Question
What should I do after being hacked
- Posted August 14, 2013
I noticed my test Rails app calling some strange routes
" Started GET “/w00tw00t.at.blackhats.romanian.anti-sec:)”.
and also running php my admin scripts even though I never installed it. Also in the logs, there’s a record of connections from strange ip addresses (such as 203.199.209.145 ) that google results reveal to be associated with suspicious behaviour
Subscribe
Share
Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Sign in to AnswerThese answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Before destroying your droplet, it is very IMPORTANT to locate the security hole, and how they are gained access and hacked your server. Installing new droplet wont protect you from future hacks. If you can’t - hire someone, but even then they might be covered they trails, if so you can use the image of the server (if you have) like a honey pot and wait for them to hack it again. But just re install droplets is not a good option.
Is this a GET request from your droplet or to your droplet?
hey, <br> <br>those idiots scan the whole internet, I see that GET request every day at work. <br> <br>Just because you see a GET or POST to your webserver does not mean you have been hacked. <br> <br>If you have people actually connecting via ssh to your server (or whatever other management tools/ports) you have enabled and successfully logging in then be concerned or you seeing files in your web server that you did not put there (apache flaws, php exploits aka web server hacked etc) <br> <br>You saying you are running php my admin even though you did not install it worries me though… you sure it didnt come with your droplet? Can you see who has connected to your server? Who is logged on from what IP? <br> <br>If you have no clue kill the box and walk away slowly :)
I recommend disabling nginx/unicorn and killing all processes that are related to your rails app until you find the infected files. <br> <br>As Pablo said, if you have a snapshot/backup of your droplet you can restore it from there.
How long did it take you to build your server to its current state? Hopefully you have a snapshot; so you can destroy the current droplet and spin up a new one. Situations like these also lend themselves to utilizing a configuration-management tool, like <a href=“https://www.digitalocean.com/community/articles/how-to-install-puppet-on-a-digitalocean-vps” target=“_blank”>Puppet</a>. Then, you could destroy this droplet, while having the piece of mind that you can spin up a new droplet rather easily & pick up right where you left off (b/f being hacked). <br> <br>In the mean time, make sure you’ve set up your firewall, e.g. <a href=“https://www.digitalocean.com/community/articles/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server” target=“_blank”>How to Setup a Firewall with UFW on an Ubuntu and Debian Cloud Server</a>.