Solved HELP - security breach - FQDN resolves to wrong IP address

[andhoe99]

Since 2:18 am UTC+1 today, the DNS of our FQDN logicsXXXX.my3cx.de does not resolve to our IPv4 anymore, but to a IPv4 of a different company (not ours).

https://customer.3cx.com/prm/myinstances.aspx shows a Public IPv4 139.59.139.234 and Public IPv6 2a03:b0c0:3:d0::68a:6001 which do not belong to us. We do not have an IPv6.



Furthermore I can see this foreign instance has only 1 GB of memory and not 4 GB of memory as our VM has. We host 3CX in a VM in the data center at our company but still use the hosted FQDN of my3cx.de.
edit: Furthermore I've noticed the foreign machine has 20 GB disk, but ours has 60 GB disk space.

I can click restart services, reboot etc. on this foreign instance, and it doesn't affect our local VM.

Our local VM is invisible to the outside world now, because the DNS A and AAAA entries are set wrong within the DNS nameserver of my3cx.de

When I change my Windows Hosts file to point 80.81.xxx.yyy to our FQDN XXX.my3cx.de, I see that my network settings is as follows:


The IPs here are correct (they are ours).

The FQDN shown here are correct (it is ours).



The license information shown at https://logicsXXX.my3cx.de:5001/#/app/settings/license is correct, too. It is the same as shown within https://customer.3cx.com/prm/myinstances.aspx


The issue seems to be similar like https://www.3cx.com/community/threads/fqdn-problems-errors.55210/

Maybe this license key OO4Y-BOM.... has been assigned to two different 3cx instances: ours (80.81.xxxxx) and the foreign 139.59.139.234 ? Or maybe your DNS nameserver my3cx.de has an issue?

At 11:54 am UTC+1, we tried fixing it by setting network settings from static -> dynamic -> reboot VM -> static (see https://www.3cx.com/community/threads/fqdn-to-wrong-ip-after-testing.51632/ ) -> this fixed the DNS issue, but the IPs shown of the 3cx instance here are still wrong https://customer.3cx.com/prm/myinstances.aspx

Please help!

 

[florink]

Are you 100% sure you haven't deployed a Hosted by 3CX instance with the same key?

 

[andhoe99]

Are you 100% sure you haven't deployed a Hosted by 3CX instance with the same key?

Yes I am. And I don't know this strange IP address 139.59.139.234

By the way: As I described in my post, I could temporarily fix the DNS issue by switching from static to dynamic IP and back. But now since 12:34 UTC+1, without changing anything, the DNS is now wrong again:

see https://toolbox.googleapps.com/apps/dig/#A/

id 62791
opcode QUERY
rcode NOERROR
flags QR RD RA
;QUESTION
logicsXXX.my3cx.de. IN A
;ANSWER
logicsXXX.my3cx.de. 599 IN A 139.59.139.234
;AUTHORITY
;ADDITIONAL

edit, the NS entry is as follows: https://toolbox.googleapps.com/apps/dig/#NS/

id 60865
opcode QUERY
rcode NOERROR
flags QR RD RA
;QUESTION
logicsXXX.my3cx.de. IN NS
;ANSWER
;AUTHORITY
my3cx.de. 299 IN SOA ns-cloud-c1.googledomains.com. cloud-dns-hostmaster.google.com. 2 21600 3600 259200 300
;ADDITIONAL

 

[florink]

This happens only when two machines with 3CX installed are using the same key. I would contact 3CX directly: https://www.3cx.com/contact-form/

I suspect that when you got your license initially, you may have used PBX Express to install 3CX in the cloud and then you installed it locally. However the cloud instance was kept online. Now for whatever reason (maybe due to an update of the cloud instances) it took over the DNS records.

Personally I don't see any breach, just ask 3CX to delete that instance!

 

[andhoe99]

This happens only when two machines with 3CX installed are using the same key. I would contact 3CX directly: https://www.3cx.com/contact-form/

Thanks, I contacted them directly, using the License Key Assistance Ticket.

I suspect that when you got your license initially, you may have used PBX Express to install 3CX in the cloud and then you installed it locally. However the cloud instance was kept online. Now for whatever reason (maybe due to an update of the cloud instances) it took over the DNS records.

Personally I don't see any breach, just ask 3CX to delete that instance!

I have never created a cloud instance via PBX Express. I never connected any Google cloud/azure/etc. account with 3CX. Therefore I don't see why this foreign instance should be mine? I don't own 139.59.139.234 - and I didn't pay for it, I've never heard of it before.

And suddenly today - after several months of no problems - the DNS points to a different IP.

The foreign IP 139.59.139.234 is now receiving numerous requests from all our company's phones. The phones can't register there though. Vice versa on https://customer.3cx.com/prm/myinstances.aspx I see live CPU, memory etc. information of a foreign 3CX hosted instance - which I can even reboot etc. Therefore I do see a security breach.

 

[NikosT_3CX]

@andhoe99 I have checked and your machine is indeed Hosted by 3CX.
Please proceed with the following in order to contact directly the Cloud Team and fix this for you the soonest :

https://www.3cx.com/community/threads/delete-instance-hosted-by-3cx.75573/

 

[andhoe99]

@andhoe99 I have checked and your machine is indeed Hosted by 3CX.
Please proceed with the following in order to contact directly the Cloud Team and fix this for you the soonest :

https://www.3cx.com/community/threads/delete-instance-hosted-by-3cx.75573/

Thanks, I'll do it, and post an update here soon.

 

[NikosT_3CX]

@andhoe99 all done, your machine has been deleted and now as I can see your FQDN resolves to the correct ip address of your side.
If you still cant see this, make a clear cache of your DNS or check your FQDN with Google DNS.

 

[andhoe99]

@andhoe99 all done, your machine has been deleted and now as I can see your FQDN resolves to the correct ip address of your side.
If you still cant see this, make a clear cache of your DNS or check your FQDN with Google DNS.

Thanks, wow you're fast.

DNS is correct.

For the first time today, at https://customer.3cx.com/prm/mykeydetails.aspx I can see the correct information now, too: FQDN IP: 80.81.xxx.yyy - nice!

At https://customer.3cx.com/prm/myinstances.aspx I can still see the foreign instance 139.59.139.234:

 

[NikosT_3CX]

@andhoe99 nooo problem at all

Now about "my instances" section, give it some time to update or trigger an event like a restart of your services now that the hosted was deleted, in order the ip address to change ip address.

 

[andhoe99]

@andhoe99 nooo problem at all

Now about "my instances" section, give it some time to update or trigger an event like a restart of your services now that the hosted was deleted, in order the ip address to change ip address.

Awesome, yes. I tried rebooting the my3cx-hosted-machine, see

- but you had already been shut down it correctly.

Shortly thereafter I saw

You have currently no managed installations. Get started today!

The Instance Manager allows you to monitor your 3CX installations. To activate it, login to your Management Console and navigate to the Settings option. Click on "Instance Manager" and activate it. Shortly afterwards your instance(s) will appear here.

Then we activated the instance manager on our on-premise-machine. Now we see it, with our correct IP-address.



Everything fine now, wow, thanks for your great and super fast support.