Misconfigured Docker Registries Expose Orgs to Critical Risks

guest · Feb 7, 2020

Misconfigured Docker Registries Expose Orgs to Critical Risks
February 7, 2020
https://www.bleepingcomputer.com/ne...ker-registries-expose-orgs-to-critical-risks/

Some organizations have improperly configured Docker registries exposed to the public web, leaving a door open for attackers to infiltrate and compromise operations.
Open access to images
In a Docker environment, applications are packed in virtualized images that include all the code and dependencies the programs need to run independently of the underlying operating system.

Searching for Docker registries accessible over the public web, security researchers at Palo Alto Networks found that 117 lacked authentication controls that would prevent unauthorized access.

"Although setting up a Docker registry server is straightforward, securing the communication and enforcing the access control requires extra configurations. System administrators may unintentionally expose a registry service to the internet without enforcing proper access control" - Palo Alto Networks
Based on reverse DNS lookup and Canonical Name (CN) records in the TLS certificates, the researchers were able to determine the owner of the vulnerable servers in 25% of the cases.
Click to expand...

Palo Alto Networks - Unit42: Unit 42 CTR: Leaked Code from Docker Registries

Log in or Sign up

Misconfigured Docker Registries Expose Orgs to Critical Risks

guest Guest

Log in or Sign up

Misconfigured Docker Registries Expose Orgs to Critical Risks

guest Guest

Useful Searches