Cybersecurity @sh.itjust.works Kid @sh.itjust.works 2 mo. ago

Millions of Docker repos found pushing malware, phishing sites

www.bleepingcomputer.com Millions of Docker repos found pushing malware, phishing sites

Three large-scale campaigns have targeted Docker Hub users, planting millions of repositories designed to push malware and phishing sites since early 2021.

23 comments

Because of course they are.
- The more interesting question is, how many downloads do they get?
  
  So without those numbers, I see this as largely FUD. It doesn't seem like trusted repos are getting infiltrated, so this sounds like a nothing burger. It's good that Docker removed them, but without actual evidence of harm, it just seems cosmetic.
  
  As of this writing, I saw one comment:
  
  I get all kinds flack for not using docker containers and this is why I don't. 20% is 1 in 5 containers, that cannot be trusted. I have no desire to to build my own Docker containers. I would much rather spin up a VM. CPU, RAM and disk space are cheap these days.
  
  - Throwdown
  
  This entirely misses the point of Docker. Yeah, 1 in 5 containers have malware, but how likely are you to be mislead into using one of those containers? I only pull containers based on some official project.
  
  For example, if I want to host nextcloud, there's an "official" image for that. For CI, I generally use images from "official" sources (e.g. this one from Rust for Rust projects).
  
  Then again, I'm a developer, but I don't see anything here about Docker itself being a problem, and the vast majority of users will probably just follow links from some blog to accomplish some task, they won't be downloading random images from the Docker hub...
  
  Thank you for your in depth explanation.
  
  I have never used docker, so I was thinking it was a bigger issue. You have given very good points, and I now know a little more about docker.
  
  Thank you!
  
  This entirely misses the point of Docker.
  
  It's just pointing out the risk of letting someone you don't know with no legal obligations setup your complete environment.
  
  How likely
  
  Probably as likely as someone cracking your really secure ssh password. Still, any sane expert will recommend disabling password auth.
  
  I only pull containers based on some official project.
  
  How do you know they weren't compromised?
  
  but I don't see anything here about Docker itself being a problem
  
  The problem is that rootless docker is a pain and no one does it. Privileged software sideloading other software is a huge risk.
  
  That risk now became an incident. Even if you're not affected, the risk still remains.
Nice pants.

I'm sorry. I don't know anything.

You've viewed 23 comments.