14 DAY TRIAL // Last week, we reported on the hacking attack that took down NVIDIA's Forums, and how the company assured everyone that the stolen passwords were encrypted with random salt value.
Hacker group “Team Apollo” have now posted on Pastebin the results of their code break-in (they have claimed responsibility for the breach).
We've actually covered the topic already, for the most part, but we've picked it up again to puzzle over the fact that, rather than random salt value, the passwords were actually stored as MD5 hashes.
Team Apollo say the user data taken from the forums contains details of every fifth user (the estimated total is at 390,000 right now).
We don't really know why NVIDIA said random salt value had been employed to encrypt the passwords. It had to know that there were high odds of the culprits publishing their feat and proving the claim false.
At any rate, the problem here is twofold. One: NVIDIA basically lied for some reason, or maybe it got the name wrong for the encryption method.
Two: raw MD5 hashes are actually fairly easy to decrypt nowadays, compared to salt value hashes. In fact, there are MD5 decryption websites that have large databases of pre-encrypted MD5 phrases.
Even without such phrases, it wouldn't take too long to break the code, and here is where the most ironic part of all comes in: a CUDA-accelerated MD5 decryption tool makes short work of the hash values.
Indeed, as NVIDIA produced better and better CUDA parallel processing technology, it also gave prospective wrongdoers (or security weakness exposers in this case) the perfect weapons/tools against it.
As we said before, people with accounts on the NVIDIA Forums should change the password at the nearest opportunity, preferably to something different from whatever they use on other websites or e-mail accounts.
On that note, some changes to the shop.nvidia.com user information might be in order as well, seeing as how that site has also been compromised.