3CX users face supply chain attack risk due to app vulnerability.
TL;DR Summary
Internet telephony company 3CX has warned its customers of malware that was apparently weaseled into the company’s own 3CX Desktop App by cybercriminals who seem to have acquired access to one or more of 3CX’s source code repositories. The malware-laced versions were apparently built and distributed by 3CX itself, so they have the digital signatures you’d expect from the company, and they almost certainly came from an official 3CX download server. 3CX has advised its users to uninstall the Desktop App and switch to using the company’s web-based telephony app for now.
- Supply chain blunder puts 3CX telephone app users at risk Naked Security
- Trojanized Windows and Mac apps rain down on 3CX users in massive supply chain attack Ars Technica
- There’s a new supply chain attack targeting customers of a phone system with 12 million users TechCrunch
- 3CX Supply Chain Attack: 8 Biggest Things To Know CRN
- 3CX knew its app was flagged as malicious, but took no action for 7 days Ars Technica
Reading Insights
Total Reads
0
Unique Readers
1
Time Saved
6 min
vs 7 min read
Condensed
93%
1,234 → 92 words
Want the full story? Read the original article
Read on Naked Security