Outbound UDP DOS on VPS

Was the kernel used an old one? Granted UDP packets can be spoofed, but more than likely it came from your instance since it was recorded on the host from their graphs. I would just create a new instance. Make sure your site apps are current and not hacked. Make sure the servies have the latest version based upon your distro.

To answer your second question, you might be able to find a managed provider for $40/mo, but not Xen based like Linode is. To get that price point it must be Virtuozzo based and oversell the host. IMHO should should at least add $100 to that price point to get a fully managed Xen based solution.

It was timthumb.php vulnerability. Read more for explanation: http://www.webrevised.com/130-timthumb- … -affected/">http://www.webrevised.com/130-timthumb-php-vulnerability-thousands-of-templates-affected/

This was the script which was uploaded to server due to timthumb.php vulnerability: http://pastebin.com/nVeVMgL4

And it was placed cache directory and executed by attacker whenever he wanted a UDP DOS attack.

@pankajbatra:

It was timthumb.php vulnerability. Read more for explanation: http://www.webrevised.com/130-timthumb- … -affected/">http://www.webrevised.com/130-timthumb-php-vulnerability-thousands-of-templates-affected/

Ouch! That is some nasty vulnerability.

@pankajbatra - for what it's worth, do you have any entries in your access logs with the useragent "Mozilla/4.0 (compatible; MSIE 5.23; Mac_PowerPC)" ? I've got some logs of this attack being attempted before, and that UA being used by the script used to try to inject it in.

I'm curious as to whether the same UA was used when it was injected onto your own system.