Skip Navigation

Technology @kbin.social

wave_walnut @kbin.social

1y ago

Thousands of images on Docker Hub leak auth secrets, private keys

www.bleepingcomputer.com Thousands of images on Docker Hub leak auth secrets, private keys

Researchers at the RWTH Aachen University in Germany published a study revealing that tens of thousands of container images hosted on Docker Hub contain confidential secrets, exposing software, online platforms, and users to a massive attack surface.

Thousands of images on Docker Hub leak auth secrets, private keys

Researchers at the RWTH Aachen University in Germany published a study revealing that tens of thousands of container images hosted on Docker Hub contain confidential secrets, exposing software, online platforms, and users to a massive attack surface.

Linux @lemmy.ml

Thousands of images on Docker Hub leak auth secrets, private keys

www.bleepingcomputer.com /news/security/thousands-of-images-on-docker-hub-leak-auth-secrets-private-keys/

Thousands of images on Docker Hub leak auth secrets, private keys

217 41

4 comments

Not sure I understood everything, but it reads as if the image creator added secrets into the image? Wouldn't that be the problem of the image creator, instead of people using the image?
- A developer works on a docker image for some sort of server software and puts in a backdoor for testing purposes or leaves some password somewhere defaulted to make things easier for them. Dev forgets about it, and publishes the image. Ten thousand people then download the compromised image and deploy it on Internet-facing servers without a second thought.
  
  Ah, that makes more sense then. Thanks.

Can't say I'm that surprised.