Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#91

Post by reidrac »

lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

At the moment I can't change the password. It fails with "Failed to save password" error, no more information.

EDIT: it finally worked, 4th attempt, and very slowly. Looks like something isn't working 100% as it should

EDIT 2: aaaand I can't login now with the new password. A password reset did work, but it looks like their password database is under some stress at the moment.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#93

Post by elcomet »

tiew9Vii wrote: post #63
morpheuskafka wrote: post #27

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

Yes, huge poisoning target enhanced by the fact images/tags are not immutable, you really have no idea what you are fetching straight from dockerhub, one pull of the same image/tag may be different to the next pull. Most people blindly fetch without verifying regardless with multiple images of varying quality for software packages.

How could one verify ?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#94

Post by ralala »

geezerjay wrote: post #89
diNgUrAndI wrote: post #48

What are dockerhub's alternatives? No 2FA. That is bad.

Gitlab provides public and private projects with their own registry which can host Docker images built by Gitlab's CICD service.

And you can even run your own gitlab instance and don't expose it to the internet.

Nevertheless: The base images will be pulled from dockerhub by default and I am not sure we should trust them. Do we have any better alternatives for this?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#95

Post by tialaramex »

techntoke wrote: post #83
TheDong wrote: post #78

Earlier quoted context omitted.

Hashes are not decrypted, they are bruteforced. > I imagine it is a one way hash All hashes are one way. If it's lossless and can be reverted, it's a compression algorithm or isomorphism or encryption or cipher or any of a number of other things, but not a hash. > I don’t even know how it can get decrypted. It is not decrypted, but brute forced. For example, even if you can't algorithmically figure out what the input…

Hopefully they are salted with a unique ID because of the are using a md5sum only then you're screwed with rainbow tables.

Rainbow tables are impractical with either salt, or more password entropy. If you use actual random passwords of, say, twelve alphanumerics because you have a password generator then even a bad choice like md5(password) is not practical to attack with brute force or rainbow tables.

The most famous application of rainbow tables is one of Microsoft's family of terrible password hashes LM. But the reason it breaks that wide open is not just the lack of salt, it's also that LM hash only works for 7 character passwords, and up to 14 chars are supported by doing two entirely separate hashes - so you can craft rainbow tables for all possible 7 character inputs and then reverse the hash.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#96

Post by leowoo91 »

craftoman wrote: post #20

Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...

NPM already freaks out many people.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#98

Post by jcims »

techntoke wrote: post #81
morpheuskafka wrote: post #27

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

I'd like to mention that Docker recently changed their automated builds to require giving them access to GitHub instead of just using a webhook. Glad I disabled access but no telling how long this was undiscovered.

Interesting. What’s their rationale?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#100

Post by unfunco »

techntoke wrote: post #83
TheDong wrote: post #78

Earlier quoted context omitted.

Hashes are not decrypted, they are bruteforced. > I imagine it is a one way hash All hashes are one way. If it's lossless and can be reverted, it's a compression algorithm or isomorphism or encryption or cipher or any of a number of other things, but not a hash. > I don’t even know how it can get decrypted. It is not decrypted, but brute forced. For example, even if you can't algorithmically figure out what the input…

Hopefully they are salted with a unique ID because of the are using a md5sum only then you're screwed with rainbow tables.

I'm going to go out on a limb and say Docker are unlikely to be using MD5, salted or otherwise.
Post reply on HN