NVIDIA has acknowledged a security breach involving their Brev cloud development platform where SSH keys for customer virtual machines were exposed. This is significant as it may lead to unauthorized access to code or compute resources for developers using Brev for AI model training and testing. The exposure window spanned from October 4 to October 20, a 16-day period in which malicious entities could potentially misuse these compromised keys.
NVIDIA rotates keys after 16-day unauthorized access window
Brev provides a cloud infrastructure solution for AI developers, providing the compute capacity needed to train large language models. It enables users to deploy virtual machines with specific GPU setups, which is integral to today’s AI development pipeline. With the exposure of SSH keys, there is a risk that unauthorized individuals could potentially access these instances and potentially alter the environment.
In response, NVIDIA has already rotated the exposed SSH keys and rolled out new keys to all customer instances to secure the platform. They have indicated that their investigation did not reveal any misuse of the compromised keys during the exposed period. However, they have not confirmed whether any customer data or workloads were accessed by the attackers, which adds a layer of uncertainty to the impact.
This breach adds to a series of security challenges hitting various tech companies recently, dubbed ‘Black October’ by some in the industry. This breach has been pointed out by social media users along with other recent key and API leaks across the industry. While there’s no confirmation of misused data, it emphasizes the ongoing security challenges within cloud development environments.
Did they specify if any customer data was actually accessed or just the keys rotated proactively?
NVIDIA stated they found no evidence of improper use but did not confirm whether workloads were touched.
black october is real now 😂
The breach window was 16 days. Rotation alone does not guarantee prior sessions were terminated by the attacker.
I hope they are rotating keys more frequently than 16 days by default for all enterprise customers.
This highlights the risk of long-lived SSH credentials in cloud environments. Short-lived tokens are the only real fix.