NVIDIA: We've Been Hacked, User Records Lost
July 13, 2012 6:00 PM
comment(s) - last by
Fortunately passwords appear to have been strongly hashed
NVIDIA Corp. (
) had some bad news to announce late yesterday. The site
the following statement on its Forums page:
NVIDIA suspended operations of the NVIDIA Forums (forums.nvidia.com) last week.
We did this in response to suspicious activity and immediately began an investigation. We apologize that our continuing investigation is taking this long. Know that we are working around the clock to ensure that secure operations can be restored.
Our investigation has identified that unauthorized third parties gained access to some user information, including:
hashed passwords with random salt value
public-facing "About Me" profile information
NVIDIA did not store any passwords in clear text. "About Me" optional profiles could include a user’s title, age, birthdate, gender, location, interests, email and website URL – all of which was already publicly accessible.
NVIDIA is continuing to investigate this matter and is working to restore the Forums as soon as possible. We are employing additional security measures to minimize the impact of future attacks.
All user passwords for our Forums will be reset when the system comes back online. At that time, an email with a temporary password, along with instructions on how to change it, will be sent to the user’s registered email address.
As a precautionary measure, we strongly recommend that you change any identical passwords that you may be using elsewhere.
NVIDIA does not request sensitive information by email. Do not provide personal, financial or sensitive information (including new passwords) in response to any email purporting to be sent by an NVIDIA employee or representative.
), and others likely fell victim to an SQL injection attack. SQL injection attacks exploit the fact that internet user databases are publicly hosted and send them malformed request strings designed to execute disallowed commands. They can be defeated by careful programming, but implementing protections is a time intensive and expensive process, hence many companies have vulnerable databases.
[Image Source: NVIDIA Wallpapers]
NVIDIA Forums is a popular stomping ground both for gaming enthusiasts and for programmers developing GPU applications using
NVIDIA's proprietary CUDA API
The first of two major concerns arising from the NVIDIA attack is the possibility of phishing. Now that an unknown party has users emails, it could send them messages (as the NVIDIA post alludes to), trying to trick them into providing their password in plaintext or other personal details.
The second danger is the possibility that the hashed passwords could be cracked. NVIDIA did not reveal what hashing algorithm it used, but the fact that it used a random salt value indicates that its passwords were likely relatively strongly hashed.
The announcement was actually the second major announcement of a SQL injection breach on Thursday. Earlier, Yahoo! Inc. (
) announced that hackers had
found 453,000 of its user passwords
. Yahoo! was less fortunate than NVIDIA -- baffingly it decided to store its user passwords in plaintext, greatly increasing the potential damage to its users.
This article is over a month old, voting and posting comments is disabled
I'm cursed - this is the sixt time in a year!
7/13/2012 8:31:42 PM
It is like where ever I've registered it is hacked and I'm always on the victim list. Luckily I haven't been using duplicate passwords and the mail address used is one for non-essential stuff but still this is getting old.
It is a scandal that companies have not yet gotten their security fixed - it's not like the guys at say Nvidia can claim they haven't heard of something like this happening.
RE: I'm cursed - this is the sixt time in a year!
7/13/2012 9:40:17 PM
It is a scandal that companies have not yet gotten their security fixed
The problem though is that regardless of what security measures are in place, it can always be broken or by-passed.
Case in point, you put iron bars on the windows of your home to stop intruders, just smash through the walls instead if it ain't brick.
It's an endless cycle of improving security as hackers get smarter.
RE: I'm cursed - this is the sixt time in a year!
7/14/2012 1:24:42 PM
Exactly, and it's allocation of resources too. Would you rather Nvidia were spending its time and money always working on their security, or making better video chips? They just have to decide where in the risk/reward area those activities fall.
"It seems as though my state-funded math degree has failed me. Let the lashings commence." -- DailyTech Editor-in-Chief Kristopher Kubicki
Yahoo Loses 453,000 User Passwords to Hackers
July 12, 2012, 4:45 PM
Nokia is the Victim of SQL Injection, Loses Developer Records
August 29, 2011, 8:37 AM
Toshiba Thrive Tablet Available for Pre-Order June 13
June 3, 2011, 12:15 PM
NVIDIA Names GTX 480, GTX 470 as First GF100 Video Cards
February 2, 2010, 10:35 AM
Lenovo Once Again The Top Global PC Maker, Apple Takes 50% of PC Profits
October 9, 2014, 7:46 AM
It’s Official: HP to Split Into Two Business Units
October 6, 2014, 8:14 AM
Quick Note: HP Plans to Split PC, Enterprise Units
October 5, 2014, 4:31 PM
Samsung Prepping 14-nm for Apple A9 Production, Handling 30 Percent of A8 Orders
October 2, 2014, 1:17 PM
Lenovo to Complete $2.1B Acquisition of IBM's x86 Server Operations on October 1
September 29, 2014, 3:19 PM
ZOTAC Announces Diminutive ZBOX PI320 pico
August 27, 2014, 9:00 AM
Most Popular Articles
Google Launches "Same-day Delivery" Subscription Service for $95/year
October 14, 2014, 10:37 AM
Ireland to Close Loophole Apple and Google Used to Evade EU Taxes
October 13, 2014, 10:45 PM
Report: Next Generation iPad Air, iPad mini to Receive A8X with 2GB of RAM
October 13, 2014, 5:01 PM
Google Announces Android 5.0 “Lollipop”, Nexus 9 Tablet, and Nexus 6 “Phablet”
October 15, 2014, 12:41 PM
FBI Director: Don't Trust Government, But Give It Your Data Without Transparency
October 13, 2014, 7:20 PM
Latest Blog Posts
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
Space Terrorism is a Looming Threat For the United States
Apr 23, 2014, 7:47 PM
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information