My testing database has been hacked.  I am pretty sure it's hacked by an easily guessed test use admin credential.  After reading  I've got an idea of what to do, but the problem is how to do it.  I have tried looking to see what queries the hacker had used but since the general_log was turned off there isn't a log to see.   So far what I did is remove all unused accounts, set port access on AWS to my computer only.  What/and how could I do to make sure that I didn't leave any vulnerability open for the hacker to use? Also how do I ensure I removed everything the hacker has done without having a log?
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
Let $G$ be a group, $H\subseteq G$ a subgroup and $a\in G$ an element of the group. Is it possible that $aHa^{-1} \subset H$, but $aHa^{-1} \neq H$?   If $H$ has finite index or finite order, this is not possible. biblatex and autonum don't work together biblatex and autonum don't seem to work together in the newest version. Consider the following MWE:  \documentclass{article} \usepackage[utf8]{inputenc} \usepackage[backend=biber]{biblatex} \usepackage{autonum}  \begin{document}  \end{document}   I get the following error messages:  0 File ended while scanning use of \ettl@for@do1 0 pdflatex: \pdfmatch: repetition-operator operand invalid pdfTeX warning: pdflatex: \pdfmatch: repetition-operator operand invalid)Runaway argument?{{\blx@bibdata@i {\blx@tempb }}\blx@bibfiles \eappto \blx@tempa {\blx@xml@comme   After commenting out either biblatex or autonum, the errors disappear. Should +1 and thanks comments be a declined flag? As a moderator for GD.SE I was always led to believe our role is to clean old comments as they are intended to be a temporary item depending on the level of context and if they add any benefit to an answer.  On SO I haven't had any issues or declines when I read old Q&amp;As and see +1 and thanks and flag.    However, on other sites when I read an old Q&amp;A and I see thanks or +1 I try to be courteous and flag them as I am aware moderators do get measured by their cleanup and I'm accustomed in doing so on SO but these flags are declined.    So this leads me to ask:   Should +1 and thanks comments be flagged and is the intended role of a comment still to be considered as temporary? What is the proper classification for a thanks or +1 comment if it should be flagged?   I didn't see any Q&amp;As on this topic after browsing the tags:   and searching led me to:  but that was several years old. Can't see a glass object through another glass object in Eevee $\sum_{n=1}^\infty\frac{z^n}{n}$ does not converge uniformly on $\mathbb{D}$. It is required to prove that the series $\sum_{n=1}^\infty\frac{z^n}{n}$ does not converge uniformly on the open unit disc centered at $0$, i.e. $\mathbb{D}$. Clearly by virtue of the ratio test the series converges pointwise on  $\mathbb{D}$. However I find it difficult to see why the convergence is not uniform. Could someone please give me a hint? How to ensure OpenVPN connection uses specific DNS? I'm using OpenVPN through Tunnelblick on MacOS X Lion.  I need to set specific DNS (with local IP, which works only when VPN is up) for the duration of this VPN session only.  I do not have access to the OpenVPN server configuration. Only client config. Also, DNS from the server doesn't work.  So it works like this: I connect to VPN, go the Network preferences and manually set DNS. After VPN is disconnected, I switch back to default. It works, but it needs to be automatic.  After some exploration I found that OpenVPN up- and down- scripts might help me with that. Unfortunately, I haven't found any specific documentation about how exactly it can be done.  How it can or can't be done? Any advice would be appreciated! Sending email with PHP from an SMTP server I have an exercise found on a list but I didn't know how to proceed. Please, any tips?  Let $X$ be a connected subset of a connected metric space $M$. Show that for each connected component $C$ of $M\setminus X$ that $M\setminus C$ is connected. Why is this sentence wrong? "He went to home." Deserializing JSON when sometimes array and sometimes object Why is the voltage across a capacitor and the current across an inductor continuous? Re-number a list when a new entry is inserted What do "watched tags" and "ignored tags" do? Do Wine Viruses only work while Wine is running? I heard Linux can get viruses through Wine,and I was curious if the viruses work only while Wine is running.  In other words, could I stop a virus from doing it's thing by just quitting Wine? Visiting Greece with back-to-back Schengen visas (One from Germany, other from Italy) I have a Schengen Visa issued by Germany, which expire on 11th Jan 2014, and I can remain in the zone till 11th Jan 23.59 PM. I have already visited Germany in the past with this visa, so I can travel whenever in Schengen zone directly from my country (Turkey).  I have a second Schengen Visa issued by Italy, which START on 12th Jan 2014, such that I can remain in Schengen zone from 12th Jan 00.00 AM onwards (I'm putting times to clarify which dates are inclusive).  I would like to travel to Greece with this visa: Entering the country on 6th January, and leaving the country on 19th January.  Is this allowed? Or do I have to leave the country first, and then re-enter through Italy? Installing Maya on Ubuntu Linux Installing Autodesk Maya on Ubuntu is possible, but can be a bit challenging.  Assuming that one already has the required specs and a solid graphics card driver installed, how can it be done? Are there cases where a period is placed inside parentheses? In which cases the period (or a comma) should be placed inside the parentheses? No CUDA and GPU option $\sum_{n=1}^\infty \frac{i^n}{n}$ converge? Connecting two Ethernet PHY without magnetics?