Hacked by extension with Receptionist permissions?

[qbitnetworking]

Hi all, this morning, one of the receptionists called (ext. 100 with receptionist permission) and said she could not make outgoing calls and that her voicemail pin was wrong. I logged in to the console and her extension still existed but the name and email had been deleted. The voicemail pin had been changed and "Disable External Calls" was selected. I checked the Audit Log and found this:

01/20/2025 2:32:12 PM 200 [site's correct IP address] Users Clear 100

Extension 200 is another receptionist with receptionist permission so shouldn't have the ability to make changes to other extensions. I also checked the activity log and its just blank like its disabled. No matter what log level I set it to. So this is either a bug or some kind of security breach and I'm not sure how to proceed.

 

[Alphabetic]

Receptionist role gives the user the ability to assign and clear from the "Team" view.. I wonder if they got curious and pressed it to see what happened.

 

[leejor]

It would be counter productive for the hacker if they disabled external calls as that is usually one of the goals, when attempting to infiltrate a PBX.. I'm assuming that the extensions involved do not have easy to guess passwords.

 

[qbitnetworking]

Receptionist role gives the user the ability to assign and clear from the "Team" view.. I wonder if they got curious and pressed it to see what happened.

Oh interesting. What is the point of the clear button?

 

[Alphabetic]

Oh interesting. What is the point of the clear button?

Set up for a new user. Imagine a new guest at a hotel room for example.

 

[qbitnetworking]

It would be counter productive for the hacker if they disabled external calls as that is usually one of the goals, when attempting to infiltrate a PBX.. I'm assuming that the extensions involved do not have easy to guess passwords.

Yeah, true. It was ChatGPT that had me thinking it was possibly due to a compromise.

 

[qbitnetworking]

Set up for a new user. Imagine a new guest at a hotel room for example.

IIRC I had to set everyone as a receptionist with the advent of v20 in order for them all to continue using call parking. Now not sure what to do to prevent this in the future.

 

[SteveITS]

Call parking is available to User as of update 2 or sometime around then: https://www.3cx.com/docs/manual/access-roles/

 

[qbitnetworking]

Call parking is available to User as of update 2 or sometime around then: https://www.3cx.com/docs/manual/access-roles/

Awesome thank you for pointing that out.

 

[qbitnetworking]

The person behind ext. 200 (the extension I thought was compromised) just called and said her voicemail pin was changed as well. Strange.

 

[SteveITS]

FWIW the menu option exists to let me Clear my own extension...didn't click it though.

 

[NicholasP_3CX]

Yeah, true. It was ChatGPT that had me thinking it was possibly due to a compromise.

Thats why AI will never take over. There is hope for humanity still.

 

[qbitnetworking]

This just happened again... A user's extension name was blanked out and the "Disable External Calls" setting was enabled. Voicemail pin was also reset.

Once again, the Audit Log says:

02/07/2025 9:56:02 AM 200 [IP Address] Users Clear 302

I called the user at Extension 200 and she had no idea the clear feature existed.

Is there a way to disable this clear feature for users with Receptionist ability?

 

[Alphabetic]

Youre gonna have to turn your logging to verbose and wait for the next instance.

 

[NicholasP_3CX]

This just happened again... A user's extension name was blanked out and the "Disable External Calls" setting was enabled. Voicemail pin was also reset.

Once again, the Audit Log says:

02/07/2025 9:56:02 AM 200 [IP Address] Users Clear 302

I called the user at Extension 200 and she had no idea the clear feature existed.

Is there a way to disable this clear feature for users with Receptionist ability?

That feature is there SPECIFICALLY for receptionists. As mentioned above, think of a hotel environment where a receptionist checks guests in and out.

So I dont think this would be feasible to disable it for receptionists....

 

[SteveITS]

At one point in life it seemed like a few times per year we had a client call to restore a missing folder that they accidentally dragged into another folder. Misclicks happen (and/or people don't like to admit errors). And upon reflection this has been less frequent...perhaps as a species we are getting better at using a mouse.

@qbitnetworking Why is this person set to Receptionist? Perhaps there is a way to remove that role.