NVIDIA Brev security breach exposes customer SSH keys and data risks

NVIDIA is currently investigating a security incident on its Brev cloud development platform after detecting unauthorized activity between October 4 and October 20. According to customer notifications, the breach may have exposed sensitive information, including SSH keys used to access virtual machines.

• Brev detected unauthorized activity on its cloud development platform between October 4 and October 20.
• The security breach may have exposed customer SSH keys used for virtual machine access.
• NVIDIA has rotated affected keys and updated customer instances, noting no current evidence of misuse.

Details of the Brev Cloud Platform Security Incident The security breach came to light after users reported suspicious activity on the platform. NVIDIA's investigation revealed that malicious actors may have accessed information stored within the Brev network, specifically the SSH key sets established by the service. SSH is a secure protocol that allows developers and system administrators to manage remote servers and virtual machines securely without physical access.

The company stated that it has already replaced the affected SSH keys and updated customer machines with secure replacements. However, NVIDIA has not yet disclosed the exact attack vector, whether the unauthorized parties attempted to use the compromised credentials, or if any customer data and workloads were accessed during the exposure window.

Broader Context of Security Breaches in Cloud Platforms This incident unfolds alongside a wave of security challenges affecting AI and cloud infrastructure providers. Cybersecurity firm Wiz recently highlighted a trend dubbed 'Black October', identifying multiple developer platforms that suffered security incidents involving targeted exploitation of stored environment variables and credentials granting AI access.

Expert Recommendations for Impacted Users Threat intelligence analysts emphasize that simply patching or updating software may not fully eliminate unauthorized access. Experts recommend that users perform extensive checks, isolate hosts that installed extensions during the exposure window, remove any unrecognized SSH keys, and thoroughly rotate all credentials and sessions.