top | item 30550028

Cybercriminals who breached Nvidia issue one of the most unusual demands ever

720 points| jbredeche | 4 years ago |arstechnica.com | reply

669 comments

order
[+] SkeuomorphicBee|4 years ago|reply
A bit off-topic, but the fact that criminals asked for help mining, instead of money or crypto-money, just gave me an epiphany:

The whole internet is showing the first signs of a digital Resource Curse [1] brought by crypto mining. Crypto mining changed the economics of the digital world in such a drastic way that it is poisoning all kinds of internet interactions. It is not just about disrupting how money used to work, it is disrupting every kind of interaction, even those that had nothing to do with money. Things that were completely economically neutral before, so people did them just for fun, can now be exploited to extract value, so naturally some people do it and the previous innocent/neutral status quo is lost. For example: most free unix shell providers, a fun tradition from nerds from the 90s, had to shut down because now there is such a big economic incentive to abuse such free service.

And while writing above I realized that crypto is probably the second internet curse, with Google's algorithm being the first. When Google became the near-monopoly in the early 2000s, linking to a website ceased to be an economic neutral activity, people realized they could extract value from linking, so link spam became a big problem and forever changed the web.

[1] https://en.wikipedia.org/wiki/Resource_curse

[+] jason-phillips|4 years ago|reply
> The whole internet is showing the first signs of a digital Resource Curse [1] brought by crypto mining. Crypto mining changed the economics of the digital world in such a drastic way that it is poisoning all kinds of internet interactions. It is not just about disrupting how money used to work, it is disrupting every kind of interaction, even those that had nothing to do with money. Things that were completely economically neutral before, so people did them just for fun, can now be exploited to extract value, so naturally some people do it and the previous innocent/neutral status quo is lost. For example: most free unix shell providers, a fun tradition from nerds from the 90s, had to shut down because now there is such a big economic incentive to abuse such free service.

The whole internet is showing the first signs of a digital resource curse brought on by advertising. Advertising changed the economics of the digital world in such a drastic way that it is poisoning all kinds of internet interactions. It is disrupting every kind of interaction, even those that had nothing to do with advertising. Things that were completely economically neutral before, so people did them just for fun, can now be exploited to extract value, so naturally some people do it and the previous innocent/neutral status quo is lost. For example: most free, non-monetized content providers, a fun tradition from nerds from the 90s, don't exist now because there is such a big economic incentive to abuse such free service.

[+] PragmaticPulp|4 years ago|reply
Both of your examples (cryptocurrency and paid linking) are indeed plagues on quality content, but I disagree that they’ve replaced quality content.

They’re mostly examples of new business models that people have tried to use to generate new types of content and monetization in a crowded space. Sites like HN and commenters here aren’t trading links for money, we’re just sharing interesting content. The obvious paid advertisements (going from 0 votes to +20 votes in minutes despite obvious content marketing) get flagged away quickly for the most part.

Crypto and “web3” especially has become a catch-all for people who want to catch a gold rush or have otherwise run out of ideas for traditional business success. The problem they’re discovering is that the average consumer has almost no interest in crypto unless it’s as a speculative investment to flip to someone else, which means the entire space is basically crypto people flipping things to each other and trying to convince new people to join in so they have more downstream people to flip their tokens too.

But despite the constant efforts to flood our news feeds with crypto stories, most of us navigate the internet without cryptocurrencies or NFTs because they’re entirely unnecessary and you have to go out of your way to do anything with them. Since they bring no actual benefit, we just ignore it. And it’s fine.

[+] SketchySeaBeast|4 years ago|reply
It's what happens when you throw a pyramid scheme into something - just like with pyramid/mlm schemes in real life, suddenly everything is about optimizing for the scheme. Every conversation becomes a sales pitch.
[+] lmkg|4 years ago|reply
That's a good way to summarize the problems that traditional game-devs foresee with NFT games. Game purchases are viewed as speculative investments rather than entertainment.
[+] hemloc_io|4 years ago|reply
Devils advocate here, but crypto does disrupt a free sharing economy that's on the internet and part of the magic of it.

Yet maybe there are benefits in terms of making previously economically inviable things viable. People making passion projects are great, but at the end of the day they are creating value for people that's almost never reciprocated in other ways and tokenizing things lets them capture that value or add new value to what their selling.

e.g. with NFTs right now you have three parties, the buyer -> who gets provenance ("ownership") the digital artist -> who makes more money off their art than was possible before because rarity is built into the price now. (Non-fungible, unlike selling prints tshirts etc.) everyone else -> who can still copy and share the work for free, as before.

I feel like this should be a growth engine for digital artists, that has minimal impact on the general public, and everyone walks away happy with the transaction. (Putting aside scams b/c the market is unregulated, environmental concerns, etc. just talking economics.)

[+] abecedarius|4 years ago|reply
The resource curse is that natural resources go together with oppressive government: the former can promote the latter in that an oppressor needs some form of wealth to pay their minions/allies, and international sales of extracted resources are a source of wealth that makes fewer demands on widespread cooperation from the locals than does local development.

How does this map to crypto? Who's the oppressive government we're getting more of?

It's correct that crypto changes the economics, and I'd say that's a good thing. We've tried leaving economics out of our core means of cooperation online for a few decades, and we don't seem very happy with the feudal internet that that led to. Let's try expanding the range of ways of coordinate and to fund work, with e.g. https://gitcoin.co/

[+] hdjjhhvvhga|4 years ago|reply
I'm sure many people would agree with your diagnosis. What's the treatment, though?
[+] Geee|4 years ago|reply
The curse is crypto tokens and NFTs, not Bitcoin or proof-of-work. As we have seen, most of these tokens are just speculative schemes without connection to the underlying property.

On the contrary, Bitcoin, as a seamless Internet-native currency, can actually help making the Internet better, by allowing easier and better ways to monetize content instead of relying on advertising. In the coming years, we'll see more Bitcoin-based services popping up.

[+] jl2718|4 years ago|reply
I have a dream of solving this with extreme-infungibility of a currency system.

I’m sure every ancient civilization noticed this problem when the ease of trade that came with common currency resulted in the incentive to be conquered and taxed from a foreign land.

[+] outside1234|4 years ago|reply
Can we please just jump to the end and make it illegal to transfer Crypto to Fiat?
[+] z3c0|4 years ago|reply
I agree with you overall - this does appear to be another resource curse - but I want to point out that the culprits in this matter are the companies that bottleneck the overly-abundant resources for profit (so Nvidia and Google), not the users who attempt to bleed constrained value through that bottleneck. Nvidia used their near-monopolistic power over the graphics card market in an attempt to globally limit the hash rate of mining. I doubt their intent was as altruistic as they spun it either - it seems very obviously a move to force miners to use more GPUs in parallel, to circumvent the limits in each single GPU. I find that to be more concerning than some hackers demanding that they stop.
[+] chmod775|4 years ago|reply
> So, NVIDIA, the choice is yours! Either: Officially make current and all future drivers for all cards open source, while keeping the Verilog and chipset trade secrets... well, secret OR Not make the drivers open source, making us release the entire silicon chip files so that everyone not only knows your driver's secrets, but also your most closely-guarded trade secrets for graphics and computer chipsets too!

Interesting. Someone got really fed up with them. I don't think their binary blob ever made them any friends.

[+] mjg59|4 years ago|reply
There are two scenarios where carrying out their threat plausibly helps the open source community:

1) A source drop demonstrates that Nvidia incorporated GPLed code into their drivers. This is, honestly, unlikely - Nvidia has sufficiently competent lawyers to ensure that everyone they employ is extremely aware of what the consequences of that would be

2) The source drop includes the private keys used to sign Nvidia GPU firmware blobs. Nouveau is currently entirely hamstrung on the last few generations of Nvidia cards because they run extremely slowly unless appropriate signed firmware is loaded, and Nvidia refuse permission to distribute that firmware. I'm not aware of any case law around whether private keys are copyrightable (I'd assume not, given that they're supposed to be randomly generated), and whether it's a DMCA violation to make use of leaked keys if you don't violate any other technical protection mechanisms. This would potentially (given a lot of work) allow Nouveau to implement equivalent firmware and sign it, but this would presumably still just result in Nvidia switching to different keys for the next architecture.

Obviously the calculation differs if Nvidia choose under duress to release the drivers under an open source license, but that doesn't seem likely - this still very much reads as an attempt to extort Nvidia into removing restrictions on crypto mining rather than an earnest attempt to improve open source support for their hardware.

[+] httpz|4 years ago|reply
>"We decided to help mining and gaming community,"

I don't understand how this demand helps the gaming community. Wouldn't this drive up the crypto-motivated demand for GPUs even more and hurt the gaming community?

[+] heavyset_go|4 years ago|reply
> I don't understand how this demand helps the gaming community.

It doesn't. This is just miners co-opting an old argument to gain sympathy.

[+] Pelam|4 years ago|reply
For a long lists of reasons; I don’t like DRMesque features like LHR and don’t like the crypto craze.

(And to be clear, cyber-extortion is clearly a criminal activity.)

BUT, I think the ”helping gamers” sounds a bit hollow.

[+] ckastner|4 years ago|reply
> I don't understand how this demand helps the gaming community.

Agreed. But I don't understand how this helps the mining community, either.

Removing the LHR restriction would lead to a vast increase of the network hash rate, and consequently the difficulty would also increase, leading to lower rewards. The result would be that (1) non-LHR card owner's rewards go down significantly, and (2) LHR card owner's rewards probably wouldn't change much, perhaps even go down as well.

At least 80% of Nvidia GeForce cards sold since Summer 2021 have been LHR. That's a lot of hashing power locked up.

[+] pizza234|4 years ago|reply
The article is confusing. It has conflicting information (the hacker group seems to have released conflicting statements).

First, it's about LHR only.

> We want nvidia to push an update for all 30 series firmware that remove every lhr limitations otherwise we will leak hw folder. If they remove the lhr we will forget about hw folder (it's a big folder). We both know lhr impact mining and gaming

Later, it becomes about entirely open sourcing the drivers:

> So, NVIDIA, the choice is yours! Either:

> –Officially make current and all future drivers for all cards open source, while keeping the Verilog and chipset trade secrets... well, secret

[+] hungryforcodes|4 years ago|reply
Just sell more GPUs. Nvidia makes more money. We get more and better GPUs.

I'm not sure how this is bad.

[+] Godel_unicode|4 years ago|reply
I think the argument is that driver source being open could help the (tiny!) Linux gaming community, but I agree. This is about mining.
[+] moonchrome|4 years ago|reply
OSS terrorists blackmailing a corp into opening their code under threat of releasing IP/trade secrets - cyberpunk future here we come :)
[+] cyberpunk|4 years ago|reply
My time has come, finally! ;)
[+] jrochkind1|4 years ago|reply
I doubt nvidia would have complied with their demands anyway, but the new demand "make all your code open source or else we'll release it ourselves" gives them absolutely no incentive to comply at all. If the choices are you can have your source out there but unlicensed so it's illegal for anyone else to use it, or you can choose to legally let anyone else use your source -- why would nvidia ever choose the latter?

The original version of the demand at least gave nvidia some business incentive to comply. I don't think they've thought through their demands very well.

[+] FridgeSeal|4 years ago|reply
> We decided to help mining and gaming community," Lapsus$ members wrote

Oh please. You have crypto and a vested interest in making GPU’s viable again.

Sorry but I have zero sympathy-crypto miners exacerbated the silicon shortage and leveraged their increased capital to make consumer cards so inordinately difficult to get. So no, suffer.

[+] bouncycastle|4 years ago|reply
I'm not a big fan of limiting hardware to run only approved software. One day it's for limiting crypto mining, the next day it will be for limiting our ability to use strong encryption. It's a slippery slope.
[+] ProtoAES256|4 years ago|reply
I absolutely hate Nvidia on my Ubuntu machine geared towards development. It's been about 4 years since I've entered the CUDA(and cudnn) scene for AI development.

You'd think I'd be a guru in the installation process by now but I still occasionally make my system unbootable for one reason or another with new releases, or the whole thing "just don't work" outright.

It is really, really frustrating since every solution is basically "try again or start anew, we don't have the source so can't help you much sorry".

[+] squarefoot|4 years ago|reply
I would rather outlaw cryptocurrencies for being a harm for the planet with their crazy energy demands, besides also fueling criminals.
[+] ezoe|4 years ago|reply
Be careful what you wish for. While I agree the current cryptocurrency is a mess, but prohibiting a pure computation cause more harms than good.
[+] smokey_circles|4 years ago|reply
I'd like to engage with this opinion because I genuinely have no idea how this is the conclusion people reach (that crypto is bad for the environment).

The configuration of transistors through which electrons are punched is obviously not the problem (at least I hope it's obvious).

So it must be about proof of work chains, right? That they create high demand? That's about the only point I do understand, but I think you'd be hard pressed to meaningfully translate a bitcoin transaction to a carbon cost. There are some mining farms powered by green energy (less altruistic and more about being off grid).

But if we're talking about energy usage and environmental damage, we have to talk mining.

There is just no debate that mining is THE singular (keyword) greatest threat to the environment. Fracking, acid mine drainage, offshore drilling, sonic bombardments of coastlines, the ridonculous requirements of smelting. The list goes on and on.

We are stuck with that industry for a long time though. I'd argue the minerals that constitute the technology you're using to view this comment may have done more damage than bitcoin and co have.

In a nutshell, here's my problem with this argument: To suggest that demand is responsible for the damage caused by supply is just a crazy warping of reality. That absolutely does not make sense.

There are other, more pressing issues with crypto (like the lack of regulation around fiat exchanges and how they constantly get rugged) and those criticisms are valid, but they get lost in the noise of "how we generate energy is not as bad as how we use it". I just can't get on board with that point of view.

[+] 0xedd|4 years ago|reply

[deleted]

[+] schappim|4 years ago|reply
Would seem to be a rather misinformed comment even to a crypto-layperson.

I’m surprised we don’t have a chorus of cyptofiles informing you that crypto emits less greenhouse gases than the traditional banking system, and there are coins/tokens that don’t require melting chips to establish proof of work.

I can’t talk to the use of crypto currencies for crime, but I would be surprised if the total volume of transactions were greater than that of traditional currencies (ie cash).

[+] baby|4 years ago|reply
Cryptocurrencies are pretty green besides bitcoin and ethereum
[+] i67vw3|4 years ago|reply
Could you tell your daily routine? I would like to calculate your carbon footprint and compare with mine to see whose is higher. By it, we can figure if you or me (an average cryptocurrency user) is harming the planet more.
[+] hyperman1|4 years ago|reply
I wonder how professional these criminals are. A crime syndicate would silently ask for money. This seems either a false flag operation for a group wanting something else, or much more likely a kid playing around and finding an unlocked door.

That last case, a kid pissing of a powerfull entity with a crime, generally does not end well for the kid.

I don't see NVidia publicly giving in and loosing face, so there seems no upside either for the criminal.

[+] feanaro|4 years ago|reply
So you think nVidia will want to see the release of all of its chip schematics? That's an interesting position, but I fail to see how that would be a good idea for them. Perhaps if they are hoping the hackers will be apprehended before Friday.
[+] ftyers|4 years ago|reply
NVIDIA's terrible software (drivers and CUDA) have wasted months of my time. They have what is essentially a monopoly on hardware for "Deep learning" and so this should come as no surprise. Of course to a certain extent this isn't their fault, if AMD or Intel got their acts together they could come up with a much better solution, and if it were free/open-source software people would even pay a premium to be free of NVIDIA's cruel grasp.
[+] nojs|4 years ago|reply
> Nvidia introduced LHR in February 2021 with the launch of its GeForce RTX 3060 models. Three months later, the company brought LHR to its GeForce RTX 3080, 3070, and 3060 Ti graphics cards. The reason: to make the cards less desirable to people mining Ethereum and possibly other types of cryptocurrencies.

What a bizarre move. Why would they do this?

[+] ofrzeta|4 years ago|reply
I don't get that logic: "We decided to help mining and gaming community", while in reality removing that LHR feature would only help Ethereum miners.
[+] avianes|4 years ago|reply
Not sure if hackers understand that NVIDIA is not necessarily the only victim if they leak the hardware. This hardware folder potentially contains IPs from other companies and the standard cell library from TSMC
[+] bobsmooth|4 years ago|reply
Imagine if they actually leaked the driver source and verilog files though...
[+] nharada|4 years ago|reply
> We decided to help mining and gaming community

How does removing LHR help the gaming community?

[+] grogenaut|4 years ago|reply
Cybercriminals will release demands or rationale like this in an attempt to sway public favor as well as have the company spend resources on the demand/threat instead of remediation or forensics. They're still criminals threatening and extorting others at the end of the day.
[+] hsbauauvhabzb|4 years ago|reply
I find three components of this very interesting:

They’re requesting an LHR unlock over a ransom, surely you could get $100m out of nvidia with this stuff, how many 3 series cards do you need for LHR to be more equitable, especially when everyone gets the unlock. Maybe it’s about reputation?

The fact that they’re ransoming data instead of crypto locking isn’t something I’ve seen before. It’s inevitable once targets start backing up, but interesting it’s the first move they made.

The fact that they changed their ransom to include open sourcing drivers. This surely reduces reputation, and makes them look amateur. IANAL but blackmail coercion surely invalidates any otherwise legally binding obligations, right?

[+] nikanj|4 years ago|reply
This is pretty high on my Cyberpunkometer