2

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. I'd be surprised if 20 people had seen it. It's not related to money or sensitive information at all.

Assuming D.O. is right, what are likely sources of this attack? Could it be through my own machine that I use to ssh onto my D.O. server with an ssh key? i.e., could someone have used my own machine illegitimately and remotely to ssh onto my Droplet? I'd be surprised if my own machine was compromised. It's running Linux and I only use it for development (no pirating or porn, etc.). Do I need to reinstall OS and clean my own machine or is it likely this alleged hacker/bot got in by some means unrelated to my own computer?

I know you can't know for sure in my own case, but any general information on this subject could help. Thanks.

4
  • 1
    You said you were running a web site? What server were you running? Was the server serving static files, or was there any server side scripts running (PHP, Node.js, ASP.net, etc)? Were you running web apps? Just because your site is 'obscure' doesn't mean bot nets wouldn't find it in an automated scan, and then store whatever you had installed for later exploitation if a vulnerability was discovered in whatever you were running.
    – Kitsune
    May 4, 2014 at 1:41
  • 2
    You could also open a support ticket and ask the support team; they are usually pretty helpful ;-) -Will
    – user45951
    May 4, 2014 at 3:11
  • use a separate box capture to/from your box -- this will help identify connections to other machines that you may or may not be aware of. Compare connections identified in the packet capture with connections in netstat -na. Dec 4, 2014 at 14:50
  • 1
    My droplet was hacked. The attacker got root access. I can't figure out how this is happening. Apparently I checked the history and there was an wget of a tar ball from a chinese IP. I have since deleted that droplet and restored from an image. I had apache2, node, mysql. Just the standard stuff. This has been the issue with many of their customers too.
    – NEO
    Dec 28, 2015 at 16:42

3 Answers 3

1

The presence of any service on the Internet will lead to it being attacked to a certain degree, as some attackers are just looking for free resources (bandwidth, CPU power) and don't really care too much about what's on the host.

Assuming that you patch the OS it's not too likely that the SSH service was compromised directly, but if you're running a web application, a security flaw in that (for example SQL Injection or Remote File Inclusion) could allow the attacker to take control of the system.

Assuming you have backups the best bet would be to destroy the droplet and recreate the system but also to review the security of your web application.

1

To be frank: There is no such thing like an unpublished web site. There are bots routinely crawling all IP numbers and looking for webservers on the usual ports.

When they found a web server, they may try out some well-known misconfigurations or other vulnerabilities to take over the server. In case of success they may send spam emails or attack other targets in the internet.

Checking your home machine for intrusions is never a bad idea, altho' I think the attack went directly to the web server. I hope your passwords for the home machine and the webserver are different, otherwise a compromise of the webserver has revealed your home machine's password as well .

0

Being a developer makes you more of a target, not less of one. Developers (as the villains may have correctly deduced in your case) often have logon credentials on their boxes for systems they administer.

If it's easy for you to hose your machine, and you know you can restore it from trusted sources, go for it. If you want to take a deep dive into your box, run multiple AV scanners; run wireshark or a proxy and find out where the outgoing connections from your box are going. This can be difficult and time-consuming, especially given the growing number of legit apps that "phone home."

Then, of course, you would examine and/or hose the server, if D.O. will let you.

There's no telling why, or who hacked you.

And change your ssh key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .