2

Recently my host (OVH) shut down my server due to it spamming traffic to another IP:

enter image description here

I've got no idea what the other IP is. It doesn't appear to be a web page (Or if it is, I can't connect to it).

Here is my latest authentication logs: enter image description here

My current IP at the time of writing is 146.90.203.194.

Have I been hacked, or is there simply a piece of faulty software? If I've been hacked, what can I do about it?

By the way, I don't use any keys, I only use password authentication.

The server went down at approximately 11:30, which is the same time as the above displayed log.

1 Answer 1

1

You haven't been hacked, you've been DDoS. Here's a (french) page about how to deal with DDoS attacks: https://www.ovh.com/fr/anti-ddos/gestion-attaque-ddos.xml Some documentation: http://en.wikipedia.org/wiki/Denial-of-service_attack

Also, you're bruteforced: a bot tries to find your password. Make sure your password is strong, you can also install fail2ban to ban bruteforcing IP.

8
  • My server is SENDING the DoS attack. Not receiving it. The IP starting with 91, specified as the source IP, is the IP of my server. Also, thanks for letting me know I'm not hacked.
    – Joehot200
    Jun 4, 2015 at 8:38
  • Oh well I've misread, that change everything. So yes, wou could be hacked. Type "w" in a terminal to see who's connected and change all your passwords.
    – Dano
    Jun 4, 2015 at 9:01
  • Could it also be a piece of malicious software? If so, is there any way for me to pinpoint it down?
    – Joehot200
    Jun 4, 2015 at 9:45
  • @Ramhound I don't know what a good backup could be. I run a minecraft server, and someone could have added a dormant exploit in there for months before using it, which is actually what most of them do to so that they get most infected servers. There is simply no way of me knowing what backup is not infected, or if even ANY of the backups are not infected.
    – Joehot200
    Jun 4, 2015 at 11:06
  • @Ramhound Is it not possible to one, block all outgoing connections initiated, and two, check the outgoing connections to see what application made them? Is that not possible?
    – Joehot200
    Jun 4, 2015 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .