Hackers Hide Behind Tor in Exposed Docker API Breaches: How Attacks Steal Your Servers

Imagine if you just left your house door open. Anyone, including that pesky neighbor, could just walk in, right? This is the same way people leave their Docker API open. Hackers see it as an open door and get in and run malicious programs. It has become a matter of course for hackers to hide where they are by using Tor.

How the hack works​

Here's the very simplified version of how hackers do it:

• Search for open Docker APIs – They scan the whole internet to find the unprotected ones

• Run malicious containers – Usually these are containers stealing power from your server to mine cryptocurrency

• Hide with Tor - They route their traffic with Tor to hide where they are coming from.

The result? Your service gets slow, your costs increase and the hacker earns money.

Why Tor makes it hard​

Tor is not harmful in itself, and many people use it to protect their privacy. To hackers, it serves as an invisibility cloak. It masks their location, making it impossible to block them, or trace their attacks.

Ever tried to stop someone you can't see? That is what defenders are up against here.

How do you stay safe​

If you are using Docker, here are a few simple actions to take to ensure your perseverance:

• Don’t place the API on the public Internet.
• Add authentication and TLS so only trusted users can connect
• Keep Docker updates current to fix known issues
• Frequently check your container activity for anything unusual.

The bottom line​

An open Docker API is like an open door. Hackers will come in, use your system for their own profit, and then hide behind a Tor network in order to avoid being caught.

So the question is: is your Docker API locked down, or are you leaving it wide open? It’s always easier to prevent this from happening than it will be to look back and regret that you did not do it sooner.