Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#21

Post by dlor »

koolba wrote: post #17
thosakwe wrote: post #12

Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. I’m just hoping that I was using a password manager by then. Any word as to the cause of this? Was something important stored in plaintext, etc.?

> Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. Eh? Doesn’t let you use what without an account? Anyone can pull images anonymously. An account is only for publishing.

Installing Docker for Mac/Windows has required users to login for awhile now.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#22

Post by judge2020 »

lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

Yep - my "deleted by associated Oauth application" event was triggered 2019-04-25 20:12:25 -0400

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#23

Post by Andoryuuta »

koolba wrote: post #17
thosakwe wrote: post #12

Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. I’m just hoping that I was using a password manager by then. Any word as to the cause of this? Was something important stored in plaintext, etc.?

> Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. Eh? Doesn’t let you use what without an account? Anyone can pull images anonymously. An account is only for publishing.

Downloading Docker CE for mac or windows requires an account.

https://github.com/docker/docker.github.io/issues/6910

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#26

Post by keithly »

thosakwe wrote: post #12

Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. I’m just hoping that I was using a password manager by then. Any word as to the cause of this? Was something important stored in plaintext, etc.?

You can brew cask install it on a Mac without an account

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#27

Post by morpheuskafka »

What permissions did the leaked tokens have?

If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base in that time.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#28

Post by tylerl »

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order.

But no, not Docker.

You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" as they are, and as godawful as the security practices are that underlie their tools and standards... they hadn't a chance. They still don't.

There is no reason to expect them to get better.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#29

Post by quickthrower2 »

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

Do they offer end to end encryption and signing. That would make your ci say f-off it the image has been played around with, and also protect any secrets, although there is no need to have source code or passwords in the image anyway.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#30

Post by morpheuskafka »

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

It's made worse by the fact that only a few major images are used as bases. That's normally good for security, as they are highly vetted and quickly updated, but if they could be compromised, say Alpine or Ubuntu Clould, even for a minute, countless images would be built using the compromised base and it would be very hard to ensure they were all rebuilt.

As I understand it, there's no element of signing from the actual devs of an image, just from the central trust service of Docker Hub.

Post reply on HN