CODEWITHSUNDEEP
web-servicessecurityjakarta-eeamazon-web-servicesamazon-ec2
user3752790
user3752790

Reputation: 61

DoS Attacks launched from my java app on aws EC2 instance

I got an email from AWS saying that they limited access to my EC2 instance because a DoS attack was launched from it. I swear it wasn't me.

Basically, all I have in this EC2 instance is Tomcat7 with a java app deployed to it. The java app is a simple web app with REST calls exposed through Jersy, so nothing super fancy since I am only using it to learn web services. The java app also is connected to an RDS mysql instance to expose the database through the REST services.

I am trying to narrow down my search area to find out how this DoS attack happened from my instance. What could have caused it? what are the security measures I need to take to prevent this from happening again?

Upvotes: 2

Views: 378

Answers (1)

Naveen Vijay
Naveen Vijay

Reputation: 16522

Apparently chances are you instance might been compromised and somebody might have logged into your instance and set up the necessary base to initiate and launch and DoS. If you have the code base for the "learning web services stuff" and do not have any critical application running, better you start a new instances from scratch; you have spoken / got the access from AWS.

Few Security Measures recommended

  1. Change the Key / Access Key - Rotate the password often
  2. Do not expose 22 / 3389 to 0.0.0.0/0 rather enable it only for your exit IP ( or local Public IP ) in the SG
  3. Have CloudWatch Alarms set to alert you by emails of Network Out, high CPU etc.

Upvotes: 2

Related Questions