This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's computing power to unpack it, thus defeating a signature-based antivirus that is limited by CPU computing power.

  • Has there been any documented instances of viruses leveraging the GPU occurring in the wild?

  • How have antivirus and antimalware vendors responded to this threat?

  • Does this mean WebGL and WebCL is another vector for exploit?

  • 2
    GPU viruses - that's an odd question. What's a CPU virus ? – StefanS Dec 15 '12 at 23:26
  • it's an interesting idea... a GPU virus may leverage bugs in graphics driver... but it will need to support at least the 3 major vendor (nvidia, ATI.. ehm... AMD, and Intel) – Max Dec 20 '12 at 8:39
  • 2
    @RoryAlsop The article cited here is not about a GPU virus, but about a CPU virus that only uses the GPU to leverage its computational power. – Gilles 'SO- stop being evil' Dec 20 '12 at 15:59
  • Might I suggest looking for a cached version of the VX Heavens website. This was, by far, one of the best VX resources on the web. – V_P Dec 20 '12 at 21:15
  • See our survey paper on attacks and security techniques for GPUs. It discusses GPU-based malware, use of GPU for keylogging, and many other techniques. – user984260 Apr 3 '18 at 2:57

The first GPU-assisted malware is considered to be the Badminer trojan reported by Semantec in 2011. Although its GPU leverage level is pretty low and the risk is low too, this is still the first precedence of using the GPU maliciously in the wild.

Another more intrusive example of the same idea is RiskTool.Win32.BitCoinMiner.

Then antivirus designers started to think really hard. No AV vendor will invent effective GPU-related protection until high-risk GPU-assisted malware starts to appear in large volume and more traditional AV approaches fail. It won't happen very soon. Meanwhile, it's just not feasible to protect against a still imaginary danger.

Everything is a potential attack vector as soon as it becomes more and more profitable. There's no such thing in the world that is not attackable or misusable in some form. Regarding particular WebCL, from Wikipedia: "Currently, no browsers natively support WebCL, seeing as it is new. However, non-native add-ons are used to implement WebCL."

|improve this answer|||||
  • Wasn't quite a virus but a bunch of online gaming community users had their GPU's hijacked to mine bitcoins (I was one of them) the company I probably shouldn't name as they have rectified the situation (a rougue employee added the code to their server browser program) - just a little extra info! – Dan Mar 6 '14 at 17:16
  • I believe you're talking about E-Sports Entertainment game developer as this article commercehousewirral.co.uk/commerce-house-wirral-latest-news/… describes your case. I don't see any point to refrain from naming/shaming/blaming as our planet simply must know its "heroes". Note, that it's still conventional malware requiring conventional Intel code to become active and proceed, so it's perfectly detectable by conventional AV solutions – Van Jone Mar 8 '14 at 7:46
  • Ah, in that case the company was ESEA. (play.esea.net) – Dan Mar 10 '14 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.