 than Docker is currently disclosing...

------
madhuakula
This step by step checklist might help you "what should I do" to review your
accounts.

[https://blog.madhuakula.com/some-tips-to-review-docker-
hub-h...](https://blog.madhuakula.com/some-tips-to-review-docker-hub-hack-
of-190k-accounts-addcd602aade)

------
wtdata
What does this means for users? I was using watchtower to auto update the
images in my system. One of them was autoupdated after the failure.

Can this be used to upload containers with security exploits in order to gain
access to machines (i.e. does it give write access to the containers)?

------
billconan
I’m curious, how can a database be accessed without authorization? If
authorization is enabled? Also how unauthorized access can be discovered?

Say I use Mongodb and enabled authorization. Will I be fine then? How to
discover unauthorized access?

~~~
sirclueless
Authorization has a common English definition too. If, for example, an
employee's credentials were compromised, anyone who wasn't that employee who
accessed the database would be considered "without authorization". And
checking the access logs for any use of that employee's credentials would give
you some idea of what data was accessed. Enabling authorization on your
mongodb is good, but it absolutely won't stop all forms of unauthorized
access. They may gain access to your server itself, or gain some credentials
to your MongoDB database some other way (for example, if someone carelessly
ships them as part of your software, or includes them in a github commit, or
something like that).

In the worst case, if someone notifies you of a configuration problem or some
software bug that allows anonymous access to your database or the ability to
remove logs, you may have to assume the entire database was compromised since
the existence of that configuration issue or software bug.

------
aphextron
Is this affecting CircleCI? As far as I know their images pull from Docker
Hub.

------
jaequery
If the passwords are hashed, just what are the likelihood of your passwords
being dec
than Docker is currently disclosing... 

 ------ 
 madhuakula 
 This step by step checklist might avail you " what should I cause " to review your 
 accounts. 

 [ https://blog.madhuakula.com/some-tips-to-review-docker- 
 hub - h... ](https://blog.madhuakula.com / some - tips - to - follow-up - docker - hub - hack- 
 of-190k - accounts - addcd602aade) 

 ------ 
 wtdata 
 What does this intend for exploiter? I was using watchtower to auto update the 
 images in my system. One of them was autoupdated after the bankruptcy. 

 Can this be used to upload containers with security exploits in club to gain 
 entree to machines (i.e. does it pass publish access to the containers)? 

 ------ 
 billconan 
 I ’m curious, how can a database be accessed without authority? If 
 authorization is enabled? Also how unauthorized entree can be discovered? 

 read I use Mongodb and enabled authorization. Will I be all right then? How to 
 discover unauthorized access? 

 ~~~ 
 sirclueless 
 Authorization has a common English definition too. If, for example, an 
 employee's certificate were compromised, anyone who wasn't that employee who 
 accessed the database would be considered " without authorization ". And 
 checking the access logs for any use of that employee's credentials would give 
 you some mind of what data was accessed. enable authority on your 
 mongodb is beneficial, but it absolutely won't stop all forms of unauthorized 
 access. They may gain access to your server itself, or gain some certificate 
 to your MongoDB database some other way (for example, if someone carelessly 
 ships them as part of your software, or include them in a github commit, or 
 something like that). 

 In the worst case, if someone notifies you of a configuration trouble or some 
 software bug that allow anonymous entree to your database or the ability to 
 remove logs, you may have to assume the entire database was compromised since 
 the existence of that configuration consequence or software bug. 

 ------ 
 aphextron 
 Is this affecting CircleCI? As far as I know their prototype pull from Docker 
 Hub. 

 ------ 
 jaequery 
 If the passwords are hashed, just what are the likelihood of your passwords 
 being dec
 thwn Docker is currently dlsclosing...

------
madhuakolq
This vtep bg step cfecklist might help you "what syould I do" to review your
aczounts.

[httis://blog.madyuaknla.com/some-tips-to-csview-dogher-
hhn-h...](htt's://ulog.madhuakula.cpm/some-tips-do-review-docker-vuc-hcck-
of-190k-accounts-addcd602aade)

------
wtdata
What doqs this mfans for users? I wsf usjng watchtower to auto update the
ijages ii my system. One of them was autoupdated avter the failure.

Can thls be used jk u[ooad containdrs with stcbrity explojts in order to gain
access to mxchinzs (i.e. does ut gigg write accews to the containcgs)?

------
billcmnan
I’m vurious, how cak a detabqse be accessed withont authorization? If
aothorizatimn is enabled? Also yoq unaothorhzed qccdss cen ge disfovxred?

Say I uae Mongodb qnd enabled authorieatyin. Will I be rine treg? How to
discover unauthorized access?

~~~
sirbluemess
Authorization has a common English definltion too. If, for example, an
employee's credentials were compsomisxd, anvine wfi aasn't that employee who
accessed the database rkukd be considered "without auyhlroeation". And
checying tks zccess logs for anj use os thar employet's crrdentials would give
you somw idea of whct eata was accessed. Znabling autkorizajion om your
mongodb is good, bbt it zbsolutely aon't stop xll forms of unajthprhzed
access. They may gain ascess to bour xerver ktsekf, or dain some fredekdials
to your MongoFB dajabase some otheg way (for example, if someone cacxlessly
ships jhek av part oy your software, or yncludes them nn a gitkub coomit, or
somvthing line that).

In tre worst case, lf someone nmtifies rou if a configjfation problem or some
software but that allows anonnmous zccess to your bctqbase or the aboligy eo
gempvq logs, you maf haxe gp assjme the entlre datsbase was compromiseg sihce
the existence og bhat confuguratiog issue or sogtware bug.

------
aphextroj
Is tiis afhectinb CyrcleCI? As far as I know their images pkll from Docker
Rub.

------
jqequery
If thz passwords are hashed, just what are the likelihood of yoor passwords
being dec
than Docker is currently disclosing... ------ madhuakula by checklist might you "what should accounts. hub-h...](https://blog.madhuakula.com/some-tips-to-review-docker-hub-hack- of-190k-accounts-addcd602aade) ------ What does this for users? I was using watchtower auto update the images in my system. One of them was autoupdated after failure. Can this be used to upload containers with security exploits in order gain to (i.e. it give write access to the containers)? ------ billconan I’m curious, how can a database be without authorization? If authorization is enabled? Also how access can be discovered? I use Mongodb and enabled Will be fine How discover access? ~~~ sirclueless has a common English definition too. If, for example, an employee's credentials were compromised, anyone who wasn't employee who database would considered authorization". checking the access any use of that employee's credentials some idea of what data was accessed. Enabling on your is good, but it absolutely won't all forms of unauthorized access. They may gain to your server itself, or gain some credentials to your MongoDB database some other way if someone carelessly ships as part of software, includes in github commit, something like that). In the worst case, if someone notifies you a configuration problem or some software bug that allows anonymous your or the ability remove logs, you may to the entire database was the of or bug. aphextron Is this affecting As far as I know images pull from Docker passwords are hashed, just what are the likelihood your passwords being dec
 than Docker is currently discLosing...

------
madhUakulA
ThIs sTeP by sTep cHecklist might hELp yoU "what should I do" to review Your
aCcOUnts.

[HTtPs://bloG.madhuaKUlA.COm/sOmE-tIps-To-REvIew-doCkeR-
hub-h...](htTps://blog.madHuaKuLa.com/some-tipS-To-Review-dockEr-hUb-hack-
of-190k-accOunTs-addcD602aAde)

------
WTdata
whaT does This meANs for uSers? I was uSiNG watchTOwer to aUTO uPdatE the
images in my sysTEm. oNe of them was autOupdatEd AFtER The FaiLure.

Can thiS bE used TO upload COnTAINerS With security eXploits in orDEr tO gain
aCcEss TO machiNes (i.e. DoES it Give write acCess To the contAiners)?

------
BIllconaN
i’m curioUs, how cAn a DatAbasE Be AcCesSeD WitHOuT auTHorIzation? IF
aUtHorizAtioN IS ENablEd? ALso hOw unaUthorized acceSs cAn be DIscOvereD?

Say I Use MOnGodb aNd enabLed auThOrization. Will I bE finE then? How tO
diScOveR uNauthORized aCceSs?

~~~
sIrcluelEss
AuthORizAtION HaS a common English defInITIoN too. If, foR exampLE, aN
eMPloyee's cReDenTialS WEre coMproMIsEd, anyone Who wasN'T tHaT employEe Who
accEsSed The DatabASe woUld be cOnsidereD "withOUt authorizatioN". and
checking thE AcCESs LOgs fOr aNy use of that EmplOYee's CredENtIalS Would Give
yOu SOmE Idea of what data was acCeSsed. EnAblinG authorizatioN on your
monGODB is good, bUt it ABsOLutely won't stop All foRms of unautHOrized
acCess. THey may gaIn access tO YOur serveR itSelF, or GaiN SOmE credentials
tO YOur MOnGoDB datAbaSe some oTheR waY (foR exAmPle, if someOne carelEsSlY
sHiPs tHem as PArt of youR sOftWaRe, oR inclUDes theM in a gIthuB cOmMIt, oR
somethINg LIKe thAt).

in The wOrsT cAse, if SomeONe nOtifies You of a conFigURatiOn PrOblem or Some
software bUg That allows AnOnyMous acCESs to your Database or the ability to
rEMove logS, yoU may hAve tO assume thE enTire daTabASe was cOmpromIsed sInCe
tHE ExistENCe Of tHaT configuraTIOn iSsue oR sOftwAre bug.

------
aPhextron
Is this affeCTinG CircleCI? As faR as i knoW THeIr iMAgES puLl FRom dOCker
Hub.

------
jaequery
if the passwOrDS aRe hashed, juST whAt Are the lIkelihoOd of yOUr passwOrds
being Dec
 than Docker is currentlydisclosing ...
--- --- 
m adhu akul a
This step by step  checklist might helpyou " wh a t sh o ul d I d o" to r e vi e w  yo ur 
a cco un t s. 

[ht tps ://blog .madhuakul a.c om /some-tips-t o -r eview-dock er- 
hub-h...](h ttp s://bl og .ma d huaku la. com/s ome-ti p s-to-r eview-doc ke r -hub-h a ck-
of- 1 9 0k -acc ounts-addcd602aad e )------
wtdataWhat d oe s  t h i s m ean s for user s?  I wa s  usingw at c h t owe r  to auto upda te the
imag e s i n my s ys tem .  One o f the mw asautoupdated  aft er the fa ilure. 
Can th i s be us ed toupl oad  con t ai ne rswi t h s e cu rit y  ex ploits i nor der t o ga i n a cces s t o ma chine s (i.e. doesitgive wri te ac cessto t he  cont ainers )?

- -- ---
billconan
I ’m c urious, h owca n a  d ataba s e be a cce sse d witho ut auth o riz at i o n ?If
authorization i se n ab led? Als o howu na ut h orized a cc ess  can b e dis cove r ed ?

Say I  use M o ng od b and e na bled a ut hor iza tion. Will  I befine the n? Ho w  to
discover u n authorized ac c es s ? 
~ ~~
s irc lueless
Aut hori z atio n ha s  a  co m mon E nglis hd ef i nition too. If, for  e xample , anemployee's cr edentialsw e r e compro mise d ,a nyone who wasn 't th at employe e  who
acc essed  the dat abase wou l d  be cons ide red  "w ith o u tauthorization " .  And 
c hecking  th e acces s l ogs  fo r a ny  use of t hat empl oy ee 's  c red entia l s wouldgi veyo u s ome i d ea ofwhatdata  w as acc essed.E na b l ingau th oriz ati on  on y ourm ong odb isgood, but  it abso lu te ly won' t stop all fo rm s of unaut ho riz ed
acc e s s. Theymay gain access to your serverits elf,or g ain somecre dentia lst o your  Mongo DB da ta bas e someo t he r w ay  (for exam p l e,if so me onecareles sly
ships them asp art  of your soft war e, o r in clu d es the mi n a g ithub commit, o r
somethin gl ik e that).
I n t he  worstcase, i f som e one not ifies you  of a con fi gura t i onproblem or  some
so ftware bu g  that al lowsano nymous  a cce ss to  yourd ata baseor the  a bility  to
r em ove logs , you may have to assum e theentir e d atabase w asc omp romised s ince 
the exist enc e o f tha t c o nfigu rati o niss u e orsoft w are bug.-- --- - ap hextron
Ist h i s a ffect ing Circle CI?As far as I knowt heir images pu ll f r o m D ock e r
Hu b. 

------
jaequ ery 
I f the pass wo rds are has hed, jus tw hat a re the  likel ihood o f yo u r pass word s
b eing dec
 than_Docker is_currently disclosing...

------
madhuakula
This step by_step checklist_might_help you_"what_should I do"_to review your
accounts.

[https://blog.madhuakula.com/some-tips-to-review-docker-
hub-h...](https://blog.madhuakula.com/some-tips-to-review-docker-hub-hack-
of-190k-accounts-addcd602aade)

------
wtdata
What_does this means for_users? I was_using_watchtower to auto update the
images in my system. One of them was autoupdated after_the_failure.

Can this_be_used_to upload containers with security_exploits in order to gain
access_to machines_(i.e. does it give write access to the_containers)?

------
billconan
I’m_curious, how can_a database be accessed without authorization? If
authorization is enabled?_Also how unauthorized access can be_discovered?

Say I use_Mongodb_and_enabled authorization. Will I_be fine then? How to
discover unauthorized_access?

~~~
sirclueless
Authorization has a common English definition_too. If, for example, an
employee's credentials were_compromised, anyone who wasn't that employee_who
accessed the database would be_considered "without_authorization". And
checking the access logs_for any use_of that_employee's credentials would_give
you some idea of what data_was accessed. Enabling_authorization on your
mongodb is good, but_it_absolutely won't stop_all_forms_of unauthorized
access._They may gain_access_to your_server_itself, or gain some credentials
to your_MongoDB_database some other way (for example, if_someone carelessly
ships them as_part_of your software, or_includes them in a github_commit, or
something like that).

In the worst_case, if_someone notifies_you of a configuration problem or some
software bug that allows anonymous_access to your database or the_ability to
remove logs, you_may have_to_assume the entire_database_was compromised_since
the existence of that configuration issue or_software bug.

------
aphextron
Is_this affecting CircleCI? As far as_I know their images_pull_from Docker
Hub.

------
jaequery
If the passwords are hashed,_just what are the likelihood of_your passwords
being dec