Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#161

Post by torvald »

saurabhnanda wrote: post #142

Just wondering, genuinely out of curiosity - how does one get to this 5% number? If the attacker had access to the DB s/he had access to 100% user data right? Or did the get access to a partition of the user data? How is this even possible? Some very old backup that had only 5% of earliest users? Some log file which had plain-text creds of approx 5% users? Or did they discover the attack as it was happening and kicke…

Their data can be sharded whereas only a part of their databases got compromised. Or it could be a cache layer that got compromised. Or a partial user dump intended for something else that somehow ended up in the wrong hands. I guess there could be a lot of reasonable explanations.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#162

Post by supakeen »

gruturo wrote: post #146
sambe wrote: post #87

Why can’t these emails just come out and say it: “your account was affected”. It’s always implicit. Also, why rely on users to change their passwords? Is there a security log I can check?

Should they change your password for you? How do they communicate it securely then? Over unencrypted email, whose password may or may not be the same of your just-compromised docker account?

They could invalidate the passwords making you use a 'forgot password' link to enter a new password instead of keeping the old compromised ones :)

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#163

Post by craftoman »

tomc1985 wrote: post #145
craftoman wrote: post #133

Earlier quoted context omitted.

I never complained and whined like a baby every time I install Gnome for example, using Debian's apt package manager where it fetches hundreds of packages worth of 1GB. Do you know how many Linux devs required you to use Lua libraries for example only for a single isolated piece of code just because they were too lazy to write it down in C.

Most distributions' package repos aren't a free-for-all, unlike NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#164

Post by hk__2 »

filleduchaos wrote: post #119
speedplane wrote: post #105

Earlier quoted context omitted.

> Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how t…

Libraries off Github literally have the source available for you and the community at large to vet. And you'll find almost no sane shop on the planet where people are allowed, hell encouraged to use shady distros or install random utility tools in production the way they are encouraged to pull unchecked binary blobs from Docker Hub in an often non-reproducible manner.

> Libraries off Github literally have the source available for you and the community at large to vet.

Nobody read the source code for this exact reason: “the community is here to read it so I won’t".

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#165

Post by trulyrandom »

ghusbands wrote: post #151
viraptor wrote: post #56

That's a nice summary. One thing I'm curious about is: > Data includes usernames and hashed passwords How are they hashed? And specifically, can we expect them to be already cracked?

Yes, in particular we need to know algorithm, work factor and salting details to know whether or not the passwords may be compromised.

Just assume that it's compromised and generate a new one. There is no point in wasting time trying to estimate how long it might take someone to crack it.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#166

Post by pacifika »

rad_gruchalski wrote: post #111

Their hub website is pretty bad. I tried changing the password and the website came back with an error: Failed to save password. Interesting, so I tried again. This time it said: Current password is incorrect. I thought, maybe I need to log out and try if the new password works. I clicked on Log Out link, the website has refreshed and I was still logged in.

Password reset works

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#167

Post by MattPalmer1086 »

jhasse wrote: post #155
Robin_Message wrote: post #152

Earlier quoted context omitted.

You can tamper with data protected by checksums: they are not designed to be irreversible, just fast to calculate and good at detecting errors, not deliberate manipulations. Use proper cryptography and don't roll your own!

Wouldn't that mean you need to find a collision?

The issue is, how do you verify the checksum you are using is valid. If you obtain the checksum from the same place you get the image, then an attacker can simply calculate a new checksum for the malicious image and publish it too.

I guess if you were really sure you had obtained a checksum prior to the service compromise, then that would give reasonable assurance the image was not tampered with.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#168

Post by orisho »

jhasse wrote: post #155
Robin_Message wrote: post #152

Earlier quoted context omitted.

You can tamper with data protected by checksums: they are not designed to be irreversible, just fast to calculate and good at detecting errors, not deliberate manipulations. Use proper cryptography and don't roll your own!

Wouldn't that mean you need to find a collision?

I think his point is that for some checksums it could be trivial (and for some, tools already exist). Checksums aren't designed for this, while on the other hand secure hashing is. As a result, authors of hashing algorithms often attempt to mathematically prove their strength and resistance to a collision.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#169

Post by gtsteve »

toxik wrote: post #137
jhasse wrote: post #122

Earlier quoted context omitted.

> Checksums aren't anywhere near enough. Why not?

A checksum’s typical use is to detect transmission errors. A cryptographically secure signature is what’s needed.

It uses SHA-256 right? My understanding is that there isn't yet a workable collision attack on the SHA-2 family.

Regardless, I think it's certainly an excellent hardening step.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#170

Post by r3bl »

jhasse wrote: post #155
Robin_Message wrote: post #152

Earlier quoted context omitted.

You can tamper with data protected by checksums: they are not designed to be irreversible, just fast to calculate and good at detecting errors, not deliberate manipulations. Use proper cryptography and don't roll your own!

Wouldn't that mean you need to find a collision?

There's a good chance that someone who can modify your base image can also modify the checksum you're showing to whatever is the new checksum.

For example, when Linux Mint's ISOs were briefly backdoored, the attackers also changed the checksum shown on the website: https://www.zdnet.com/article/hacker-hundreds-were-tricked-i...

Post reply on HN