The 3CX Supply Chain Attack - Understanding Everything That Happened
When it comes to waging wars, the best way to sabotage your enemy is to infiltrate and disrupt their supply chain. The internet and its bad actors have been using similar strategies to cause harm and bring chaos to corporations.
In today's interconnected world, businesses rely heavily on their supply chains to deliver services and software. If a hacker can infiltrate such a supply chain, he gains access to all the company’s resources.
If you use VoIP for business communication, chances are you’ve heard about how a leading platform such as 3CX suffered from a similar attack.
In this blog, we will be covering all the basics of supply chain cyber-attacks, how they are executed and explore strategies to prevent them.
We will also dive deep into the 3CX hack and learn what happened and how it happened.
Let’s get started then, shall we?
What are Supply Chain Cyber Attacks?
Supply chain cyber-attacks are a type of cyber attack that targets a company's suppliers or partners to gain access to the company's network.
Instead of attacking the company directly, the attacker looks for vulnerabilities they can exploit in the company's supply chain.
Let’s consider an example here. A company has a supplier that provides them with a software program. The attackers will then try to find and exploit vulnerabilities in the supplier’s network.
Once they gain access, they insert malicious code or malware into a soon-to-be-released software update. All it takes now is for the company to install the software update released by its supplier. Once that happens, attackers gain access to the company’s network and other resources.
From this point on, there’s a lot that may go wrong for the company. The attackers can use the access to steal sensitive and compromising information or trade secrets. They may also launch more targeted attacks and cripple the operations of the company.
Such attacks will appear to be originating from within the firm. This makes it difficult to track down the source and mitigate these. The consequences of this can be serious and have a strong negative effect on the company and its customers,
Quick detection and a strong security shakedown can eliminate such attacks. However, it is safer to take strong measures to prevent supply chain attacks from happening.
Wondering what these preventive measures are? We shall discuss those in the later half of this article. Before that, you must gain a better understanding of how supply chain cyber attacks are executed.
Let’s head over to that, shall we?
How are Supply Chain Cyber Attacks Executed?
Supply chain cyber attacks can be executed in various ways. However, the core process remains the same while the methodology and approach can vary.
Here is a step-by-step core process to execute such attacks:
1. Reconnaissance
Similar to any other form of attack, a supply chain cyber attack begins with scouting for opportunities. Careful scouting helps identify potential targets and ingress points in a company’s supply chain.
On their part, they have to ensure that the supplier either has a direct or indirect connection with the target company. Once all of this intel has been gathered, attackers can move on to advanced reconnaissance.
Advanced reconnaissance may make use of social engineering techniques to gather information.
2. Identify Vulnerabilities
The next step before the attack is identifying vulnerabilities in the company’s supply chain. These vulnerabilities can be in the form of unpatched software, open ports, weak passwords or other similar ones.
Exploiting these vulnerabilities is what allows the attackers to gain access to the target company’s network.
Additionally, the attacker may also conduct a spear phishing attack to gain access to user credentials or install malware on the systems. These credentials can be further used to cause more damage via the misuse of the access there grant.
3. Gain Access
The subsequent step grants access to the company systems and network to the attackers. A stolen password, keys, session cookies or a brute force attack may be used to gain access to the system.
In some instances, the attackers may even resort to social engineering to get an intended target to download and install malware on their system.
Coercion and blackmail have also been observed to be common ways to force employees to provide access to their systems. Remote access tools may also be used to gain access to a target system and its network.
4. Move Laterally
With access to the systems and network, the attackers have free reign inside the company network and all their data. At this stage, the attackers will now move laterally throughout the network to find targets of value.
This may include more access codes, credentials, trade secrets, more system vulnerabilities via software or hardware, sensitive data and more.
5. Steal or Compromise Data
Once the targets have been identified to be of value, the attackers may either steal the data or compromise it in different ways. This sensitive data may be in the form of intellectual property, internal communication, financials, corporate secrets, cover-ups and more.
There’s a lot that corporations don't want the public to see and go to extreme lengths to hide these things. Attackers are aware of these things and know which companies have the most things to hide.
These attackers may release this sensitive data to the public, hold it for ransom, delete technological progress and experiment logs and much more. In some instances, they may even install malware to create a backdoor into the network for remote access.
6. Cover Their Tracks
A crime is a crime, no matter if you do it in the real world or the virtual one. Not being caught is the most important aspect of committing a crime for any criminal.
Thus, it would be the top priority of the attackers to ensure they cover up their tracks to avoid being detected, identified and caught. There are multiple measures that attackers can undertake to accomplish this.
Deleting or changing logs, creating fake records and dodgy trails to throw off investigators, and deleting or encrypting all available data on servers are some ways attackers achieve this.
Please note that the steps mentioned above are not always executed in the sequence mentioned. There are a lot of variations and other methods that the attackers may resort to. The key takeaway is that supply chain attacks are complex and difficult to detect.
Detailed Incident report with references
We will cover the background of 3CX and take a look at the 2 detailed incident reports by CrowdStrike and Sentinel One.
Background
The 3CXDesktopApp is an enterprise call routing software used for voice and video conferencing that has been developed by 3CX.
They are a company that specializes in business communication software. They have a customer base of 600,000 companies and 12 million users, according to their website.
3CX provides services to various sectors such as:
- Automotive
- Food and Beverage
- Hospitality
- Managed IT service providers
- Manufacturing.
The 3CX PABX client is compatible with Windows, macOS, and Linux, as well as mobile versions for Android and iOS, a Chrome extension, and a Progressive Web App (PWA) browser-based version.
CrowdStrike Report
On March 29, 2023, Falcon OverWatch, a cybersecurity service, identified malicious activity in the 3CXDesktopApp - a legitimate softphone application developed by 3CX.
This activity included connecting to actor-controlled infrastructure, deploying second-stage payloads, and, in some instances, manual manipulation of the system.
Falcon Prevent and Insight have specific measures in place to prevent such abuse of 3CXDesktopApp.
Meanwhile, Falcon Complete has reached out to customers under their management who are using this application. Customers, where hands-on-keyboard activity has been detected, have been notified.
The 3CXDesktopApp is available on various platforms such as Windows, macOS, Linux, and mobile. As of now, the malicious activity has been observed on both Windows and macOS.
This is an ongoing situation and CrowdStrike's Intelligence Team is coordinating with 3CX. They suspect LABYRINTH CHOLLIMA, a threat actor, of having nation-state involvement.
After conducting a thorough review and reverse engineering process, the CrowdStrike Intelligence Team has determined that the signed MSI file (aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868) is malicious.
This MSI file will drop three files, with the main component being the compromised binary ffmpeg.dll (7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896).
Once activated, the HTTPS beacon structure and encryption key match the ones seen by CrowdStrike in a March 7, 2023 campaign that has been confidently attributed to the DPRK-nexus threat actor LABYRINTH CHOLLIMA.
SentinelOne Report
On March 22, 2023, SentinelOne discovered an increase in suspicious activity related to the 3CX Desktop App. 3CX is a well-known voice and video conferencing software categorized as a PABX platform.
To protect against potential harm, the system detected and quarantined these malicious installers immediately.
This is the first phase of a multi-part attack that involves pulling ICO files appended with base64 data from GitHub. This led to the third stage infostealer DLL, which is currently being analyzed.
The attacker used a code signing certificate to sign the trojanized files.
Although SentinelOne has detected the threat actor's activity since February 2022, we are still investigating the supply chain behind the attack. SentinelOne has not yet found any connections to known threat groups.
On March 30, 2023, we updated our IOCs with help from the research community.
Furthermore, we can confirm that the MacOS installer has also been infected, according to Patrick Wardle's report.
We have identified a limited deployment of a second-stage payload for Macs and have updated our IOCs accordingly. Our system shows that the first attempt to infect a device occurred on March 8, 2023.
Now you know what happened with the 3CX Desktop App. Let’s move to understand what threats such a supply chain attack poses!
What possible security threats would such an attack pose?
A supply chain cyber attack can have serious consequences for both users and the Firm attacked.
Here are some possibilities of the risks such an attack can pose.
1. Stolen Data
Attackers gain access to everything in the company’s network via a supply chain attack. In 3CX’s case, this access was not just limited to 3CX’s resources but also to the systems of its users via the 3CX Desktop App.
Personal information such as names, addresses, credit card details and other PII can easily be accessed and stolen in such instances. What made the 3CX case more serious was the extent of exposure.
The attackers could have accessed the data of all 600,000 customers of 3CX and the data of the customers’ customers too. This data can easily be sold on the dark web and can lead to identity theft, financial fraud and other crimes.
2. Malware Infection
A single piece of malware can cause a wide range of problems for the affected users. It can be used to steal data, spy on users or act as ransomware.
Malware can also be used to slow down systems and networks or use the infected network to stage additional cyber attacks.
Considering that most of 3CX’s customers are small and medium business owners, such possible threats could have posed a lot of trouble for them.
3. Downtime
Supply chain attacks can be very disruptive. The security concern itself can get the affected company to suspend services temporarily. This will affect all the businesses relying on the company’s services for their operations.
Let’s consider 3CX’s case. VoIP communication is essential for all small and medium businesses to carry out different operations. Losing the ability to communicate with clients, teams and remote employees brings any business to a standstill.
In an instance where the attackers can damage the physical infrastructure or critical databases of a firm, the service downtime can be extensive.
4. Reputational Damage
You've heard the headlines in recent decades when it comes to data privacy and staying safe online. People are now aware of the risks of their data ending up in the wrong hands.
When people submit sensitive data to your business, they expect you to do everything to ensure that it stays safe. When it comes to VoIP communication, platforms require a lot of your personal data by law to provide you with the service.
While a cyber-attack may have failed and the attackers may not have any data, it still damages the brand’s reputation a lot. Almost 90% of the customers cite that data protection plays an important role in their purchase decision.
5. Legal and Regulatory Consequences
If there is anyone that hates cyber attacks more than a brand’s customers, it's the government and regulatory agencies. Cyber attacks that compromise consumer data safety have far-reaching effects.
The government and regulators are ultimately responsible for protecting the customers from any harm, if it may come. However, that means that as a business, you will be held responsible for being unable to prevent this mishap.
For example, if the brand is subject to GDPR regulations, it may face fines or lawsuits for failing to protect user data.
In an instance where a data breach damages the business operations of a customer, the customer can file a civil suit against the service provider.
With this, now we know a lot about the basics of supply chain cyber-attacks and the 3CX case. But could have it been prevented? Yes! Let’s find out how.
How to Prevent a Supply Chain Cyber Attack?
Preventing a supply chain cyber attack requires a multi-faceted approach. Such an approach involves a combination of technical, operational, and organizational measures.
Here are some steps one can take to prevent a supply chain cyber attack:
1. Assess and Manage Risk
With the age of SaaS platforms, we have new features and capabilities being added to the service regularly. Each component that gets added needs to be safe and assessed for all types of security vulnerabilities.
In bigger firms working with a lot of vendors and partners, it needs to be ensured that all involved are assessed for their internal and external security measures.
A firm should encourage all its vendors to use the latest security practices and follow a strict code of conduct when it comes to data and network security.
You should be updated with the latest developments in the cyber security world to ensure you patch all new-found security vulnerabilities and exploits.
2. Implement Security Controls
Having strict Security Controls in place will tremendously help you in preventing supply chain cyber-attacks. Such security controls may include firewalls, antivirus software, intrusion detection and prevention systems, behavior-based alerts, two-factor authentication and more.
You can also have all your data encrypted while in transit and in storage. This ensures the data is protected from being read even when stolen during an attack.
It is also important to stay vigilant and update all your systems and applications with the latest security patches. However, ensure that these patches and updates are themselves not compromised as was the case with 3CX.
3. Train Employees
Your employees can act as the biggest single point of failure in your efforts to keep your systems and network secure. Humans make errors and regularly become complacent and make security lapses.
Thus, it becomes essential to regularly train your employees about the best cybersecurity practices. Measures such as using strong passwords and regularly changing them should be promoted and rewarded to propagate habit adoption.
Employees should be trained to be able to easily identify phishing emails, suspicious activities and honeypot scams. A healthy culture of cybersecurity is what you need to ensure your firm stays secure and protected against supply chain cyber-attacks.
4. Monitor the Supply Chain
A breach in your network or system security can easily go unnoticed if you’re not actively monitoring your supply chain. Real-time monitoring is essential for cyber security and dedicating resources towards it is pivotal towards your business’s future.
Monitoring the supply chain can include activities such as analyzing network traffics, log files and other indicators of security lapse.
You must also ensure that the monitoring efforts cover the entire supply chain. Thus, no possible ingress points will be left for attackers to exploit. Swift detection of a breach can easily help one isolate the affected systems and contain the breach.
5. Establish Incident Response Plans
As Murphy's Law states, “Anything that can go wrong, will go wrong.” The eventuality of your business being a victim of a supply chain attack is certain.
The best way to prepare for it is to know what to do when it eventually happens. So start by developing an Incident Response Plan. A good plan should allow you to coordinate all your resources, mitigate damage and ensure PR duties are handled capably.
A good Incident Response Plan should lay out clear roles and responsibilities for everyone. This should include communication plans, procedures to isolate affected systems, procedures to assess and mitigate damage and procedures to restore service and databases.
One must regularly review and update the Incident Response Plan to be safe from all new threats.
6. Conduct Regular Security Audits
Having preventive measures in place won’t do any good if you have no idea how well they work. Security audits provide you with insights into how effective your security and preventive measures are.
Security audits include vulnerability assessments, penetration testing and other activities that help determine the effectiveness of the measures in place.
Such audits help identify areas in which you can improve your security and preventive measures. You can also tweak your Incident Response Plan to accommodate for any findings of the security audit.
6. Collaborate With Partners
When it comes to supply chain cyber attacks, the security measures employed by your partners and suppliers also become important. Any security lapse on their end can compromise the entire supply chain along with your systems and databases.
This makes it necessary to collaborate with your partners and suppliers in terms of security and preventive measures. It needs to be ensured that their security setup is on par if not better than the one employed by you.
Setting clear expectations in terms of security requirements also helps alleviate tensions when an attack occurs.
Concluding
I know this was a long article but when it comes to security, it's better to be thorough with everything. With that said, I'm sure you now have a good understanding of supply chain cyber-attacks.
We can make the internet a safer place for business with one safety measure at a time. The preventive measures discussed in this blog also help to prevent other forms of security threats.
Key among these measures is creating strong passwords and changing them often. So go ahead and implement these measures and secure the future of your business!