# Docker Hub Hack: Secure Your Supply Chain

- Link: https://www.agilicus.com/docker-hub-hack-secure-your-supply-chain/
- Published: 2019-04-29T04:45:49+00:00
- Author: Don Bowman

There was some [unauthorised access to the Docker Hub Database.](https://success.docker.com/article/docker-hub-user-notification)
tl;dr… user names, hashed passwords, and deploy tokens, taken.

If you have a docker hub account, change the password now. And while you are there,
complain about their lack of 2-factor authentication. Also while you are there you
should (out of caution) remove all deploy keys and rebuild all your containers.

Now, you may be thinking, what does this have to do with me? I don’t have a docker
hub account, I don’t publish images. But you use them. Either directly (every time
you type `docker run` you are likely using one from here), or as you use any cloud(
e.g. Kubernetes).

Now, you are thinking, I’m not a developer, I don’t use that. But you still do, 
you see many things you use day-to-day (including this blog) are part of the chain.
We are all inter-twined. One player makes a mistake, loses some authentication tokens,
we are all put at risk.

What’s the nightmare scenario? Docker Hub found that 190K accounts were compromised
in this attack. Was there a previous one that wasn’t detected? Did somebody use 
that to publish an _improved_ version of some popular container? How bad could that
be?

Well, very bad. Docker (all containers) are a set of layers. If you get control 
of a base-layer, you own a lot of things. Let’s say that someone managed to add 
some malware to Alpine or Ubuntu or Debian base images? The rest of the world would
blissfully import that, and then run inside their own environment. No firewall would
protect you (because you, the privileged user, did the deploy).

I predict there is an [iceberg](https://en.wikipedia.org/wiki/Iceberg) [boiled frog](https://en.wikipedia.org/wiki/Boiling_frog)
affect here. The iceberg: for every attack we here, there are 10(000) we don’t. 
The boiled frog. We hear of little attacks here and there, they don’t immediately
affect us, so our tolerance goes up, we stop listening. And one day bad things happen.