6 ms·

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking ju

Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.

pavanagrawal123 7y ago
This raises the question of whether any high profile images were targetted by the infiltrators?
anaphor 7y ago
That doesn't mean there aren't plenty of things they could have done to make this more secure. The fact that you can just `docker login` with the same credentials that allow access to your entire registry is pretty poor security design IMO.
tylerl 7y ago
I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order. But no, not Docker. You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" as they are, and as godawful as the security practices are that underlie their tools and standards... they hadn't a chance. They still don't. There is no reason to expect them to get better.
- lowpro 7y ago
  Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0] https://twitter.com/WHHackersBR/status/1118393568656334850 https://twitter.com/WHHackersBR/status/1118393568656334850
  - acct1771 7y ago
    And do we ever find out how much that was being exploited "in the wild"?
    - simondedalus 7y ago
      we grit our teeth and "believe" that anyone traceably affected got an email directly from the company or something :D (that said, google main page vulnerable to xss is kind of like... what, we're afraid someone will take over google and put some cryptominers on the google.com main page?)
      - WrtCdEvrydy 7y ago
        The Microsoft Approach... 'people totally didn't access your email body... except we eventually owned up to it after it got leaked'
        mehrdadn 7y ago
        Where did they deny that anybody's email bodies were read? I'm looking for it and I can't find it. I only see that they told the other 94%(?) of people that unauthorized access did not reveal the contents of their messages in particular, which seems to be truthful?
        WrtCdEvrydy 7y ago
        Initial email said the body wasn't affected, and motherboard asked for a confirmation, so they said 'Yes'. 6% of the people received a specific email saying the body of their email was accessed and they had to backtrack.
        mehrdadn 7y ago
        Well the email said: > This unauthorized access could have allowed unauthorized parties to access and/or view information related to your email account (such as your e-mail address, folder names, the subject lines of e-mails, and the names of other e-mail addresses you communicate with), but not the content of any e-mails or attachments, between January 1st 2019 and March 28th 2019. Notice it says your email account. The whole email is about the account of the recipient, not those of other recipients. Given that they explicitly worded it this way and people clearly misinterpreted it to mean something else, I hope you can forgive me for being a little skeptical of third-party anecdotes that suggest Microsoft claimed nobody's email contents were accessed...
- cabaalis 7y ago
  You are aware that Google identified a vulnerability so awful that they hid it from the public so as not to draw government scrutiny, did not retain access logs, and ultimately shut down a major public application? It wasn't authentication credentials, but still.
  - Scoundreller 7y ago
    Which vulnerability was this?
    - wahern 7y ago
      Presumably the Google+ exfiltration issue. > The bigger problem for Google isn’t the crime, but the cover-up. The vulnerability was fixed in March, but Google didn’t come clean until seven months later when The Wall Street Journal got hold of some of the memos discussing the bug. The company seems to know it messed up — why else nuke an entire social network off the map? — but there’s real confusion about exactly what went wrong and when, a confusion that plays into deeper issues in how tech deals with this kind of privacy slip. (https://www.theverge.com/2018/10/9/17957312/google-plus-vulnerability-privacy-breach-law https://www.theverge.com/2018/10/9/17957312/google-plus-vuln...)
- simondedalus 7y ago
  it is of course just a matter of time for either of the companies you mentioned to "be hacked" (obviously it's happened countless times with Microsoft, both the OS and their cloud services like O365, and there was a recent high profile revelation that the google apps suite APIs exposed user info to developers). the difference is incident response and layered security. as long as you're using software somewhere in the stack that isn't like maturity level 5, AND you don't have constant audits looking for novel attacks on working-as-intended systems, you're pretty much guaranteed to inherit (or create) a vulnerability at some point, and if you're important enough it will get exploited. the reason that doesn't mean we should start modeling computer systems as "living organisms that eventually get old and die" and should keep modeling security like war is that when you get hit, you can respond. all the layers matter, and insofar as Microsoft or Google do it right, they primarily do it right by having a mature process for monitoring, patching, isolating, etc. as for docker hub though, yeah i'm totally with you. i'm just saying we shouldn't overestimate the preventive capacity of anyone, honestly. if you're doing anything important over the internet at all, you're making some compromises somewhere. here are 2 links to things i handwaved at above, for example's sake: https://www.wired.com/story/microsoft-email-hack-outlook-hotmail-customer-support/ https://www.wired.com/story/microsoft-email-hack-outlook-hot... https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/google-plus-breach-what-happened-who-was-impacted-and-how-to-delete-your-account/#4f05fda96491 https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/goog...
quickthrower2 7y ago
Do they offer end to end encryption and signing. That would make your ci say f-off it the image has been played around with, and also protect any secrets, although there is no need to have source code or passwords in the image anyway.
morpheuskafka 7y ago
It's made worse by the fact that only a few major images are used as bases. That's normally good for security, as they are highly vetted and quickly updated, but if they could be compromised, say Alpine or Ubuntu Clould, even for a minute, countless images would be built using the compromised base and it would be very hard to ensure they were all rebuilt. As I understand it, there's no element of signing from the actual devs of an image, just from the central trust service of Docker Hub.
- eecc 7y ago
  I don’t think Docker has a way to revoke individual image hashes. Or does it?
duxup 7y ago
Is hacking even needed? There already have been questionable images hosted there ... just by users uploading compromised images. No hacking needed.
- ohyeshedid 7y ago
  There's a difference between alpineworm:latest and alpine:latest. Someone would have to choose to download the questionable image, while someone compromising a base image could go unnoticed for quite some time and have a massive install base since it's used in so many other images.
ahmedalsudani 7y ago
Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...
- speedplane 7y ago
  > Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how tar allows you to package files. What you put in it is up to you.
  - bayareanative 7y ago
    That's a strawman because the shriekingly-obvious difference is ease of facilitation. With Docker, it's a mere couple of commands to pull a box and run it. Docker weakens trust because it lets anonymous people, as well as trusted ones, upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated on Docker's side. It's spray-and-pray DevOps. Image integrity has to be solved on Docker's side with end-to-end integrity or it's all for naught... this is something that cannot be solved within a container or separate from Docker, it must be universal, mandatory and trustworthy.
    - speedplane 7y ago
      > Docker weakens trust because it lets anonymous people ... upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated How is this github any different?
ris 7y ago
But it was possible to see this trouble coming from way back. Docker, Inc. took on over $150m of VC investment up to the end of 2015. One hundred and fifty million dollars. How do you possibly plan to show a return on such an investment? The only way is to get one of your "services" injected into peoples pipelines as a critical component, no matter how questionable the fundamental necessity of that service is. But of course, you own the tool, you get to design the workflow and do your best to shape your users worldview. I do wish developers would be a little wiser around these things, especially when they see companies taking such huge amounts of capital. I found it quite depressing to watch the unquestioning way development communities assimilated the docker worldview.

pavanagrawal123 7y ago

This raises the question of whether any high profile images were targetted by the infiltrators?

anaphor 7y ago

That doesn't mean there aren't plenty of things they could have done to make this more secure. The fact that you can just `docker login` with the same credentials that allow access to your entire registry is pretty poor security design IMO.

tylerl 7y ago

I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order. But no, not Docker. You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" as they are, and as godawful as the security practices are that underlie their tools and standards... they hadn't a chance. They still don't. There is no reason to expect them to get better.

lowpro 7y ago
Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0] https://twitter.com/WHHackersBR/status/1118393568656334850 https://twitter.com/WHHackersBR/status/1118393568656334850
- acct1771 7y ago
  And do we ever find out how much that was being exploited "in the wild"?
  - simondedalus 7y ago
    we grit our teeth and "believe" that anyone traceably affected got an email directly from the company or something :D (that said, google main page vulnerable to xss is kind of like... what, we're afraid someone will take over google and put some cryptominers on the google.com main page?)
    - WrtCdEvrydy 7y ago
      The Microsoft Approach... 'people totally didn't access your email body... except we eventually owned up to it after it got leaked'
      - mehrdadn 7y ago
        Where did they deny that anybody's email bodies were read? I'm looking for it and I can't find it. I only see that they told the other 94%(?) of people that unauthorized access did not reveal the contents of their messages in particular, which seems to be truthful?
        WrtCdEvrydy 7y ago
        Initial email said the body wasn't affected, and motherboard asked for a confirmation, so they said 'Yes'. 6% of the people received a specific email saying the body of their email was accessed and they had to backtrack.
        mehrdadn 7y ago
        Well the email said: > This unauthorized access could have allowed unauthorized parties to access and/or view information related to your email account (such as your e-mail address, folder names, the subject lines of e-mails, and the names of other e-mail addresses you communicate with), but not the content of any e-mails or attachments, between January 1st 2019 and March 28th 2019. Notice it says your email account. The whole email is about the account of the recipient, not those of other recipients. Given that they explicitly worded it this way and people clearly misinterpreted it to mean something else, I hope you can forgive me for being a little skeptical of third-party anecdotes that suggest Microsoft claimed nobody's email contents were accessed...
cabaalis 7y ago
You are aware that Google identified a vulnerability so awful that they hid it from the public so as not to draw government scrutiny, did not retain access logs, and ultimately shut down a major public application? It wasn't authentication credentials, but still.
- Scoundreller 7y ago
  Which vulnerability was this?
  - wahern 7y ago
    Presumably the Google+ exfiltration issue. > The bigger problem for Google isn’t the crime, but the cover-up. The vulnerability was fixed in March, but Google didn’t come clean until seven months later when The Wall Street Journal got hold of some of the memos discussing the bug. The company seems to know it messed up — why else nuke an entire social network off the map? — but there’s real confusion about exactly what went wrong and when, a confusion that plays into deeper issues in how tech deals with this kind of privacy slip. (https://www.theverge.com/2018/10/9/17957312/google-plus-vulnerability-privacy-breach-law https://www.theverge.com/2018/10/9/17957312/google-plus-vuln...)
simondedalus 7y ago
it is of course just a matter of time for either of the companies you mentioned to "be hacked" (obviously it's happened countless times with Microsoft, both the OS and their cloud services like O365, and there was a recent high profile revelation that the google apps suite APIs exposed user info to developers). the difference is incident response and layered security. as long as you're using software somewhere in the stack that isn't like maturity level 5, AND you don't have constant audits looking for novel attacks on working-as-intended systems, you're pretty much guaranteed to inherit (or create) a vulnerability at some point, and if you're important enough it will get exploited. the reason that doesn't mean we should start modeling computer systems as "living organisms that eventually get old and die" and should keep modeling security like war is that when you get hit, you can respond. all the layers matter, and insofar as Microsoft or Google do it right, they primarily do it right by having a mature process for monitoring, patching, isolating, etc. as for docker hub though, yeah i'm totally with you. i'm just saying we shouldn't overestimate the preventive capacity of anyone, honestly. if you're doing anything important over the internet at all, you're making some compromises somewhere. here are 2 links to things i handwaved at above, for example's sake: https://www.wired.com/story/microsoft-email-hack-outlook-hotmail-customer-support/ https://www.wired.com/story/microsoft-email-hack-outlook-hot... https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/google-plus-breach-what-happened-who-was-impacted-and-how-to-delete-your-account/#4f05fda96491 https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/goog...

quickthrower2 7y ago

Do they offer end to end encryption and signing. That would make your ci say f-off it the image has been played around with, and also protect any secrets, although there is no need to have source code or passwords in the image anyway.

morpheuskafka 7y ago

It's made worse by the fact that only a few major images are used as bases. That's normally good for security, as they are highly vetted and quickly updated, but if they could be compromised, say Alpine or Ubuntu Clould, even for a minute, countless images would be built using the compromised base and it would be very hard to ensure they were all rebuilt. As I understand it, there's no element of signing from the actual devs of an image, just from the central trust service of Docker Hub.

eecc 7y ago
I don’t think Docker has a way to revoke individual image hashes. Or does it?

duxup 7y ago

Is hacking even needed? There already have been questionable images hosted there ... just by users uploading compromised images. No hacking needed.

ohyeshedid 7y ago
There's a difference between alpineworm:latest and alpine:latest. Someone would have to choose to download the questionable image, while someone compromising a base image could go unnoticed for quite some time and have a massive install base since it's used in so many other images.

ahmedalsudani 7y ago

Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...

speedplane 7y ago
> Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how tar allows you to package files. What you put in it is up to you.
- bayareanative 7y ago
  That's a strawman because the shriekingly-obvious difference is ease of facilitation. With Docker, it's a mere couple of commands to pull a box and run it. Docker weakens trust because it lets anonymous people, as well as trusted ones, upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated on Docker's side. It's spray-and-pray DevOps. Image integrity has to be solved on Docker's side with end-to-end integrity or it's all for naught... this is something that cannot be solved within a container or separate from Docker, it must be universal, mandatory and trustworthy.
  - speedplane 7y ago
    > Docker weakens trust because it lets anonymous people ... upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated How is this github any different?

ris 7y ago

But it was possible to see this trouble coming from way back. Docker, Inc. took on over $150m of VC investment up to the end of 2015. One hundred and fifty million dollars. How do you possibly plan to show a return on such an investment? The only way is to get one of your "services" injected into peoples pipelines as a critical component, no matter how questionable the fundamental necessity of that service is. But of course, you own the tool, you get to design the workflow and do your best to shape your users worldview. I do wish developers would be a little wiser around these things, especially when they see companies taking such huge amounts of capital. I found it quite depressing to watch the unquestioning way development communities assimilated the docker worldview.