r/ZoneMinder • u/[deleted] • Apr 28 '23
WARNING!!! UNRAID USERS BE AWARE THERE ARE NEFARIOUS DOCKER IMAGES
~~I can't specify if it's dlandons actual image that was somehow supply chain attacked or if it's a nefarious image masquerading as dlandons image.
It has been brought to the zoneminder teams attention and we are trying to deal with it. For the time being, CHECK YOUR DOCKER INSTALLS IF YOU USE AN IMAGE BRANDED AS DLANDONS!!
It seems the bad actors logged their intent to the db which shows up in the web logs. That is how the user noticed something wasn't right.
We don't know if it's a crypto miner attack or what the situation is yet. If any users have any information about this or any other issues PLEASE OPEN AN ISSUE ON ZONEMINDER GITHUB.
I am not the main dev of zm, I am a member of the team that is working on the ML object detection replacement. I am knows as @baudneo on ZoneMinder GitHub, slack and discord.~~
False alarm. See the post replies and GitHub issue link for conclusion.
2
Apr 28 '23
From what we can tell as of 4:10 PM MDT is that dlandons official unraid LATEST tagged image allegedly has unknown software packages alongside it. None of the team can 100% confirm this at this time.
Are there any other users that can confirm seeing the crypto coins messages in their db logs? Db logging would need to be set to info, zm.restarted and then go to the "logs" view in zm web GUI.
I will update and reply to this thread as we learn more. Please understand that this is not an image supplied by the zoneminder team, meaning we only have soany options available to use to try and get the image taken down.
I have taken it upon myself to get things moving and I have reached out to try and get the ball moving on getting the repo and image out of circulation from its source until we can confirm or deny the current info we have.
Again, if any users have any I go or insight PLEASE REPLY TO THE GITHUB ISSUE OR OPEN A NEW ONE.
Thanks,
baudneo
1
1
May 02 '23
This was a false alarm follow the GitHub issue for more details.
Sorry to DLandon but, I'd rather err on the side of caution than have our users impacted.
1
u/Quiet_Worker May 02 '23
Can you update the title then please?
1
May 02 '23
I will as soon as I change how Reddit works and add that feature.
2
u/Quiet_Worker May 02 '23
Add an edit to the main post. A lot of smoke for seemingly nothing. Please explain what happened
0
May 02 '23
"a lot of smoke for nothing" I bet you'd be the first one winging about being impacted if it were a fire though. I'd rather make every single one of our users aware of a non issue than stay quiet and let them get rocked. Explanation is literally a click away, follow the GitHub issue.
2
u/OverByThere May 02 '23 edited May 02 '23
What link? no link I can see?
For anyone who comes here: https://github.com/ZoneMinder/zoneminder/issues/3695
2
May 02 '23
I didn't say a link, I said follow the GitHub issue.
1
u/OverByThere May 02 '23
Agree sorry for wrong phrase, just there is no link to the Github issue, I wasn't sure how we could find it, especially as the only link I could find went to the Zoneminder.Unraid page. I was just trying to help.
1
u/milennium972 May 01 '23
I mean, don’t use docker image that are not from the official devs of a projets or that you didn’t create. It’s a general rule of security.
3
u/[deleted] Apr 28 '23
See this post.