you guys should partner with github to disable those token which have leaked
Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
261–269 of 269 posts
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#262Earlier quoted context omitted.
Wait, designed to work with http only? Link?
I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation. [1] https://whydoesaptnotusehttps.com
You don't need HTTPS if everything is signed appropriately
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#263Earlier quoted context omitted.
Wouldn't that mean you need to find a collision?
The issue is, how do you verify the checksum you are using is valid. If you obtain the checksum from the same place you get the image, then an attacker can simply calculate a new checksum for the malicious image and publish it too. I guess if you were really sure you had obtained a checksum prior to the service compromise, then that would give reasonable assurance the image was not tampered with.
You create the docker image on your local computer, create checksum and write it down / remember it. Then you just use this checksum when downloading the image from other computers to check it's the same one. This only works for images created and uploaded by you of course, for images created by other people it does not work.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#264Earlier quoted context omitted.
Docker hub is a centralized service. What we are seeing is the result of having a huge centralized service: if it gets compromised, then many dependencies are compromised. Some organizations took the risk of running docker taking images directly from docker hub. They were relaying the security of the images to them. Some organizations are going to panic now and host their own registry. Which they need to protect as w…
We run our own registry that just mirrors images that we want to use and keeps them up to date. It’s not a silver bullet but it works.
I'd worry about mirroring the images because of cases like this, you'd want some sort of triage process before it gets into your environment.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#265Earlier quoted context omitted.
Integrity is all you need as long as you have verified the original image that you have saved the hash for.
Is your argument that you only need integrity if you verified the authenticity out of band?
No, I'm saying you only need integrity to validate you are getting the same thing each time. If I checked and made sure an image is safe, then I can save that hash and know that as long as the has matches, I'm always getting that same safe image.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#266Earlier quoted context omitted.
Which effectively nobody does. Package managers and distribution packaging systems default to the safe method rather then defaulting to insecure rewritable tags. To be fair, the docker.io/library/* images are signed but no other images are and there are a bunch of issues with how the signing policies work for users that want to enforce that some images must be signed.
I do it! Everything I pull is pinned with sha256 since I use Nix/Kubenix, so I'm required to pin sha256 if I'm fetching from the Docker registry (or build the package deterministically myself.)
The way image signing works with Docker is that there is a signature tying a tag to a sha256. If you use the sha256 directly you get immutable sources, but now your source isn't signed anymore -- how are you sure the hash is correct?
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#267Earlier quoted context omitted.
> Libraries off Github literally have the source available for you and the community at large to vet. If Github was compromised, it would be easy and obvious to insert malicious code in a repository, but hide those changes from anyone on the github website.
Which you can avoid by forking the mainline repo and depending on your fork. Images on Docker Hub don't even need to share their Dockerfile, to talk of all the source/etc that went into their build.
>> If Github was compromised, it would be easy and obvious to insert malicious code in a repository
> Which you can avoid by forking the mainline repo and depending on your fork.
If github was compromised, the it would be pretty easy to generate forks with the same compromised code.
Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#268Re: Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled
#269Earlier quoted context omitted.
Is your argument that you only need integrity if you verified the authenticity out of band?
No, I'm saying you only need integrity to validate you are getting the same thing each time. If I checked and made sure an image is safe, then I can save that hash and know that as long as the has matches, I'm always getting that same safe image.
This is useless without authentication though. You're opening yourself up to attacks on the first retrieve. Sure, you can make sure you're getting the file they want you to have, but you don't know _who_ is giving you that file.