3

I'm currently researching what malicious activities can one do with a computer containing a high-end GPU. So far the only uses I found were Bitcoin mining and password cracking. Are there any other possible malicious uses for such computers?

7

A high-end GPU makes it very easy to do any sort of computational process that can be highly parallelized, each individual process doesn't need a lot of memory, and requires similar operations to be done to differing starting input.

So if you have md5 hashes with salts that you want to find the password that goes with, its trivial; e.g., generate a simple scheme to feed the GPU billions of passwords per second to try simultaneously and compare to the hashes you have. You could also do things like try constructing hash rainbow tables as well.

Another good candidate would be brute-forcing decryption of a file that's encrypted with a strong cipher. A GPU could plausibly be used to parallelize the process of doing trial decryption under many candidate passphrases.

I wouldn't say bitcoin mining is malicious; its basically the intended method of generating currency (except a GPU makes it more efficient).

Off the top of my head could also use a GPU to better crack simple CAPTCHAs using computer vision techniques.

  • Proof of concept: IGHASHGPU can easily brute force MD5 hashes at a rate of 1 billion tests per second on high end hardware. – Frank Farmer May 19 '12 at 16:45
  • 1
    Your comments about brute-force decryption are inaccurate and reflect a misunderstanding of the link you posted. That link is about encrypting a single large file by someone who knows the password, which for CBC mode is not parallelizable. This question is about decrypting a file by someone who doesn't know the password. The latter is parallelizable: each guess at the password can be tried separately, in parallel. To test a guess, you only need to decrypt a few blocks, not the whole file. (And if you wanted to decrypt the whole file, CBC mode decryption parallelizes well.) – D.W. May 21 '12 at 0:45
  • @D.W. - You are probably right. The step of generating a decryption key from a password is easily parallelizable with a GPU (exactly similar to hashing). Applying each key to completely decrypt a file is not easily parallelizable with a GPU, and I was imagining some sort of bottleneck there with checking that the file appears to have been successfully decrypted (unlike a hash where you know the exact outcome hash you want the password to turn into). However, you can just attempt to decrypt say the first (few) block(s) and do a check if it appears to be valid data. – dr jimbob May 21 '12 at 4:15
  • OK, thanks, dr jimbob. I've edited the answer to reflect this. – D.W. May 21 '12 at 4:33
-1

Here are some other examples (some of these are vulnerabilities of GPUs):

  1. keylogging
  2. running stealthy malware,
  3. denial of service attacks (since WebGL allows browsers to use GPUs for accelerating webpage-rendering, if user opens a malicious website, his GPU can be overloaded such that it never responds and thus, crashes)
  4. extracting credit card numbers, email contents and classified documents from remanent data in GPU memory
  5. leaking other users' data in cloud-computing.
  6. Here is a real incident which happened in 2013: A malicious person hid a bitcoin miner in ESEA (a video game service) software. This miner used the GPUs in users’ machines for mining bitcoin without their knowledge. The miner overheated and harmed the machines by overloading the GPUs. Thus, the malicious person earned cryptocurrency at the expense of the users’ resources.

See my survey paper for a more detailed discussion on security vulnerabilities of GPUs along with their countermeasures, and works which show use of GPU for malicious purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.