Better Angels and Better Mining
Welcome

We're told that modern war will include the elements of cyber war, and now, as war rages in Europe, we look to our networks with renewed vigilance. In this context, the news of a stolen NVIDIA private key seems especially alarming.
Dear Reader,
We're told that modern war will include the elements of cyber war, and now, as war rages in Europe, we look to our networks with renewed vigilance. In this context, the news of a stolen NVIDIA private key seems especially alarming. Although this event is not related to any military conflict, and does not appear to be a state-sponsored act, it is yet another wake-up call about how far we have to go before we can truly say that our systems are secure.
In early March, reports trickled in about bogus binaries that were signed with an NVIDIA code-signing certificate but not created by NVIDIA [1]. According to the reports, the attack appears related to a recent intrusion on NVIDIA's internal systems by the Lapsus$ ransomware gang.
As it turns out, the stolen key used to sign the binaries actually expired back in 2014, which would make you think it was too old to cause any damage, but the attack exposed yet another little known quirk about Microsoft Windows: Under the right conditions, the Windows driver-signing policy will accept certificates issued prior to July 29, 2015, even if they are expired. This measure was adopted for backward-compatibility reasons when Microsoft introduced the policy with Windows 10. Luckily, several malware scanners already know about these rogue drivers and are scanning for them. However, the onus is on all who use or administer Windows systems to review security policies and check for instances of drivers signed with the rogue cert.
As a Linux guy, I would say this seems a little like Groundhog Day – yet another example of Microsoft fixing a problem by opening up another problem elsewhere on the system that they bury in the fine print and don't really explain to people. As a journalist, however, I would have to add that there are probably lessons in this for everyone. For instance, we don't know how the attackers got on NVIDIA's network in the first place, but an unpatched or misconfigured Linux system could well have been part of it. Another lesson: Expired keys can still make mischief, so lock them down and don't let them get lost.
Perhaps the weirdest and most intriguing part of this story is the apparent motive for the attack. According to reports, NVIDIA recently introduced new safeguards in the drivers for its RTX 30-series GPUs designed to limit the use of the GPU as a tool for calculating hash values in crypto mining. NVIDIA is apparently tired of crypto miners buying up all the high-end hardware and thereby shorting the company's traditional customers, such as gamers and other graphics power users.
In this case, the ransom the attackers wanted was not money but was, instead, the key to unlock the Lite Hash Rate feature [2] so that they could use the graphics cards for crypto mining. If this scheme had worked, it would have ushered in a whole new era for ransom attacks, where you don't just try to get rich but actually attempt to control a company into changing or circumventing its own policies. There are some reasons why this kind of attack doesn't sound very feasible. A company can begrudgingly admit to its shareholders that it had to pay money in a ransomware attack, but to actually change your corporate policies because a ransom attacker told you to looks really bad for management, which means that the CEO who agreed to do it would probably get fired for doing so. And to make a deal under the table with the criminals to avoid pubic scrutiny might actually be illegal.
As a means for exerting power, this whole scenario seems a bit hairbrained to me, kind of like when the two counterfeiters tried to steal of the body of Abraham Lincoln in order to spring a third counterfeiter out of prison [3]. From the viewpoint of the attacker, though, it is all a matter of seeing how far you can push the boundary. If it works, lots of better mining up ahead. What's to stop you from trying?
Joe Casad, Editor in Chief
Infos
- "Leaked Stolen NVIDIA Key Can Sign Windows Malware" by Gareth Corfield, The Register, March 5, 2022, https://www.theregister.com/2022/03/05/nvidia_stolen_certificate/
- A Further Step Towards Getting GeForce Cards into the Hands of Gamers: https://blogs.nvidia.com/blog/2021/05/18/lhr/
- "The Plot to Steal Lincoln's Body" by Peggy Robertson, American Heritage, April/May 1982, https://www.americanheritage.com/plot-steal-lincolns-body
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.
-
Linux Kernel 6.2 Released with New Hardware Support
Find out what's new in the most recent release from Linus Torvalds and the Linux kernel team.
-
Kubuntu Focus Team Releases New Mini Desktop
The team behind Kubuntu Focus has released a new NX GEN 2 mini desktop PC powered by Linux.