drewdahlman

Author here.

It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.

Author here -

The purpose of going through and removing the malicious scripts was to learn more about server security. I figured if I had been compromised I might as well learn what was causing it and how to fix it.

I have since toasted the server and set it back up with all of the things I mention in the article. I wrote the piece because I felt that there might be others out there who can learn from my mistakes and to also have a record for myself.

We are always learning and sometimes we need to learn the hard way, I got lucky in that this was on a side project and not any real client work.

Would love to see a little behind the scenes for this, maybe a write up / blog post. Pretty neat little experiment.

The app has been around for a little over a year. The search engine is powered by users of the extensions and apps and was released earlier this year. Hope you all enjoy! Happy Giffing!