Live data from Hacker News

Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

news.ycombinator.com

251–260 of 269 posts

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#251

Earlier quoted context omitted.

Libraries off Github literally have the source available for you and the community at large to vet. And you'll find almost no sane shop on the planet where people are allowed, hell encouraged to use shady distros or install random utility tools in production the way they are encouraged to pull unchecked binary blobs from Docker Hub in an often non-reproducible manner.

> Libraries off Github literally have the source available for you and the community at large to vet. If Github was compromised, it would be easy and obvious to insert malicious code in a repository, but hide those changes from anyone on the github website.

Which you can avoid by forking the mainline repo and depending on your fork.

Images on Docker Hub don't even need to share their Dockerfile, to talk of all the source/etc that went into their build.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#252
post #164

Earlier quoted context omitted.

Libraries off Github literally have the source available for you and the community at large to vet. And you'll find almost no sane shop on the planet where people are allowed, hell encouraged to use shady distros or install random utility tools in production the way they are encouraged to pull unchecked binary blobs from Docker Hub in an often non-reproducible manner.

> Libraries off Github literally have the source available for you and the community at large to vet. Nobody read the source code for this exact reason: “the community is here to read it so I won’t".

Speak for yourself, please - there are plenty of places that aren't into cowboy coding.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#253

Earlier quoted context omitted.

I haven't received an e-mail, I've got multiple docker-hub accounts.

I haven't received one yet either.

Neither have I. I manage over 30 images on dockerhub. Maybe this means they are certain my data was not in the data that was leaked but I'm not sure how they'd be certain of that.

They did just post the notice in a banner at the top of https://hub.docker.com

https://success.docker.com/article/docker-hub-user-notificat...

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#254
post #93

Earlier quoted context omitted.

How could one verify ?

You can't. Not without end-to-end integrity with nonrepudiation. Checksums aren't anywhere near enough. But that's Docker.. security optional and run random, untrusted code from the internet.

The company I work for, Sylabs, is taking what I think to be a pretty great approach to solving this problem. Essentially we've introduced a container image format where the actual runtime filesystem can be cryptographically signed (you can read about that here: https://www.sylabs.io/2018/03/sif-containing-your-containers...). The Singularity container runtime we develop treats this concept of "end-to-end integrity" as a core philosophy. Our docker hub analogue, the container Library, is working to make cryptographic signing one of the fundamentals of a container workflow. We're also actively working on container image encryption, which I think will bump container integrity up a few notches.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#255
post #180

Earlier quoted context omitted.

we grit our teeth and "believe" that anyone traceably affected got an email directly from the company or something :D (that said, google main page vulnerable to xss is kind of like... what, we're afraid someone will take over google and put some cryptominers on the google.com main page?)

Well, a compromised google.com main page could return malicious search results for certain queries. How many Windows sysadmins install PuTTY by googling "putty", and then installing an executable from whatever site shows up in the first couple of results?...

If the primary install method is "search and download whatever manually from the internet," you have bigger issues than a potential Google compromise: create a site with better ranking than the canonical HTTP (!) download page, MITM the HTTP download, whatever.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#257

What permissions did the leaked tokens have? If they had write access, then leaked personal data is the least of anyone's worries. The real concern is how close the hackers came to infiltrating the image source for virtually every modern microservices system. If you could put a malicious image in say alpine:latest for even a minute, there's no telling how many compromised images would have been built using the base i…

Is it unreasonable to request more information about the attack that can help us understand whether our builds and images were affected? We might've built and deployed images containing or receiving production secrets which could be compromised. This is very important information at the moment.

IMO, dockerhub should publish:

* exact time when attack happened, so we know exactly what builds might have pulled malicious images

* degree of access the hackers gained (whether it had ro or rw access, and to what exactly)

* mechanisms used for password/tokens/pii/etc. security (salt, encryption, hashing alg...)

* list of affected public accounts/images

Instead of last point, or complementing it, it would be useful if image providers would confirm on their official channels if their images were or weren't compromised, and which tags&shas are (un)safe to use.

EDIT: https://success.docker.com/article/docker-hub-user-notificat... is now updated with additional information:

Q: What happened?

There was a brief period of unauthorized access to a Docker Hub database. During this time some sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of users as well as GitHub and Bitbucket tokens for Docker autobuilds. All these tokens have been revoked.

Q: Were any of the Docker Official Images impacted by this incident?

No Official Images have been compromised. We have additional security measures in place for our Official Images including GPG signatures on git commits as well as Notary signing to ensure the integrity of each image.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#259

Earlier quoted context omitted.

It uses SHA-256 right? My understanding is that there isn't yet a workable collision attack on the SHA-2 family. Regardless, I think it's certainly an excellent hardening step.

Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".

Well I was approaching it from the point of view that you verify the image is correct and then you guarantee you'll always use that image and not some other version given that tags are mutable.

Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

#260
post #249

Earlier quoted context omitted.

A hash only provides integrity. A signature provides integirty and authentication .

Integrity is all you need as long as you have verified the original image that you have saved the hash for.

Is your argument that you only need integrity if you verified the authenticity out of band?
Post reply on HN