Nvidia's Brev Cloud Platform Suffers Security Incident, SSH Keys Potentially Exposed

Brev Platform Security Incident

Nvidia's Brev cloud development platform was targeted by hackers, leading to unauthorized activity reported by users between October 4 and October 20. Nvidia informed affected customers that some accounts might have been exposed and identified unidentified activity on the platform. Information stored on the platform, including SSH keys set up by Brev, may have been exposed.

Response and Mitigation

Nvidia has replaced the affected SSH keys and updated customer machines with new ones. The company stated that its investigation found no evidence of improper use of the compromised keys. The notification to customers confirmed that their information from the Brev network might have been affected and that the SSH key was rotated with a replacement key provided to instances.

Unanswered Questions

Nvidia did not provide details on how attackers gained access to the platform or whether attempts were made to use the compromised data. The company also did not disclose if customer data or workloads were accessed during the incident. SSH keys are critical for secure access to virtual machines, allowing developers to manage remote servers and execute commands; their compromise could potentially grant control over a virtual machine depending on its permissions.

Broader Industry Context

This incident occurs amidst increasing security challenges for firms hosting AI development services and cloud infrastructure. Cybersecurity firm Wiz reported 'Black October' for AI developer platforms, identifying at least nine platforms with security incidents during the month. These incidents often involve targeted exploitation of stored environment variables, particularly those granting AI access.