3CX: How this malware almost hacked every business

3CX: A popular phone system software for VOIP was hit by a supply chain attack, with the original source serving malware infected installers.
Buy F-Secure now with -52%: prf.hn/click/camref:1101liYab... (sponsor)
Buy the best antivirus: thepcsecuritychannel.com/best...
Join the discussion on Discord: discord.tpsc.tech/
Get your business endpoints tested by us: tpsc.tech/
Contact us for business: thepcsecuritychannel.com/contact

[@RawPikachu]

I just imagined scam call centers being affected by this

[@americanhotdog876]

Lmao im currently watching jim browning on my laptop

[@joepjoep9531]

Should be used against them :-))

[@Akamo.]

They usually run pirated versions of vicidial

[@mahdedarmo]

I’m sure they are petri dishes for malware 😄

[@DrHarryT]

One of the guys that scam the scammers should get ahold of this file and execute it on their system, hopefully it would infest their entire network.

[@vaakdemandante8772]

The 3CX response is somewhat typical of many businesses in general. It just shows, that making business is mostly about getting paid and avoiding as many responsibilities as possible. It's not just about being hacked. It's about everything that is remotely tied to bearing costs, that eat away at the profit margin. Do as little as possible but get as much money as possible. This isn't bad per se, but it often is, because businesses then try to ignore important issues like waste and environmental pollution, they hide internal data, sell customers data, do away with proper security etc. The list just goes on and on. It's true both for small and big business, the difference being the big business has a lot more capital to layer their way out of responsibility. And if you are an honest business that cares about its customers your costs are so high compared to the unscrupulous businesses, that you go out of business very quickly. The state has become so corrupted through lobbing that it's too weak or uninterested in leveling the playing field for businesses and holding them accountable to laws that are already in place.

[@vincei4252]

Current year is the spider-man meme at all levels.

[@dougaltolan3017]

. Mostly about getting paid? It's *all* about getting paid. The product and customer care are just tools to getting paid

[@theglowcloud2215]

3CX is worse. Their CEO is a complete piece of shit and pathetic excuse for a human being. He got permabanned on reddit for doxxing someone. His policy is "ban anyone who goes against me" on the 3CX forums. 3CX resellers get treated like shit. In short, Nick Galea deserves to be pistol whipped.

[@MutedAndReported3032]

That sucks, man.

[@npsit1]

It's particularly frustrating when security professionals know this software is doing something malicious but the company where the file is hosted refuses to even look into the problem.

[@Ozymandias1]

It needs to get into the NEWS for that to happen. And unfortunately the news won’t report on it until massive damage is done. And then grannies around the world will send bogus claims to all their friends that they should unhook their phones for a week and wrap them in aluminum foil or they’ll get infected. And then granny dies because she can’t call the doctor with a medical emergency.

[@myonlineclasses3651]

It just means that their "professionals" in their field are inept at doing their jobs.

[@LudicrousAvian]

I hope 3CX gets sued to oblivion. This is absolutely unacceptable behavior from a company that mass-distributes corporate software 😑

[@767corp]

ain't every single corporation being ignorant when their customer data was leaked ? and did anyone sue and actually get anywhere ? be real for god sake . if you check your mail it's probably out there in leaks and are you gonna go and sue corporation XYZ cuz they get breached ? ROFLMAO good luck !

[@malwaretestingfan]

The "fun" part is that the threat actors used a 10 year old Windows certificate evaluation bug (CVE-2013-3900) for this supply chain attack, which has not been patched out of existence yet.

[@malwaretestingfan]

​@Nathan Oops, I've misread the BleepingComputer article on it which still mentions that upgrading to Windows 11 removes that setting. Nevertheless, it's not a well known bug, I can't blame the company for that at the very least.

[@markjacobs1086]

​@Nathan Not just software, hardware as well (which requires dated software in a lot of instances) 😅

[@berndeckenfels]

That’s however only to hide the first stage, it’s not really the root of the compromise. They could have just ship an unsigned DLL or a DLL signed by the compromised vendor.

[@engineerskitchen8964]

If they enable securitypadding, this app can't be installed.

[@kariossyr6018]

This figure us becoming common day after another, which means companies are feeling safe from people's reaction since long violation of their privacy caused them not to care any more.

[@TheCocoaDaddy]

Excellent video!!! This video gave me an idea for possible future PC Security Channel video: Maybe do a "top 10 most sophisticated malware threats" video, where you highlight the malware threats with the most sophisticated techniques for avoiding detection,etc. What you presented here is very impressive and I can only imagine, the bad actors will improve, especially with AI helping out. Thanks for posting!

[@rebootfactory]

Thanks Leo! As usual, very informative and a great breakdown of the key facts. Thanks for what you do!

[@MaxSpec]

That really shows that even with words from the companies, that isn't gonna stop malicious actors from hijacking you. Hence why FOSS is really gonna be the bigger alternative if that kind of thing keeps up.

[@corumuk67]

Interesting video, thanks. Hadn't heard of 3CX before to be honest. In those areas of the public sector I'm most familiar with we tend to use MS Teams for all calls/video conferencing these days.

[@nkamkar09]

What an informative video, as usual. Thank you. May I ask what the name of the graph program you are using is?

[@Volvith]

Thanks for this. I had an old (not used for 10+ months) installation of 3CX on my PC which i immediately removed. This is absolutely beyond unacceptable.

[@kazii_the_avali]

if you try to shift the blame you have instantly lost my respect. edit :changed trust to respect.

[@TheSpanjaMan]

I agree, but when talking about security, there's no one to trust. Not even AV companies that this channel advertises. Security is not about slapping on an AV and hoping it prevents what it prevents... Security is about limiting the OS in a manner that these types of attacks are almost non-existent.

[@kazii_the_avali]

@@TheSpanjaMan most defently true. that is where the rule of zero trust comes from. i do realise i ment respect and not trust tho so thank you for yhat XD

[@Johnithinuioian]

Although all the evidence you've meticulously gathered clearly points to me without any doubts whatsoever, it ain't me! Yeah. LOOK AT THIS GUY INSTEAD!

[@jonaskiauleikis1973]

Cyber Security Sauna, a podcast from Finland brings guests from F-Secure all the time. I never actually seen their products

[@andyspark5192]

They will be sued out of business. That was very much irresponsible behavior by 3cx. playing down, ignoring, turn away

[@swimfan6292]

sued by whom? sueing companies in the tech industry doesn't fair well for most

[@nicolasramirez5789]

@@swimfan6292 Didn't this affected companies like Pepsi?

[@Akamo.]

@@nicolasramirez5789 Pepsi 100% has the means to sue if they were affected.

[@ernies8828]

All be design when you let bad communist/socialist leaders indoctrinate, steal and deceive. Looking at the public school systems should wake you up. It is all a web. We need the true president, Donald Trump, and better more solid strong American leaders back. These self centered communist socialist leaders like Biden, Obama, Clinton and Harris, and any Congress and educators who go along with them, are why we have the bad policies and failing country right now. The evidence is clear. Corporations are the same in this way.

[@767corp]

ROFLMAO it's not like they put this crap in their own software, they been hacked and 3rd party put malware in, he said it in video , it's like you are gonna sue fire cuz your property burned down , WTF you talking about. They prob gonna loose lot of business cuz their reputation is crushed now but only one you can sue is ppls who hacked malware into it and good luck finding out who it was

[@canadaplease7981]

What is the program you were using to see the graph of what the program is doing?

[@LouisSerieusement]

cool you finally did a video on 3CX ! Thanks :)

[@blissbyrne]

Not the first time nor the last - supply chain attacks are becoming more frequent . Kaseaya, Solar winds,.....there will be many more.

[@Symbian2704]

Whats the name of the software used to inspect the .msi file in the video at 3:26?

[@rellaxshala4189]

What tool is used for graph view at 5:58? Does someone has an idea?

[@keyb1nd]

Great video, what is the name of the tool you used to generate the graph from the MSI ?

[@ardwetha]

I am surprised, that Microsoft/Windows Defender picked it up so fast.

[@SpaceCadet4Jesus]

Finally, Microsoft at the forefront! Forefront of what exactly I don't know, but they did show up. 😄

[@berndeckenfels]

Do we know if the ffmpeg hacked DLL was procured by them in a pre-compromised version or if their built system was compromised and modifies the DLL.

[@leepiper4621]

Too many vulnerabilities w common apps. Nuts

[@fab_81]

Switch to linux and you won't have problems my friend. You'll leave the comfort zone but for a better place.

[@ReligionAndMaterialismDebunked]

​@@fab_81 not true. Linux still has problems with the OS, apps, etc. I use Linux. You're spreading a myth that Linux is safe, like Mac and iPhone users love to spread myths that they're safe. Linux has antivirus, rootkit hunters, etc. Linux is targeted more lately, since it's not focused on much and most servers run on Linux. The most popular smartphone is Droid, my favourite, and it's Linux-based. Smartphones still get malware and such. Plus, Linux doesn't have much capability with gaming since Windows is the designated OS for gaming and even Ubuntu Linux doesn't have too good of drivers. Wine may leave vulnerabilities by making some Windows stuff work on Linux. Not much works with it, and plenty of issues with apps using it. Most games made for Windows will lag on it. I've never used it though. There is another app to make some Windows stuff work better on Linux, but it costs hundreds of dollars to use, and you might as well just have bought a Windows license. Windows 11 is quite secure, sleek, etc. Malware just needs to be written to not have the code known, and it's good. It can also have encrypted code. Other ways to go about it too. Just be more responsible when you use an OS online, around people, and with whatever you put into it from another device. (;

[@ReligionAndMaterialismDebunked]

Stay up-to-date with patches, and be more careful, or just don't use smartphones, computers, and tablets then, I guess.

[@ReligionAndMaterialismDebunked]

​@@BorisJohnsonMayor beat me to it. Hehe. You got more likes too. I was just writing a longer comment. XD

[@ReligionAndMaterialismDebunked]

Just beat it! Haha 😂😂💀MJ. :3 🔥🤝 Astral Realms 💀👻 🔥 FH RIP. Scandal debunked and many misuse the p-word too. Hehe

[@donaldseder3057]

What's that map that you used to show what the file does and what's inside it?

[@surenderarora1899]

Explained very well, thanks a lot!

[@sendlocation8476]

@ THE PC SECURITY CHANNEL Do you know how I can have my VMware guest to have internet access but be isolated from the host so there is no vm escape? What would I need and need to do?

[@Humle85]

Great run through, whats the name of the graph disassemble software you are using at 3:20?

[@saidjuma1433]

Same I want to know as well

[@fabianclifford2681]

Yes i wanna know to

[@Humle85]

Found it, it's VirusTotal Graph

[@simkoo2000]

Whats that analysis program to Show Whats a program does?

[@toitoitoy]

Good job, nice and easy explanation

[@xiao-pengjonathan7013]

Would anyone happen to know the name of the software used to pull apart the executable at 4:15 ? Thanks, and great video. :)

[@MattStevens9824]

@The PC Security Channel Thank you for the very helpful and educational posts! Can I request something for a future post? Because a lot of people are training Ai and installing these locally in their machines for training, can you please explore the possible risks or any trending, suspicious behavior your security contacts noticed with these codes running in the background? Thank you very much!

[@toquita3D]

Would be interesting to analyze their Linux binary as well.

[@richardh9071]

Careful! You could trigger the deluded linux fan boys screaming 'linux can't get malware!' with that suggestion :)

[@ymca225]

May I know where do you find out about news like this? I would like to keep myself informed to stay safe.

[@realandrewhatfield]

Is that history of detection events an Enterprise only feature?

[@SB-qm5wg]

Well thought through plan

[@bartwaggoner2000]

Thank you for this!

[@hander9929]

everyday i learn something thanks bro

[@IndyColts1987]

I am shocked at the amount of comments from people saying they've never heard of 3CX before.

[@georgesherpa]

Thank you for the explanation

[@trashcanmucous5153]

will malware bytes pick up any of this?

[@andrewdunbar828]

An important news with an interesting information about a popular software.

[@stevea1708]

Our company had to uninstall it like crazy fast. It's interesting that this video explains what actually happened.

[@ORIOLESFan02]

This feels like the Audacity/ClassicShell hack all over again. At least this one didn't overwrite our MBR

[@young-ceo]

3:18 which software do you use to see this?

[@MichaelToub]

Great Video!!

[@imyoubutbetter9951]

i wanna go into cybersecurity but don't know where to start, what programming language should i start with etc can someone help me?

[@danwake4431]

a couple questions. Crowdstrike and SentinalOne. Never heard of those. Are those available to users or are they not made for desktops? How soon did Windows Defender detect it compared to 3rd party AV?

[@IndyColts1987]

those are enterprise EDR/antivirus agents installed on (typically) business hardware by MSPs.

[@Ihyabond009]

1:48 Customer: Bro...your app got hacked App dev: Nope, you are nitpicking and biased. I win, bye bye

[@ShawnKavanagh]

"We'll die with pride, right?"

[@BernhardErnst]

At least 3CX had a way to be contacted. Many companies try to get customers to only look at some ancient and very general FAQ's. Many companies do not list any contact details on their website.

[@TOTFAHRER]

Is that a freaking dunkey reference?

[@vincei4252]

Wonder whether they word "bigot" got tossed out liberally as they were banning their customers complaining about malware.

[@realabusivedad]

@@vincei4252 ea support but without malware

[@broli123]

What's that cool graph tool you used to dissect that executable? Looks kind of awesome did you every do a video on that alone?

It's VirusTotal.

[@Appoxo]

You need a login for virustotal and at the top of the page is the tool

[@ryanmohamad6316]

can you help me to fix my Windows security, my windows security wouldn't appear, and just a blank screen when I click it it cause viruses from Ocean of Games

[@stephenxs8354]

Are there any open source control software that you can purposely install to be able to control a system that you own? I want it running in background like like malware would but it reports to my own server.

[@FreakyPlay709]

Guacamole could be something for u

[@randomnickify]

Open source...something everyone could edit to inject some malicious code there? Brilliant idea!😂

[@nocoz112]

​@@randomnickify yeah, something that anyone could inject with malicious code, but when detected - could be traced back with ease, as soon as it gets suspicious, and there would be no blame shifting or stalling, yea, that open source

[@Johnithinuioian]

@@nocoz112 I know you're trying to be sarcastic and all, but it's not as easy as it looks.

[@nocoz112]

@@Johnithinuioian but closed-source vs open-source, when shit hits the fan - which one is better? obviously both have pros and cons but come on, if there's a breach in closed-source, you literally can do nothing about it, and as the video showed - it can even work against you

[@SriHarshaChilakapati]

Thanks for the video Leo. When I first saw you showing the .msi file and having a ffmpeg.dll right beside it, even though I recognized this to be a DLL injection attack, I didn't think that .msi file itself is hacked since the signatures are matching. Maybe someone downloaded from a different place which included hacked ffmpeg.dll file in the archive (probably a torrent) and then when people launched it immediately after installation from within installer (like launch the program checkbox checked on the finish page) and since it launched from the current directory with wrong path, this injection has happened and it infected immediately. If that is the case, then it is a bug inside the official .msi installer itself for not launching the program from the correct directory. But if that is not the case, then I wonder how did the signatures match with the original. Is it the case that their devops build systems were breached?

[@int_pro]

Do you recommend Crowd Strike?

[@rogerramjet6429]

As someone that has worked on windows systems since win 3.1, I've stopped using antivirus software since 2008. Had far to many times where false positives were quarantined then the OS starts writing errors and becomes a problem itself. Since I've stopped, I haven't had to do another full reinstall of any OS and two laptops are still running xp sp2 as my media system. Difference is I grasp the ways of internet infections and use that to prevent infections. Only two times I had to do a fresh install was due to idiots on my computers, clicking links for a free scan. I also us p2p and AV has caused immense loss of data due to false positives. Currently running, win 7, win 8.1 x64, 10 and Linux, on different systems. Currently there's a large number of society keeping AV companies running, and McAfee isn't the only company that developed viruses to justify updates that have subroutines that effectively act like trojans or data collection. Takes me 4.5 days on average to set up a phone these days because I fully customise and I'm a rare breed in the respect that I read every single EULA, plus research new processes. Most people are to damned dumb and just click yes to install, then wonder why they're getting problems. That's uf they recognise they even have problems.

[@braaitongs]

How to remove this malware after it has infected ones pc?

[@honahwikeepa2115]

Thanks for that. Shared.

[@treyquattro]

it would have been good if you could go into the signing issue more in depth. It sounds like you're saying the actual app executable is signed with 3CX's certificate, but the entire MSI bundle is not signed. Obviously a wide attack surface if this is the case.

[@MedicalStudentChannel]

hello, I am studying computer sciences to make a Master in cybersecurity. My laptop (Hp envy 14" model 2020) Windows 11 Pro, 8Gb RAM and 512 Gb storage, i5-1135g7 I wounder is it bad with my laptop specs if I lunch 2 Virtual machines at the same time , one for Kali and another for windows lab test ? for your info while I study/read on Edge the laptop fan is almost always off because the laptop is cold. Thank you in advance

[@dvuemedia]

The more RAM the better, 8GB is not enough anymore, 16GB RAM minimum. More cpu cores would be better also, your cpu has 8 cores.

[@MedicalStudentChannel]

@@dvuemedia Yeah your right more RAM is better but what happen if I run low on RAM, and I have 10Gb virtual Ram from Nvme ssd, does it make it better ?

[@dvuemedia]

@@MedicalStudentChannelNVMe will help, but is not a substitute. RAM has lower latency. Remember, You want to run 3 OS on your laptop at the same time, each OS need RAM to operate. Linux with low RAM could be fine, but Windows 11, probably not.

[@MedicalStudentChannel]

@@dvuemedia thank you for your time, I understand now

[@njpme]

Need more RAM

[@ConnorN97]

I think I asked this before, what is this software called? It seems interesting

[@TheSuthern101]

No mention that this is an electron app? Or how the attackers modified the dll that 3cx uses? :-/

[@levyroth]

I'm not even surprised that NHS was on that list 😢

[@ghostakatactu]

3:39 what is that app called?

[@ThanhTienOfficial11020]

Hello sir, I hope you can do a test video about Emsisoft anti-malware software, I haven't seen you do this software for a long time, about 5-6 years ago you did it, but it's old.

[@Foxconnpc]

Bro, can you test Dr Web, please? As a Siberian, I have lost access to my favorite Antiviruses from the west and have to depend on Russian software (Such as Kasper and Dr Web) . But Kasper is using this as a bussiness opportunity and cranked the price up. By the way, I have been using Panda Antivirus for many years, is it even good? I never depend on AV to protect my pc, but it would be nice to know.

[@ZipplyZane]

I wouldn't expect a standard antivirus to detect it right away. But I would think that a newly updated program accessing URLs it isn't supposed to would result in a block.

[@A42yearoldARAB]

That is what I am wondering, Kaspersky and Bitdefender did not detect it at firs, but their firewalls 'should' have blocked the url.

[@guilherme5094]

👍Thanks!

[@belialarchitect1678]

At 8:04 as he scrolls down the list, there was a antivirus that detected it right from the start 1 / 59, I wonder which program it was.

[@danwake4431]

I'm guessing it wasn't F-Secure :) :)

[@Blood-PawWerewolf]

This is pretty much SolarWinds 2.0

[@berndeckenfels]

Only with much worse information politics. No analysis available and stupid recommendation to delete the software instead of providing a clean update.

[@fltfathin]

@@berndeckenfels which icks me because it can be dll swap

[@oldschoolyoutube2773]

Hi can you please do a test with Spybot - search and destroy and see if it’s any good against finding malware and other viruses

[@jraymundotunortiz9138]

Is there a way to request a video of a certain program? 👀 I was looking into my files to free up some space and I saw an Antivirus installer that I have never installed.......

[@jraymundotunortiz9138]

Correction: "an Antivirus installer that I have never downloaded before."

[@700gsteak]

You only need one antivirus running at a time so if youre already using one you can delete the other.

[@DevilbyMoonlight]

this will keep happening over and over

[@comoyun]

The sponsor part was so fit tho

[@nemea6698]

What is the name of that software that shows us the msi file from within?

[@SpaceCadet4Jesus]

It's a Virustotal graph.

[@AlicesWondereland]

Yikes! I had to use 3CX for a temp system (hosted in-house with physical phones) for a couple weeks before we got a permanent phone system. 3CX had to be the worst system I've ever used. The second the new system went live, I deleted to 3CX server from the data store without even shutting it down.

[@georgecybergringo1180]

What about vitualbox the hackers use to hack and delete files?

[@daan1565]

The more I watch your channel the more paranoid I get

[@macky10229]

What’s the current status of the app? Its been cleaned from threats?

[@_Blacklagoon_]

I've never ever heard about this 3CX

[@comgreed]

Thank got I didn't do any updates and the auto-updater didn't work. I was still using an old version that wasn't infected.

[@700gsteak]

Yea this is a good reason to not use auto update and defer the update until you can do it manually later on. If you keep the installer you can do a rollback too

[@tonysolar284]

I used 3cx with Asterisk way before these major corps used it. It has not changed much since.

[@HanSDevX]

None of the businesses I work at don't use 3CX fortunately.

[@Store4PGM]

can you try eset antivirus and see if it can remove the malware right after installing the app ?

[@SpaceCadet4Jesus]

Likely flags it on download.

[@williamshenk7940]

Excellnet videos and tutorial contents.

[@DaxHyena]

what is the graph software at 3:45

[@kiyu3229]

That's the pro(I'm not sure if it's the pro) version of virus total

[@SpaceCadet4Jesus]

Paid version.

[@techie7702]

When was this installer infected? I have been using this App for years?

[@katrinabryce]

On or before 22 March this year.

[@techie7702]

@@katrinabryce Thanks, I wasn't sure if that was the first version that was affected. Checked my installer, it's over 10 years old!

[@downundarob]

Only on businesses that had upgraded to V18, some are still on v16.

[@nathanboyd2604]

Only on Businesses that upgraded to the very latest version of V18, Update 7, which had only been available for like a week. This was caught pretty early in the scheme of things.

[@aonoloki]

Side note: Is it the F-Secure that rebranded to W-Secure recently ? Bug my mind

[@kf4hzu]

Yes for their business products they rebranded them to WithSecure but the consumer ones are still F-Secure.

[@ForbiddenUser403]

This is why users are never given local admin rights.

[@katrinabryce]

As far as I can see, this would still cause problems even when running as local user rights, because the local user has access to their browser cookie store etc.

[@DFPercush]

@@katrinabryce It really illustrates a major flaw in the fundamental concepts of computer security when these operating systems were being designed. Why are all privileges based on the current user? A chat client doesn't need to look at my browser history, the browser especially doesn't need access to sensitive parts of the system, etc. You really need mandatory access controls, something like SELinux, to keep stuff like this from happening. Android uses a very basic version of this for its permission system - it's certainly better than nothing.

[@iincognito96]

the wonders of proprietary close source software

[@Uranatis]

Whats the actual best free antivirus

[@johnshelley7826]

Slightly random question... Why don't ISPs get hacked?

[@berndeckenfels]

They get hacked just like anybody else (every now and then). Companies usually try to hide the fact, of course.

[@denissorn]

this is why we need to outsource and migrate everything to cloud and exclusively use services, serverless whatever newest cool tech to 'develop' (rather configure) 'our' products, and save customer data. Btw events like this are probably going to be used as an excuse to lock down hardware and operating systems even more, so only certain people can surveil and manage everyone. Options confuse people, create an illusion of choice.

[@RunicSigils]

Are you being sarcastic? If not, which one of those companies do you work for? Because there's no way you would think that unless you are getting money out of it. Digitizing and centralizing aren't the answer, they're the problem. Physical records are nearly impossible for random people online to get access to. Most data shouldn't be stored anywhere online at all. Post 2007 internet is cancer and so is everyone who joined since thanks to smart devices and wifi.

[@jairo8746]

Now imagine all of the other software that have been hacked and we don't know about.

[@bazcurtis178]

This shows why exclusions are so important and you should know what you are allowing. My AV is flagging a false positive, surely it is a false positive. I will just add an exclusion. You should always trust your AV vendor. Get on the phone to them and ask for help and get them a sample. You will get better help from them than you will from the people who have just encrypted all your files!!! Just because a vendor has an exclusion document, it doesn’t mean you need them. The Kaseya document basically excludes the attacked folder and file

[@didyouknowamazingfacts2790]

I don't get how the malware is able to bypass the windows antivirus and other antivirus on the systems.

[@prowler1567]

If I'm a business, bye bye 3CX. Start cleaning your machines.

[@tacticalcenter8658]

What government, organization, oligarch, ngo or business is behind this?

[@Sc0ttPrian]

I assume once the exploit is discovered, virus detecting software..... adds that to the list of things to check?

[@berndeckenfels]

Yes but still only half of the VT engines recognize it. It is probably less for derived (different) installers using the same chain.

[@rickysgamingworld9952]

Quick Heal 💪💪💪💪