Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#191

Post by craftoman »

dvdgsng wrote: post #183
craftoman wrote: post #163

Earlier quoted context omitted.

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

Wait, designed to work with http only? Link?

That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most of the distros are using HTTP by default except a few that respect privacy and security.

https://www.theregister.co.uk/2019/01/22/debian_package_mana...

https://whydoesaptnotusehttps.com

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#192

Post by chungleong »

saurabhnanda wrote: post #142

Just wondering, genuinely out of curiosity - how does one get to this 5% number? If the attacker had access to the DB s/he had access to 100% user data right? Or did the get access to a partition of the user data? How is this even possible? Some very old backup that had only 5% of earliest users? Some log file which had plain-text creds of approx 5% users? Or did they discover the attack as it was happening and kicke…

A differential backup file would be my guess.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#193

Post by gtirloni »

Kudos wrote: post #156

Why am I being asked to change my password? Why haven't they just invalidated it for me already? I'm astounded I was still able to login with my existing password.

It looks like they have sent emails to everyone, not just the 5% affected.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#194

Post by tobias3 »

rqs wrote: post #116
lugg wrote: post #2

If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

In my case I don't even know why it needs read and WRITE access to ALL repositories. All I want is for it to build one public repository. It doesn't need any special permissions for that at all.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#195

Post by onei »

dvdgsng wrote: post #183
craftoman wrote: post #163

Earlier quoted context omitted.

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

Wait, designed to work with http only? Link?

I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation.

[1] https://whydoesaptnotusehttps.com

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#196

Post by gigatexal »

friedrichg wrote: post #190
gigatexal wrote: post #112

Earlier quoted context omitted.

I’m thinking twice about using docker hub. And the main usecase is k8s. So docker is just an implementation detail its relevancy is waning imo

Docker hub is a centralized service. What we are seeing is the result of having a huge centralized service: if it gets compromised, then many dependencies are compromised. Some organizations took the risk of running docker taking images directly from docker hub. They were relaying the security of the images to them. Some organizations are going to panic now and host their own registry. Which they need to protect as w…

We run our own registry that just mirrors images that we want to use and keeps them up to date. It’s not a silver bullet but it works.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#198

Post by ris »

Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

But it was possible to see this trouble coming from way back. Docker, Inc. took on over $150m of VC investment up to the end of 2015. One hundred and fifty million dollars. How do you possibly plan to show a return on such an investment? The only way is to get one of your "services" injected into peoples pipelines as a critical component, no matter how questionable the fundamental necessity of that service is. But of course, you own the tool, you get to design the workflow and do your best to shape your users worldview.

I do wish developers would be a little wiser around these things, especially when they see companies taking such huge amounts of capital. I found it quite depressing to watch the unquestioning way development communities assimilated the docker worldview.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#199

Post by logophobia »

gtirloni wrote: post #193
Kudos wrote: post #156

Why am I being asked to change my password? Why haven't they just invalidated it for me already? I'm astounded I was still able to login with my existing password.

It looks like they have sent emails to everyone, not just the 5% affected.

I haven't received an e-mail, I've got multiple docker-hub accounts.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#200

Post by matthewaveryusa »

Sukram21 wrote: post #131
rqs wrote: post #116

Earlier quoted context omitted.

Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?

GitHub provides a way for more granular third-party access: GitHub Apps . There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app. It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories. [1] https://developer.github.com/apps/differences-between-apps/ [2] https://docs.do…

I just looked at github OAuth scopes ( https://developer.github.com/apps/building-oauth-apps/unders... )

honest question, what's the point of using OAuth when the Authz is so coarse? Why not augment to have scopes per repo? Is it considered bad practice to have have a variable (repo name) as a scope?

Post reply on HN