SoylentNews is people
SoylentNews
19.4 percent of the Docker store's top 1000 containers have no root password, potentially exposing users' systems to attacks under certain conditions.
Last week, a similar flaw was found impacting the official Alpine Linux Docker image, when Talos researchers discovered that all images since v3.3 were shipping with a root account with a null password. The vulnerability meant attackers who infiltrated systems via another entry point, or users with shell (remote) access, could elevate their privileges to root within the container.
Over the weekend, security expert Jerry Gamblin built a script that checked the top 1000 docker containers from the Docker store to determine if they were impacted by the same misconfiguration.
After tweaking the script to correct for duplicates, Gamblin found that 194 of the 1000 containers he analysed had blank passwords, including images from the UK government, HashiCorp, Microsoft, Monsanto and Mesosphere.
Sources:
- https://techerati.com/news-hub/19-of-the-most-popular-docker-containers-have-no-root-password/
- https://www.infosecurity-magazine.com/news/fifth-of-docker-containers-have-no-1/
- https://www.bleepingcomputer.com/news/security/194-of-the-top-1000-docker-containers-don-t-have-root-passwords/
[Editors Comment: The submitter is employed by the first source. Alternative sources have been found for this story to verify its content.]
(Score: 2) by janrinok on Thursday May 23 2019, @12:59AM (2 children)
Noted, your feedback is appreciated.
(Score: 2) by Whoever on Thursday May 23 2019, @04:38AM (1 child)
He should also focus on important things, not pointless scares:
https://soylentnews.org/comments.pl?noupdate=1&sid=31733&page=1&cid=846353#commentwrap [soylentnews.org]
(Score: 2, Interesting) by janrinok on Thursday May 23 2019, @06:55AM
We are investigating how best to report stories where the submitter has a professional link to the source material. It is possible that this could result in biased submissions. We can usually find additional stories to support claims made in the submission, but we feel that it is equally as important to point out to the community that the link exists so that they can better evaluate any claims made.
Currently, I am leaning towards a combination of listing additional sources and an editorial comment bringing the reader's attention to the professional link between submitter and one of the sources. We will consider what action to take when we receive a submission for which we can find no supporting sources if, and when, it occurs. One option would be to simply reject the submission but that might in some cases result in good information being lost unnecessarily. We will continue to review the matter and we welcome community feedback.