I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users."
I checked my running processes and it appears that someone injected a script and run it with
root permission. The pic is as follows:
the thing is I can't even find this file
udp_flood.txt. and I don't even know how one can get by
root permission so easily..
My guess is in my backend I have an API that let user upload their images to the site. And then I crop / resize the image and upload to AWS. But I couldn't be sure this is the cause of the problem so I don't know how to prevent future injections too.
So my questions are:
- how he did it to inject scripts and run as root?
- how to prevent it? is it safe to say the cause is coming from upload functionality?
- how to log it so in the future I know I am being attacked? (instead of my service provider telling me)