Better Angels and Better Mining
Welcome

We're told that modern war will include the elements of cyber war, and now, as war rages in Europe, we look to our networks with renewed vigilance. In this context, the news of a stolen NVIDIA private key seems especially alarming.
Dear Reader,
We're told that modern war will include the elements of cyber war, and now, as war rages in Europe, we look to our networks with renewed vigilance. In this context, the news of a stolen NVIDIA private key seems especially alarming. Although this event is not related to any military conflict, and does not appear to be a state-sponsored act, it is yet another wake-up call about how far we have to go before we can truly say that our systems are secure.
In early March, reports trickled in about bogus binaries that were signed with an NVIDIA code-signing certificate but not created by NVIDIA [1]. According to the reports, the attack appears related to a recent intrusion on NVIDIA's internal systems by the Lapsus$ ransomware gang.
As it turns out, the stolen key used to sign the binaries actually expired back in 2014, which would make you think it was too old to cause any damage, but the attack exposed yet another little known quirk about Microsoft Windows: Under the right conditions, the Windows driver-signing policy will accept certificates issued prior to July 29, 2015, even if they are expired. This measure was adopted for backward-compatibility reasons when Microsoft introduced the policy with Windows 10. Luckily, several malware scanners already know about these rogue drivers and are scanning for them. However, the onus is on all who use or administer Windows systems to review security policies and check for instances of drivers signed with the rogue cert.
As a Linux guy, I would say this seems a little like Groundhog Day – yet another example of Microsoft fixing a problem by opening up another problem elsewhere on the system that they bury in the fine print and don't really explain to people. As a journalist, however, I would have to add that there are probably lessons in this for everyone. For instance, we don't know how the attackers got on NVIDIA's network in the first place, but an unpatched or misconfigured Linux system could well have been part of it. Another lesson: Expired keys can still make mischief, so lock them down and don't let them get lost.
Perhaps the weirdest and most intriguing part of this story is the apparent motive for the attack. According to reports, NVIDIA recently introduced new safeguards in the drivers for its RTX 30-series GPUs designed to limit the use of the GPU as a tool for calculating hash values in crypto mining. NVIDIA is apparently tired of crypto miners buying up all the high-end hardware and thereby shorting the company's traditional customers, such as gamers and other graphics power users.
In this case, the ransom the attackers wanted was not money but was, instead, the key to unlock the Lite Hash Rate feature [2] so that they could use the graphics cards for crypto mining. If this scheme had worked, it would have ushered in a whole new era for ransom attacks, where you don't just try to get rich but actually attempt to control a company into changing or circumventing its own policies. There are some reasons why this kind of attack doesn't sound very feasible. A company can begrudgingly admit to its shareholders that it had to pay money in a ransomware attack, but to actually change your corporate policies because a ransom attacker told you to looks really bad for management, which means that the CEO who agreed to do it would probably get fired for doing so. And to make a deal under the table with the criminals to avoid pubic scrutiny might actually be illegal.
As a means for exerting power, this whole scenario seems a bit hairbrained to me, kind of like when the two counterfeiters tried to steal of the body of Abraham Lincoln in order to spring a third counterfeiter out of prison [3]. From the viewpoint of the attacker, though, it is all a matter of seeing how far you can push the boundary. If it works, lots of better mining up ahead. What's to stop you from trying?
Joe Casad, Editor in Chief
Infos
- "Leaked Stolen NVIDIA Key Can Sign Windows Malware" by Gareth Corfield, The Register, March 5, 2022, https://www.theregister.com/2022/03/05/nvidia_stolen_certificate/
- A Further Step Towards Getting GeForce Cards into the Hands of Gamers: https://blogs.nvidia.com/blog/2021/05/18/lhr/
- "The Plot to Steal Lincoln's Body" by Peggy Robertson, American Heritage, April/May 1982, https://www.americanheritage.com/plot-steal-lincolns-body
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
News
-
KDE Plasma 6 Looks to Bring Basic HDR Support
The KWin piece of KDE Plasma now has HDR support and color management geared for the 6.0 release.
-
Bodhi Linux 7.0 Beta Ready for Testing
The latest iteration of the Bohdi Linux distribution is now available for those who want to experience what's in store and for testing purposes.
-
Changes Coming to Ubuntu PPA Usage
The way you manage Personal Package Archives will be changing with the release of Ubuntu 23.10.
-
AlmaLinux 9.2 Now Available for Download
AlmaLinux has been released and provides a free alternative to upstream Red Hat Enterprise Linux.
-
An Immutable Version of Fedora Is Under Consideration
For anyone who's a fan of using immutable versions of Linux, the Fedora team is currently considering adding a new spin called Fedora Onyx.
-
New Release of Br OS Includes ChatGPT Integration
Br OS 23.04 is now available and is geared specifically toward web content creation.
-
Command-Line Only Peropesis 2.1 Available Now
The latest iteration of Peropesis has been released with plenty of updates and introduces new software development tools.
-
TUXEDO Computers Announces InfinityBook Pro 14
With the new generation of their popular InfinityBook Pro 14, TUXEDO upgrades its ultra-mobile, powerful business laptop with some impressive specs.
-
Linux Kernel 6.3 Release Includes Interesting Features
Although it's not a Long Term Release candidate, Linux 6.3 includes features that will benefit end users.
-
Arch-Based blendOS Features Cool Trick
If you're looking for a Linux distribution that blends Linux, Android, and web apps together, blendOS might be what you're looking for.