Hmm, my GitHub account is showing failed logins starting from 2 days ago, with none for the remaining period that GitHub shows - no email from Docker yet, but I wonder if this is related?
Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
181–190 of 269 posts
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#182Earlier quoted context omitted.
Which effectively nobody does. Package managers and distribution packaging systems default to the safe method rather then defaulting to insecure rewritable tags. To be fair, the docker.io/library/* images are signed but no other images are and there are a bunch of issues with how the signing policies work for users that want to enforce that some images must be signed.
The important thing is that tags are signed and up-to-date, like how git tags work or how Debian signs its entire repository as a unit (via the Release file) rather than having developers just sign individual packages. Otherwise, even if it's signed, it's subject to downgrade attacks. Installing known-vulnerable old versions of legitimate software can be just as bad as installing custom malware.
Sure, that's how almost all package managers work. I can't think of a modern package manager from an "enterprise" distribution that didn't have a lot of the features of TUF[+].
And as I said, only official-library Docker images are signed. All other images are unsigned and even for third-party repos you can't force Docker to verify all images from a given repo (you have to enable it globally, which breaks the utility of a local "docker build").
[+] Arch is the only counterexample I can think of and I'm not even sure if my memory is correct.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#183Earlier quoted context omitted.
Most distributions' package repos aren't a free-for-all, unlike NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously
Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.
Wait, designed to work with http only? Link?
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#184https://status.docker.com still not a mention. Wonder how long until it is.
They added it.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#185Earlier quoted context omitted.
Installing Docker for Mac/Windows has required users to login for awhile now.
It doesn’t require one to use it. I use it daily on MacOS and I don’t have an account.
It requires one to download the installer: https://hub.docker.com/editions/community/docker-ce-desktop-...
Notice the big "Please Login to Download" button.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#186Earlier quoted context omitted.
Libraries off Github literally have the source available for you and the community at large to vet. And you'll find almost no sane shop on the planet where people are allowed, hell encouraged to use shady distros or install random utility tools in production the way they are encouraged to pull unchecked binary blobs from Docker Hub in an often non-reproducible manner.
> Libraries off Github literally have the source available for you and the community at large to vet. Nobody read the source code for this exact reason: “the community is here to read it so I won’t".
> Nobody read the source code
In Debian we review and vet packages.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#187Earlier quoted context omitted.
A checksum’s typical use is to detect transmission errors. A cryptographically secure signature is what’s needed.
It uses SHA-256 right? My understanding is that there isn't yet a workable collision attack on the SHA-2 family. Regardless, I think it's certainly an excellent hardening step.
Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#188If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…
At the moment I can't change the password. It fails with "Failed to save password" error, no more information. EDIT: it finally worked, 4th attempt, and very slowly. Looks like something isn't working 100% as it should EDIT 2: aaaand I can't login now with the new password. A password reset did work, but it looks like their password database is under some stress at the moment.
Same can't change password
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#189What does this means for users? I was using watchtower to auto update the images in my system. One of them was autoupdated after the failure.
Can this be used to upload containers with security exploits in order to gain access to machines (i.e. does it give write access to the containers)?
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#190Earlier quoted context omitted.
Did Docker become any less useful for you due to this, or provides less value? Unlikely.
I’m thinking twice about using docker hub. And the main usecase is k8s. So docker is just an implementation detail its relevancy is waning imo
Docker hub is a centralized service. What we are seeing is the result of having a huge centralized service: if it gets compromised, then many dependencies are compromised.
Some organizations took the risk of running docker taking images directly from docker hub. They were relaying the security of the images to them.
Some organizations are going to panic now and host their own registry. Which they need to protect as well. But in general it will create a better decentralized ecosystem.
I think this is good for the docker community in general.