# Malware in Docker for Mac? **URL:** \ **Category:** Docker Desktop\ **Tags:** macos\ **Created:** [July 29, 2017, 11:43am UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754 "2017-07-29T11:43:23Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![dwamara](https://avatars.discourse-cdn.com/v4/letter/d/c0e974/32.png) [@dwamara](https://forums.docker.com/u/dwamara)\ **Post date:** [July 29, 2017, 11:43am UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/1 "2017-07-29T11:43:23Z")
I kept on receiving some notifications from my internet provider a couple of weeks ago but dismissed them as not correct until I realised that my connection wasn’t getting accepted by my provider for some reasons. I decided to completely reinstall my MacOS and the connection was working fine until I installed Docker for Mac (the lastet Version from the Docker Store) and started it. Mind you, I had only installed Docker, Firefox and Unibox at the moment, so the Mac was “clean”. A couple of minutes after that, I received a mail from the firewall that stated that a connection was made from the port 50896 and it was trying to connect to a Russian URL (see screenshot: [Docker for MAc - Album on Imgur](http://imgur.com/a/9NJPV)). I found it strange and checked to see what was using this port and I found out it was the vpnkit from Docker (see screenshot: [Docker for MAc - Album on Imgur](http://imgur.com/a/9NJPV)). Is there a malware in the last version of the Docker for Mac? ---
**Author:** ![djs55](https://avatars.discourse-cdn.com/v4/letter/d/c4cdca/32.png) [@djs55](https://forums.docker.com/u/djs55)\ **Post date:** [July 31, 2017, 4:44pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/2 "2017-07-31T16:44:57Z")
Could you upload diagnostics (from the Whale menu: Diagnose and Feedback… -\> Diagnose & Upload) and quote the diagnostics id here? All outgoing network traffic from Docker for Mac goes via the “vpnkit” process. With no containers running the only expected outgoing UDP is NTP. To temporarily disable this for debugging, try On the host, get a a root shell in the VM: ``` $ docker run --rm --net=host --pid=host --privileged -it justincormack/nsenter1 /bin/sh ``` Inside the VM shell, kill the “chronyd” process: ``` / # killall chronyd ``` Next, on the host, find the pid of the “vpnkit” process using a command like: ``` $ cat ~/Library/Containers/com.docker.docker/Data/tasks/com.docker.vpnkit | jq .Pid 8185 ``` Next, on the host, list the open UDP ports on “vpnkit”: ``` $ lsof -p 8185 -P | grep UDP ``` On my system I’m running ``` Version 17.06.0-ce-mac19 (18663) Channel: stable c98c1c25e0 ``` I killed “chronyd” and waited a few minutes and then all my UDP ports went away. For reference my “vpnkit” binary has hash: ``` $ sha1sum /Applications/Docker.app/Contents/Resources/bin/vpnkit 66803b539be79bde693fe28d86e3a076a53243d0 /Applications/Docker.app/Contents/Resources/bin/vpnkit ``` Let me know what you observe. ---
**Author:** ![bramus](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/bramus/32/18737_2.png) [@bramus](https://forums.docker.com/u/bramus)\ **Post date:** [February 1, 2018, 10:24pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/3 "2018-02-01T22:24:15Z")
Got a likewise warning from LittleSnitch today, from IP address 51.255.138.215. A reverse DNS lookups reveals that the hostname `ntp.cybertu.be` is linked to it. Although the hostname can be totally fake, it makes me point into the direction of NTP. ---
**Author:** ![chekunkov](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/chekunkov/32/19336_2.png) [@chekunkov](https://forums.docker.com/u/chekunkov)\ **Post date:** [March 24, 2018, 10:23pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/4 "2018-03-24T22:23:45Z")
LittleSnitch caught “Incoming connections via vpnkit from 13.74.149.188” for me: ``` # alex in ~ [22:12:09] → whois 13.74.149.188 % IANA WHOIS server % for more information on IANA, visit http://www.iana.org % This query returned 1 object refer: whois.arin.net inetnum: 13.0.0.0 - 13.255.255.255 organisation: Administered by ARIN status: LEGACY whois: whois.arin.net changed: 1991-09 source: IANA # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # Query terms are ambiguous. The query is assumed to be: # "n + 13.74.149.188" # # Use "?" to get help. # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=13.74.149.188?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2 # NetRange: 13.64.0.0 - 13.107.255.255 CIDR: 13.64.0.0/11, 13.96.0.0/13, 13.104.0.0/14 NetName: MSFT NetHandle: NET-13-64-0-0-1 Parent: NET13 (NET-13-0-0-0-0) NetType: Direct Assignment OriginAS: Organization: Microsoft Corporation (MSFT) RegDate: 2015-03-26 Updated: 2015-03-26 Ref: https://whois.arin.net/rest/net/NET-13-64-0-0-1 OrgName: Microsoft Corporation OrgId: MSFT Address: One Microsoft Way City: Redmond StateProv: WA PostalCode: 98052 Country: US RegDate: 1998-07-09 Updated: 2017-01-28 Comment: To report suspected security issues specific to traffic emanating from Microsoft online services, including the distribution of malicious content or other illicit or illegal material through a Microsoft online service, please submit reports to: Comment: * https://cert.microsoft.com. Comment: Comment: For SPAM and other abuse issues, such as Microsoft Accounts, please contact: Comment: * abuse@microsoft.com. Comment: Comment: To report security vulnerabilities in Microsoft products and services, please contact: Comment: * secure@microsoft.com. Comment: Comment: For legal and law enforcement-related requests, please contact: Comment: * msndcc@microsoft.com Comment: Comment: For routing, peering or DNS issues, please Comment: contact: Comment: * IOC@microsoft.com Ref: https://whois.arin.net/rest/org/MSFT OrgAbuseHandle: MAC74-ARIN OrgAbuseName: Microsoft Abuse Contact OrgAbusePhone: +1-425-882-8080 OrgAbuseEmail: abuse@microsoft.com OrgAbuseRef: https://whois.arin.net/rest/poc/MAC74-ARIN OrgTechHandle: MRPD-ARIN OrgTechName: Microsoft Routing, Peering, and DNS OrgTechPhone: +1-425-882-8080 OrgTechEmail: IOC@microsoft.com OrgTechRef: https://whois.arin.net/rest/poc/MRPD-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # alex in ~ [22:13:10] → dig -x 13.74.149.188 ; <<>> DiG 9.9.7-P3 <<>> -x 13.74.149.188 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45826 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;188.149.74.13.in-addr.arpa. IN PTR ;; AUTHORITY SECTION: 149.74.13.in-addr.arpa. 600 IN SOA prd1.azuredns-cloud.net. msnhst.microsoft.com. 9 900 300 604800 3600 ;; Query time: 20 msec ;; SERVER: 192.168.0.1#53(192.168.0.1) ;; WHEN: Sat Mar 24 22:17:11 GMT 2018 ;; MSG SIZE rcvd: 134 ``` ---
**Author:** ![eproxus](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@eproxus](https://forums.docker.com/u/eproxus)\ **Post date:** [March 26, 2018, 10:31am UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/5 "2018-03-26T10:31:42Z")
I’m seeing something similar. According to Little Snitch the application `/Applications/Docker.app/Contents/MacOS/com.docker.supervisor via /Applications/Docker.app/Contents/Resources/bin/vpnkit` has 194 (!) incoming connections from all over the world. I would have expected Docker to have connections to Docker Hub, and from any started containers to whatever nodes they communicate with (I have _no containers started at all_ when this is reported). Nothing in the Docker for Mac documentation or the settings for the app itself hints at it running a hidden VPN connected all over the world… What is this actually doing? ---
**Author:** ![justincormack](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/justincormack/32/6760_2.png) [@justincormack](https://forums.docker.com/u/justincormack)\ **Post date:** [March 26, 2018, 8:49pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/6 "2018-03-26T20:49:08Z")
There was an issue where the ntp server was incorrectly configured to use the public ntp pool see [https://github.com/docker/for-mac/issues/2529](https://github.com/docker/for-mac/issues/2529) - this should be fixed now in 18.03. If you are seeing this issue please can you confirm which version you are using. ---
**Author:** ![justincormack](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/justincormack/32/6760_2.png) [@justincormack](https://forums.docker.com/u/justincormack)\ **Post date:** [March 26, 2018, 8:52pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/7 "2018-03-26T20:52:31Z")
Also, if you are on the current version, please can you open a new issue on [https://github.com/docker/for-mac](https://github.com/docker/for-mac) with a diagnostic id as the forum is not a good place for issue tracking. ---
**Author:** ![eproxus](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@eproxus](https://forums.docker.com/u/eproxus)\ **Post date:** [March 27, 2018, 12:46pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/8 "2018-03-27T12:46:58Z")
With version 18.03.0-ce-mac59 (23608) I still see 19 connections to all over the world. Is this expected? ---
**Author:** ![justincormack](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/justincormack/32/6760_2.png) [@justincormack](https://forums.docker.com/u/justincormack)\ **Post date:** [March 28, 2018, 10:09pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/9 "2018-03-28T22:09:14Z")
Please can you open an issue as above with a diagnostic ID. ---
**Author:** ![eproxus](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@eproxus](https://forums.docker.com/u/eproxus)\ **Post date:** [April 9, 2018, 8:57am UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/10 "2018-04-09T08:57:50Z")
Reported here: [https://github.com/docker/for-mac/issues/2786](https://github.com/docker/for-mac/issues/2786) ---
**Author:** ![felipemillhouse](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/felipemillhouse/32/32552_2.png) [@felipemillhouse](https://forums.docker.com/u/felipemillhouse)\ **Post date:** [March 28, 2022, 5:13pm UTC](https://forums.docker.com/t/malware-in-docker-for-mac/35754/11 "2022-03-28T17:13:22Z")
![Screen Shot 2022-03-28 at 9.55.47 AM](https://global.discourse-cdn.com/docker/original/3X/5/0/50bb0c1ce9fac259dbad66afee235d039ae58155.png)