Post saying “change password please”
Post saying “change password please”
Post saying to check bookmarks
Post saying to check bookmarks
Post saying “change password please”
Post saying to check bookmarks
At the time this post went live on Ars, the Mandiant profile displayed the message “This account doesn’t exist.”
Mandiant profile declaring “this account doesn’t exist.”
Mandiant profile declaring “this account doesn’t exist.”
Mandiant is one of the leading security companies and best known for helping clients investigate and recover from major network compromises. That vantage point gives it major insights into threat actors, many of them backed by nation-states, and the often previously unknown tactics, techniques, and procedures they use to compromise the security of some of the world’s most powerful and well-resourced organizations. Google purchased Mandiant in 2022 for $5.4 billion, which, at the time, was its second-biggest acquisition ever.
Many questions remain about Mandiant’s measures to secure its X account. Among them: Was it protected by a strong password and any form of two-factor authentication? Last month, someone claimed to have discovered the social media site was vulnerable to a “reflected XSS,” a type of vulnerability that can sometimes be used to compromise the security of accounts when a legitimate user currently logged in clicks on a malicious link in a different browser tab. The user said they reported the vulnerability through legitimate channels but that the submission didn’t qualify under the X bug bounty program.
“Clicking a crafted link or going to some crafted web pages would allow attackers to take over your account (posting, liking, updating your profile, deleting your account, etc.),” Chaofan Shou, a University of California at Berkeley Ph.D. candidate, wrote last month.
December 12 post by UC Berkeley Ph.D. candidate Chaofan Shou.
December 12 post by UC Berkeley Ph.D. candidate Chaofan Shou.
Attempts to reach Phantom for comment were unsuccessful.
