Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#81

Post by techntoke »

morpheuskafka wrote: post #27

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

I'd like to mention that Docker recently changed their automated builds to require giving them access to GitHub instead of just using a webhook. Glad I disabled access but no telling how long this was undiscovered.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#83

Post by techntoke »

TheDong wrote: post #78
jaequery wrote: post #74

If the passwords are hashed, just what are the likelihood of your passwords being decrypted? I’d also imagine it is a one way hash since that’s typically the norm so I don’t even know how it can get decrypted.

Hashes are not decrypted, they are bruteforced. > I imagine it is a one way hash All hashes are one way. If it's lossless and can be reverted, it's a compression algorithm or isomorphism or encryption or cipher or any of a number of other things, but not a hash. > I don’t even know how it can get decrypted. It is not decrypted, but brute forced. For example, even if you can't algorithmically figure out what the input…

Hopefully they are salted with a unique ID because of the are using a md5sum only then you're screwed with rainbow tables.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#84

Post by techntoke »

buzer wrote: post #66
viraptor wrote: post #53

Earlier quoted context omitted.

Your own repo, AWS ECR, whatever GCP's version is called, and many others.

There are actually very few alternatives for the autobuild part. The only alternative that I'm aware of is Quay, others require you to roll out your own build & push process.

Autobuilding is really just a free GitLab pipeline.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#86

Post by dawnerd »

buzer wrote: post #66
viraptor wrote: post #53

Earlier quoted context omitted.

Your own repo, AWS ECR, whatever GCP's version is called, and many others.

There are actually very few alternatives for the autobuild part. The only alternative that I'm aware of is Quay, others require you to roll out your own build & push process.

I use drone.io self hosted to build all my images. They then get pushed to a self-hosted hub.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#90

Post by martinlofgren »

buzer wrote: post #57
lugg wrote: post #42

Earlier quoted context omitted.

Pretty sure (don't quote me) those are read only and repo specific but that could contain all sorts of juicy info depending how lax you are with security of configs in private repos. Even then just read access to code often allows enough info for leveraging/escalating privilege.

When you connect your Github account to Docker Hub, that will give DH full access to all repos ( https://i.imgur.com/4jJWrez.png ). I'm not even sure if Github's permission model supports adding only read access to private repositories. I'm not 100% sure if Docker hub uses deploy keys for repos it has access to thru the integration, but at least previously there was an option to manually add one to repository if it c…

I tried to give an user read-only access to a private repository on GitHub a few weeks ago, and from what I could tell it isn't possible.
Post reply on HN