Upon review, Google's cybersecurity operation at Mandiant has determined it temporarily lost control of its X account to cryptocurrency drainer malware operators on Jan. 3 because it didn't have two-factor authentication set up.
Effective March 20, 2023, only paid, premium subscribers to X have access to 2FA. It's an embarrassing admission that experts say is a sign of the strain cybersecurity teams are under to keep a crushing onslaught of cyberattacks at bay with a shrinking pool of resources and talent to meet the challenge.
If it can happen to Mandiant, it can happen anywhere, they warn.
The statement also noted the SEC did not have 2FA enabled on the account.
Similar to how cybersecurity companies often have more vulnerabilities in their code than other forms of software, due to time pressures and cutting-edge code development, security firms like Mandiant may be so focused on more serious or complex exploits that the basics - like setting up 2FA on an X account - simply is missed.
This Cyber News was published on www.darkreading.com. Publication date: Thu, 11 Jan 2024 23:00:33 +0000