Attacks/Breaches
7/16/2012
11:41 AM
50%
50%

Nvidia Investigates Password Breach

Hacker posts "Apollo Project" leak involving 800 forum and developer passwords.

Graphics and mobile processor manufacturer Nvidia has confirmed that about 800 users of is online forums had their personal information, including usernames and passwords, posted online.

Thursday, Nvidia said that earlier this month it suspended Nvidia Forums "in response to suspicious activity and immediately began an investigation," and apologized for the investigation continuing. "Know that we are working around the clock to ensure that secure operations can be restored."

Nvidia Friday then confirmed that "a small proportion of users' hashed passwords for DevZone has been posted publicly," via a statement posted to its Developer Zone site. "We continue to strongly recommend that you change any identical passwords that you may be using elsewhere." For now, however, Nvidia said that its Developer Zone would likewise remain offline until the company concluded its investigation.

"All user passwords for our forums will be reset when the system comes back online. At that time, an email with a temporary password, along with instructions on how to change it, will be sent to the user's registered email address," it said.

[ Even Apple's security checks aren't safe from hackers. See Apple In-App Store Hacked. ]

According to Nvidia, "unauthorized third parties" had gained access to some of its forum members' usernames, email addresses, public-facing "about me" information, as well as "hashed passwords with random salt value." But the company said that it "did not store any passwords in clear text." Furthermore, while users' "about me" profiles could contain "a user's title, age, birthdate, gender, location, interests, email, and website URL," all of those profiles were already publicly viewable.

In response to Nvidia's Thursday advisory, a hacker Friday posted to Pastebin a list of what he called "Nvidia Admin Hashes," as part of what he dubbed "The Apollo Project." The 800 leaked accounts included numerous nvidia.com email addresses, plus Hotmail and Gmail Webmail accounts, as well as corporate accounts at ARM, Bloomberg, Fibertek, Givex, Honda, Patriot Memory, and many other companies. According to the Pastebin post, the list was only a "partial dump" of purloined data. In addition, the post also warned that Nvidia's online store had been hacked. That led Nvidia, on Friday, to also suspend operations for the Nvidia Gear Store.

"But let's put this in perspective, this is only a forum hack," according to a note included in the Pastebin post. "I am actually suprised [sic] nVidia decided to even disclose that they'd been hacked quite a few weeks ago ... It did take them a while though. We aren't acting extremely maliciously, we've used this database to target disgusting corporations who deserve to be brought to justice ... and we are getting there, slowly but surely."

As noted, Nvidia urged all users to reset any of their forum passwords that they've reused elsewhere. "Password re-use is a big problem--with an alarming number of people using the same password on multiple sites," said Graham Cluley, senior technology consultant at Sophos, in a blog post. "The consequences of that lax attitude to security is that if you get hacked in one place, your other online accounts could also be accessed. For instance, if you used the same password on Nvidia as you did on your Web email account, it would be child's play for hackers to gain access to your personal communications and steal other information about you."

Nvidia's password breach disclosure follows on the heels of a hacking group calling itself "WikiBoat" announcing via CodePaste.net Wednesday that it had obtained 35,000 usernames for customers of surf-clothing maker Billabong. But the attackers said they were only releasing a subset of the data they'd obtained, which appears to run from email addresses that start with the letter "A" through to email addresses that start with the letter "M."

Meanwhile, a hacking group calling itself D33Ds Company last week released 450,000 usernames and passwords associated with Yahoo Voices--formerly known as Yahoo Contributor Network--as well as 420,000 passwords from question-and-answer website Formspring.

Those incidents followed recent password breaches involving LinkedIn, as well as eHarmony and Last.fm. With the exception of Yahoo, which appeared to be storing user passwords in plaintext, all of those breaches came to light after stolen password hashes were posted to online cracking forums.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1414
Published: 2015-02-27
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

CVE-2015-2072
Published: 2015-02-27
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or...

CVE-2015-2075
Published: 2015-02-27
SAP BussinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.

CVE-2015-2076
Published: 2015-02-27
The Auditing service in SAP BussinessObjects Edge 4.0 allows remote attackers to obtains sensitive information by reading an audit event, aka SAP Note 2011395.

CVE-2015-2101
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.