NVIDIA forums hacked, accounts compromised

Late last night NVIDIA announced its forums had been hacked following the company's suspension of the service last week. The news comes just a day after it was revealed more than 400,000 Yahoo! Voice accounts had been compromised.

According to NVIDIA's announcement, hackers gained access to user information including usernames, e-mail addresses, hashed passwords with random salt value and publicly available "about me" profile information. The company emphasized that user passwords were not stored in plain text and the "about me" profile information was already publicly available. Information in this section could include a user's title, age, birth date, gender, location, interests, e-mail and website URL.

NVIDIA is currently investigating the incident and "are employing additional security measures to minimize the impact of future attacks," the company said. Additionally, user passwords will be reset when NVIDIA's forums reopen. Users will be e-mailed a temporary password along with instructions on how to change it. The company had suspended operations of the forums last week without mention of the incident. NVIDIA didn't say when the incident took place.

Thanks to Manarift in the forums for the tip!

Source: NVIDIA

Report a problem with article
Previous Story

We talk to Verizon about LTE, take a tour of their SF Innovation Center

Next Story

Super Smartphone Showdown Part 2: Displays

28 Comments

Commenting is disabled on this article.

I got an email from NVIDIA forum and MSN (or Hotmail) Service was flagging email as: "This message looks suspicious to our SmartScreen filters." SmartScreen should be renamed to "DumbScreen".

American Mafia said,
Post the damn Users and Password List! otherwise this isn't any worth

did you read the post ?

what are you gonna do with Hashed + salted passwords ? lol

s3n4te said,
And this is another reason why I buy AMD.

If you go with reasons like this for your purchases then major issues in life are ahead.

I am Not PCyr said,

is that suppose to make sense ?
His sense of logic dictate to his fanatical skull that AMD is more reliable.

I thought nVidia used IPB? It's more likely that the hackers gained entrance using a security flaw than by bruteforcing an admin password.

Lirodon said,
By the way, the Nvidia forum uses the same software we use (IPB 3.x)

They used a 3.0.x version from the looks which had a security holes that were fixed in later versions

Really? Nvidia? What in gods name were they hoping to steal? That was the most pointless data theft I've ever heard of.

Funny thing is, for having such meaningless information (the most that's going to happen is email spam... which already happens) they had better security than companies that hold financial information.

That's why on such websites I don't use main/actual email/pass/personal infos. I have an active account there, but I don't care at all.

If you check my spam/junk email I give, you won't believe what kind of crap it currently has. Full of BS.

makes you wonder what type of server are all these companies who're getting hacked are using. can someone at least do a good analysis of what's going on and how it's being done instead of just shouting out (this site and that site got hacked).

are they using windows servers, Apache or both?

ctrl_alt_delete said,
makes you wonder what type of server are all these companies who're getting hacked are using. can someone at least do a good analysis of what's going on and how it's being done instead of just shouting out (this site and that site got hacked).
are they using windows servers, Apache or both?

Some companies dont update their software as often as they should cause of custom modfication or other factors in their network but based off what i read for the post it was a sql injection so chances are it wasn't fully patched to fix said issue

ctrl_alt_delete said,
makes you wonder what type of server are all these companies who're getting hacked are using. can someone at least do a good analysis of what's going on and how it's being done instead of just shouting out (this site and that site got hacked).

are they using windows servers, Apache or both?

The main problem is not updating the forum software.

ctrl_alt_delete said,
makes you wonder what type of server are all these companies who're getting hacked are using. can someone at least do a good analysis of what's going on and how it's being done instead of just shouting out (this site and that site got hacked).

are they using windows servers, Apache or both?


Former colleagues (from a previous job working with VERY large brands) never fully adopted security measures: besides failing to update forum software as Sly_Ripper stated, they enable every plug-in they don't need, they open alternate firewall ports just-in-case, and they trust software providers who issue a million patches a week instead of the most-reputable (but slightly costlier) competing software package that does adopt greater security analysis.

doesn't matter the vulnerabilities people find are non stop
so it doesn't matter what their running
and relying on 3rd party updates isn't going to accomplish much either
i went through security issues for a long time with PHP Nuke for example
and eventualy dumped it because of security crap so i'm familiar with
the never ending exploits that come out.

I bet some bored "hackers" simply found an exploit on the platform,
then searched the web for the most well known and popular sites..
probably nothing to do with the target at hand, just a matter of having
a new hack and wanting to use it before its spread and patched.

I feel sorry for a lot of server admins because they may be targeted
endlessly until a vulnerability is found, persistence pays !
When hackers want you bad enough look out and watch your back lol

Manarift said,
What surprised me was it took them a week to actually report the issue on their site

Really? It took cryptic years to actually announce they were hacked.

Time for all the conspiracy theorists and paranoids here to speculate about the password encryption/salting/protection on their passwords...

ir0nw0lf said,
Time for all the conspiracy theorists and paranoids here to speculate about the password encryption/salting/protection on their passwords...

They didn't mention what algorithm, but...

Our investigation has identified that unauthorized third parties gained access to some user information, including:

• username
• email address
hashed passwords with random salt value
• public-facing “About Me” profile information


(from the e-mail I got this morning)

GreyWolf said,

They didn't mention what algorithm, but...

(from the e-mail I got this morning)


IPB default password hashing algorithm is: md5(md5(salt).md5(password)) and I doubt they actually changed it.

ir0nw0lf said,
Time for all the conspiracy theorists and paranoids here to speculate about the password encryption/salting/protection on their passwords...

nah, its all good.

After the biggest fail in history, the $ONY c*** newtowrk and their shi* PSN and l/p users stored on plain .txt nothing more worries me.