backtop


Print 33 comment(s) - last by JimKiler.. on Jul 16 at 2:22 PM

Fortunately passwords appear to have been strongly hashed

NVIDIA Corp. (NVDA) had some bad news to announce late yesterday.  The site posted the following statement on its Forums page:

NVIDIA suspended operations of the NVIDIA Forums (forums.nvidia.com) last week.

We did this in response to suspicious activity and immediately began an investigation. We apologize that our continuing investigation is taking this long. Know that we are working around the clock to ensure that secure operations can be restored.

Our investigation has identified that unauthorized third parties gained access to some user information, including:

 
  • username
  • email address
  • hashed passwords with random salt value
  • public-facing "About Me" profile information
NVIDIA did not store any passwords in clear text. "About Me" optional profiles could include a user’s title, age, birthdate, gender, location, interests, email and website URL – all of which was already publicly accessible.

NVIDIA is continuing to investigate this matter and is working to restore the Forums as soon as possible. We are employing additional security measures to minimize the impact of future attacks.

All user passwords for our Forums will be reset when the system comes back online. At that time, an email with a temporary password, along with instructions on how to change it, will be sent to the user’s registered email address.

As a precautionary measure, we strongly recommend that you change any identical passwords that you may be using elsewhere.

NVIDIA does not request sensitive information by email. Do not provide personal, financial or sensitive information (including new passwords) in response to any email purporting to be sent by an NVIDIA employee or representative.

NVIDIA, like Sony Corp. (TYO:6758), Nokia Oyj. (HEX:NOK1V), and others likely fell victim to an SQL injection attack.  SQL injection attacks exploit the fact that internet user databases are publicly hosted and send them malformed request strings designed to execute disallowed commands.  They can be defeated by careful programming, but implementing protections is a time intensive and expensive process, hence many companies have vulnerable databases.

NVIDIA logo
[Image Source: NVIDIA Wallpapers]

NVIDIA Forums is a popular stomping ground both for gaming enthusiasts and for programmers developing GPU applications using NVIDIA's proprietary CUDA API.

The first of two major concerns arising from the NVIDIA attack is the possibility of phishing.  Now that an unknown party has users emails, it could send them messages (as the NVIDIA post alludes to), trying to trick them into providing their password in plaintext or other personal details.

The second danger is the possibility that the hashed passwords could be cracked.  NVIDIA did not reveal what hashing algorithm it used, but the fact that it used a random salt value indicates that its passwords were likely relatively strongly hashed.

The announcement was actually the second major announcement of a SQL injection breach on Thursday.  Earlier, Yahoo! Inc. (YHOO) announced that hackers had found 453,000 of its user passwords.  Yahoo! was less fortunate than NVIDIA -- baffingly it decided to store its user passwords in plaintext, greatly increasing the potential damage to its users.

Source: NVIDIA Forums



Comments     Threshold


This article is over a month old, voting and posting comments is disabled

By ArizonaSteve on 7/14/2012 2:47:46 PM , Rating: 2
...in their SQL should be immediately fired. There is absolutely no excuse for this, none at all.

Concatenating user-entered data into a SQL statement is a recipe for this sort of security breach.




By japlha on 7/16/2012 10:43:14 AM , Rating: 2
Exactly. I work with Oracle. I see programmers concatenting strings from user input to create SQL statements that are passed to the database.

Also, their code fails when a user enters a single quote. Then they waste more time writing elaborate parsers.

Just use bind variables and call stored procedures.
SQL injection attacks will go away because there is no SQL to inject!


"We basically took a look at this situation and said, this is bullshit." -- Newegg Chief Legal Officer Lee Cheng's take on patent troll Soverain














botimage
Copyright 2014 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki