Monitoring firewall logs would show calls to suspicious IPs and domains after you pulled the Docker container. A MiTM attack is usually conducted between two communicating parties, rather than inside the server itself. The attacker intercepts traffic as it travels across a network or service path. MiTM are not always done exterior of the server, but usually. Strong ciphers are your friend. Although MiTM and PIC events can overlap, a PIC is usually an attacker gaining unauthorized access to a system. A PIC compromise occurs outside the public facing server, through a stolen administrator password, compromised developer workstation, exposed API key, or hijacked cloud account. Securing API, devices, frequent password rotation are good practices. Again, not always exterior of the server, but usually.
Comment on Replacement for Docker Content Trust (DCT)
maltfield@slrpnk.net 22 hours ago How could monitoring a firewall log protect you from a Publishing Infrastructure Compromise or MITM attack? It would just show the malicious image being downloaded from the expected source…
irmadlad@lemmy.world 22 hours ago
moonpiedumplings@programming.dev 20 hours ago
Anyway I was gonna write a rant about it but I’m too tired. But basically the docker ecosystem is kinda fucked in this regard, and trades security in many aspects for convenience of development and distribution. This is one of the most notable examples of this.
Can you tell me a bit more about this? Who are the major providers?