Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

Post by ohyeshedid » Sat, Apr 27, 2019, 7:05 AM UTC

rectang wrote: post #59

morpheuskafka wrote: post #27

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

Maybe some day we'll get serious about reproducible builds, since reproducibility can serve as a layer of defense against such compromises.

Post by ohyeshedid » Sat, Apr 27, 2019, 7:12 AM UTC

duxup wrote: post #37

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

Is hacking even needed? There already have been questionable images hosted there ... just by users uploading compromised images. No hacking needed.

Post by speedplane » Sat, Apr 27, 2019, 7:13 AM UTC

ahmedalsudani wrote: post #102

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...

Post by ohyeshedid » Sat, Apr 27, 2019, 7:20 AM UTC

tannhaeuser wrote: post #104

ohyeshedid wrote: post #70

Earlier quoted context omitted.

That's because npm has a history of screwing the pooch.

What did they do specifically? Not saying npm is beyond criticism, but we shouldn't just accept vague and unsubstantiated claims here.

Post by eecc » Sat, Apr 27, 2019, 7:24 AM UTC

morpheuskafka wrote: post #30

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

It's made worse by the fact that only a few major images are used as bases. That's normally good for security, as they are highly vetted and quickly updated, but if they could be compromised, say Alpine or Ubuntu Clould, even for a minute, countless images would be built using the compromised base and it would be very hard to ensure they were all rebuilt. As I understand it, there's no element of signing from the act…