2

Recently my host (OVH) shut down my server due to it spamming traffic to another IP:

enter image description here

I've got no idea what the other IP is. It doesn't appear to be a web page (Or if it is, I can't connect to it).

Here is my latest authentication logs: enter image description here

My current IP at the time of writing is 146.90.203.194.

Have I been hacked, or is there simply a piece of faulty software? If I've been hacked, what can I do about it?

By the way, I don't use any keys, I only use password authentication.

The server went down at approximately 11:30, which is the same time as the above displayed log.

1

You haven't been hacked, you've been DDoS. Here's a (french) page about how to deal with DDoS attacks: https://www.ovh.com/fr/anti-ddos/gestion-attaque-ddos.xml Some documentation: http://en.wikipedia.org/wiki/Denial-of-service_attack

Also, you're bruteforced: a bot tries to find your password. Make sure your password is strong, you can also install fail2ban to ban bruteforcing IP.

  • My server is SENDING the DoS attack. Not receiving it. The IP starting with 91, specified as the source IP, is the IP of my server. Also, thanks for letting me know I'm not hacked. – Joehot200 Jun 4 '15 at 8:38
  • Oh well I've misread, that change everything. So yes, wou could be hacked. Type "w" in a terminal to see who's connected and change all your passwords. – Dano Jun 4 '15 at 9:01
  • Could it also be a piece of malicious software? If so, is there any way for me to pinpoint it down? – Joehot200 Jun 4 '15 at 9:45
  • @Ramhound I don't know what a good backup could be. I run a minecraft server, and someone could have added a dormant exploit in there for months before using it, which is actually what most of them do to so that they get most infected servers. There is simply no way of me knowing what backup is not infected, or if even ANY of the backups are not infected. – Joehot200 Jun 4 '15 at 11:06
  • @Ramhound Is it not possible to one, block all outgoing connections initiated, and two, check the outgoing connections to see what application made them? Is that not possible? – Joehot200 Jun 4 '15 at 11:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.