Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#231

Post by kobalsky »

Boulth wrote: post #160
jvdongen wrote: post #157

Earlier quoted context omitted.

Exactly this. For the docker images we use in production, we fork the corresponding git repo, build our own image and push it to our own local docker registry and pull it from there. It's fairly easy to setup in fact.

Out of curiosity do you resolve it so that the image is FROM scratch or do you rely on alpine/some other base image?

I forked an ubuntu image and then used it as a base for all my projects. It doesn't come for free though, you will need to periodically run security updates and then rebuild all images that depend on it.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#233

Post by netsectoday »

lskillen wrote: post #174
diNgUrAndI wrote: post #48

What are dockerhub's alternatives? No 2FA. That is bad.

As others have stated you could run your own registry or use an alternative service for private repositories, to minimise or eliminate the attack vector. By replicating the images (or packages) that you need into your own account, you can minimise the possibility of a bad actor replacing a well-known image with something untrusted. An alternative is to side-cart a service like Notary ( https://docs.docker.com/notary/…

You can run your own private Docker registry but you will still depend upon the base images pulled from hub.docker.com in your deploy chain unless you make sure to clone the base image Dockerfile from github and build it yourself. Even with this protected setup; you still have exposure from poisoned Github repos after this attack because of the compromised Github access keys. I'm not sure you can eliminate this threat, even with third-party services. What a mess.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#234

Post by dehrmann »

ahmedalsudani wrote: post #102
Leo_Verto wrote: post #5

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...

Not docker, but library hosting, in general. My company maintains client libraries for 6 languages, also hosted in the popular place for that language. The standards for account management and authenticating the libraries are all different. Some have scary-little security, some have painful security.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#235

Post by ithkuil »

blattimwind wrote: post #187
gtsteve wrote: post #169

Earlier quoted context omitted.

It uses SHA-256 right? My understanding is that there isn't yet a workable collision attack on the SHA-2 family. Regardless, I think it's certainly an excellent hardening step.

Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".

Can't the hash be verified by the client too?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#236

Post by ithkuil »

MattPalmer1086 wrote: post #167
jhasse wrote: post #155

Earlier quoted context omitted.

Wouldn't that mean you need to find a collision?

The issue is, how do you verify the checksum you are using is valid. If you obtain the checksum from the same place you get the image, then an attacker can simply calculate a new checksum for the malicious image and publish it too. I guess if you were really sure you had obtained a checksum prior to the service compromise, then that would give reasonable assurance the image was not tampered with.

Checksums/fingerprints can help mitigating the problem of _changing_ images people already use. As you correctly point out they don't solve the problem of authenticated distribution.

Assuming you have fetched a given image and captured its sha in a config file in your version control (e.g. a kubetnetes manifest), then whenever you deploy a container you are sure that you're not affected by exploits happening _after_ you saved the fingerprint.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#237

Post by Operyl »

ahmedalsudani wrote: post #99
Operyl wrote: post #15

https://status.docker.com still not a mention. Wonder how long until it is.

That's the wrong place to track a hack. The status page is concerned with uptime, not security.

I disagree, destroying a ton of keys breaks stuff.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#238

Post by ahmedalsudani »

dehrmann wrote: post #234
ahmedalsudani wrote: post #102

Earlier quoted context omitted.

Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...

Not docker, but library hosting, in general. My company maintains client libraries for 6 languages, also hosted in the popular place for that language. The standards for account management and authenticating the libraries are all different. Some have scary-little security, some have painful security.

Agreed 100%. It's insane the practices that fly in our industry. It's as if we didn't know any better.

One day, there's going to be a colossal compromise, and that might finally change where we place security in the priority chain.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#239

Post by subway »

ithkuil wrote: post #235
blattimwind wrote: post #187

Earlier quoted context omitted.

Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".

Can't the hash be verified by the client too?

Sure, but who tells the client what the correct hash is?

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#240

Post by tomc1985 »

craftoman wrote: post #163
tomc1985 wrote: post #145

Earlier quoted context omitted.

Most distributions' package repos aren't a free-for-all, unlike NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely different kettle of fish, and most of the mainstream distros take security pretty seriously

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

That's why I said most
Post reply on HN