Docker Registries Expose Hundreds of Orgs to Malware, Data Theft

[silversurfer]

A slew of misconfigured Docker container registries has inadvertently exposed source code for 15,887 unique versions of applications owned by research institutes, retailers, news media organizations and technology companies.
 
According to Palo Alto Networks’ Unit 42 division, the registries lacked proper network access control.
“Although setting up a Docker registry server is straightforward, securing the communication and enforcing the access control requires extra configurations,” the company said in a posting on Friday, explaining that researchers found the exposed registries via Shodan and Censys searches. “System administrators may unintentionally expose a registry service to the internet without enforcing proper access control.”
 
As the security firm explained, Docker registries are essentially cloud servers, which are used to store and organize Docker images. Docker images are containers that have everything needed to run an application, including code, dependent libraries and operating system files. These image containers are organized into repositories, which can have multiple versions of the application, including backups.
 
The consequences for companies whose registries are attacked by cybercriminals can be profound, according to Unit 42.
“These registries contain the application source code and historical versions,” researchers said. “When leaked, proprietary intellectual property can be stolen, malicious code can be injected and operation critical data can be hijacked…misconfigured Docker registry could leak confidential data, lead to a full-scale compromise and interrupt the business operations.”

Read more: https://threatpost.com/docker-registries...ft/152734/