https://status.docker.com still not a mention. Wonder how long until it is.
that's not good...
Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
61–70 of 269 posts
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#62Earlier quoted context omitted.
we grit our teeth and "believe" that anyone traceably affected got an email directly from the company or something :D (that said, google main page vulnerable to xss is kind of like... what, we're afraid someone will take over google and put some cryptominers on the google.com main page?)
The Microsoft Approach... 'people totally didn't access your email body... except we eventually owned up to it after it got leaked'
Where did they deny that anybody's email bodies were read? I'm looking for it and I can't find it. I only see that they told the other 94%(?) of people that unauthorized access did not reveal the contents of their messages in particular, which seems to be truthful?
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#63What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…
Yes, huge poisoning target enhanced by the fact images/tags are not immutable, you really have no idea what you are fetching straight from dockerhub, one pull of the same image/tag may be different to the next pull. Most people blindly fetch without verifying regardless with multiple images of varying quality for software packages.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#64Not a huge surprise. Here's another security issue with Docker Hub they've let sit for 4 years with no action: https://github.com/docker/hub-feedback/issues/590 (which is apparently a dupe of https://github.com/docker/hub-feedback/issues/260).
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#65Earlier quoted context omitted.
The Microsoft Approach... 'people totally didn't access your email body... except we eventually owned up to it after it got leaked'
Where did they deny that anybody's email bodies were read? I'm looking for it and I can't find it. I only see that they told the other 94%(?) of people that unauthorized access did not reveal the contents of their messages in particular, which seems to be truthful?
Initial email said the body wasn't affected, and motherboard asked for a confirmation, so they said 'Yes'.
6% of the people received a specific email saying the body of their email was accessed and they had to backtrack.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#66What are dockerhub's alternatives? No 2FA. That is bad.
Your own repo, AWS ECR, whatever GCP's version is called, and many others.
There are actually very few alternatives for the autobuild part. The only alternative that I'm aware of is Quay, others require you to roll out your own build & push process.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#67Earlier quoted context omitted.
Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0]…
“We are enhancing our overall security processes and reviewing our policies. Additional monitoring tools are now in place.” Why wasn’t that the case before?!
Sometimes you don't know what to monitor until you know the attack vector. We are only human
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#68Earlier quoted context omitted.
Where did they deny that anybody's email bodies were read? I'm looking for it and I can't find it. I only see that they told the other 94%(?) of people that unauthorized access did not reveal the contents of their messages in particular, which seems to be truthful?
Initial email said the body wasn't affected, and motherboard asked for a confirmation, so they said 'Yes'. 6% of the people received a specific email saying the body of their email was accessed and they had to backtrack.
Well the email said:
> This unauthorized access could have allowed unauthorized parties to access and/or view information related to your email account (such as your e-mail address, folder names, the subject lines of e-mails, and the names of other e-mail addresses you communicate with), but not the content of any e-mails or attachments, between January 1st 2019 and March 28th 2019.
Notice it says your email account. The whole email is about the account of the recipient, not those of other recipients. Given that they explicitly worded it this way and people clearly misinterpreted it to mean something else, I hope you can forgive me for being a little skeptical of third-party anecdotes that suggest Microsoft claimed nobody's email contents were accessed...
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#69Earlier quoted context omitted.
Your own repo, AWS ECR, whatever GCP's version is called, and many others.
There are actually very few alternatives for the autobuild part. The only alternative that I'm aware of is Quay, others require you to roll out your own build & push process.
It's not that hard to roll your own (I'm doing that). It's not trivial, but if you need autobuild rather than just tags, it's not a huge time investment either. Some systems have all the necessary stuff exposed as plugins too (for example buildkite)
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#70Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...
That's because npm has a history of screwing the pooch.