Many users followed our advice to deploy our PWA web app mode instead of our Desktop App during the attack. Following this, we learned more about deploying in this mode. I wanted to share some of the things we’ve seen and give some background and suggestions on which is the best to use according to the situation. The PWA (Progressive Web App) app What is a PWA app? PWA stands f [...]
Initial Results from Mandiant Incident Response Following the appointment of Mandiant as our security incident response team, forensic analysis on our network and product is in progress. In a nutshell, the interim assessment concluded: Attribution Based on the Mandiant investigation into the 3CX intrusion and supply chain attack thus far, they attribute the activity to a cluste [...]
When Actions Speak Louder than Words! We’ve faced a massive security attack head on! As too have you - our Partners, our product resellers, our extension of the 3CX brand. And yet despite this, you’ve stood faithfully, shoulder to shoulder with 3CX - facing what we face. Your support has spoken louder than any words ever could. Now it’s our turn to reply. We hope our actions sp [...]
We regret to inform you that our company has become victim to an attack on our product and the larger supply chain. Our highest priority is to be transparent in sharing details on what actions we are taking in response to this incident and what we know to date. Information is rapidly unfolding in this ongoing investigation. We want to ensure we only share validated information [...]
The Desktop App can be uninstalled as explained below. On some Windows machines where antivirus software already deleted some of the files the uninstaller may fail. On Windows: Start Type “Control Panel”, Enter Select “Programs and Features” Find 3CX Desktop App, select and press “Uninstall”. On Mac: Go to “Applications” Tap on “3CX Desktop APP” Right click then “Move to Bin” Ensure that it [...]
I’ve seen many users going straight in and redeploying the Electron Apps without even considering the PWA or the Windows Legacy App. Although clearly we’re not in a position to anger anyone or make strong demands, it still remains our duty to warn you of the security risks the Electron Apps pose right now. The rebuilt Electron Windows App with the new certificate has been sent [...]
Google has invalidated our software security certificate. This means the MSI DesktopApp files that we released yesterday afternoon can no longer be downloaded via Google Chrome (nor can the originally infected MSI files). Furthermore several AV vendors are blocking any software signed with the old security certificate. We are now going to make new msi installers with a new certificate [...]
UPDATE: The list of Mac versions has been updated on 01/04 11AM UK time to reflect that one of them was shipped with Update 6.Early this morning we informed our partners and customers that our electron windows app shipped in Update 7, version numbers 18.12.407 & 18.12.416, included a severe security issue. We since learned that Electron Mac App version numbers 18.11.1213 shipped with Update 6 [...]
UPDATE: The list of Mac versions has been updated on 01/04 11AM UK time to reflect that one of them was shipped with Update 6. We regret to inform our partners and customers that our Electron Windows App shipped in Update 7, version numbers 18.12.407 & 18.12.416, includes a security issue. Anti Virus vendors have flagged the executable 3CXDesktopApp.exe and in many cases uninstalled it [...]
Since our first blog post we’ve made some important changes to the 4 SC FREE requirements and deadlines. We’ve also upgraded all 4 SC Standard Subscriptions to PRO - for free! On top of this we have an update regarding the end of the Affiliate level. Read on for more details. 4 SC Standards Upgraded to PRO The difference between a 4 SC Standard and a 4 SC FREE was literally not [...]