Compromised EC2 image includes root access SSH key

Hello,

It has recently come to our attention that a public AMI in the US-East region was distributed with an included SSH public key that will allow the publisher to log in as root. However, our records indicate that you have, or have had, instances launched from this AMI.

Compromised AMI: ami-c2a255ab
Your AWS Account ID: ##SNIP##
Your Instance ID(s): ##SNIP##

It is our recommendation that you consider instances based on this AMI compromised and immediately migrate your services to a new instance based on a different AMI. We are in the process of disabling the compromised AMI but it is possible that it will still be available by the time you receive this. You should not launch new instances from this AMI.

While you are migrating your services to a new instance we also recommend that you disable the offending SSH key. To do so, remove the following text from BOTH the '/root/.ssh/authorized_keys' file and '/home/ubuntu/.ssh/authorized_keys' file on each running instance:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCU8QRvONa/Rv4mXSDMVFX7EnIiJd2nuQ0mUHPTGNUCq0PjyNemjXTLztxfbA9q8+S9T7q1UJG3dp49EzE1Gq8KAQm6vmSn80pPrm3hTHAmiBboIZzoqv6PSedkUvZyqqBn1NK0VZxGH7JvsagW95R2AfTdEwdXRjorxtPzi/MpYdoOzM41yzysyjmIZYdeOcZLliLfv9B31lTaFY2RfxpJ4TWlKh1Fo4/IyUyd3uyih17ucbKiSdJ2G5iYS01wL18o9Ett8cyjtrYXDewEsGtrL0taQMuPpiD66+HE37k4GWwNho6vsMSO1qbeTY431EQSaIrr/SKn8ToqnnLBy6On ##SNIP##

We're sorry for any inconvenience this may have caused.

Best regards,
The Amazon EC2 Security Team

This message was produced and distributed by Amazon Web Services LLC, 410 Terry Avenue North, Seattle, Washington 98109-5210