Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
Musk’s Twitter takeover and its security implications
Security Magazine published an analysis of the security implications stemming from Elon Musk's Twitter acquisition in April 2022. Casey Ellis contributed expert perspective on issues including bot accounts, data privacy, and content moderation challenges arising from the platform transition.
Musk Masterminds Private Twitter Takeover for $44 Billion
E-Commerce Times reported on Elon Musk's $44 billion acquisition of Twitter and the company's transition to private ownership in April 2022. The article detailed the sequence of events leading to the deal's completion.
Experts warn of need to patch critical cryptographic Java bug
A The Record article from Recorded Future reports on expert warnings about a critical Java cryptographic vulnerability that could enable digital signature forgery. Casey Ellis joins other cybersecurity experts in cautioning organizations to apply patches immediately to mitigate the risk of signature spoofing attacks.
GitHub: Stolen OAuth Tokens Used to Breach Private Repositories, Dozens of Organizations Impacted
A CPO Magazine article from April 2022 reports on attackers using stolen OAuth tokens to breach private code repositories of dozens of organizations on GitHub. Casey Ellis is cited for perspective on the incident and its implications for software supply chain security.
Microsoft Pays Top Dollar for Bug Bounties
The Street published an article on Microsoft's bug bounty program and the financial rewards it offers ethical hackers for discovering and reporting security vulnerabilities. Casey Ellis is quoted discussing the significance of bug bounty initiatives in strengthening software security and incentivizing responsible vulnerability disclosure practices.
Addressing Critical Infrastructure Threats Requires Collaboration
Security Boulevard published an article in April 2022 on the necessity of public-private collaboration in defending critical infrastructure against cyber threats, referencing a joint advisory from international security agencies. Ellis contributed perspective on how coordinated defense strategies between government and private sector organizations strengthen resilience against evolving threats to essential systems.
Five Eyes countries warn of Russian attacks against critical infrastructure
A SiliconANGLE article covers a joint warning from the Five Eyes intelligence alliance regarding Russian state-sponsored cyberattacks targeting critical infrastructure. Casey Ellis is quoted discussing the severity of the threat and the importance of coordinated defense measures across allied nations.
Hackers use stolen OAuth access tokens to breach dozens of organization’s internal systems
A VentureBeat article from April 2022 reports on attackers using stolen OAuth tokens from tools like Heroku and Travis to breach dozens of organizations. Casey Ellis, founder and CTO of Bugcrowd, is quoted warning that cloud convenience makes failing to audit, monitor, or expire OAuth keys easier.
Threat actors that compromised two OAuth integrators could potentially penetrate cloud systems
SC Media reported on threat actors who compromised OAuth integrators and gained potential access to cloud systems through stolen tokens from Heroku and Travis-CI. Casey Ellis provided analysis on how the compromised credentials could be leveraged to breach private code repositories and emphasized the cascading risks across integrated development environments.
RaidForum dismantled by joint security operation
Security Magazine reported on the dismantling of the RaidForum cybercrime marketplace through a coordinated international law enforcement operation that resulted in the arrest of its administrator. Casey Ellis contributed analysis on the significance of the takedown for the broader cybersecurity threat landscape and implications for future enforcement actions.
Microsoft Takes Down Russia’s Strontium Allies Attacking Ukraine
Security Boulevard reported on Microsoft's disruption of STRONTIUM, a Russian state-sponsored hacking group conducting attacks on Ukraine, by taking control of domains used in the campaign. Casey Ellis contributed analysis on the significance of the domain takedown action and its impact on the threat landscape.
DDoS Attacks Pepper Taiwanese Government Sites Security There are 24.6 billion pairs of credentials for sale on dark web
A report published by Infosecurity Magazine documents DDoS attacks targeting Taiwanese government websites during U.S. House Speaker Nancy Pelosi's visit in April 2022. Casey Ellis provided security context and analysis on the coordinated nature of the attacks and their geopolitical implications.
The US government called on hackers to identify vulnerabilities
CHIP published an article in April 2022 about the U.S. government enlisting white-hat hackers to identify security vulnerabilities through a new Department of Defense program. Casey Ellis is referenced as a key figure supporting government cybersecurity initiatives and vulnerability disclosure practices.
Pen Testing: Which Skills Can Help Cybersecurity Job Seekers?
A Dice article discusses penetration testing skills that cybersecurity job seekers need to advance their careers and meet employer demand. Casey Ellis contributes insights on the technical competencies and certifications that strengthen candidates' prospects in the pen testing field.
Upstart crime site woos Raid Forums orphans
ARN reported in April 2022 on the emergence of a new cybercrime forum called Breached, which sought to attract members displaced by the closure of RaidForums. Casey Ellis commented on the threat landscape shift and the dynamics of cybercriminal communities adapting to law enforcement action.
Beware of These 5 Tax Scams
Dark Reading's article by Steve Zurier, published April 4, 2022, lists five tax scams to watch for before the 2022 tax season. Casey Ellis, founder and CTO of Bugcrowd, advises companies to warn users, keep tested backups current, limit lateral movement for remote workers, and keep internal patching up to date.
Harnessing Neurodiversity Within Cybersecurity Teams
SecurityWeek published an article examining the role of neurodiversity in cybersecurity teams and strategies for recruiting and supporting neurodivergent professionals. Casey Ellis discusses how cognitive differences strengthen team capabilities and outlines practical approaches organizations can adopt to build more inclusive security workforces.
Upstart crime site woos Raid Forums orphans
CSO Online published this April 2022 article on Breach Forums, a new surface web forum launched as an alternative to the disrupted Raid Forums cybercrime community. Casey Ellis, CTO and founder of Bugcrowd, says a chunk of Raid Forums' activity is shifting to Breach Forums and that its disruption complicates threat intelligence gathering.
VMware Horizon platform pummeled by Log4j-fueled attacks
TheRegister reported on Sophos findings about malware campaigns exploiting the Log4j vulnerability to target VMware Horizon servers. Casey Ellis contributed analysis on the scope and implications of Log4j attacks against enterprise virtualization infrastructure.
Google Chrome Bug Actively Exploited as Zero-Day
A Threatpost article from March 2022 documents an actively exploited zero-day vulnerability in Google Chrome that prompted an emergency security patch. Casey Ellis commented on the severity of the vulnerability and the importance of rapid patching in response to in-the-wild exploitation.
Automaker Cybersecurity Lagging Behind Tech Adoption, Experts Warn
Threatpost published an article examining how automakers are adopting connected vehicle technology faster than they are implementing adequate cybersecurity protections. Casey Ellis contributed expert commentary on the gap between automotive innovation and security maturity in the industry.
Companies Going to Greater Lengths to Hire Cybersecurity Staff
Dark Reading published an article on strategies for aspiring cybersecurity professionals to enter the field and secure employment. Casey Ellis discusses hiring challenges in cybersecurity and offers perspective on what companies seek when recruiting talent for security roles.
Nation-State Hackers Ramp Up Ukraine War-Themed Attacks
Dark Reading published an article on nation-state-backed cyberattacks leveraging Ukraine war-themed phishing lures to compromise targets. Casey Ellis contributed analysis on the threat landscape and tactics being employed by state-sponsored actors in response to geopolitical tensions.
Don’t ignore Spring4Shell. But there’s still no sign it’s widespread
VentureBeat published an article on the critical Spring4Shell vulnerability affecting the Java Spring Framework and the need for organizations to prepare despite limited evidence of active exploitation. Casey Ellis comments on the vulnerability's severity and recommends that companies take preventive action rather than wait for widespread attacks to materialize.
New Platform Pushes Data, Dirty Pipe and DNS Tunnel Pollute Linux Plumbing
LinuxInsider published an article examining recent security vulnerabilities affecting Linux systems, including the Dirty Pipe privilege escalation flaw and DNS tunneling techniques used for command-and-control communications. Casey Ellis is cited for insights on the security threats and their implications for Linux infrastructure protection.
Google releases emergency security update for Chrome users after second 0-day of 2022
The Record by Recorded Future reported on Google's emergency security update for Chrome to address the second actively exploited zero-day vulnerability of 2022. Casey Ellis commented on the significance of the vulnerability and the importance of timely patching for users.
The history of Casey Ellis
The history of Casey Ellis is a 32-minute podcast episode from Hacker History Podcast, published March 22, 2022 on Apple Podcasts. In it, Casey, founder and chairman of Bugcrowd and co-founder of the disclose.io project, discusses his history with technology, a TV show he once hosted, and how his career began.
Hackers Are Targeting Your March Madness Bracket
TheStreet published an article about phishing scams and cyber threats that exploit March Madness bracket participation. Casey Ellis discusses how hackers leverage the tournament's popularity to target consumers and outlines practical security measures for protecting personal information during the event.
Lapsus$ gang sends a worrying message to would-be criminals
This March 17, 2022 article from The Register, a technology news publication, examines how the Lapsus$ gang's high-profile attacks may be inspiring other threat actors. Casey Ellis, CTO of crowdsourced security firm Bugcrowd, calls the group technically proficient and wonders whether global conflicts created an opening for it.
Devil-may-care Lapsus$ gang is not the aspirational brand infosec needs
A March 2022 article in The Register examines the activities of the LAPSUS$ extortion group and its breaches of major technology companies including Microsoft, Okta, and Nvidia. Casey Ellis comments on the group's reckless approach and its failure to represent a professional model for the cybercriminal underground.