Just after Russia invaded Ukraine on February 24, US-based chipmaker Nvidia was hacked. It wasn't a minor incident — cybercriminals managed to take down vital services including email and developer tools. While the timing there fueled suspicion that the attack could be connected to the invasion somehow — after all, Nvidia chips are in devices everywhere, making it a valuable target — it's since become apparent that we're instead looking at a crypto-motivated shakedown attempt.
As detailed in a new report from Ars Technica, a hacking group using the name Lapsus$ will start leaking vital, stolen information including source code used in drivers and firmware unless Nvidia disables its GPU-limiting Lite Hash Rate (LHR) functionality. The hackers claim to have exfiltrated this gold mine of data from Nvidia's internal network, and they've already offered proof of that access with a leak that includes more than 70,000 email addresses and cryptographically hashed passwords.
LHR is a fairly new (February 2021) "feature" in Nvidia's GeForce RTX 3060, 3070, 3080 graphics cards, and it was specifically introduced to make it harder to mine cryptocurrency like Ethereum (ETH). It came into being largey in response to supply and demand issues: the crypto boom of the last couple of years has created a market hungry for cards that could take on the heavy-duty work mining requires, leading to shortages. LHR spots ETH algorithms and throttles the hash rate by half.
The cybercriminals demanded in a message posted on Telegram that Nvidia "make current and all future drivers for all cards open source," or Lapsus$ would release the rest of its pilfered files, revealing "closely-guarded trade secrets for graphics and computer chipsets too." Nvidia issued a statement Tuesday saying in part that it has no evidence that the hack was related to Russia's invasion of Ukraine, but otherwise, the company hasn't publicly responded to the hackers' demands. Right now, the clock is ticking — the ransom deadline is coming up today, Friday, March 4.