Users , the official container registry for the Docker system, received about the breach of the project's infrastructure. As a result of the attack, the attackers gained access to a database of user accounts, which includes information on 190,000 users of the service, including hashed passwords and tokens for accessing repositories on GitHub and Bitbucket. To prevent the spread of the attack, build formation has been suspended, and tokens for GitHub and Bitbucket have been revoked.
All Docker Hub users are advised to urgently change their passwords, especially if one password is used across multiple different resources. If automated builds linked to a repository on GitHub or Bitbucket are used, it is also recommended to enable two-factor authentication and update the OAuth connection identifier ( disconnect and re-link the repository).
In the case of linking to a repository, full read and write permissions were requested, i.e., compromising Docker Hub may also lead to compromising the linked repositories. If there is a link, it is necessary to carefully
check the log ( ) of recent events for any suspicious activity. Furthermore,
if connection keys to various APIs are hosted in private repositories and containers, those keys must also be updated, as attackers may have gained access to private repositories.
The infrastructure of Docker Hub was attacked on April 25. During the attack, the attackers gained access to the project's database and user information, excluding financial data. Initial investigations showed that the leak affects data from approximately 190,000 users, which constitutes about 5% of the total user base of the service. Detailed information about the incident is not yet available, and the investigation is still ongoing.
Source: opennet.ru
