hash+salt please
Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
71–80 of 269 posts
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#72Earlier quoted context omitted.
I see. I originally thought this was the announcement, as that is what the post indicated.
Yea sorry about that I was more focused on figuring out what needed to be done today and who needed waking up so I just dumped the email. I hope this doesn't hurt docker too badly. I really like the hub / auto build service.
You aren't the one hurting Docker, they've done that themselves. You put the word out there, so thank you for thinking of everyone else out there.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#73If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…
Yesterday at 9pm PT my private Github repo produced this notification:
The following SSH key was added to the foo/bar repository
by myorg-dockerhub-user:
Docker Cloud Build
39:31:51:be:d6:00:c4:ef:c7:74:c2:16:66:33:93:06
If you believe this key was added in error, you can
remove the key and disable access...
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#74If the passwords are hashed, just what are the likelihood of your passwords being decrypted? I’d also imagine it is a one way hash since that’s typically the norm so I don’t even know how it can get decrypted.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#75What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…
Docker Hub's Github integration requires both read and write access for private repositories. In fact, if you want it to set up deploy keys I think it requires Admin access.
See this issue: https://github.com/docker/hub-feedback/issues/873
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#76Earlier quoted context omitted.
Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0]…
“We are enhancing our overall security processes and reviewing our policies. Additional monitoring tools are now in place.” Why wasn’t that the case before?!
1. Because humans aren’t perfect. 2. Because mistakes happen.
3. Because there’s a cost to everything: if you want better security, it’s going to cost you more, immediately. And we don’t always estimate trade-offs correctly (see points 1 and 2).
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#77Earlier quoted context omitted.
> Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. Eh? Doesn’t let you use what without an account? Anyone can pull images anonymously. An account is only for publishing.
Downloading Docker CE for mac or windows requires an account. https://github.com/docker/docker.github.io/issues/6910
I downloaded it last week without an account. It involved one of those non-obvious skip button dark patterns.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#78If the passwords are hashed, just what are the likelihood of your passwords being decrypted? I’d also imagine it is a one way hash since that’s typically the norm so I don’t even know how it can get decrypted.
Hashes are not decrypted, they are bruteforced.
> I imagine it is a one way hash
All hashes are one way. If it's lossless and can be reverted, it's a compression algorithm or isomorphism or encryption or cipher or any of a number of other things, but not a hash.
> I don’t even know how it can get decrypted.
It is not decrypted, but brute forced. For example, even if you can't algorithmically figure out what the input to md5sum is that gives you '1f3870be274f6c49b3e31a0c6728957f', you could apply md5sum to every word in the dictionary in a matter of seconds and find out that 'apple', when md5summed, has that output. You would then have one possible password for that hash (though technically there are infinitely many inputs that have that output).
The only way we can know how computationally difficult it is to brute force the password hashes is if we know the following: 1) the hash algorithm used (and other inputs like cost factor) and 2) the entropy of the salt used. Those two together lets us calculate the amount of computation needed to try one brute force "guess". Individual password's difficulty to be brute forced can then be calculated from their entropy (e.g. 'apple' has less entroy than '2SEZb'), to determine the average number of inputs needed to be tried, multipled by the cost of each attempt. Given that difficulty, you can then estimate how long an attacker will take to find your password by estimating how much computational power they have at their disposal.
In general, if you randomly generate 10+ character passwords and docker used best practices, the answer is that any attacker will not get your password in under a thousand years, and if you use a password which has been leaked before or is a dictionary word (or simple variation), it can be found on the order of minutes to days.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#79I wonder if that will encourage them to finally resolve this issue: https://github.com/docker/docker.github.io/issues/6910
[deleted]
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#80Earlier quoted context omitted.
Your own repo, AWS ECR, whatever GCP's version is called, and many others.
There are actually very few alternatives for the autobuild part. The only alternative that I'm aware of is Quay, others require you to roll out your own build & push process.
GCP's Cloud Build is also a simple option.