Docker Hub hack exposes sensitive data of 190,000 users

                                                                   

An unauthorized person gained access to a Docker Hub database that exposed sensitive information for approximately 190,000 users. Docker says the hacker had access to this database only for a short moment and the data accessed is only five percent of Docker Hub's entire userbase.

This information included some usernames and hashed passwords, as well as tokens for GitHub and Bitbucket repositories used for Docker autobuilds.

GitHub and Bitbucket access tokens stored in Docker Hub allow developers to modify their project's code and have it automatically build, or autobuild, the image on Docker Hub. If a third-party gains access to these tokens, though, it would allow them to gain access to a private repositories code and possibly modify it depending on the permissions stored in the token.

Docker Hub lost keys and tokens which could have downstream effects if hackers used them to access source code at big companies.

Docker Hub is the official repository for Docker container images. It makes software tools for programmers and developers.

According to a security notice sent late Friday night, Docker became aware of unauthorized access to a Docker Hub database on April 25th, 2019.

Docker disclosed the breach in an email to customers and users of Docker Hub, its cloud-based service that’s used by several companies and thousands of developers all over the world. In the email, obtained by Motherboard, Docker said that the stolen data includes “usernames and hashed passwords for a small percentage of these users, as well as Github and Bitbucket tokens for Docker autobuilds.”

"On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data," said Kent Lamb, Director of Docker Support.

Experts Motherboard spoke to said that, in a worst-case scenario, the hackers would have been able to access proprietary source code from some of those accounts. Specifically, Docker allows developers to run software packages known as “containers.” It is used by some of the largest tech companies in the world, though it is not yet publicly known what information was accessed and which companies’ accounts were affected.

14.8 million 500px users’ data stolen




500px, an online photography community suffering a massive data breach that leaked 14.8 million users personal information by cybercriminals.

500px global network for photographers and the platform managing around 16 million users who get paid for their work and skills.

Security experts learned this security incident in July 2018 when an unauthorized party breaking the 500px systems and gained access to users personal information.

In this case, Intruder accessed the user’s sensitive information including first and last name, username, email address, hashed password, Date of birth, city, state/province, country, and gender.

500px Engineering team already deployed to mitigate this incident and the company believes that there is no indication of unauthorized access” to user accounts, adding that information like credit card numbers since these data aren’t saved on a company server.

The company said that users who have opt-in prior to July 5, 2018, are potential victims of this data breach and the company notify to all users via email as well as onsite and with mobile notifications, however, given the volume of users affected.

According to 500px, following Steps are taken to protect their customer from future attacks.

▬ Given the nature of the personal data involved, we have already forced a reset of all MD5-encrypted passwords, and a system-wide password reset is underway.

▬ We have vetted access to our servers, databases, and other sensitive data-storage services.

▬ We have and are continuing to monitor our source code, both public-facing and internal, to protect against security issues.

▬ We are partnering with leading experts in cybersecurity to further secure our website, mobile apps, internal systems, and security processes.

▬ We are modifying our internal software development process.

▬ We are continuing to upgrade our network infrastructure. The company also states that it’s alerted the enforcement and has retained a private security firm to investigate the issue.

Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records



Security researcher Nitish Shah uncovered a data leak by a Mobile Spyware Maker mSpy that claims to help in excess of a million paying clients keep an eye on the cell phones of their children and partners.

mSpy has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and area information furtively gathered from phones running the stealthy spyware. He likewise saw that there was no requirement for any verification in order to reach for the records.
As per Shah, the exposed data additionally incorporated the most recent a half year records of mSpy license purchases with the mSpy client logs, alongside the Apple iCloud information of gadgets and devices with the spyware installed on them.


A list of data points that can be slurped from a mobile device that is secretly running mSpy’s software.

Shah later added that when he attempted to alert mSpy of his discoveries; the organization's support personnel disregarded him.

 “I was chatting with their live support, until they blocked me when I asked them to get me in contact with their CTO or head of security,” Shah said.

Later KrebsOnSecurity alerted mSpy about the exposed database on Aug. 30. To which they responded an email from mSpy’s chief security officer, who gave only his first name, “Andrew.”

“We have been working hard to secure our system from any possible leaks, attacks, and private information disclosure. All our customers’ accounts are securely encrypted and the data is being wiped out once in a short period of time. Thanks to you we have prevented this possible breach and from what we could discover the data you are talking about could be some amount of customers’ emails and possibly some other data. However, we could only find that there were only a few points of access and activity with the data.” Andrew wrote.

In any case though, this isn't the first time when mSpy is being considered responsible of a release that brought about the leak of the sensitive records of millions of its clients. As it had likewise occurred in May 2015, that KrebsOnSecurity broke the news that mSpy had been hacked and its client/customer information was posted on the Dark Web.