{"id":32532,"date":"2019-10-31T21:47:34","date_gmt":"2019-10-31T18:47:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vzlom-infrastruktury-docker-hub-s-vozmozhnoj-komprometatsiej-svyazannyh-repozitoriev\/"},"modified":"2019-10-31T21:47:34","modified_gmt":"2019-10-31T18:47:34","slug":"vzlom-infrastruktury-docker-hub-s-vozmozhnoj-komprometatsiej-svyazannyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vzlom-infrastruktury-docker-hub-s-vozmozhnoj-komprometatsiej-svyazannyh-repozitoriev","title":{"rendered":"Hacking da infraestrutura do Docker Hub com poss\u00edvel compromissos de reposit\u00f3rios associados","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Usu\u00e1rios Docker Hub<\/a><\/noindex>, cat\u00e1logo oficial de containers para o sistema Docker, receberam uma notifica\u00e7\u00e3o<\/a><\/noindex> sobre a viola\u00e7\u00e3o da infraestrutura do projeto. Como resultado do ataque, os criminosos obtiveram a base de dados de contas, que inclui informa\u00e7\u00f5es sobre 190 mil usu\u00e1rios do servi\u00e7o, incluindo hashes de suas senhas e tokens de acesso a reposit\u00f3rios no GitHub e Bitbucket. Para evitar a propaga\u00e7\u00e3o do ataque, a forma\u00e7\u00e3o de builds foi suspensa, e os tokens do GitHub e Bitbucket foram revogados. <\/p>\n

Todos os usu\u00e1rios do Docker Hub s\u00e3o aconselhados a mudar suas senhas imediatamente, especialmente se uma mesma senha for usada em v\u00e1rios recursos diferentes. No caso de uso de builds automatizadas vinculadas ao reposit\u00f3rio no GitHub ou Bitbucket, tamb\u00e9m \u00e9 recomendado ativar a autentica\u00e7\u00e3o de dois fatores e atualizar o identificador de conex\u00e3o OAuth (\u00e9 necess\u00e1rio<\/a><\/noindex> desvincular e vincular novamente o reposit\u00f3rio). <\/p>\n

No caso de estar vinculado a um reposit\u00f3rio, foram solicitadas permiss\u00f5es completas para leitura e grava\u00e7\u00e3o de informa\u00e7\u00f5es, ou seja, a comprometimento do Docker Hub pode levar \u00e0 comprometimento dos reposit\u00f3rios vinculados. Se houver vincula\u00e7\u00e3o, recomenda-se examinar cuidadosamente os logs (
\nBitBucketGitHub<\/a><\/noindex> ) dos \u00faltimos eventos em busca de atividade suspeita. Al\u00e9m disso,<\/a><\/noindex>caso chaves de conex\u00e3o a v\u00e1rias APIs estejam armazenadas em reposit\u00f3rios e containers n\u00e3o p\u00fablicos, \u00e9 necess\u00e1rio atualizar tamb\u00e9m essas chaves, pois os atacantes podem ter acessado reposit\u00f3rios privados.
\nA infraestrutura do Docker Hub foi atacada em 25 de abril. Durante o ataque, os criminosos tiveram acesso ao banco de dados do projeto e \u00e0s informa\u00e7\u00f5es dos usu\u00e1rios, exceto os dados financeiros. A investiga\u00e7\u00e3o inicial revelou que a viola\u00e7\u00e3o abrange aproximadamente 190 mil usu\u00e1rios, o que representa cerca de 5% da base total de usu\u00e1rios do servi\u00e7o. Informa\u00e7\u00f5es detalhadas sobre o incidente ainda n\u00e3o est\u00e3o dispon\u00edveis, e a investiga\u00e7\u00e3o ainda n\u00e3o foi conclu\u00edda.<\/p>\n

\"Hacking<\/a><\/noindex><\/center><\/p>\n

Os usu\u00e1rios do Docker Hub, cat\u00e1logo oficial de containers para o sistema Docker, receberam<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Docker Hub, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b Docker, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0440\u0443\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e\u043f\u0430\u043b\u0430 \u0431\u0430\u0437\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0430\u044f \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 190 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0445\u044d\u0448\u0438 \u0438\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043d\u0430 GitHub \u0438 Bitbucket. \u0414\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0431\u043e\u0440\u043e\u043a \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e, \u0430 \u0442\u043e\u043a\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24331,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-32532","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Invas\u00e3o da infraestrutura do Docker Hub com poss\u00edvel comprometimento de reposit\u00f3rios relacionados | ProHoster","description":"\ud83e\udd47Viola\u00e7\u00e3o da infraestrutura do Docker Hub com poss\u00edvel comprometimento dos reposit\u00f3rios relacionados | ProHoster","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vzlom-infrastruktury-docker-hub-s-vozmozhnoj-komprometatsiej-svyazannyh-repozitoriev","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Docker Hub \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Docker Hub, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b Docker, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vzlom-infrastruktury-docker-hub-s-vozmozhnoj-komprometatsiej-svyazannyh-repozitoriev","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:47:34+00:00","article:modified_time":"2019-10-31T18:47:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32532","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 11:20:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:57:22","updated":"2026-01-21 11:20:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/32532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=32532"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/32532\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/24331"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=32532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=32532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=32532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}