CODEWITHSUNDEEP
amazon-ec2
SelectStament767
SelectStament767

Reputation: 45

AWS EC2 Instance Hacked

One of my EC2 instances was hacked a few days ago.

I tried logging in via SSH to the server, but I couldn't connect. I am the only one with access to the private key, and I keep it in a safe place.

Luckily, I had a backup of everything and was able to move the web app to a new instance quite fast.

My concern right now is that I don't know how my instance was hacked in the first place.

Why can't I log in via SSH using my private key? I would assume that the private key stored on the server can't be (easily) deleted.

Is there a way I can find out how the hacker gained access to the instance? Perhaps a log file that would point me in the right direction.

Should I attach the EBS volume in question to a new instance and see what's on it or what are my options in this case?

Right now, it seems I have to access at all to the hacked instance.

Thank you!

Upvotes: 0

Views: 3786

Answers (3)

John Rotenstein
John Rotenstein

Reputation: 269826

The fact that you are unable to login to the machine does not mean that it has been "hacked". It could be due to a configuration change on the instance, or the instance might have changed IP address after a stop/start.

Do a search on StackOverflow for standard solutions to problems connecting to an instance and see if you can connect (eg recheck IP address, check security group, turn on ssh -v debugging, check network connectivity & VPC settings, view Get System Log, etc).

Worst case, yes, you could:

  • Stop the instance
  • Detach the EBS volume
  • Attach the EBS volume to another EC2 instance
  • Access the content of the EBS volume

Upvotes: 0

Karen B
Karen B

Reputation: 2761

@Krishna Kumar R is correct about the hacker probably changing the ssh keys.

Next steps:

Security concerns (do these now!):

  1. Stop the instance, but don't terminate yet

  2. Revoke/expire any sensitive credentials that were stored on the instance, including passwords and keys for other sites and services. Everything stored on that instance should be considered compromised.

Post-mortem

  1. Take an EBS snapshot of the instance's root volume (assuming that's where logs are stored)

  2. Make a new volume from the snapshot and attach to a (non-production) instance

  3. Mount and start reading logs. If this is a linux host and you have port 22 open in the firewall, I'd start with /<mount-point>/var/log/auth.log

Upvotes: 1

krishna_mee2004
krishna_mee2004

Reputation: 7366

They might have logged into your machine via password. In ssh config, check the value of: PasswordAuthentication. If it is set to yes, then users can login to the instance remotely via password. Check /var/log/secure for any remote logins. It will show up all logins (password or key based).

If someone logged in as 'root', they can modify the ssh keys.

Upvotes: 0

Related Questions