These days my hosting (a2hosting) had an issue with the node hosting my VPS and during this period my users noticed a weird behavior other than the several restarts that happened while there were issues on the node.
It all started when some of my website users contacted me saying they saw different images than usual on the website (totally random images, not related to my website), since i wasn't home i shut down the server from my hosting control panel, fearing an hacker attack.
After a couple of hours I've been told by my users that the server is up again (even though i didn't bring it up) and my users said that after clearing the cache they didn't see anything wrong with their images anymore. I shut it down again as soon as i read about this, even more fearful of an hacker attack (but puzzled since no password has been changed)
Finally, when i came back home I booted the server again and checked the log. No suspicious activity on the logs, nobody logged on the server besides me, no file (of those which i was told were different) had been changed. The only strange things were:
- I have 2 apache logs files called 20150518-access.log and 20150517-access.log (and i have some log entries dated May, 18 on other logs, as stated above), which means my system temporarly had May, 18 as date (now it's back to April though and it changed by itself).
- Some of my logs have this http://mjzone.net/Files/lognull.png as log entry after one of the restarts
I have done some checks and my system seems fine, no access other than mine, no suspicious file found (not even the images that i was told were different), and i spent all my sunday checking for suspicious activity but i couldn't find any.
So, i have opened a ticket on a2hosting and they said they couldn't give me any information but it was more likely that it was a security breach rather than an issue linked to the node problem (except the restarts, they confirmed it was a problem on their side), but honestly i'm not convinced...and while i can think of a link between the automated restart and the temporarily changed date, i can't find any related to the images (which is the only thing that made me think about a security issue, although i can't think of an hacker that changes a bunch of random images and the server date but then reverts everything back).
My questions are:
- is there any way that people seeing random images instead of the actual images might be linked to a server/node issue rather than a security breach?
- What else could i check other than system logs and recently changed files to make sure nothing weird happened?