dockhub compromised

[repomanz]

https://news.ycombinator.com/item?id=19763413.  May be worth a bulletin to users given the significant use of containers within unraid.

[Squid]

https://news.ycombinator.com/item?id=19763413.  May be worth a bulletin to users given the significant use of containers within unraid.

Only affects those who create containers, not anyone who only uses them

Sent via telekinesis

[melmurp]

Could not someone have used the tokens to add themselves to the github repo access, modify some code, and let the auto build do it's thing... then we get the "docker has update" notification and those with auto update just pulled a poisoned copy?

 

For example this was in the wild for a few days and last night I noticed 6 of my dockers had updates pending... worrisome in light of this news.

[Squid]

Sure, but all that's needed is the authors to change their passwords.

[melmurp]

You have a lot more faith then me I guess... some authors likely don't even know this happened or have things in a code complete mode so don't check their github daily.

 

Guess I'll go check all the recent ones marked as updated and see what exactly changed to relieve my paranoia.

[Squid]

Ultimately, you need to have faith since none of us have any control over it.

39 minutes ago, melmurp said:

Guess I'll go check all the recent ones marked as updated and see what exactly changed to relieve my paranoia.

Good luck with that.

[saarg]

49 minutes ago, melmurp said:

You have a lot more faith then me I guess... some authors likely don't even know this happened or have things in a code complete mode so don't check their github daily.

 

Guess I'll go check all the recent ones marked as updated and see what exactly changed to relieve my paranoia.

 

Those accounts that got compromised also got an email asking them to change password and change github api key.

 

Linuxserver.io did not get any email. Personally I got an email.

[melmurp]

7 minutes ago, saarg said:

 

Those accounts that got compromised also got an email asking them to change password and change github api key.

 

Linuxserver.io did not get any email. Personally I got an email.

I did check and seems the majority of mine where Linuxserver.io's bot updating dependence libs on the same day this compromised occurred.. bad timing

Curious why dockerhub requires write access to github repo if they're just pulling

 

[repomanz]

little late replying to my own thread here but agree with melmurp.  unraid, and it's community, leverage a lot of docker containers and just making an assumption that those dev owners who author containers for use of unraid have taken steps is a bit risky.   

I know emails, password resets including api tokens has occurred.  I may jump over to the community plugin support page to see if they are mitigating this at all.  Would make me feel better about it at least.