AI
Finding Secrets in Docker’s Ghost Layers
At DEF CON 32, a Docker exploitation framework demo showed that files deleted from container images persist in the underlying tarball. Torres and Hoffman built a scanner to find secrets in those layers. Their tool regexed through DockerHub images looking for API keys, SSH keys, and passwords. After hitting the 200-pull-per-day free tier limit, they upgraded to a premium account and pulled 5,000 containers daily. 240,000 raw findings accumulated in Elasticsearch, most of them false positives from crypto trading bots and placeholder example keys.
Git Metadata Exposed in Public Images
Of 80,000+ containers pulled over three months, 15,000 contained .git metadata. 1,500 linked to non-public repositories. The mechanism: Docker’s own tutorial instructs developers to run COPY . . in their Dockerfile, which copies the .git directory from the prior git clone. That directory holds the remote URL and sometimes a personal access token with write permissions. If a developer uses that token for CI, it lands in a public image. Torres and Hoffman demonstrated writing to such a repository, kicking off a CI job that would ship their code in the next public build.
From Backup Abuse to a PRC Operational Relay Network
One DockerHub account triggered repeated alerts: multiple container updates per day, each containing private git repositories. On first inspection it looked like backup abuse, storing data in DockerHub as free cloud storage. Spanning 38 repositories across 4 accounts with hundreds of image tags each, the data told a different story. It pointed to infrastructure spinning up and down cloud nodes to proxy traffic, with connections redirecting through the Great Firewall. The network had been in development since 2022 and was updating several times daily as of last year. The last recorded update was June 20, 2025.
Root Keys, Password Templates, and a Browser Fingerprint API
The infrastructure’s backups included an SSH config pointing to the exact key needed for root access across all nodes, and they had that key too. Every password followed one template: a fixed prefix, an @ symbol, and a letter corresponding to the username. The same password worked for email, domain registrars, and social media. Heroku and GitHub API keys appeared in plain text throughout their notes. A credential-serving API delivered browser fingerprints alongside session cookies, letting operators mimic stolen browser profiles automatically to avoid fraud detection systems.
BT Panel Bugs and AI-Assisted Development Inside a Relay Network
The operators ran BT Panel, a Chinese-market server management tool built on Python Flask. Two man-in-the-middle paths lead to root code execution: a PAM module fetched over plain HTTP during setup (patched), and an update script that downloads RPMs and tarballs over HTTP and runs as root (unpatched at presentation time). BT Panel also used one TOTP seed shared across all users, and its SSH one-time passwords were static credentials. Chat logs in the backups showed operators querying AI models via their own proxy to bypass China’s IP restrictions while building the network.
Notable Quotes
containers as free cloud storage. Zane “earl” Hoffman · ▶ 15:33
vibe coding also is alive and well Michael “mtu” Torres · ▶ 30:30
it’s just Python, man. Zane “earl” Hoffman · ▶ 28:34
Key Takeaways
- Public DockerHub containers regularly expose git metadata, API keys, and CI credentials left behind by COPY . . in Dockerfiles.
- Nation-state adjacent operators abuse free cloud tiers on DockerHub, Heroku, Hugging Face, and GitHub to build relay infrastructure.
- Serving browser fingerprints via API alongside session cookies is an underappreciated technique for evading automated fraud detection.
About the Speaker(s)
Michael “mtu” Torres is a security engineer focused on detecting threats at scale. He serves as a Staff Sergeant in the United States Marine Corps Reserve, planning and conducting both offensive and defensive cyber operations. He volunteers with VetSec (veteransec.org), a charity helping military veterans build careers in cybersecurity.
Zane “earl” Hoffman is a DevOps engineer who does vulnerability research in his free time. He recently left active duty as a U.S. Marine, where he focused on vulnerability research and tool development. He is also a certified airplane seamstress, qualified to operate industrial sewing machines to maintain aircraft equipment.