6 ms·

Tragedy of the commons - only need a few bad actors to ruin it all for us. Almost all distributors face this problem, from Docker Hub to PyPI. This also reminde

Tragedy of the commons - only need a few bad actors to ruin it all for us. Almost all distributors face this problem, from Docker Hub to PyPI. This also reminded me of official Postgres Docker image running a cryptominer in the background [1] [1] - https://github.com/docker-library/postgres/issues/770 https://github.com/docker-library/postgres/issues/770

boomanaiden154 3y ago
It doesn't seem like the linked Github issue really backs up the claim that malware was getting shipped in the official image? The OP kept claiming that (even titling it `[Confirmed]`), but only one other person was able to corroborate the claim and their image hashes didn't match any of the hosted ones.
brasetvik 3y ago
Reading that thread it doesn't seem like the official image shipped with any cryptominer at any point, and that it's more likely that the container got compromised in other ways. (A compromised [superuser connection to Postgres can execute shell code](https://medium.com/r3d-buck3t/command-execution-with-postgresql-copy-command-a79aef9c2767 https://medium.com/r3d-buck3t/command-execution-with-postgre...), so that seems more likely than the image shipping with a miner)
- jeroenhd 3y ago
  Several other issues also mention this problem across versions, with one issue mentioning that changing the default password fixed the issue. It looks like the miner was installed because the Postgres port got exposed with a weak password.
nonethewiser 3y ago
That is a very interesting read. The maintainers seem more sane than Antender. Im even sympathetic to many of his points but he cant be sure a maintainer put a cryptominer in the image. Shouldnt be so fast to point fingers. Are there any aggregators of interesting github issues? Links with a bit of context about them make for some fascinating reads.

6 ms·

Tragedy of the commons - only need a few bad actors to ruin it all for us. Almost all distributors face this problem, from Docker Hub to PyPI. This also reminde

by tzhenghao 3y ago

boomanaiden154 3y ago
It doesn't seem like the linked Github issue really backs up the claim that malware was getting shipped in the official image? The OP kept claiming that (even titling it `[Confirmed]`), but only one other person was able to corroborate the claim and their image hashes didn't match any of the hosted ones.
brasetvik 3y ago
Reading that thread it doesn't seem like the official image shipped with any cryptominer at any point, and that it's more likely that the container got compromised in other ways. (A compromised [superuser connection to Postgres can execute shell code](https://medium.com/r3d-buck3t/command-execution-with-postgresql-copy-command-a79aef9c2767 https://medium.com/r3d-buck3t/command-execution-with-postgre...), so that seems more likely than the image shipping with a miner)
- jeroenhd 3y ago
  Several other issues also mention this problem across versions, with one issue mentioning that changing the default password fixed the issue. It looks like the miner was installed because the Postgres port got exposed with a weak password.
nonethewiser 3y ago
That is a very interesting read. The maintainers seem more sane than Antender. Im even sympathetic to many of his points but he cant be sure a maintainer put a cryptominer in the image. Shouldnt be so fast to point fingers. Are there any aggregators of interesting github issues? Links with a bit of context about them make for some fascinating reads.