Docker Breach

Summary

Security researchers from Palo Alto Networks discovered some organizations—including research institutes, retailers, news media organizations, and technology companies—have improperly configured Docker registries. They found 117 unsecured Docker registries accessible over the public web that permitted image downloads, authorized uploads, and image deletions. The misconfiguration and permitted commands can allow malicious actors to replace images with backdoors, host malware, interrupt business operations, or blackmail for ransom. 

Recommendations

The NJCCIC recommends adding a firewall rule to prevent the registry from being accessible from the public internet and enforce the Authenticate header in all API requests as forms of access control. Please review the Palo Alto Networks article for more information.