Containers benefit software developers, aiding them with increased portability, scalability, and consistency across different environments. From a security point of view, containers incentivize the conversion of monolithic software into microservices which then can be isolated from each other, better lending themselves to least-privilege deployments. In this paper, we shed light to the unexplored issue of remote dependencies in Docker images and containers. Unless a Docker image is fully self-contained, every dependence to the outside world is an opportunity for attackers to hijack these dependencies and conduct supply-chain attacks against these images. To do so, we curate a dataset of 200 K Docker images and design DockerGym, a dynamic analysis system which automatically installs, executes, and stimulates running containers, while monitoring their network communications. We discuss multiple approaches for activating the images in our dataset and the types of remote dependencies that we were able to discover. Among others, we observe that 13% of evaluated Docker images have some form of remote dependencies, with approximately 10 K images resolving public domain names. We observe the use of unencrypted protocols (such as HTTP) and a range of other issues that could be straightforwardly exploited by attackers in the context of supply-chain attacks.

The current news landscape is in the middle of a major transition. Digital news are quickly overtaking legacy media (such as, newspapers and TV programs), offering a slew of benefits to consumers including ease and immediacy of access. They also, however, allow publishers to arbitrarily modify the articles they publish, at any time after the article has been released. Little is known about how often this happens and to what extent these post-publication edits change an article’s original message.In this paper, we shine light to this previously ignored phenomenon by collecting and analyzing a corpus of more than 600k online news articles, published by tens of U.S. news publishers over a period of nine months. We discover that 165k articles exhibit post-publication changes and use natural language processing tools to identify the magnitude of these changes and their effect. Among others, we find that different publishers modify their articles at different rates, with a publisher’s ranking and political bias affecting the frequency of changes and that over 15% of changed paragraphs do not "follow" their original versions. Finally, we discover that most of the evaluated publishers do not properly note these changes to their articles, using non-descriptive notices and updated timestamps that cannot be used by readers to assess what has changed.