Toggle sidebar Toggle sidebar

Threat alerts from SentinelOne for desktop update initiated from desktop client

Status
Not open for further replies.
glipschitz_summit said:
Looks like the update touches LOTS of files and directories.....


/var/lib# find 3cxpbx/ -newermt "2023-03-26 14:00:00" -not -newermt "2023-03-26 15:00:00+1"

3cxpbx/
3cxpbx/Instance1/Data/Ivr/Prompts
3cxpbx/Instance1/Data/Ivr/Prompts/Sets/8210986B-9412-497f-AD77-3A554F4A9BDB
3cxpbx/Instance1/Data/Ivr/Prompts/Sets/8210986B-9412-497f-AD77-3A554F4A9BDB/time
3cxpbx/Instance1/Data/Ivr/Prompts/Sets/8210986B-9412-497f-AD77-3A554F4A9BDB/numbers
3cxpbx/Instance1/Data/Ivr/Prompts/Hotel
3cxpbx/Instance1/Data/Http/Reports
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyExtensionStatisticReport_2603_zm70L3huk6rJbLLsaBDQ.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyQueueAnsweredcallsbywaittimeReport_2603_z8LZwDG5XfY002bZJcGY.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyRingGroupStatisticsReport_2603_rLbyA8ahxOwILaNl2SZr.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyQueuePerformanceReport_2603_G0iZ9j5mMubKHO3gCvfr.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyAbandonedQueueCalls_2603_6ENUYU0LR3SoJytseVUQ.html
3cxpbx/Instance1/Data/Http/Reports/Logo
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyDetailedQueueStatisticsReport_2603_rJWYZXcdcxF58ewFfgc6.html
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/fanvil_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/yealink_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/snom_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/aastra_phonebook.csv
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/gigaset_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/gs_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/cisco_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/000000000000-directory.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/logo
3cxpbx/Instance1/Data/Http/Interface/MyPhone
3cxpbx/Instance1/Data/Http/Templates/provider
3cxpbx/Instance1/Data/Http/Templates/phones
3cxpbx/Instance1/Data/Http/Templates/gateway
3cxpbx/Instance1/Data/Http/Templates/fxs
3cxpbx/Instance1/Data/Http/Templates/messaging
3cxpbx/Instance1/Data/Http/Templates/crm
3cxpbx/Instance1/Data/Http/electron
3cxpbx/Instance1/Data/Http/electron/windows
3cxpbx/Instance1/Data/Http/electron/windows/version.xml
3cxpbx/Instance1/Data/Http/electron/windows/3CXDesktopApp-18.12.416.msi
3cxpbx/Instance1/Data/Http/electron/windows/3CXDesktopApp-18.12.416-full.nupkg
3cxpbx/Instance1/Data/Http/electron/osx
3cxpbx/Instance1/Data/Http/electron/osx/3CX Desktop App-darwin-x64-18.12.416.zip
3cxpbx/Instance1/Data/Http/electron/osx/version.xml
3cxpbx/Instance1/Data/Http/electron/osx/3CXDesktopApp-18.12.416.dmg
3cxpbx/Instance1/Data/Logs/3CXWebMeeting.log
3cxpbx/Instance1/Data/Logs/3CXQueueManager.log
3cxpbx/Instance1/Data/Logs/3CXCallFlow.log
3cxpbx/Instance1/Data/Logs/3CXAudioProvider.2023-03-26.141059.log
3cxpbx/Instance1/Data/Logs/3CXQueueManager.track.log
3cxpbx/Instance1/Bin/Cert
3cxpbx/Instance1/Bin/Cert/root_cert_dt.pem
3cxpbx/Instance1/Bin/Cert/root_cert_voxtelesys.pem
3cxpbx/Instance1/Bin/Cert/root_cert_teamsdirectrouting.pem
3cxpbx/Instance1/Bin/Cert/root_cert_bouyguestelecom.pem
3cxpbx/Instance1/Bin/Cert/certificates.xml
3cxpbx/Instance1/Bin/Cert/Apple
3cxpbx/Instance1/Bin/Cert/root_cert_televoip.pem
3cxpbx/Data/Http/Reports
3cxpbx/Data/Http/wwwroot
3cxpbx/Data/Http/wwwroot/licenses
3cxpbx/Data/Http/wwwroot/livechat
3cxpbx/Data/Http/wwwroot/callus
3cxpbx/Data/Http/wwwroot/l10n
3cxpbx/Data/Http/wwwroot/webclient
3cxpbx/Data/Http/wwwroot/webclient/i18n
3cxpbx/Data/Http/wwwroot/webclient/notifications
3cxpbx/Data/Http/wwwroot/webclient/assets/manifest
3cxpbx/Data/Http/wwwroot/webclient/assets/emojione/32
3cxpbx/Data/Http/wwwroot/webclient/assets/emojione/32/_alt
3cxpbx/Data/Http/wwwroot/webclient/assets/img
3cxpbx/Data/Http/wwwroot/webclient/assets/img/picker
3cxpbx/Data/Http/wwwroot/ace-plugins
3cxpbx/Data/Http/provsubdir
3cxpbx/Data/Http/provsubdir/42/2
3cxpbx/Data/Http/provsubdir/42/2/cgi
3cxpbx/Data/Http/provsubdir/42/2/cgi/shop
3cxpbx/Data/Http/provsubdir/42/2/sht/81
3cxpbx/Data/Http/provsubdir/42/2/webuil/81
3cxpbx/Data/Http/provsubdir/sifs
3cxpbx/Data/Http/provsubdir/70/1
3cxpbx/Data/Http/provsubdir/70/1/cgi
3cxpbx/Data/Http/provsubdir/70/1/cgi/shop
3cxpbx/Data/Http/provsubdir/logo
3cxpbx/Data/Http/Templates/provider
3cxpbx/Data/Http/Templates/phones
3cxpbx/Data/Http/Templates/gateway
3cxpbx/Data/Http/Templates/fxs
3cxpbx/Data/Http/Templates/messaging
3cxpbx/Data/Http/Templates/crm
3cxpbx/Data/Logs/PbxConfigTool.log
3cxpbx/Data/Logs/unattended-upgrade.log
3cxpbx/Data/Logs/CloudServiceWatcher.log
3cxpbx/Bin/nftables.conf
3cxpbx/Bin/3CXGatewayService.config.json
3cxpbx/Bin/3CXPhoneSystem.ini
3cxpbx/Bin/nginx/conf
3cxpbx/Bin/nginx/conf/nginx.conf
3cxpbx/Bin/nginx/conf/snippets
3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf
3cxpbx/Bin/Cert/Apple
3cxpbx/Bin/License
3cxpbx/Bin/3cxmediaserver.ini
Click to expand...
Are you suspecting the PBX itself may be infected? or are we only looking at the desktop client?
 
clarity2 said:
Has anyone seen the compromised versions get installed if you are self-hosting and auto-updates turned off so Update 7 was not installed?

We have auto-updates off on all our instances and have not installed Update 7 and we are not seeing 18.12.x versions of the 3CXDesktopApp installed or blocked by S1 anywhere.
Click to expand...
This has nothing to do with the Auto Update. There is a scheduled task which runs that background updates core files.
 
Sparky Bear said:
Are you suspecting the PBX itself may be infected? or are we only looking at the desktop client?
Click to expand...
The 3CX code repo is compromised.
There is an auto-update background task which runs and pulls down the Desktop Client Updates.
 
clarity2 said:
Has anyone seen the compromised versions get installed if you are self-hosting and auto-updates turned off so Update 7 was not installed?

We have auto-updates off on all our instances and have not installed Update 7 and we are not seeing 18.12.x versions of the 3CXDesktopApp installed or blocked by S1 anywhere.
Click to expand...
Same here. Only 1 instance on U7 and S1 stopped it. 20+ other instances are self-hosted, U5, no compromised installs. All desktop clients are 18.10.461.0.
 
netpoint said:
Same here. Only 1 instance on U7 and S1 stopped it. 20+ other instances are self-hosted, U5, no compromised installs. All desktop clients are 18.10.461.0.
Click to expand...
Can you tell me how to verify client version on the 3CX server?
 
Billy Carter said:
Can you tell me how to verify client version on the 3CX server?
Click to expand...
If Windows check out this directory:
C:\ProgramData\3CX\Instance1\Data\Http\electron

And look for all executives in osx and windows directory
 
Billy Carter said:
Can you tell me how to verify client version on the 3CX server?
Click to expand...
You will be able to see the software version under the "Phones" menu in the admin portal.
 
You can also see what version the app is on by going to the windows system tray, right click on the app and go to "about".
 
Billy Carter said:
Can you tell me how to verify client version on the 3CX server?
Click to expand...
SSH to your server

cd /var/lib/3cxpbx/Instance1/Data/Http/electron
ls -la *

That will show you the files which include the version in the name.
 
You can also see your versions of the client from the Management Portal > Phones
Just filter by the 3CX App and you can check the versions.
 
skuers said:
Same problem here. On some Workstations it still runs - on mine it was wiped away...
Still awaiting answer from SentinelOne - but definitely looks as false positive.
And btw: Yes, same Edition: 18.0 Update 7 (Build 312)
Click to expand...
Do not treat as a false positive, i would not whitelist!
this looks real!
 
Aaron Falzon said:
Do not treat as a false positive, i would not whitelist!
this looks real!
Click to expand...
You've just replied to a comment posted a week ago, the severity of the issue has only been raised in the past 24 hours.
 
It is true. For the record we contacted SentinelOne for more information but never received it. We are issueing a new build as we speak we apologize for the inconvenience.
 
  • Like
  • Love
Reactions: mferraby, AVF, mcsphones and 9 others
Nick Galea said:
It is true. For the record we contacted SentinelOne for more information but never received it. We are issueing a new build as we speak we apologize for the inconvenience.
Click to expand...
Thank you. Will there be a direct download link when available? Like most others here, we've stopped our 3CX servers from automatically downloading the new builds, and I'm sure most of us want to manually test on our end before we do restart the automatic build downloads.
 
Thank you @Nick Galea
Looking forward to being able to reinstall it.
 
  • Like
Reactions: N_G
Nick Galea said:
It is true. For the record we contacted SentinelOne for more information but never received it. We are issueing a new build as we speak we apologize for the inconvenience.
Click to expand...
@Nick Galea as the update touched lots of files. Is there any idea if the other files may have been compromised
glipschitz_summit said:
Looks like the update touches LOTS of files and directories.....


/var/lib# find 3cxpbx/ -newermt "2023-03-26 14:00:00" -not -newermt "2023-03-26 15:00:00+1"

3cxpbx/
3cxpbx/Instance1/Data/Ivr/Prompts
3cxpbx/Instance1/Data/Ivr/Prompts/Sets/8210986B-9412-497f-AD77-3A554F4A9BDB
3cxpbx/Instance1/Data/Ivr/Prompts/Sets/8210986B-9412-497f-AD77-3A554F4A9BDB/time
3cxpbx/Instance1/Data/Ivr/Prompts/Sets/8210986B-9412-497f-AD77-3A554F4A9BDB/numbers
3cxpbx/Instance1/Data/Ivr/Prompts/Hotel
3cxpbx/Instance1/Data/Http/Reports
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyExtensionStatisticReport_2603_zm70L3huk6rJbLLsaBDQ.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyQueueAnsweredcallsbywaittimeReport_2603_z8LZwDG5XfY002bZJcGY.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyRingGroupStatisticsReport_2603_rLbyA8ahxOwILaNl2SZr.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyQueuePerformanceReport_2603_G0iZ9j5mMubKHO3gCvfr.html
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyAbandonedQueueCalls_2603_6ENUYU0LR3SoJytseVUQ.html
3cxpbx/Instance1/Data/Http/Reports/Logo
3cxpbx/Instance1/Data/Http/Reports/xxxWeeklyDetailedQueueStatisticsReport_2603_rJWYZXcdcxF58ewFfgc6.html
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/fanvil_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/yealink_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/snom_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/aastra_phonebook.csv
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/gigaset_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/gs_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/cisco_phonebook.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/000000000000-directory.xml
3cxpbx/Instance1/Data/Http/Interface/provisioning/d85fcxvw6rk72h/logo
3cxpbx/Instance1/Data/Http/Interface/MyPhone
3cxpbx/Instance1/Data/Http/Templates/provider
3cxpbx/Instance1/Data/Http/Templates/phones
3cxpbx/Instance1/Data/Http/Templates/gateway
3cxpbx/Instance1/Data/Http/Templates/fxs
3cxpbx/Instance1/Data/Http/Templates/messaging
3cxpbx/Instance1/Data/Http/Templates/crm
3cxpbx/Instance1/Data/Http/electron
3cxpbx/Instance1/Data/Http/electron/windows
3cxpbx/Instance1/Data/Http/electron/windows/version.xml
3cxpbx/Instance1/Data/Http/electron/windows/3CXDesktopApp-18.12.416.msi
3cxpbx/Instance1/Data/Http/electron/windows/3CXDesktopApp-18.12.416-full.nupkg
3cxpbx/Instance1/Data/Http/electron/osx
3cxpbx/Instance1/Data/Http/electron/osx/3CX Desktop App-darwin-x64-18.12.416.zip
3cxpbx/Instance1/Data/Http/electron/osx/version.xml
3cxpbx/Instance1/Data/Http/electron/osx/3CXDesktopApp-18.12.416.dmg
3cxpbx/Instance1/Data/Logs/3CXWebMeeting.log
3cxpbx/Instance1/Data/Logs/3CXQueueManager.log
3cxpbx/Instance1/Data/Logs/3CXCallFlow.log
3cxpbx/Instance1/Data/Logs/3CXAudioProvider.2023-03-26.141059.log
3cxpbx/Instance1/Data/Logs/3CXQueueManager.track.log
3cxpbx/Instance1/Bin/Cert
3cxpbx/Instance1/Bin/Cert/root_cert_dt.pem
3cxpbx/Instance1/Bin/Cert/root_cert_voxtelesys.pem
3cxpbx/Instance1/Bin/Cert/root_cert_teamsdirectrouting.pem
3cxpbx/Instance1/Bin/Cert/root_cert_bouyguestelecom.pem
3cxpbx/Instance1/Bin/Cert/certificates.xml
3cxpbx/Instance1/Bin/Cert/Apple
3cxpbx/Instance1/Bin/Cert/root_cert_televoip.pem
3cxpbx/Data/Http/Reports
3cxpbx/Data/Http/wwwroot
3cxpbx/Data/Http/wwwroot/licenses
3cxpbx/Data/Http/wwwroot/livechat
3cxpbx/Data/Http/wwwroot/callus
3cxpbx/Data/Http/wwwroot/l10n
3cxpbx/Data/Http/wwwroot/webclient
3cxpbx/Data/Http/wwwroot/webclient/i18n
3cxpbx/Data/Http/wwwroot/webclient/notifications
3cxpbx/Data/Http/wwwroot/webclient/assets/manifest
3cxpbx/Data/Http/wwwroot/webclient/assets/emojione/32
3cxpbx/Data/Http/wwwroot/webclient/assets/emojione/32/_alt
3cxpbx/Data/Http/wwwroot/webclient/assets/img
3cxpbx/Data/Http/wwwroot/webclient/assets/img/picker
3cxpbx/Data/Http/wwwroot/ace-plugins
3cxpbx/Data/Http/provsubdir
3cxpbx/Data/Http/provsubdir/42/2
3cxpbx/Data/Http/provsubdir/42/2/cgi
3cxpbx/Data/Http/provsubdir/42/2/cgi/shop
3cxpbx/Data/Http/provsubdir/42/2/sht/81
3cxpbx/Data/Http/provsubdir/42/2/webuil/81
3cxpbx/Data/Http/provsubdir/sifs
3cxpbx/Data/Http/provsubdir/70/1
3cxpbx/Data/Http/provsubdir/70/1/cgi
3cxpbx/Data/Http/provsubdir/70/1/cgi/shop
3cxpbx/Data/Http/provsubdir/logo
3cxpbx/Data/Http/Templates/provider
3cxpbx/Data/Http/Templates/phones
3cxpbx/Data/Http/Templates/gateway
3cxpbx/Data/Http/Templates/fxs
3cxpbx/Data/Http/Templates/messaging
3cxpbx/Data/Http/Templates/crm
3cxpbx/Data/Logs/PbxConfigTool.log
3cxpbx/Data/Logs/unattended-upgrade.log
3cxpbx/Data/Logs/CloudServiceWatcher.log
3cxpbx/Bin/nftables.conf
3cxpbx/Bin/3CXGatewayService.config.json
3cxpbx/Bin/3CXPhoneSystem.ini
3cxpbx/Bin/nginx/conf
3cxpbx/Bin/nginx/conf/nginx.conf
3cxpbx/Bin/nginx/conf/snippets
3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf
3cxpbx/Bin/Cert/Apple
3cxpbx/Bin/License
3cxpbx/Bin/3cxmediaserver.ini
Click to expand...
 
Nick Galea said:
It is true. For the record we contacted SentinelOne for more information but never received it. We are issueing a new build as we speak we apologize for the inconvenience.
Click to expand...
This is a pretty piss poor response @Nick Galea
We've had absolutely no official communication from your Team and have been left to reverse engineer the issue.
Will you be openly publishing a post incident report?
You also make no mention of who the "third party library" is who you claim was compromised.
 
Last edited:
  • Like
Reactions: Dale Maunder, jbland, dvml and 2 others
Nick Galea said:
It is true. For the record we contacted SentinelOne for more information but never received it. We are issueing a new build as we speak we apologize for the inconvenience.
Click to expand...
Is there any reason to believe the Android or Apple iPhone versions have been compromised or is it not known at this time?
 
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
111,937
Messages
589,831
Members
164,819
Latest member
mechelle
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom