Hacked 3cx

[Mike-2408]

I have found out that my 3cx user account was hacked, and 200usd bills were added to my account.

I am using the latest 3cx software and GSM SIP

Please advise how that could happen?

 

[florink]

Well, the most common reason this happens is due to weak or leaked credentials.

You might find the following helpful:
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-1/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-2/
https://www.3cx.com/docs/voip-security/

 

[Mike-2408]

Thats I will go through, but how they found my domain to access my user account i understand weak passwords and user id but it is a new account i haven't shared the domain with anyone!!!

 

[florink]

There's a few things to be noted here:

a) A domain can be easily found even without sharing it
b) A hacker does not need to know your domain in order to attempt to connect to your PBX
c) As soon as a server goes online it can be immediately detected by scanners/bots that scan the internet (ip ranges). If a server is listening publicly for traffic then it will start receiving (malicious) requests in a matter of minutes

That is why it is important to setup your system in a secure way so that it does not allow access to third parties.

 

[leejor]

Many (most?) hack attempts, be that a registration attempt, or a Direct SIP call, will make use of your public IP and not your FQDN. They just scan IP addresses sequentially. You can confirm this in the 3CX Activity Log. If you can find a log of a hack, it will also show how they were able to make a call, what extension they used, etc..