and EU are owned by multinational corporations whose only motive is profits.
      These corporations currently perceive engaging with Russia as a threat to profits.
      If Russia were perceived as a threat to profits you can bet that they will be happy to commit someone else's children to an armed conflict.
      Especially if they can sell weapons to both sides
      • As is pointed out in another story, someone may want to use Nvidia's signature to push various types of malware. But high gas prices are bad for lots of businesses, and at this point Russia is looking at extended sanctions, even if they declare victory and go home. Lost profits are baked in to every scenario, with a weak response to Russia's aggression being the most-profitable course.
  • ...To Pieces. At some point, we will need to take Russia off the internet, but until then, hurt them, please.

    • Re: (Score:2)

      by bobby ( 109046 )

      I was thinking I'd be willing to donate some CPU cycles and bandwidth to help that effort. But I don't want any legal repercussions. It'd be great if our (USA's) govt. would pass a law allowing people to contribute to the war effort this way, without any kind of criminal or civil penalty. It'd be up to the ISP to regulate the traffic (if they can...)

      BTW, thank you for your videos! I need to watch more of them. We are kindred spirits (but I don't post videos, yet...)

  • Not sure if GPU crypto mining depends on manufacturer drivers, but might it be possible to insert some sort of malware in the driver which would steal mined crypto?

    • Only if miners regularly take their mining rigs offline to download and install questionably-improved drivers instead of ignoring it and just continuing to mine at known rates.

      The only people that regularly update GPU drivers as soon as they become available are "enthusiasts" that JUST have to have the latest whatever they can, no matter how many times they've had their crotch cut while straddling that bleeding edge. Everyone else updates if there's a problem, or a notification says they should.

    • This could literally be just [funded by] miners who want to know how to unlock the latest gaming cards to make them better for mining. There's enough money at stake.

  • Mmmm -- signed nVidia driver updates would be an amazing vector for malware.

  • Best option...

    Cut them off from the internet...

    • Re: (Score:3)

      by ffkom ( 3519199 )
      So you want to cut off the Russian population from their only information source that is not state propaganda?

      • I am for cutting them off.

        We will be safer from cyberattacks.

        And for the last years having this source did not help at all - situation was getting worse year by year...

        So why the f..k should we care about Russian population? They do not want to fight.

        We should protect ourselves and those who want to oppose Putin like Ukrainians...

        • Also members of this population bomb residential areas, shot to civilian convoys, shot ambulances...

          Do you really believe that having them access to Internet will help?

  • "NVIDIA's mail servers were also partially operational during this time"

    What were they for the rest of the time ?

    Does Nvidia have Sysadmins ?

    • Re: (Score:2)

      by ewhac ( 5844 )

      "NVIDIA's mail servers were also partially operational during this time"

      What were they for the rest of the time ?

      They run MS Exchange, so... partially operational.

  • In the light of recent events and everyone imposing economic sanctions, I wouldn't be surprised if Russians tried to plant invisible, irremovable cryptominers at the source.

    • How would it be irremovable when you could just restore a backup of your git host? Are you suggesting that Nvidia doesn't regularly do disaster recovery testing?

      • I meant irremovable from the user perspective, if it was a part of an official Nvidia binary, built-in and signed, and required for Nvidia features to work; or if the malware had a stage two which installs a rootkit.

      • On the second subject, I work in cybersecurity and I am yet to see a company which fully tests disaster recovery, and those who have a DR plan at all are few and far between, usually the bigger they are, the less they care.

        • I've worked for midsize software developers, which would probably be close to the size of the software team at Nvidia for doing their driver and Android development work. We were annually audited for proof that various mission-critical service could be restored in a disaster. Our code repositories were included in that test.

          I would be shocked if Nvidia, who knows the value of software to the point of being a total pain in the ass on Linux on purpose, didn't at least have a nightly backup of their repos.

  • Umm, pardon me for asking, but given that this was likely, why weren't NVidia more security-conscious?

    From the most basic of perspectives, there should be nothing inside NVidia's network that can be reached from the outside. Only the DMZ and certificate-and-IP authenticated IPSec endpoints should be reachable by the outside. Standard business security. Or, at least, it should be. I've seen that type of configuration maybe twice in my career and it was a relatively small shop running critical medical infrast

    • Umm, pardon me for asking, but given that this was likely, why weren't NVidia more security-conscious?

      From the most basic of perspectives, there should be nothing inside NVidia's network that can be reached from the outside. Only the DMZ and certificate-and-IP authenticated IPSec endpoints should be reachable by the outside. Standard business security. Or, at least, it should be.

      Almost the entire IT sector has been working remotely for the past two years. How are people going to work from home if they can't access the network? And if they can access the network remotely... how do you keep their home systems secure?

      I've seen that type of configuration maybe twice in my career and it was a relatively small shop running critical medical infrastructure. None of the big players I've worked for have.

      For specialized industries that's feasible (a lot of SCADA does the same).

      But it's a huge PITA to work with which is why it's the exception, not the norm.

      • Re: (Score:2)

        by jd ( 1658 )

        Almost the entire IT sector has been working remotely for the past two years. How are people going to work from home if they can't access the network? And if they can access the network remotely... how do you keep their home systems secure?

        The first term you would be looking for is "extranet", a single "internal" network that consists of many physically disconnected sites. In order to build these, you need virtual private networks, since home users obviously can't afford physically private networks, and sec

  • I would probably avoid updating drivers for some time. Else hide your crypto wallets.
  • NVDA stock was up today.
  • but you better think long and hard before you start messing with our video games, Putin

  • But some others may use the current crisis as giving them cover for their operations.

    • Re: (Score:2)

      by jvkjvk ( 102057 )

      Russia has not reason to attack Ukraine.

      I can certainly see how Russia *could* be involved. It makes just as much sense that it was them as that it wasn't.

  • Blame everything on Russia nowadays. As if the "cui bono" principle did not clearly point to China. Sheep.

Slashdot Top Deals

"Ask not what A Group of Employees can do for you. But ask what can All Employees do for A Group of Employees." -- Mike Dennison

Close