Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, registered to some dude in China, that redirected to my server. I looked around and found that it's pretty common to have folks requesting stuff to check for vulnerabilities in your site etc.

Then I saw a GET request with my FTP username in it, not made by me and that's when I started getting worried my server had been compromised. I promptly started taking measures, making sure everything was up to date, changing passwords, username of my FTP, hosting account and pretty much anything I could think of. Now I see the same type of requests, with my changed FTP username, still not by me.

This is kind of freaking me out.

There's nothing terribly serious on my webserver, it's just a couple of basic sites I've been (mostly) playing with. No client data or anything sensitive like that. I just use it to host my online webpage/resumé for the moment.

Still, I don't have any experience in how to deal with this & I'm somewhat uneasy about what's going on. My site is very simple, so I could quite easily rebuild it from scratch.. What's the best course of action here? Burn everything & start over?

A million thanks to anyone taking the time to reply, I could really used some advice on this.

share|improve this question

closed as unclear what you're asking by tylerl, NULLZ, Adnan, TildalWave, Xander Aug 20 '13 at 13:09

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
What's your username? –  Lucas Kauffman Aug 20 '13 at 2:16
    
Hopefully you're not using plain, unencrypted FTP! –  Kitsune Aug 20 '13 at 3:50

2 Answers 2

Do you use any application to access your FTP account? The first thing I would do is to check the source of the FTP connection. Some application may save your credentials if you have selected to and would periodically connect. Don't freak out yet, check the source IP of the FTP connection. If it is from one of your IPs, it is probably a saved password in one of your application. If it is something from elsewhere (China), you might even have issues with your personal machine as you mentioned that you changed the username and it appeared in the logs when you did not use it.

share|improve this answer
    
While it is good to be secure and alert for stuff, just make sure that you dont DoS yourself by mistakenly thinking that you have been compromised. FileZilla is a well known FTP client and you should check for the source IPs in th log. If it is your IP, you probably would be fine given that you have not done anything unsafe on your local machine. –  AdnanG Aug 20 '13 at 11:14
    
Sorry, screwed up my last comment. Yes, I typically use Filezilla. I'm not even sure what kind of connection it is, but this is what the log looks like 178.77.126.55 - - [18-aug-2013:13:13:30 -0700] "GET www.RedirectDomainRegistreredinChina.com/~oldFTPusername/robots.txt HTTP/1.1" 404 2920 "-" "Mozilla/5.0 (compatible; CareerBot/1.1; +career-x.de/bot.html)"; That was the first strange one after I changed my FTP username. It's most certainly not my IP. By personal machine I assume you mean my PC? –  John Aug 20 '13 at 12:32

You should treat it as if the machine was compromized. In fact, you should probably always work with the assumption that a public system will be compromized and take necessary steps to mitigate this, both preventively (through data encryption, use of strong, unique passwords, proper log hygiene) and in order to ease on recovery (historical backups, documentation, etc).

As to what specifically you should do about a compromized system, there is a nice canonical answer to that on serverfault: http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.