-1
Last night someone exploited some vulnerability in my site and then upload a PHP script to my images folder.
I have an Amazon EC2 server with CentOS.
Then the hacker downloaded 600GB and increased my bill.
Can this be a DOS attack? How can I check this?
When hacker was downloading I saw
- CPU usage being 100%
- many apache kworker process running
- I stopped the apache service but data was still being transmitted
I then stopped my instance.
How can I see what happened?
3http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server and http://security.stackexchange.com/questions/23842/advice-on-what-to-do-after-being-hacked are worth reading. The third thing you mentioned might indicate your system itself was compromised – Journeyman Geek – 2013-09-05T06:19:42.570
If data was transmitted even with Apache being turned off, I'd suggest you set up a new instance. – slhck – 2013-09-05T06:20:17.997
@slhck I knew what happened , there was vulnerability in mu site which the hacker exploited. it was this http://www.bugreport.ir/78/exploit.htm . i deleted those scripts and now system is ok. i know it was those scripts. i checked llast modified files in
– user22 – 2013-09-05T06:33:02.393/var/www/html
and then i got those files. i hadmaldetect installed
and it also gave me the report and removed three files but it didn't remove other 2 php files which were also virus. i had to rmeove them and they causing the issue.1Is it relevant what happened? You already know the vulnerability that was exploited, so you know you can prevent a repeat by killing the server, acquiring a new one, and set that up with the patched Joomla version. – Jan Doggen – 2013-09-05T07:54:33.800