<story><title>Unauthorized access to Docker Hub database</title><url>https://success.docker.com/article/docker-hub-user-notification</url></story><parent_chain><item><author>rlt</author><text>I&amp;#x27;ve found Docker&amp;#x27;s communication about this incident to be pretty poor.&lt;p&gt;1. The email they sent out didn&amp;#x27;t specify whether your account was included in the 5% of compromised users, or whether you had linked GitHub or BitBucket accounts that they unlinked. The only way to know seems to be if you still have a linked GH&amp;#x2F;BB account then you&amp;#x27;re (probably?) ok.&lt;p&gt;2. They mention you should &amp;quot;check security logs to see if any unexpected actions have taken place&amp;quot; and linked to GH&amp;#x2F;BB security audit log pages, but I don&amp;#x27;t believe that&amp;#x27;s sufficient, you also need to check for rogue commits.&lt;p&gt;3. They haven&amp;#x27;t said when the breach occurred, so there&amp;#x27;s no way of knowing how far back to look. They &amp;quot;discovered&amp;quot; it on Thursday, and say it was a &amp;quot;brief period&amp;quot;, but that&amp;#x27;s meaningless.&lt;p&gt;4. They downplayed it as &amp;quot;brief&amp;quot;, &amp;quot;non-financial user data&amp;quot;, and &amp;quot;less than 5%&amp;quot; of users. I care more about the integrity of source code and builds than any financial information I might have given to Docker.&lt;p&gt;I can sometimes forgive companies for breaches like this, &lt;i&gt;if&lt;/i&gt; they own up to it and do an excellent job of communicating what happened, how, when, what the impact and mitigations are, both internally and for their customers. That was not the case here.&lt;p&gt;EDIT: they discovered the breach Thursday, but still haven&amp;#x27;t given a timeframe for when it may have first occurred.</text></item></parent_chain><comment><author>tie_</author><text>I also find it frustrating that they are not stating &lt;i&gt;when&lt;/i&gt; exactly did the breach occur. The message implies that they know, due to the &amp;quot;brief period&amp;quot; claim, but they are not explicitly stating one of the most important facts. No mention in the FAQ either.&lt;p&gt;I&amp;#x27;m guessing that they are either not quite certain about the exact timing and duration, or that the brief period was actually embarrassingly long. Otherwise, that&amp;#x27;s one of the most important facts that anyone would communicate.</text></comment>
<story><title>Unauthorized access to Docker Hub database</title><url>https://success.docker.com/article/docker-hub-user-notification</url></story><parent_chain><item><author>rlt</author><text>I&amp;#x27;ve found Docker&amp;#x27;s communication about this incident to be pretty poor.&lt;p&gt;1. The email they sent out didn&amp;#x27;t specify whether your account was included in the 5% of compromised users, or whether you had linked GitHub or BitBucket accounts that they unlinked. The only way to know seems to be if you still have a linked GH&amp;#x2F;BB account then you&amp;#x27;re (probably?) ok.&lt;p&gt;2. They mention you should &amp;quot;check security logs to see if any unexpected actions have taken place&amp;quot; and linked to GH&amp;#x2F;BB security audit log pages, but I don&amp;#x27;t believe that&amp;#x27;s sufficient, you also need to check for rogue commits.&lt;p&gt;3. They haven&amp;#x27;t said when the breach occurred, so there&amp;#x27;s no way of knowing how far back to look. They &amp;quot;discovered&amp;quot; it on Thursday, and say it was a &amp;quot;brief period&amp;quot;, but that&amp;#x27;s meaningless.&lt;p&gt;4. They downplayed it as &amp;quot;brief&amp;quot;, &amp;quot;non-financial user data&amp;quot;, and &amp;quot;less than 5%&amp;quot; of users. I care more about the integrity of source code and builds than any financial information I might have given to Docker.&lt;p&gt;I can sometimes forgive companies for breaches like this, &lt;i&gt;if&lt;/i&gt; they own up to it and do an excellent job of communicating what happened, how, when, what the impact and mitigations are, both internally and for their customers. That was not the case here.&lt;p&gt;EDIT: they discovered the breach Thursday, but still haven&amp;#x27;t given a timeframe for when it may have first occurred.</text></item></parent_chain><comment><author>rlt</author><text>Oh, and if anyone with write access to your repositories had  &lt;i&gt;their GH&amp;#x2F;BB account&lt;/i&gt; linked to &lt;i&gt;their DockerHub account&lt;/i&gt;, your source code could be compromised.&lt;p&gt;AFAIK the only way to check is to ask every person who has write access and hope they tell the truth.&lt;p&gt;Honestly, &lt;i&gt;everyone&lt;/i&gt; should probably check their repos for recent activity &amp;#x2F; commits.&lt;p&gt;We need more fine-grained permissions for things like this. Principle of Least Authority, people.&lt;p&gt;Now is a good time to review authorized application &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;settings&amp;#x2F;installations&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;settings&amp;#x2F;installations&lt;/a&gt; and if you&amp;#x27;re part of a GitHub organization I highly recommend setting up OAuth application restrictions &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;help.github.com&amp;#x2F;en&amp;#x2F;articles&amp;#x2F;about-oauth-app-access-restrictions&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;help.github.com&amp;#x2F;en&amp;#x2F;articles&amp;#x2F;about-oauth-app-access-r...&lt;/a&gt;</text></comment>