Crowdstrike Endpoint Security Detection re 3CX Desktop App

[Evolute IT]

Forgot @pj3cx

 

[Nick W]

MsiExec.exe /X {EFC8D3F7-8A56-430E-93D3-C7AF626123CB} should do the job

If the GUID is incorrect, you can find it on a sample machine by looking in the registry - this should point you in the right direction -

https://www.advancedinstaller.com/msi-retrieve-productcode.html

If you are using RMM or whatever, this will work as well.

$app = Get-WmiObject -Class Win32_Product | Where-Object {
$_.Name -match "3CX Desktop App"
}
$app.Uninstall()

That said, I am waiting until there is something official out from 3CX. Which I hope is soon.

 

[infused]

I only have one user with the client installed and it appears to have been dormant (or he was using the web client version) till this afternoon at 13:52GMT which is when it all went a little crazy. Thankfully no other users have the client installed so it's had a low impact for us.

I should say it was the AI that got it. So if you don;t have that turned on, you wouldn't have caught it.

 

[Michael Menor]

From my 3CX rep:
Yes, we are aware and the 3CX Desktop Application Virus Vulnerability has been reported. Please open a support ticket and in the meantime please just use the web client.

From 3CX Support:
Just so you know, the issue reported is due to some virus scanners picking up the desktop app as a virus for some reason. We are looking into this and will get back to you as soon as we have further information.

 

[mcsphones]

3CX should probably make a public (or at least a forum) posting about this soon, at least to allay some fears from the community.

 

[Microland]

3CX should probably make a public (or at least a forum) posting about this soon, at least to allay some fears from the community.

Agreed, I just called them about that and they said that they don't have enough evidice about what is actually happening to make an announcement. But they said they have their security expert actively working on this and will post something once they know what's going on.

 

[mboucher_rcr]

Sophos MDR just issued this:

// Overview 
Leveraging open-source intelligence, MDR Operations has observed the popular Voice Over Internet Protocol (VOIP) client, 3CXDesktop, being actively used in an ongoing campaign.

The software is a digitally signed and trojanized version of the softphone desktop client for both Windows and MacOS. The most common post-exploitation activity observed to date is the spawning of an interactive command shell.

Some security researchers suspect this activity to be state sponsored, however we cannot verify this attribution with high confidence at this time.


// What you should do 
Stay alert for communication from 3CX either directly or on their forum
https://www.3cx.com/community/forums/webrtc-webclient/
Identify systems running 3CXDesktopApp.exe process and document the version, hash, and last update date time. It has been reported that the impacted versions are 18.12.407 and 18.12.416 for Windows and 18.11.1213 for MacOS. Typical installation paths include:
*\ProgramData\3CXPhone (Windows)
*\AppData\Local\Programs\3CXDesktopApp (Windows)
/Applications/3CX Desktop App.app (MacOS)

In the event any suspicious activity is observed from these hosts, consider network isolation until detailed vendor guidance from 3CX has been issued

 

[Gwish]

Uninstalling is proving difficult because the application installs in the appdata folder, which doesn't work with the PowerShell uninstall method.

 

[Nick W]

The MSIEXEC Method wont work either in /qn mode

 

[Danvarii]

You can use this to uninstall:

https://www.reddit.com/r/msp/comments/125sxuo/_/je6kugc

 

[Dupablada]

S1 ai module actually picked this up a few days ago. We thought it was a false positive.

Same here. Busy undoing all the exclusions we put in place at the moment.

 

[N_G]

Unfortunately the rumors are true. Please uninstall the client. And we will have a new one in the next few hours via updates.

The updating probably wont work because Windows Defender will flag it.

Unfortunately this happened because of an upstream library we use became infected.

 

[akissick]

Unfortunately the rumors are true. Please uninstall the client. And we will have a new one in the next few hours via updates.

The updating probably wont work because Windows Defender will flag it.

Unfortunately this happened because of an upstream library we use became infected.

Hi Nick, Thanks for the update. One of the infected versions it seems was the Jabra SDK version. Do you know if the updates will provide a clean version with the Jabra SDK? Thanks : )

 

[N_G]

Jabra SDK works with PWA too, no problem.....

But yes new MSI will have jabra API support