AWS EC2: How to determine whether my EC2/scalr AMI was hacked? What to do to secure it?
- by Niro
I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump:
Original report:
Destination IPs:
Destination Ports:
Destination URLs:
Abuse Time: Sun May 16 10:13:00 UTC 2010
NTP: N
Log Extract:
External 184.xxx.yyy.zzz, 11.842.000 packets/300s (39.473 packets/s), 5 flows/300s (0 flows/s), 0,320 GByte/300s (8 MBit/s)
(184.xxx.yyy.zzz is my instance ip)
How can I tell whether someone has penetrated my instance? What are the steps I should take to make sure my instance is clean and safe to use? Is there some intrusion detection techinque or log that I can use?
Any information is highly appreciated.