techniques to evade 3CX blacklist

[Jose Lara]

The maximum number of attempts allowed by this PBX is 2, the attacker is waiting 10 minutes between each attempt and thus avoids being blacklisted.
It is certain that cybercriminals are learning how the system works and are implementing evasion techniques to try to gain access`.

 

[SteveITS]

There were other threads earlier this year I believe it was…the count/setting in the console is for SIP not the management console. Per 3CX the management console is supposed to be fixed at 10 failures. Obviously still not enough to block that IP.

 

[cobaltit]

The maximum number of attempts allowed by this PBX is 2, the attacker is waiting 10 minutes between each attempt and thus avoids being blacklisted.
It is certain that cybercriminals are learning how the system works and are implementing evasion techniques to try to gain access`.
View attachment 34999

Does this surprise you? The entirety of security, be it physical or cybersecurity is about moves and countermoves. This was happening long before 3CX and is nothing new. 3CX won't acknowledge or disclose how their blacklist works but I imagine they get that information as well and factor it in. You can always manually block it yourself or lookup the abuse contact for that ISP/netblock and reach out to them if so inclined. Also, this really isn't related to the supply chain attack so lets keep this section clean for so information pertaining to it does not get lost in the clutter.

 

[SWS RWU]

There is a significant difference to older attacks seen at my aws servers.

Most login attemps were random endpoint numbers and passwords.

Joses logs shown are logins to the admin console. The Passwords looking like a list of more or less valid passwords. (Maybe someone should tell intercel.eu and proztec qatar they have been pwned and they likely should review their compliance policies on password strength)

My Logs often shows logins agains sip with bruteforced passwords.

Havent seen a log like Joses before. Anyone else did?

A very normal logfile while hosting @ AWS

 

[ascoial]

Hello guys this file appeared yesterday what is it?
looks like a strange shortcut that leads too 3cx should i be worried?

 

[N_G]

This is not related to the supply chain attack and i already moved the threat

 

[ascoial]

This is not related to the supply chain attack and i already moved the threat

Thanks for the fast reply so its a normal file made from 3cx? Sorry im a noob