cxs

New cxs v5.12

Changes:

  • Implemented native systemd support for startup and shutdown of cxs Watch
  • Added version detection for Fancybox for WordPress
  • Exploit fingerprint definitions database additions

New cxs v5.11

Changes:

  • Updated license servers
  • Exploit fingerprint definitions database additions

New cxs v5.10

Changes:

  • Disable –xtra [file] when using –wttw [file]
  • Display error on license retrival failure
  • Added check for perl modules LWP::Protocol::https and Linux::Inotify2 on installation and upgrade
  • Added new advanced PHP decoders
  • Exploit fingerprint definitions database additions

New cxs v5.09

Changes:

  • Fix for issues where license file became corrupted after update to v5.08

New cxs v5.08

Changes:

  • Fixed a rare potential issue with fingerprint processing in –xtra [file]
  • Added new advanced PHP decoders
  • Updated scripts to use https://download.configserver.com
  • Revert to using LWP::UserAgent instead of HTTP::Tiny for SSL support

cxs and “CryptoPHP”

CryptoPHP:

http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-inside-popular-content-management-systems/

cxs can detect “CryptoPHP” for currently reported variants (and has done so for some time with then known variants).

A few things to note:

  • As with all exploits, new variants are developed regularly so they will not always be detected
  • Ensure that you have a daily cron job to update cxs
  • cxs will not necessarily prevent an account being exploited as this “infection” is caused by clients installing illegal (“nulled”) applications that have already been exploited
  • As with all exploits, regular full cxs scans have to be run to detect newly reported variants that may have previously evaded cxs Watch
  • If you find new variants that are not detected by cxs, submit them to us in the normal manner (see the cxs –wttw [script] option in the documentation)

New cxs v5.07

Changes:

  • Modified new installs to better initially update to the latest fingerprints
  • Ignore and Xtra files can now use an Include statement to include additional files. If cxswatch is running then it will also watch the included files for changes and reload if necessary
  • Added new quarantine option –qignore [method] which used when restoring a file using –qrestore [file] will create an entry in –ignore [file] before restoring the file. See POD for more info
  • Optimised fingerprint database to remove duplicates and old entries of no value reducing the size without reducing effectiveness
  • Exploit fingerprint definitions database additions

New csf v7.56

Changes:

  • Fixed issue with Restricted UI item sanity checks failing
  • Modified LF_CSF on cPanel servers to detect a change in the cPanel version and then trigger a restart of ConfigServer scripts (lfd, MailScanner cxs Watch). Restart triggers are limited to every 12 hours and will only trigger if upcp is not running

New cxs v5.06

Changes:

  • HTTP::Tiny upgraded to v0.050
  • Modified use of BSD::Resource to be silent on failure
  • Exploit fingerprint definitions database additions