Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
DHS Launches Bug Bounty Program
Infosecurity Magazine reported on the Department of Homeland Security's launch of "Hack DHS," its inaugural bug bounty program designed to identify vulnerabilities across federal systems. Casey Ellis contributed expertise to the initiative as a recognized voice in coordinated vulnerability disclosure and bug bounty program design.
Bug hunt bounty: Feds to offer up to $5,000 to identify cyber weak spots
WRAL TechWire reported on the U.S. federal government's launch of the "Hack DHS" bug bounty program, which offers up to $5,000 for identifying security vulnerabilities. Casey Ellis discussed the program's significance for strengthening federal cybersecurity defenses through crowdsourced vulnerability discovery.
'Less obvious' uses of Log4j pose a major risk
This VentureBeat article from December 14, 2021, explains that Apache Log4j is often used unknowingly inside software products, making the Log4Shell vulnerability difficult to detect and fix. Casey Ellis, founder and chief technology officer at Bugcrowd, advises organizations to fix known exposures first while planning for unknown vulnerable Log4j in their environments.
CISA orders federal civilian agencies to patch Log4j vulnerability and 12 others by December 24 - ZDNET
ZDNet reported in December 2021 that CISA added Log4j and 12 other vulnerabilities to its Known Exploited Vulnerabilities Catalog with a December 24 patching deadline. Bugcrowd CTO Casey Ellis commended the deadlines but said most organizations would struggle, since they must first find Log4j and then run regression testing before patching.
Log4Shell Malware Vulnerability Vaccine Helps Protect Users that Could Not Update Yet
TechTimes reported on security efforts to develop a protective "vaccine" against the Log4Shell vulnerability for systems unable to patch immediately. Casey Ellis contributed to these efforts aimed at providing interim protection for exposed users against active exploitation of the critical logging flaw.
Here We Go Again: Second Log4j Flaw Surfaces
A Security Boulevard article from December 2021 covers the discovery of a second Log4j vulnerability, CVE-2021-45046, that surfaced shortly after the initial disclosure and required additional patching. Casey Ellis commented on the implications of the chained flaw and the challenges organizations faced in securing their systems against successive Log4j exploits.
What is Log4Shell, and why are we panicking about it? | Computer Weekly
This December 2021 article from ComputerWeekly.com explains the Log4Shell vulnerability in Apache's Log4j2 library and the alarm it triggered. Casey Ellis, chief technology officer at Bugcrowd, calls it a worst-case scenario, citing Log4j's widespread use, the many exploit paths, difficult patching, and an exploit that fits in a tweet.
Security company offers Log4j 'vaccine' for systems that can't be updated immediately - ZDNET
This ZDNet article from December 13, 2021 covers a security company's Log4j vaccine for systems that cannot be updated immediately, which experts call a limited stop-gap. Bugcrowd CTO Casey Ellis warns that running such a fix on others' systems without permission likely violates the CFAA, creating legal risk even for well-intentioned users.
Serious Log4j Security Flaw: Race Underway to Discern Scope
This BankInfoSecurity article from December 2021 covers the Apache Log4j 2 zero-day flaw and how security teams are working to gauge its scope. Casey Ellis, CTO and founder of Bugcrowd, says he has seen the flaw exploited via a Wi-Fi SSID and calls its long tail extraordinary.
Chinese Researchers Discover EwDoor Botnet Affecting up to 100,000 AT&T VoIP Servers
CPO Magazine published a report on the discovery of EwDoor, a botnet targeting AT&T VoIP servers that potentially infected up to 100,000 devices, as identified by Chinese security researchers. Casey Ellis commented on the security implications and threat landscape revealed by the botnet's widespread reach and targeting of critical communications infrastructure.
How Do I Find My Servers With the Log4j Vulnerability?
Dark Reading published a technical guide on identifying servers vulnerable to the Log4j flaw. Casey Ellis contributed advice and methods to help system administrators detect the vulnerability across their infrastructure.
Bug-Bounty Programs Shift Focus to Most Critical Flaws
Dark Reading published an analysis on how bug bounty programs are evolving to prioritize critical vulnerabilities with higher payouts. Casey Ellis discusses the strategic shift toward incentivizing researchers to focus on the most impactful security flaws rather than volume-based submissions.
'Vaccine' against Log4Shell vulnerability has potential -- and limitations
A December 2021 VentureBeat article covers Cybereason's "vaccine" workaround for the Log4Shell flaw in Apache Log4j servers. Casey Ellis, founder and CTO of Bugcrowd, tells VentureBeat the fix appears effective, though he calls it a supplementary tool rather than a cure-all and notes it does not work before Log4j 2.10.
Apache Log4j Threatens, Well, Everything
This Security Boulevard article from December 11, 2021, covers the actively exploited Apache Log4j flaw, CVE-2021-44228, in the widely used Log4j2 Java logging library. Casey Ellis, founder and CTO at Bugcrowd, warns that the library's ubiquity and many exploit paths will complicate patching, and urges teams to immediately locate Log4j in their environments.
NVD: It’s Another Record Year for Vulnerabilities
This Infosecurity Magazine article, published December 9, 2021, reports that the National Vulnerability Database logged another record number of software vulnerabilities, marking the fifth consecutive year of such totals. Casey Ellis, CTO at Bugcrowd, says the record reflects the pace of technological development, since more software produced means more vulnerabilities exist.
2021 marks another record year for security vulnerabilities
TechRepublic published an article examining the record number of security vulnerabilities disclosed in 2021. Casey Ellis provides insight into the factors driving the surge in vulnerability disclosures and their implications for the security industry.
With 18,378 vulnerabilities reported in 2021, NIST records fifth straight year of record numbers
ZDNet published a report on NIST data showing that 2021 saw 18,378 vulnerabilities discovered, continuing a fifth consecutive year of record numbers. Casey Ellis commented on the vulnerability landscape and the implications of sustained increases in reported security flaws.
How to get started with bug bounties and finding vulnerabilities | Cyber Work Podcast
A Cyberwire podcast episode from December 2021 features Casey Ellis discussing how to begin participation in bug bounty programs and the process of identifying vulnerabilities. Ellis provides guidance on entry points for security researchers interested in coordinated vulnerability disclosure and bug bounty participation.
AT&T Looks to Shut Down Botnet that Attacked 5,700 Network Appliances
eSecurity Planet reported on AT&T's efforts to shut down the EwDoor botnet, which compromised over 5,700 carrier-grade network address translation devices. Casey Ellis commented on the incident's significance for critical infrastructure security and the importance of coordinated response efforts against emerging botnet threats.
Arrest Points to Ubiquiti Breach Being an Inside Job
BankInfoSecurity reported on the arrest of a former Ubiquiti employee charged with orchestrating a data breach and extortion attempt against the networking company. Casey Ellis commented on the incident's implications for corporate security practices and insider threat detection.
Searching for Bugs in Open Source Code
Security Boulevard published an article on the challenges and importance of proactively identifying and fixing security vulnerabilities in open-source software. Casey Ellis discusses the need for systematic approaches to vulnerability discovery and remediation in open-source projects.
300,000 banking Trojan infections from Google Play in 4 months
Security Magazine reported on a wave of banking trojan infections from malicious apps on Google Play that resulted in over 300,000 infections across four months. Casey Ellis contributed analysis on the threat landscape and the security implications of malware distribution through official app marketplaces.
CTO Talk: Q&A with Bugcrowd’s Casey Ellis
Verdict published a Q&A interview with Casey Ellis, founder and CTO of Bugcrowd, in November 2021. Ellis discusses how cybersecurity has evolved and explains the role crowdsourced security plays in modern defense strategies.
Q&A: Casey Ellis
A Q&A session published by Duo Security explores Casey Ellis's perspectives on bug bounties and vulnerability disclosure practices. Ellis discusses the evolution of bug bounty programs and shares insights on the future direction of how organizations discover and address security vulnerabilities.
Decipher Podcast: Casey Ellis
Decipher Security Podcast published an episode featuring Casey Ellis on November 23, 2021. Ellis discusses how vulnerability disclosure programs have evolved, gained adoption, and become standardized in the United States and internationally.
Malicious Golang program attacks e-commerce servers
A report from SC Magazine details malicious Golang malware targeting e-commerce servers to steal payment information. Casey Ellis provided analysis on the threat's implications for retail infrastructure and payment security vulnerabilities.
Digital Bounty Hunters Want To Help Businesses Track Down
A Forbes article examines the emerging practice of applying bug bounty models to identify bias and discrimination in artificial intelligence systems. Casey Ellis discusses how crowdsourced security approaches can be adapted to surface algorithmic fairness issues before they cause harm to users and organizations.
Ethical Hackers Prevented $27B in Cybercrime
The Security Boulevard article "Ethical Hackers Prevented $27B in Cybercrime," published November 17, 2021, examines how security researchers skew younger, are more entrepreneurial, and span generations. Casey Ellis, founder and CTO of Bugcrowd, comments that 79% of ethical hackers taught themselves using online resources and calls the cohort's impact on thwarting cyberattacks monumental.
U.S. Government Details Federal Agency Incident Response
Duo Security published an analysis of new U.S. government directives establishing incident response requirements for federal civilian agencies. Casey Ellis is quoted discussing the practical implications of the government's clearer cybersecurity incident playbooks and their effect on federal agency preparedness.
Ethical Hackers Stymie $27bn of Cybercrime
A report in InfoSecurity Magazine details research estimating that ethical hackers prevented over $27 billion in cybercrime damages during a one-year period. Casey Ellis contributed to the research, which quantifies the financial impact of vulnerability disclosure and coordinated security research on reducing criminal losses.