my self hosted instance Hacked(?)

[leasetech]

Hello, today in one installation of a client, self-hosted on amazon lightsail, I realized that calls started happening from an inactive extension (check ext 28)




It is obvious that 28 is enabled but in the next screen you can see that no phone device is registered to 28



Despite the ext 28 has checked the "Block remote phones using stun (Insecure!)" and despite i changed the (really) hard password, the extension continues to be registered. I blocked all calls and now calls stopped.

Any ideas on this?

 

[HRMNY]

Looks like you have insecure passwords set for the remaining extensions. I would highly recommend doing a regenerate for every remaining extension.

Selecting block remote phone will not prevent someone from using the 3CX app or webclient. You need to do that separately.

 

[SteveITS]

also, re: regenerate, changing the password does not disconnect the desktop app or mobile client.

 

[SweetAction]

also, re: regenerate, changing the password does not disconnect the desktop app or mobile client.

It should, almost instantly too.

That is if you use the box for regenerating the QR code in regenerate.

 

[SteveITS]

It should, almost instantly too.

That is if you use the box for regenerating the QR code in regenerate.

I was suggesting regenerate, not just changing passwords as OP mentioned. Sorry if I wasn’t clear.

Ref: Post in thread 'Disable Extension'
https://www.3cx.com/community/threads/disable-extension.79188/post-364333

 

[SweetAction]

I was suggesting regenerate, not just changing passwords as OP mentioned. Sorry if I wasn’t clear.

Ref: Post in thread 'Disable Extension'
https://www.3cx.com/community/threads/disable-extension.79188/post-364333

My bad, I misunderstood. Thanks for clearing that up.

 

[Alphabetic]

Having "Ring my mobile simultaneously" enabled will put this in to available state.

 

[SteveITS]

@SweetAction no worries, I was answering quickly using a phone to reply while doing something else.

"Changing the password doesn't disconnect hackers" is not an intuitive "feature." M365 kind of has that, but one can "block sign-ins" then change the password to kick out the hacker.

It might be good for 3CX to show a warning/reminder to clear/regenerate when changing an extension's password. And if "Regenerate provisioning file & QR Code for 3CX Apps" defaults to unchecked in a dialog that talks about securing the extension after compromise, that is not intuitive either. Perhaps name it "Regenerate provisioning file & QR Code for 3CX Apps (disconnect existing apps)."