Not sure if this should go under security or Ubuntu but, I believe that my server got hacked somehow. Its being hosted on Digital Ocean and I mainly use it fiddle around with things. Today, I got a notification from NewRelic that my sever has surpassed 90% disk usage. Logging in, I run a normal df -h to find this:

Filesystem Size Used Avail Use% Mounted on 917G 826G 46G 95% /var/tmp/temp

I find that odd because I haven't mounted anything recently, yet alone touched the server in a couple months. I can view all files in the share but nothing seems to be useful. Just a bunch of binaries and tars in folders. The IP seems to be from China. I got the notification today, so I checked fstab and history of accounts created on the server. I don't see anything fishy but, I'm starting to think that I got hacked. I know this is possible but how? Has anyone ever seen anything like this? Is there anything I can do further to prevent this?

Server details: Root account disabled, ssh port changed, I'm the only user with access and haven't been logged on in months. This had to have happened today because I got the NewRelic notice this morning.

  • we need more information, and what exactly is your question? – LvB Jun 9 '15 at 1:09
  • Have you tried untaring the files in the folder? What kind of binaries are they ... try running them through a public malware scan. – Ari Trachtenberg Jun 9 '15 at 15:53

First and foremost, have you contacted tech support? If there's a forensics investigation to perform you should not meddle with your server but flag it and let them do their digging.

Secondly, assuming tech support doesn't want to or cannot help, the fact that you got the notification on day X does not imply that the mount happened on the previous day. From what you're writing the notification is informing you about your local disk usage, and the output shows a remote mount. Is the notification triggered for all mounts or only local mounts?

Thirdly, please look in the logs and see if you can find anything suspicious including mount failures, logins from root or other accounts in the two months you know you haven't touched the server. You might want to take a look at the content of the remote mount and find the earliest created file from your user (looks like a NFS mount so I assume there's user parity between yours and the remote system).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.