Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
US Department of Defense invites hackers to help harden its security systems
Tech Radar reported on the U.S. Department of Defense's launch of "Hack U.S.," a bug bounty program that crowdsources security testing to ethical hackers. Casey Ellis contributed to the coverage by discussing how coordinated vulnerability disclosure and bug bounty initiatives strengthen defense systems against emerging threats.
Researchers, NSA cybersecurity director warn of hackers targeting Zyxel vulnerability BriefsCybercrimeGovernmentTechnology Researchers, NSA cybersecurity director warn of hackers targeting Zyxel vulnerability BriefsCybercrimeGovernmentTechnology Researchers, NSA cybersecurity director warn of hackers targeting Zyxel vulnerability
A report from The Record by Recorded Future covers warnings from cybersecurity researchers and the NSA regarding active exploitation of a critical Zyxel firewall vulnerability. The alert details the remotely exploitable flaw and advises organizations on mitigation steps to protect their network infrastructure from ongoing attacks.
DoD announces launch of a new bug bounty program
VentureBeat reported on the Department of Defense's launch of a new bug bounty program focused on strengthening security collaboration with ethical hackers. Casey Ellis contributed to the announcement, supporting the DoD's effort to engage the broader security research community in identifying and addressing vulnerabilities across federal systems.
Security Pros Lured to Bug Bounties by Big Pay Days
TechNews World published a 2022 article on the expanding appeal of bug bounty hunting as a career path for security professionals. The piece explores how competitive payouts and flexible work arrangements draw security talent to the bug bounty model.
LockBit 3.0 Ransomware Emerges With Bug Bounty Program
Security Week reported on the emergence of LockBit 3.0 ransomware in June 2022, noting the operation's unusual creation of its own bug bounty program to identify flaws in its malware. Casey Ellis commented on the development as part of industry analysis of the ransomware threat landscape and emerging tactics used by criminal operations.
24.6 billion pairs of credentials for sale on the dark web
The Register's June 20, 2022 security roundup reports on 24.6 billion credential pairs for sale on the dark web, along with other security news. It also covers Bugcrowd founder and CTO Casey John Ellis admitting the company's mistake in banning researcher Soatok, and his public apology on Twitter.
There are 24.6 billion pairs of credentials for sale on dark web
The Register published a security news roundup in June 2022 covering the proliferation of stolen credentials on dark web marketplaces and emerging threats like LockBit 3.0 ransomware-as-a-service operations. Casey Ellis was cited for insights on credential compromise risks and the evolving threat landscape affecting organizations worldwide.
SBOMs Go Prime Time at RSAC 2022
This Security Boulevard article from June 2022 covers SBOM discussions at RSA Conference 2022, including a panel with CISA's Allan Friedman. Casey Ellis, founder and CTO of Bugcrowd, said his company has prioritized features that reduce DevSecOps workload when bugs are found, empower developers, and connect security operations with development.
Former Uber security chief found guilty of covering up 2016 cyberattack
A Brussels Times article reports that Uber's former security chief Joe Sullivan was convicted of obstruction and misprision of felony charges related to covering up a 2016 data breach. The case examined corporate handling of cybersecurity incidents and accountability for disclosure failures.
Microsoft Suggests Work-Around For ‘Serious’ Follina Zero-Day
Security Boulevard published Microsoft's official guidance and mitigation steps for the Follina zero-day vulnerability affecting the Microsoft Support Diagnostic Tool. Casey Ellis provided context on the severity and impact of the flaw, helping organizations understand the threat level and recommended remediation approaches.
Zero-Day Remote Code Execution Vulnerability Found in Microsoft Office; No Patch Yet, But Possible Fix Available
A CPO Magazine article from June 2022 covers the Follina zero-day vulnerability affecting Microsoft Office and available workarounds prior to an official patch. Casey Ellis discusses the remote code execution risk and practical mitigation strategies for organizations facing the unpatched threat.
Two-thirds of ethical hackers considering bug bounty hunting as a full-time career
SC Media published survey findings showing that two-thirds of ethical hackers are considering bug bounty hunting as a full-time career. Casey Ellis contributed research and analysis supporting the trend toward professionalization of vulnerability disclosure and security researcher compensation models.
Microsoft releases guidance for Office zero-day used to target orgs in Russia, India, Tibet
The Record by Recorded Future published Microsoft's guidance for the Follina zero-day Office vulnerability actively exploited in targeted attacks against organizations in Tibet, Russia, and India. Casey Ellis provided analysis and context on the vulnerability's significance and implications for enterprise security.
How Wildcard Hacktivists and ‘Robin Hood’ Ransomware Groups Amplify Cyber Risk
An article in The Economic Times examines how ideologically motivated hacktivists and Robin Hood-style ransomware groups increase cyber risk through unpredictable attack patterns. Casey Ellis is quoted discussing the evolving threat landscape and how organizations must adapt security strategies to counter activism-driven threats alongside traditional financially motivated cybercriminals.
What are the security risks of open sourcing the Twitter algorithm?
VentureBeat published an analysis of the security implications of Twitter's plan to open-source its algorithm. Casey Ellis discusses the potential attack surfaces and risks that transparency could introduce to the platform's operations and user safety.
OneTrust launches Ethics and Compliance Cloud to foster ethical work culture
SC Media reported on OneTrust's launch of its Ethics & Compliance Cloud platform in May 2022. Casey Ellis is featured as a contributor discussing how organizations can use the software to build ethical workplace cultures and strengthen compliance frameworks.
Businesses Could Lose Money from QR Codes
The Street published an article warning about financial risks to businesses from malicious QR codes, a fraud technique known as quishing. Casey Ellis discusses how attackers exploit QR codes to defraud customers and damage brand reputation, highlighting the need for businesses to implement security awareness and verification practices.
Hackers Use QR Codes to Steal Your Money
The Street published an article on malicious QR code attacks used by hackers to steal consumer money and personal information through phishing. Casey Ellis discusses the technical mechanisms behind QR code exploitation and recommends practical security measures for individuals and businesses to detect and avoid these threats.
Shopping for malware: $260 gets you a password stealer. $90 for a crypto-miner...
The Register published an article on May 14, 2022 detailing the Eternity Project, a malware-as-a-service operation selling modular malicious tools including password stealers, crypto-miners, and ransomware. Casey Ellis analyzed the pricing structure and technical capabilities of the toolkit, highlighting how commoditized malware development has become and its implications for organizational security.
Former Uber security chief convicted of covering up 2016 data breach
Washington Post coverage of the October 2022 conviction of former Uber security chief Joe Sullivan for obstructing a Federal Trade Commission investigation into the 2016 breach. Casey Ellis is quoted on the precedent the verdict sets for security executives navigating disclosure obligations.
Former Uber security chief convicted in hack cover-up: reports
A Reuters article published by UK Yahoo Finance reports on the conviction of former Uber Chief Security Officer Joe Sullivan for covering up a 2016 data breach. The case highlights accountability measures in corporate security leadership regarding disclosure obligations for significant security incidents.
Multifactor authentication is not all it’s cracked up to be
An article in Cyber Security Dive examines limitations of multifactor authentication as a security control, arguing it cannot serve as a complete defense against determined attackers. Casey Ellis discusses how MFA, while important, has exploitable weaknesses that security teams must understand and address comprehensively.
DoD launches “Hack U.S." bug bounty opportunity
The Department of Defense launched the "Hack U.S." bug bounty program, as reported by Security Magazine, to engage ethical hackers in securing government systems. Casey Ellis contributed to the initiative's development and helped establish the program framework for coordinating vulnerability disclosures across federal infrastructure.
Pentagon: We'll pay you if you can find a way to hack us
The Register reported on the U.S. Department of Defense's launch of its "Hack U.S." bug bounty program, which invites vetted security researchers to identify vulnerabilities in military systems. Casey Ellis contributed to the program's development and helped establish the framework for coordinating between the DoD and the hacker community on responsible disclosure.
Third-Party Risk Could Cost E-Commerce Sites Millions
Ecommerce Times published an article examining the financial risks that third-party software and supply chain vulnerabilities create for e-commerce businesses. Casey Ellis discusses how organizations can identify and manage third-party risk exposures to protect revenue and customer data.
Interview with Casey Ellis | Bugcrowd, disclose.io, cybersecurity
The Cyber PARA published a video interview with Casey Ellis in May 2022 covering his background and entry into cybersecurity. Ellis discusses his founding of Bugcrowd and his work in vulnerability disclosure and coordinated security research.
Log4Shell a huge wake-up call for 95% of security leaders
This Security Magazine article reports on Valtix research finding that cloud security leaders changed how they secure workloads after Log4Shell. Casey Ellis, founder and CTO of Bugcrowd, says Log4Shell pushed defenders to their limit, and notes that bug hunter activity dropped in early January as teams weighed further effort against practical importance.
Vast majority of IT leaders say Log4Shell was a ‘wake-up call’ for cloud security
SC Media published survey findings in April 2022 showing that most IT leaders viewed the Log4Shell vulnerability as a critical wake-up call for their cloud security practices. Casey Ellis contributed perspective on how the incident prompted organizations to reassess and strengthen their cloud security strategies.
Crowdsourcing in der Cybersicherheit: Gemeinsam sind wir stärker
An iBusiness article from April 2022 examines crowdsourcing approaches in cybersecurity and collective defense strategies. Casey Ellis discusses how distributed security models leverage community participation to strengthen organizational protection against evolving threats.
FBI Director Warns of Chinese Espionage Threats
Security Boulevard published an article in April 2022 covering the FBI Director's warning about Chinese government economic espionage and hacking campaigns against Western interests. Casey Ellis is cited for his perspective on the scope and implications of these threats to private sector organizations.