General

cxs and “CryptoPHP”

CryptoPHP:

http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-inside-popular-content-management-systems/

cxs can detect “CryptoPHP” for currently reported variants (and has done so for some time with then known variants).

A few things to note:

  • As with all exploits, new variants are developed regularly so they will not always be detected
  • Ensure that you have a daily cron job to update cxs
  • cxs will not necessarily prevent an account being exploited as this “infection” is caused by clients installing illegal (“nulled”) applications that have already been exploited
  • As with all exploits, regular full cxs scans have to be run to detect newly reported variants that may have previously evaded cxs Watch
  • If you find new variants that are not detected by cxs, submit them to us in the normal manner (see the cxs –wttw [script] option in the documentation)

New cxs v5.07

Changes:

  • Modified new installs to better initially update to the latest fingerprints
  • Ignore and Xtra files can now use an Include statement to include additional files. If cxswatch is running then it will also watch the included files for changes and reload if necessary
  • Added new quarantine option –qignore [method] which used when restoring a file using –qrestore [file] will create an entry in –ignore [file] before restoring the file. See POD for more info
  • Optimised fingerprint database to remove duplicates and old entries of no value reducing the size without reducing effectiveness
  • Exploit fingerprint definitions database additions

New csf v7.56

Changes:

  • Fixed issue with Restricted UI item sanity checks failing
  • Modified LF_CSF on cPanel servers to detect a change in the cPanel version and then trigger a restart of ConfigServer scripts (lfd, MailScanner cxs Watch). Restart triggers are limited to every 12 hours and will only trigger if upcp is not running

New csf v7.55

Changes:

  • If LF_SELECT is enabled the port(s) listed in PORTS_* can now be specifed as port;protocol,port;protocol, e.g. “53;udp,53;tcp” to allow for protocol specific port blocks. This port format can also now be used in regex.custom.pm  and csf –td/–ta to allow udp port blocks
  • PORTS_bind now defaults to “53;udp,53;tcp” on new installations
  • PORTS_directadmin added for DA installs to allow for per port blocks if LF_SELECT is enabled
  • Ports 993 and 995 now added to TCP_OUT and TCP6_OUT on new installs
  • LF_IPSET taken out of BETA as it is proving stable
  • Modified Server Check to skip checking xinetd on Plesk servers
  • Modified UI_SSL_VERSION for new installations to use the new IO::Socket::SSL default SSL_version setting of SSLv23:!SSLv3:!SSLv2 so that SSLv3 is disabled
  • If systemd is running the installer disables firewalld using systemctl

New cxs v5.06

Changes:

  • HTTP::Tiny upgraded to v0.050
  • Modified use of BSD::Resource to be silent on failure
  • Exploit fingerprint definitions database additions

New csf v7.54

Changes:

  • Added IPv4/IPv6 column to show whether the port in the csf –ports option is listed in *_IN (e.g. TCP_IN)
  • Added IPv4/IPv6 column to show the number of ESTABLISHED connections to the port in the csf –ports
  • Modified Server Check text from “SMTP Tweak” to “SMTP Restrictions” for cPanel/WHM UI
  • Added the following to LF_IPSET for IPv4 IPs and CIDRs: /etc/csf/csf.allow, /etc/csf/csf.deny, GLOBAL_DENY, GLOBAL_ALLOW, DYNDNS, GLOBAL_DYNDNS, MESSENGER. IPv6 IPs, Advanced Allow Filters and temporary blocks use traditional iptables
  • Modified ipset information in csf.conf including that only ipset v6+ is supported
  • Modified ConfigServer::Slurp to carp instead of croak
  • Improvements to Server Check nameserver checking to include IPv6 servers and better determine how many are local nameservers
  • Modified csf –graphs to append a trailing slash if missing to directory name

New csf v7.53

Changes:

  • Modified Slurp.pm to use O_RDONLY instead of O_RDWR

New csf v7.52

Changes:

  • Fixed issue with Restricted UI items sanity checks failing

New csf v7.51

Changes:

  • Removed duplicate “Search System Logs” button from the UI

New csf v7.50

Changes:

  • Added new BETA options LF_IPSET, IPSET. Use ipset for CC_* and csf.blocklist bulk list matching. See csf.conf for more info
  • Added new UI option to view ports on the server that have a running process behind them listening for external connections
  • Added new CLI option (csf -p, csf –ports) to view ports on the server that have a running process behind them listening for external connections
  • Added new CLI option (csf –graphs) to Generate System Statistics html pages and images for a given graph type into a given directory. See ST_SYSTEM for requirements
  • If using DYNDNS and the FQDN has multiple A records then all IP addresses will now be allowed
  • IPv6 support added to DYNDNS. Requires the Perl module Socket6 from cpan.org to be installed
  • On DA servers, if LF_DIRECTADMIN is enabled, DIRECTADMIN_LOG_* will be scanned for login failures to Roundcube, SquirrelMail and phpMyAdmin if installed and logging enabled via CustomBuild v2+. Failures will contribute to the LF_DIRECTADMIN trigger level for that IP
  • On DA servers, FTPD_LOG now defaults to /var/log/messages on new installs
  • Added exe:/usr/libexec/dovecot/anvil to csf.pignore for new installs on DA
  • Added to UI count of entries in /etc/csf/csf.allow
  • Added blocklist.de to csf.blocklists for new installs, latest file copied to /etc/csf/csf.blocklists.new on existing installs
  • Started moving common functions to separate modules within csf
  • HTTP::Tiny upgraded to v0.050
  • Fixed csf stop/start routines on reboot for servers using systemd
  • Modified integrated UI to display die errors to browser
  • Modified X_ARF report to use a self-published schema: http://download.configserver.com/abuse_login-attack_0.2.json
  • Modified X_ARF to lowercase the Source-Type field
  • Modified X_ARF template to use the v0.2 “X-XARF: PLAIN” header field
  • Updated restricted UI items
  • Geo::IP upgraded to v1.45
  • Crypt::CBC upgraded to v2.33