Researchers from a German university recently published a paper revealing that tens of thousands of container images hosted on Docker Hub contain confidential secrets. Docker Hub is an online repository for docker container images. And a docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application; that includes the code, runtime, system tools, system libraries and settings. The researchers analysed over 345,000 images and found that around 8.5% of them included secrets. They found 52,107 private keys, 3,158 leaked API secrets and 275,269 TLS and SSH hosts that were using the leaked private keys for authentication. This is a huge issue which impacts the image creator’s security and potentially everyone using those images. The secrets were most likely left in there by mistake or out of negligence. We scan our code repository for secrets, we need to also be doing the same for our container images. Stay safe out there.
https://arxiv.org/pdf/2307.03958.pdf
This segment was created for the It’s 5:05 podcast