3CX: How this malware almost hacked every business

3CX: A popular phone system software for VOIP was hit by a supply chain attack, with the original source serving malware infected installers.

[RawPikachu]

I just imagined scam call centers being affected by this

[vaakdemandante]

The 3CX response is somewhat typical of many businesses in general. It just shows, that making business is mostly about getting paid and avoiding as many responsibilities as possible.

It's not just about being hacked. It's about everything that is remotely tied to bearing costs, that eat away at the profit margin. Do as little as possible but get as much money as possible.

This isn't bad per se, but it often is, because businesses then try to ignore important issues like waste and environmental pollution, they hide internal data, sell customers data, do away with proper security etc. The list just goes on and on. It's true both for small and big business, the difference being the big business has a lot more capital to layer their way out of responsibility.

And if you are an honest business that cares about its customers your costs are so high compared to the unscrupulous businesses, that you go out of business very quickly. The state has become so corrupted through lobbing that it's too weak or uninterested in leveling the playing field for businesses and holding them accountable to laws that are already in place.

[npsit]

It's particularly frustrating when security professionals know this software is doing something malicious but the company where the file is hosted refuses to even look into the problem.

[kariossyr]

This figure us becoming common day after another, which means companies are feeling safe from people's reaction since long violation of their privacy caused them not to care any more.

[LudicrousAvian]

I hope 3CX gets sued to oblivion. This is absolutely unacceptable behavior from a company that mass-distributes corporate software 😑

[TheCocoaDaddy]

Excellent video!!! This video gave me an idea for possible future PC Security Channel video: Maybe do a "top 10 most sophisticated malware threats" video, where you highlight the malware threats with the most sophisticated techniques for avoiding detection, etc. What you presented here is very impressive and I can only imagine, the bad actors will improve, especially with AI helping out. Thanks for posting!

[nkamkar]

What an informative video, as usual. Thank you. May I ask what the name of the graph program you are using is?

[MaxSpec]

That really shows that even with words from the companies, that isn't gonna stop malicious actors from hijacking you. Hence why FOSS is really gonna be the bigger alternative if that kind of thing keeps up.

[malwaretestingfan]

The "fun" part is that the threat actors used a 10 year old Windows certificate evaluation bug (CVE-2013-3900) for this supply chain attack, which has not been patched out of existence yet.

[Volvith]

Thanks for this.
I had an old (not used for 10+ months) installation of 3CX on my PC which i immediately removed.
This is absolutely beyond unacceptable.

[Humle]

Great run through, whats the name of the graph disassemble software you are using at 3:20?

[corumuk]

Interesting video, thanks. Hadn't heard of 3CX before to be honest. In those areas of the public sector I'm most familiar with we tend to use MS Teams for all calls/video conferencing these days.

[rebootfactory]

Thanks Leo! As usual, very informative and a great breakdown of the key facts. Thanks for what you do!

[jonaskiauleikis]

Cyber Security Sauna, a podcast from Finland brings guests from F-Secure all the time. I never actually seen their products

[Symbian]

Whats the name of the software used to inspect the .msi file in the video at 3:26?

[IndyColts]

I am shocked at the amount of comments from people saying they've never heard of 3CX before.

[blissbyrne]

Not the first time nor the last - supply chain attacks are becoming more frequent . Kaseaya, Solar will be many more.

[ORIOLESFan]

This feels like the Audacity/ClassicShell hack all over again. At least this one didn't overwrite our MBR

[kazii_the_avali]

if you try to shift the blame you have instantly lost my respect.
edit :changed trust to respect.

[toquitad]

Would be interesting to analyze their Linux binary as well.