Dear Reader,

We're told that modern war will include the elements of cyber war, and now, as war rages in Europe, we look to our networks with renewed vigilance. In this context, the news of a stolen NVIDIA private key seems especially alarming. Although this event is not related to any military conflict, and does not appear to be a state-sponsored act, it is yet another wake-up call about how far we have to go before we can truly say that our systems are secure.

In early March, reports trickled in about bogus binaries that were signed with an NVIDIA code-signing certificate but not created by NVIDIA [1]. According to the reports, the attack appears related to a recent intrusion on NVIDIA's internal systems by the Lapsus$ ransomware gang.

As it turns out, the stolen key used to sign the binaries actually expired back in 2014, which would make you think it was too old to cause any damage, but the attack exposed yet another little known quirk about Microsoft Windows: Under the right conditions, the Windows driver-signing policy will accept certificates issued prior to July 29, 2015, even if they are expired. This measure was adopted for backward-compatibility reasons when Microsoft introduced the policy with Windows 10. Luckily, several malware scanners already know about these rogue drivers and are scanning for them. However, the onus is on all who use or administer Windows systems to review security policies and check for instances of drivers signed with the rogue cert.

As a Linux guy, I would say this seems a little like Groundhog Day – yet another example of Microsoft fixing a problem by opening up another problem elsewhere on the system that they bury in the fine print and don't really explain to people. As a journalist, however, I would have to add that there are probably lessons in this for everyone. For instance, we don't know how the attackers got on NVIDIA's network in the first place, but an unpatched or misconfigured Linux system could well have been part of it. Another lesson: Expired keys can still make mischief, so lock them down and don't let them get lost.

Perhaps the weirdest and most intriguing part of this story is the apparent motive for the attack. According to reports, NVIDIA recently introduced new safeguards in the drivers for its RTX 30-series GPUs designed to limit the use of the GPU as a tool for calculating hash values in crypto mining. NVIDIA is apparently tired of crypto miners buying up all the high-end hardware and thereby shorting the company's traditional customers, such as gamers and other graphics power users.

In this case, the ransom the attackers wanted was not money but was, instead, the key to unlock the Lite Hash Rate feature [2] so that they could use the graphics cards for crypto mining. If this scheme had worked, it would have ushered in a whole new era for ransom attacks, where you don't just try to get rich but actually attempt to control a company into changing or circumventing its own policies. There are some reasons why this kind of attack doesn't sound very feasible. A company can begrudgingly admit to its shareholders that it had to pay money in a ransomware attack, but to actually change your corporate policies because a ransom attacker told you to looks really bad for management, which means that the CEO who agreed to do it would probably get fired for doing so. And to make a deal under the table with the criminals to avoid pubic scrutiny might actually be illegal.

As a means for exerting power, this whole scenario seems a bit hairbrained to me, kind of like when the two counterfeiters tried to steal of the body of Abraham Lincoln in order to spring a third counterfeiter out of prison [3]. From the viewpoint of the attacker, though, it is all a matter of seeing how far you can push the boundary. If it works, lots of better mining up ahead. What's to stop you from trying?

Joe Casad, Editor in Chief