Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by hi56793 on Saturday April 27, 2019 @04:54AM (#19764598)

Many package managers that support git as source allow to pin to a specific commit sha. That's as far as I can see a quite secure way to keep using an uncompromised/verified version. It's not the most popular feature but people do it every now and then, probably it should be done more.

I wonder if docker allows this and on the other hand if that's even feasible for say application images, given that applications must be updated a lot for security reasons. Of course if the Dockerfile's parent reference is not pinned, that does only help to some degree...

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by Polyisoprene on Saturday April 27, 2019 @05:22AM (#19764670)

You can pull an image using the sha:

docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by cyphar on Saturday April 27, 2019 @05:40AM (#19764719)

Which effectively nobody does. Package managers and distribution packaging systems default to the safe method rather then defaulting to insecure rewritable tags.

To be fair, the docker.io/library/* images are signed but no other images are and there are a bunch of issues with how the signing policies work for users that want to enforce that some images must be signed.

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by dlitz on Saturday April 27, 2019 @06:22AM (#19764835)

The important thing is that tags are signed and up-to-date, like how git tags work or how Debian signs its entire repository as a unit (via the Release file) rather than having developers just sign individual packages. Otherwise, even if it's signed, it's subject to downgrade attacks.

Installing known-vulnerable old versions of legitimate software can be just as bad as installing custom malware.

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by cyphar on Saturday April 27, 2019 @06:32AM (#19764855)

Sure, that's how almost all package managers work. I can't think of a modern package manager from an "enterprise" distribution that didn't have a lot of the features of TUF[+].

And as I said, only official-library Docker images are signed. All other images are unsigned and even for third-party repos you can't force Docker to verify all images from a given repo (you have to enable it globally, which breaks the utility of a local "docker build").

[+] Arch is the only counterexample I can think of and I'm not even sure if my memory is correct.

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by sterlind on Saturday April 27, 2019 @10:24AM (#19765684)

I do it! Everything I pull is pinned with sha256 since I use Nix/Kubenix, so I'm required to pin sha256 if I'm fetching from the Docker registry (or build the package deterministically myself.)

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by cyphar on Wednesday May 01, 2019 @11:51AM (#19798242)

The way image signing works with Docker is that there is a signature tying a tag to a sha256. If you use the sha256 directly you get immutable sources, but now your source isn't signed anymore -- how are you sure the hash is correct?

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by ownagefool on Saturday April 27, 2019 @04:47PM (#19767538)

It's a bit of a pain, you need to build, push, pull, then get the sha. I suspect it would be done more if there was actually a decent UX for it.

[ Parent | on HN ]