I'm pretty sure that if you have no security group attached to an instance no traffic is allowed. And a new security group doesn't allow traffic from "everywhere" by default. You have to actively allow that.