Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#131

Post by Sukram21 »

rqs wrote: post #116
lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

GitHub provides a way for more granular third-party access: GitHub Apps. There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app.

It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories.

[1] https://developer.github.com/apps/differences-between-apps/

[2] https://docs.docker.com/docker-hub/builds/link-source/

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#132

Post by bvm »

rad_gruchalski wrote: post #111

Their hub website is pretty bad. I tried changing the password and the website came back with an error: Failed to save password. Interesting, so I tried again. This time it said: Current password is incorrect. I thought, maybe I need to log out and try if the new password works. I clicked on Log Out link, the website has refreshed and I was still logged in.

yeh that happened to me when i rotated the password on our master docker hub (or cloud or whatever it is today) account prior to all of this.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#133

Post by craftoman »

manigandham wrote: post #123
craftoman wrote: post #20

Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...

Both situations are bad, and people are upset over Docker Hub. It just happens to be Friday night so it's not getting as much attention. NPM is bad because the Javascript ecosystem is fast-moving with loose builds that have thousands of dependencies that are all bundled and run insider consumer's browsers.

I never complained and whined like a baby every time I install Gnome for example, using Debian's apt package manager where it fetches hundreds of packages worth of 1GB. Do you know how many Linux devs required you to use Lua libraries for example only for a single isolated piece of code just because they were too lazy to write it down in C.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#134

Post by andy_ppp »

Sukram21 wrote: post #131
rqs wrote: post #116

Earlier quoted context omitted.

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

GitHub provides a way for more granular third-party access: GitHub Apps . There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app. It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories. [1] https://developer.github.com/apps/differences-between-apps/ [2] https://docs.do…

You can implement OAuth per repo if github wanted though, or alternatively can you grant access to a specific organisation? Not sure. The default should be per repo auth IMO.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#136

Post by tnolet »

rad_gruchalski wrote: post #111

Their hub website is pretty bad. I tried changing the password and the website came back with an error: Failed to save password. Interesting, so I tried again. This time it said: Current password is incorrect. I thought, maybe I need to log out and try if the new password works. I clicked on Log Out link, the website has refreshed and I was still logged in.

same issue.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#137

Post by toxik »

jhasse wrote: post #122
bayareanative wrote: post #115

Earlier quoted context omitted.

You can't. Not without end-to-end integrity with nonrepudiation. Checksums aren't anywhere near enough. But that's Docker.. security optional and run random, untrusted code from the internet.

> Checksums aren't anywhere near enough. Why not?

A checksum’s typical use is to detect transmission errors. A cryptographically secure signature is what’s needed.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#138

Post by martinp »

rqs wrote: post #116
lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

Agree, it's terrible if you just want automatic builds.

I almost gave up on automatic Docker image push on one of my projects [1] earlier this year, when GitHub services were deprecated.

Luckily I found a way to have Travis push the image instead [2]. It involves giving Travis my Docker Hub password (encrypted), but it's certainly better than granting some service full access to my GitHub account.

[1] https://github.com/mpolden/echoip

[2] https://docs.travis-ci.com/user/docker/#pushing-a-docker-ima...

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#139

Post by mmmeff »

Sukram21 wrote: post #131
rqs wrote: post #116

Earlier quoted context omitted.

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

GitHub provides a way for more granular third-party access: GitHub Apps . There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app. It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories. [1] https://developer.github.com/apps/differences-between-apps/ [2] https://docs.do…

Holy shit this is a crazy attack vector.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#140

Post by hi56793 »

speedplane wrote: post #127
bayareanative wrote: post #118

Earlier quoted context omitted.

That's a strawman because the shriekingly-obvious difference is ease of facilitation. With Docker, it's a mere couple of commands to pull a box and run it. Docker weakens trust because it lets anonymous people, as well as trusted ones, upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated on Docker's side. It's spray-and-pray DevOps.…

> Docker weakens trust because it lets anonymous people ... upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated How is this github any different?

Many package managers that support git as source allow to pin to a specific commit sha. That's as far as I can see a quite secure way to keep using an uncompromised/verified version. It's not the most popular feature but people do it every now and then, probably it should be done more.

I wonder if docker allows this and on the other hand if that's even feasible for say application images, given that applications must be updated a lot for security reasons. Of course if the Dockerfile's parent reference is not pinned, that does only help to some degree...

Post reply on HN