Weekly Watch April 29-May 3, 2019

In Case You Missed It

Looking Ahead

In the Spotlight This Week

Open source container platform, Docker, announced that a malicious actor briefly gained access to the sensitive data related to 190,000 Docker Hub accounts. While that number might be relatively low, the Docker breach has far reaching implications for further potential risks.

Developers can store app “containers” on Docker Hub. The malicious actor was able to hack into one of the hub databases and expose usernames and hashed passwords. However, it also contained tokens for popular developer resources, including GitHub and BitBucket. The possible compromise of these tokens magnifies the risk that attackers may be able to add malicious code to other data repositories.

Kenn White, a security expert and co-director of the Open Crypto Audit Project, warned that “Even if your company doesn't rely on Docker Hub for production, if a developer in your org enabled auto builds and linked to GitHub via oauth for a personal project, when that oauth token is compromised, _all_ repos on GH they had access to are vulnerable.”

Since the breach, Docker has revoked the GitHub tokens and access keys for the affected accounts. The company also encourages users to unlink and then relink their GitHub and BitBucket source provider.

For more information:

Docker Hub Breach: It's Not the Numbers; It's the Reach

Docker Hub Hack Affects 190K Accounts, with Concerning Consequences

Attackers Breached Docker Hub, Grabbed Keys and Tokens

REN-ISAC

Weekly Watch April 29-May 3, 2019

In Case You Missed It

In the Spotlight This Week

Research & Education Networks Information Sharing & Analysis Center