NVIDIA Employee Data Leaked, Hackers Threaten Trade Secrets, RTX 40 Series Allegedly Exposed
As if to prove that, that same day, Lapsus released "part one" of its ill-gotten gains from NVIDIA, including proprietary source code as well as a database of employee credentials. The gang claims that this 20GB leak is just a tiny fraction of a full 1TB of data that they stole over the course of a week that they had admin access to NVIDIA's systems, and that if NVIDIA doesn't acquiesce to its demands, it will continue to release stolen proprietary data.
However, Lapsus has made numerous demands of NVIDIA, and changed its goals twice. Initially the group simply wanted to establish contact with Team Green, but later, it said that it wants the company to "push an update for all 30 series firmware that remove every LHR limitations." LHR, of course, stands for "Lite Hash Rate," and it refers to NVIDIA's practice of artificially limiting cryptographic hash rates on GeForce GPUs intended for gamers, rather than crypto miners. Lapsus claims to have gamers in mind with this demand, but it's hard to imagine how.
Then, on March 1st, Lapsus added another demand: "NVIDIA [must] commit to COMPLETELY OPEN-SOURCE (and distribute under a foss license) their GPU drivers for Windows, macOS, and Linux, from now on and forever." That's such a grandiose demand that it's hard to even take seriously, with users in Lapsus' Telegram chat alternately cheering them for their open-source spirit and jeering them for their unrealistic expectations.
Lapsus claims to have pilfered all kinds of proprietary product information, including design files such as RTL and layout information for "all recent NVIDIA GPUs, including the RTX 3090 Ti and upcoming revisions." That's the kind of information that constitutes "trade secrets," and certainly data that NVIDIA would prefer to keep out of the hands of its competitors—to say nothing of Chinese or Russian groups looking to create their own home-grown computer hardware. However, it's very likely that the information is tightly encrypted and may ultimately be of little value outside of NVIDIA's network.
That post said "YOU HAVE UNTIL FRIDAY, YOU DECIDE!", but Friday has come and gone, and the only news from Lapsus has been the leak of 204 GB of data from an unrelated Samsung hack. In fact, Lapsus has said twice today that it wants people to "GIVE US TIME," and that asking about the NVIDIA data will result in a block on Telegram.
Even if Lapsus doesn't end up releasing the design files for GeForce GPUs, the data that the group has released has already done plenty of damage. The employee data from NVIDIA included e-mail addresses and hashed passwords for some 71,335 employees both past and present. NVIDIA is only known to have around 18,000 employees at current, so it's possible that that information goes back quite a ways. HaveIBeenPwned claims that the hashes have been cracked already, and are being traded among the hacker community.
Furthermore, the driver source that Lapsus released, aside from any other consequences it may have, also apparently included the codenames and certain specifications for the next generation of GeForce GPUs. Thanks to hardware-heads @XinoAssassin1, @kopite7kimi, and @harukaze5719 on Twitter, we were able to compile this chart that lists the known specifications of NVIDIA's upcoming Ada Lovelace GPUs and compares them against its extant Ampere series.
The standout specification is of course the L2 cache size. It's tied to the memory bus width, and is sixteen times larger in Ada Lovelace than in Ampere. That's bound to have a big impact on performance, but don't discount the effect of having some 71% more shader modules, either. That top-end AD102 GPU is going to be absolutely massive, and likely responsible for the outrageous 600W power draw claims we've seen in the past.
Another concern from the Lapsus hack is the release of NVIDIA signatures. Along with the leak, a couple of signatures for expired NVIDIA certifications came out. Per cybersecurity enthusiast Kevin Beaumont (@GossiTheDog on Twitter), threat actors have already started using the leaked NVIDIA certs to sign their malware.
Even though they're expired, Windows 10 and Windows 11 will gleefully load them as drivers, at the kernel level. That opens the hatch for a flood of nasty exploits using the expired certs, but thankfully, security experts are already on top of the matter.
As of the time of this writing, in the mid-afternoon on Saturday in the United States, Lapsus has still not released any new NVIDIA information. We'll keep an eye on the situation and let you know if it develops.
