1

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users."

I checked my running processes and it appears that someone injected a script and run it with root permission. The pic is as follows:

enter image description here

the thing is I can't even find this file udp_flood.txt. and I don't even know how one can get by root permission so easily..

My guess is in my backend I have an API that let user upload their images to the site. And then I crop / resize the image and upload to AWS. But I couldn't be sure this is the cause of the problem so I don't know how to prevent future injections too.

So my questions are:

  1. how he did it to inject scripts and run as root?
  2. how to prevent it? is it safe to say the cause is coming from upload functionality?
  3. how to log it so in the future I know I am being attacked? (instead of my service provider telling me)

closed as too broad by Philipp, Stephane, StackzOfZtuff, Neil Smithline, schroeder Nov 16 '15 at 16:18

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There is about a million things you could have done wrong. Pinpointing the vulnerablility would require a forensic analysis which we can't provide remotely on a Q&A site. I voted to close this question as too broad. – Philipp Nov 16 '15 at 9:48
  • Voting to close as "too broad". However: here's a few tidbits: That whereis command is wrong. Try find / | grep udp_flood.txt. But from the googling the filename I'm guessing this file: pastebin.com/fjpRH1wm (Which is known to VirusTotal.) – StackzOfZtuff Nov 16 '15 at 11:00
  • sure. thanks but @SteffenUllrich also pointed out a few good points. thanks guys – Shih-Min Lee Nov 17 '15 at 1:42
4

how he did it to inject scripts and run as root?

This is not known based on the few details you have provided. It might through brute-forcing SSH logins. It might also through combining several problems. A simple upload is not enough because the attacker must also find ways to execute the code and must also have found a security issue which allows to gain root access for a normal user (there are various exploits for this on unpatched Linux systems).

how to prevent it? ...how to log it so in the future I know I am being attacked? (instead of my service provider telling me)

Use a fully patched system, find and fix security problems in your application, use strong passwords for remote login (or better keys) ... There are lots of similar questions about this topic already.

Based on the current knowledge you have I you look instead for a managed system to keep the system secure and look for expertise in web application security to make the application secure. There is way to much to look out for and cannot be shown in detail just in a single answer (too broad).

is it safe to say the cause is coming from upload functionality?

Not without doing a proper forensic analysis of the system.

See also I was hacked, but I don't know why.

  • I see. My guess is not brute-forcing SSH otherwise he could have done much more than that.. Also the os is ubuntu 14.04.. – Shih-Min Lee Nov 16 '15 at 6:20
  • 1
    @Shih-MinLee: root access make it possible to do everything and it does not matter how it was gained. Apart from that whereis is only usable to find real commands, not simple text files which are used as the input to some other program (i.e. perl in this case). – Steffen Ullrich Nov 16 '15 at 6:28
  • first I am trying to check ssh logins using last command. I see many different ips but I login from home and it has static ips so I still cannot quite tell if there's people who actually ssh in this instance.. or is there something else I can do? – Shih-Min Lee Nov 16 '15 at 7:01
  • 1
    You can put up honeypots, even for SSH. Some IDS may also log the attempts. – Daniel Ruf Nov 16 '15 at 7:01
  • 1
    @Shih-MinLee: again - asking about what can be done is too broad, because there are simply too much things to watch for. If you have more specific questions please ask a new question and don't add a comment with the question. – Steffen Ullrich Nov 16 '15 at 7:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.