0

My EC2 instance reported got suspicious activity and I got this email:

has been implicated in activity which resembles scanning remote hosts on the internet for security vulnerabilities. Activity of this nature is forbidden in the AWS Acceptable Use Policy (https://aws.amazon.com/aup/). We've included the original report below for your review.

Please take action to stop the reported activity and reply directly to this email with details of the corrective actions you have taken. If you do not consider the activity described in these reports to be abusive, please reply to this email with details of your use case.

If you're unaware of this activity, it's possible that your environment has been compromised by an external attacker, or a vulnerability is allowing your machine to be used in a way that it was not intended.

I don't know how to check what's happened. I changed my root password but I am still got same activity report.

below is the log:

Full logs:
(time in UTC)=2020-12-08T23:59:13 (attacker's IP)=myip (IP being scanned)=91^208^184^50 (TCP port being scanned)=523
(time in UTC)=2020-12-08T23:59:21 (attacker's IP)=myip (IP being scanned)=78^128^99^30 (TCP port being scanned)=2025
(time in UTC)=2020-12-08T23:59:28 (attacker's IP)=myip (IP being scanned)=140^238^172^100 (TCP port being scanned)=841
(time in UTC)=2020-12-08T23:59:42 (attacker's IP)=myip (IP being scanned)=219^91^85^19 (TCP port being scanned)=10699
(time in UTC)=2020-12-08T23:59:54 (attacker's IP)=myip (IP being scanned)=78^128^99^30 (TCP port being scanned)=1298
(time in UTC)=2020-12-09T23:57:40 (attacker's IP)=myip (IP being scanned)=219^91^85^19 (TCP port being scanned)=313
(time in UTC)=2020-12-09T23:57:43 (attacker's IP)=myip (IP being scanned)=219^91^62^21 (TCP port being scanned)=21735
(time in UTC)=2020-12-09T23:57:43 (attacker's IP)=myip (IP being scanned)=91^203^192^19 (TCP port being scanned)=984
(time in UTC)=2020-12-09T23:57:52 (attacker's IP)=myip (IP being scanned)=185^178^44^132 (TCP port being scanned)=18263
(time in UTC)=2020-12-09T23:57:53 (attacker's IP)=myip (IP being scanned)=140^238^172^100 (TCP port being scanned)=1389

another log:

Logs:
------------------------------------------------------------------------
Dec 9 01:01:55 kmh-wmh-003-nbg03 sshd[698]: Invalid user test from myip port 44682
Dec 9 01:01:55 kmh-wmh-003-nbg03 sshd[698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Failed password for invalid user test from myip port 44682 ssh2
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Received disconnect from myip port 44682:11: Bye Bye [preauth]
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Disconnected from myip port 44682 [preauth]
Dec 9 01:18:16 kmh-wmh-003-nbg03 sshd[2480]: Invalid user pppuser from myip port 41660
Dec 9 01:18:16 kmh-wmh-003-nbg03 sshd[2480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Failed password for invalid user pppuser from myip port 41660 ssh2
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Received disconnect from myip port 41660:11: Bye Bye [preauth]
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Disconnected from myip port 41660 [preauth]
Dec 9 01:21:25 kmh-wmh-003-nbg03 sshd[2792]: Invalid user master from myip port 38852
Dec 9 01:21:25 kmh-wmh-003-nbg03 sshd[2792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip

Because I never connect to ssh using my instance, so I just want to block all outgoing SSH traffic from any user and any app/process. How to do that?

Maybe I can block all outgoing traffic to port 22 using iptables, but not all ssh using port 22 right? any other effective way?

Muhammad Dyas Yaskur
  • 497
  • 2
  • 19
  • Does this answer your question? [How do I deal with a compromised server?](https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server) – Michael Hampton Dec 10 '20 at 18:54

2 Answers2

1

It's not that easy. If your server got compromised, you got to investigate it.

First, block all incoming traffic to it, but your service (example, ports 80 and 443) Block access to ssh from any source, but your.

Second, I suggest starting installing and running softwares like clamav, chkrootkit and rkhunter. These software can scan your machine and identify several well-known exploits.

Third, take a look at all running process, logs and the like

Fourth, apply some hardening techniques to your machine

surfingonthenet
  • 695
  • 2
  • 6
  • This is not an useful approach. The only guaranteed way to get a clean system is to do a reinstall. There are many ways the server can be compromised, and with above methods, one can find a minority of the compromises. – Tero Kilkanen Dec 12 '20 at 15:55
  • @TeroKilkanen, reinstalling will make sense after the first checks. If there's any evidence of invasion, I don't see reasons for reinstalling it all – surfingonthenet Dec 13 '20 at 21:49
0

Check your "Security Groups" if you have inbound rule for port 22 / SSH service remove that.

You never do ssh then what services you are running ?

ras
  • 131
  • 1
  • 1
  • 6