Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled • Hacker News Board

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#51

Post by lugg » Sat, Apr 27, 2019, 4:37 AM UTC

pavanagrawal123 wrote: post #18

lugg wrote: post #4

Earlier quoted context omitted.

I assume they will. I only just got the email and it looks like only a small subset of accounts are affected. Or at least that's what that PR spin is supposed to make you think.

I see. I originally thought this was the announcement, as that is what the post indicated.

Yea sorry about that I was more focused on figuring out what needed to be done today and who needed waking up so I just dumped the email.

I hope this doesn't hurt docker too badly. I really like the hub / auto build service.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#52

Post by viraptor » Sat, Apr 27, 2019, 4:39 AM UTC

gigatexal wrote: post #36

Does this lessen the relevance that docker has these days?

Did Docker become any less useful for you due to this, or provides less value? Unlikely.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#53

Post by viraptor » Sat, Apr 27, 2019, 4:41 AM UTC

diNgUrAndI wrote: post #48

What are dockerhub's alternatives? No 2FA. That is bad.

Your own repo, AWS ECR, whatever GCP's version is called, and many others.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#54

Post by wahern » Sat, Apr 27, 2019, 4:42 AM UTC

Scoundreller wrote: post #49

cabaalis wrote: post #39

Earlier quoted context omitted.

You are aware that Google identified a vulnerability so awful that they hid it from the public so as not to draw government scrutiny, did not retain access logs, and ultimately shut down a major public application? It wasn't authentication credentials, but still.

Which vulnerability was this?

Presumably the Google+ exfiltration issue.

> The bigger problem for Google isn’t the crime, but the cover-up. The vulnerability was fixed in March, but Google didn’t come clean until seven months later when The Wall Street Journal got hold of some of the memos discussing the bug. The company seems to know it messed up — why else nuke an entire social network off the map? — but there’s real confusion about exactly what went wrong and when, a confusion that plays into deeper issues in how tech deals with this kind of privacy slip.

(https://www.theverge.com/2018/10/9/17957312/google-plus-vuln...)

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#55

Post by lugg » Sat, Apr 27, 2019, 4:45 AM UTC

Operyl wrote: post #16

rhizome wrote: post #14

Earlier quoted context omitted.

They say "accessed database," so I'm thinking SQLi.

SQLi that managed to access only a single shard though? Hm.

It sounds more like a developer environment got exposed with prod data on it.

This going by the way it's worded "single hub database with a subset of non financial data"

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#56

Post by viraptor » Sat, Apr 27, 2019, 4:50 AM UTC

That's a nice summary. One thing I'm curious about is:

> Data includes usernames and hashed passwords

How are they hashed? And specifically, can we expect them to be already cracked?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#57

Post by buzer » Sat, Apr 27, 2019, 4:52 AM UTC

lugg wrote: post #42

morpheuskafka wrote: post #27

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

Pretty sure (don't quote me) those are read only and repo specific but that could contain all sorts of juicy info depending how lax you are with security of configs in private repos. Even then just read access to code often allows enough info for leveraging/escalating privilege.

When you connect your Github account to Docker Hub, that will give DH full access to all repos (https://i.imgur.com/4jJWrez.png). I'm not even sure if Github's permission model supports adding only read access to private repositories.

I'm not 100% sure if Docker hub uses deploy keys for repos it has access to thru the integration, but at least previously there was an option to manually add one to repository if it couldn't access it otherwise.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#58

Post by mkagenius » Sat, Apr 27, 2019, 4:54 AM UTC

yjftsjthsd-h wrote: post #46

steve_taylor wrote: post #41

Earlier quoted context omitted.

Direct links still work. Mac: https://download.docker.com/mac/stable/Docker.dmg Windows: https://download.docker.com/win/stable/Docker%20for%20Window...

True, but they deliberately obfuscate that to get people to sign up. Not a great look.

This is the opposite of what it actually should be. All the startups of the world, please ask least amount of personal information or none at all -- for all we know these things are bound to happen.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#59

Post by rectang » Sat, Apr 27, 2019, 4:54 AM UTC

morpheuskafka wrote: post #27

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

Maybe some day we'll get serious about reproducible builds, since reproducibility can serve as a layer of defense against such compromises.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#60

Post by azinman2 » Sat, Apr 27, 2019, 4:59 AM UTC

lowpro wrote: post #32

tylerl wrote: post #28

Earlier quoted context omitted.

I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order. But no, not Docker. You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" a…

Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0]…

“We are enhancing our overall security processes and reviewing our policies. Additional monitoring tools are now in place.”

Why wasn’t that the case before?!