Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Last night some one exploit some vulnerability in my site and then upload php script in my images folder.

I have the Amazon EC2 server with centos.

Now the Hacker downloaded 600GB and increased my bill.

Can this be DOS attack. How can I check it.

When hacker was downloading then I see

  1. CPU usage being 100%
  2. I saw many apache kworker process running
  3. I stopped the apache service but data was still being transmitted

I then stopped my instance

How can I see what happened

share|improve this question

marked as duplicate by Lucas Kauffman, TildalWave, NULLZ, Adi, Gilles Sep 5 '13 at 11:06

This question was marked as an exact duplicate of an existing question.

Please don't ask the same question on multiple StackExchange sites. – Ladadadada Sep 5 '13 at 9:27
It's not really a dupe, but it's definitly close-worthy. I voted as 'unclear'. – Adi Sep 5 '13 at 10:00
What do you mean by downloaded? Was this traffic downloaded FROM your vm or TO your VM? If the former, what do your logs show you? – symcbean Sep 5 '13 at 10:16

if the data is transfered via http, then this is probably not an attack; check your apache-logs. check the user-agents and corresponding ips

what it might be:

  • webcrawlers
  • buggy setup

btw, if you still have data-transer w/out apache ... do your really know what you are doing there? how do you know about non-HTTP-data-transfer?

share|improve this answer
is there any way to find non http data transfer – user22 Sep 5 '13 at 6:34
Have you checked your Apache logs yet? That is the first step. It probably has the right answer. I expect you will find millions of requests to that file the attacker uploaded. By default, the size of the response is the field after the response code and is measured in bytes. – Ladadadada Sep 5 '13 at 7:09
you can use ntop to monitor traffic on that host, but you need root access. another tool for live-traffic-monitoring is iptraf, or you can run (as root) "lsof | grep TCP" or "netstat -nv -t tcp". you server is probably part of an irc-botnet already. if so, you'll probably see strange stuff in /tmp, like hidden directories. – that guy from over there Sep 5 '13 at 19:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.