Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Do you think that vendors like nvidia will be able to keep their bios proprietary and encrypted? Would be cool if we could enable things like nvlink on consumer cores
 help



It takes time and effort to find vulnerabilities. GPUs are still a moving target, with frequent new models, and many different chips, with multiple companies producing different PCBs. Game consoles are a more static target by contrast.

You would need a juicy target, easy to procure for cheap for the effort to make sense.

It's probably doable, though I suspect that more recent models are probably better protected against that sort of attack. These are performance-oriented chips though, not security-oriented, so they probably make a few compromises. They may also use chiplets with a more secure "secure element", I have no idea (though you still need to communicate with it).

I don't think I've seen anyone attempt it, so it may be that they haven't specifically hardened their designs against these attacks.

Then comes the question of practicality: would you solder a "modchip" to your GPU? It may even be hard to reach the correct spot without interfering with cooling.

I would bet that this is doable with the same setup as the RP2350 hack, but that requires drilling into the specific chip that you are targeting, so great, but not very useful: there probably aren't many secrets to extract, you could decrypt the BIOS (I thought these were just signed with asymmetric keys?) and try to find an exploit in the code there, I guess. But this specific technique is not useful for putting your own firmware then using the chip.

Anyway, it's probably doable to glitch the power supply of some mid-to-late 2010s nvidia GPUs to have it accept custom BIOSes, though graphics card are specifically designed to keep the power supply stable, so you would have to desolder a lot of capacitors (and reconnect them after startup is finished?).




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: