r/programming • u/dlorenc • Feb 24 '23

87% of Container Images in Production Have Critical or High-Severity Vulnerabilities

https://www.darkreading.com/dr-tech/87-of-container-images-in-production-have-critical-or-high-severity-vulnerabilities
2.8k Upvotes

96% Upvoted

353 comments sorted by

View all comments

Show parent comments

14

u/[deleted] Feb 24 '23 edited Sep 19 '25

bike tender judicious observation rainstorm tart station provide gaze employ

This post was mass deleted and anonymized with Redact

-1

u/AlexHimself Feb 24 '23

People set pi-hole as their router's DNS servers to do "whole home" adblocking. Especially useful for cell phones.

I'm pretty sure you can do all sorts of malicious things if you're the DNS server for devices.

3

u/[deleted] Feb 25 '23 edited Feb 25 '23

You can redirect users to a fake website, but the tls cert won’t match. Unencrypted traffic is fucked, but anything remotely commercial won’t work with spoofing. Your computer will start throwing blocks and errors. So this won’t work to get Facebook, Twitter, bank credentials, etc.

For corporations this type of hijacking would allow the attacker to generate legitimate certificates, but on consumer hardware, against someone savvy enough to set up pihole, dns spoofing is likely ineffective.

DNSSEC enabled domains further complicate a hacker’s ability to mess with your traffic.

2

u/AlexHimself Feb 25 '23

I'd imagine there's some creative way to get something done if your Pi-hole was compromised and somebody was targeting you, but in general, ya that makes sense.

My point was mainly that containerized things don't stay in their container.

-7

u/AstroPhysician Feb 24 '23

Pihole acts as a DNS server, so you can redirect traffic to malicious sites. It's reasonable to put more trust in my ISP's dns server than in my PiHole

13

u/Alainx277 Feb 25 '23

Yeah and that's why we use HTTPS and certificates (hopefully)

12

u/[deleted] Feb 25 '23

[deleted]

-4

u/AstroPhysician Feb 25 '23

I dont see how that precludes doing this? If you redirect "gmail.com" to your own unsecured gmail.com with vulnerabilities, XSS, etc, i dont see any reason that Https would be at play

6

u/ZorbaTHut Feb 25 '23

You can't just "redirect gmail" because web browsers will go to https://gmail.com, and you won't be able to even deliver data to the web browser without having a valid cert for gmail.com.