Thread: Did my seedbox just get hijacked?!

Hey guys, I have been on a long vacation and today I opened my Deluge client's web interface for the first time in a month and to my horror I saw 5 torrents currently downloading from PassThePopcorn where I don't even have an account! I didn't remember the time but I think they were added today or at the earliest yesterday.
Of course, I changed my Deluge password immediately but I still cannot comprehend how this could have happened...

Any ideas or suggestions to improve security?

it might b your torrents only downloaded via rss feeds or auto irssi download
best thing would be to check the passkey and confirm if its others or yours.
if it is others just you can pinpoint who hacked your account
method -download any torrent file from ptp replace ur passkey with that users passkey and then start download check the peerlist at site and see whose passkey it is.

ps-dnt 4gt to inform the staff before playing with passkey

I never used RSS or other similar auto-download methods since I never got them to work. On the other hand, I should have though of trying to check who did this the way you described but I panicked and rushed to delete the torrents. :-\ Besides, I don't have an account in PTP.
Now I can just sit and see if any new torrents pop up into my client.

sounds like your box was hijacked. I would change all your passwords on that box, not just deluge, and make sure your box is secure. Make sure your deluge password is strong.

Make sure your box is secure, check the tutorials section here, or just google search for info.

Who is your seedbox provider. May have been that someone who works there saw there had been no activity on your box, and decided to use it to buffer their ptp account.

well that mean definitely someone was in your seedbox account.
deleting torrent was a big mistake,it will be difficult now to find the culprit.

what i would have done- keep the password same and wait for the culprit to add other torrent files to catch him

I guess I'll change my root password as well. :-\ The provider is EvoBoxes, recently absorbed by RapidSpeeds. I've been dealing quite a bit with RS support lately because I had some problems logging into the control panel on their site but still, could someone over there just access people's servers and use them?!
I should maybe change my SSH port as well, when I come to think of it.

By the way, my webclient can be reached only if you know the exact IP of the server. Does this mean it was definitely someone from RapidSpeeds?

no it could have been anyone and RapidSpeeds are respectable, so probably not someone from there, but possible.

hackers have bots, that attack thousands of IP addresses, best way to protect yourself is to not allow root ssh access, reason for this is they will attack using 'root' as the username, then they just need to break the password. Use strong passwords, and change the ssh port from the default one.

Also for your web client use both a strong user name and password.

Check out the sections on securing your box in MikeD's tutorial - Debian/Ubuntu Dedicated Server Setup

If they did get in your box you should probably do a OS reinstall, as who knows what else they may have put in there, and start from scratch, just be aware this will also delete all your data.

don't use a weak password, and change the default ssh, deluge port to something else.