Docker Hub was just attacked! More than 190K user accounts may have been exposed. Docker Hub discovered the unauthorized access to a single Hub database On Thursday, April 25th, 2019.
The accessed data includes usernames, passwords, Github and Bitbucket tokens for Docker auto builds. Dockers confirm that only non-financial user data is affected.
Docker hub is the cloud repository which allows users to create a test, store and distribute container images. It also allows you to download the docker images built by other communities.
Docker started notifying users about the security incident. It was unclear how the hackers gained unauthorized access to a single database.
According to the company’s official statement, “we’ve learned unauthorized access to a Docker Hub database, sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users).”
Docker recommends users to change their password and for shared accounts. All the impacted accounts GitHub tokens and access keys, so the user’s with auto builds are impacted. Impacted users need to reconnect to the repositories and the users are recommended to check with security logs for any unauthorized access.
“We are enhancing our overall security processes and reviewing our policies. Additional monitoring tools are now in place. Our investigation is still ongoing, and we will share more information as it becomes available,” as it says in the company’s statement.
Last year, attacker’s made a way to docker for mining cryptocurrencies. They pushed malicious images to a Docker Hub registry and pulling it from the victim’s system, hackers were able to mine 544.74 Monero.
While only 190,000 seems a small breach, it is not. A vast majority of Docker Hub users are employees inside large companies, who may be using their accounts to auto-build containers that they then deploy in live production environments.
A user who fails to change his account password and may have their accounts autobuilds modified to include malware. Docker said it is still investigating the incident and will share details when available. The security incident was not disclosed on the company’s website, but only via email.
