Amazon EC2 Abuse Report

Question

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance.

The email states: We observed machines under your control participating in a DDoS attack targeting Google IPs.

The attack was a UDP amplification attack. In this attack, a UDP-based service is abused to attack others, wasting your bandwidth and computing resources.

I am fairly new to all of this stuff in addition to AWS and have no idea as to where to start. What should be the first steps for me to take to mitigate this?

After running the commands from @ximaera

Davids-MacBook-Pro:~ davidpham$ ntpdc -nc monlist *ip*
*ip*: timed out, nothing received
***Request timed out
Davids-MacBook-Pro:~ davidpham$ dig @ip +edns=0 +ignore com ANY

<<>> DiG 9.10.6 <<>> @ip +edns=0 +ignore com ANY
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
Davids-MacBook-Pro:~ davidpham$ 

This was the output I received. Am i missing something?

Answer 1

Generally, there's a long list of servers and protocols vulnerable for UDP amplification. A few command line calls to determine the presence of some of the most prominent amplification vectors might be found here. All the commands should better be invoked remotely. E.g. if your server is 192.0.2.1, then, to check for an NTP amplifier, you do

ntpdc -nc monlist 192.0.2.1

from your laptop or an adjacent datacenter machine.

I'd recommend to check NTP and DNS first, and if there's no match, then to dive into details.

tcpdump -ni any udp on the server itself will definitely help you to dive. If you're able to spot any traffic you don't expect to see in the dump, you can then track down the vulnerable application listening on the port seen in the dump by looking (or greping) at the output of ss -lpn.

---

EDIT. So now, as you've provided the IP address of your server, I've been able to check it myself, and it turns out you have a PORTMAP amplifier active:

$ rpcinfo -T udp $ip | wc -l
      17
$

So you basically needed to go through the rest of the checks past DNS and NTP ones.

The fix is obviously to disable port mapper (here's how you do it on Debian/Ubuntu) or at least block the access to the port 111/UDP via firewall.