Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
Sanctions Halt Rewards for Bug Hunters in Belarus, Russia
BankInfoSecurity published an article examining how international sanctions on Russia and Belarus have disrupted bug bounty payments to security researchers in those countries. Casey Ellis discusses the operational and ethical challenges these restrictions create for vulnerability disclosure platforms and their researcher communities.
7 old attack vectors cybercriminals still use
CSO published an article on March 15, 2022, examining seven longstanding attack vectors that cybercriminals still exploit effectively, including phishing and unpatched software. Casey Ellis contributed analysis on why these older methods remain dangerous despite years of security awareness and patching efforts.
SEC Proposal Would Impose Stricter Timeline for Public Companies Reporting Cyberattacks
Channel Futures reported on an SEC proposal requiring public companies to disclose cyberattacks within four days of discovery. Casey Ellis commented on the implications of the stricter reporting timeline for corporate security practices and incident response protocols.
More on President Biden’s digital assets Executive Order. Reaction to the Strengthening American Cybersecurity Act. Response to SEC’s incident reporting proposal.
CyberWire's policy briefing newsletter from March 2022 covered the Biden administration's digital assets executive order, the Strengthening American Cybersecurity Act, and the SEC's incident reporting proposal. The briefing included Bugcrowd's designation as a CVE Numbering Authority, a recognition of the platform's role in coordinating vulnerability disclosures.
Vice Society Publishes LA Public School Student Data, Psych Evals
Dark Reading reported on Vice Society's publication of sensitive data stolen from the Los Angeles public school system, including student psychological evaluations. Casey Ellis commented on the breach's implications for school cybersecurity and the need for improved data protection measures in educational institutions.
Palo Alto: More than 100,000 infusion pumps vulnerable to 2 vulnerabilities
ZDNet reported on security research from Palo Alto Networks identifying over 100,000 medical infusion pumps vulnerable to two significant security flaws. Casey Ellis contributed analysis of the vulnerabilities and their potential impact on healthcare device security and patient safety protocols.
The internet's autoimmune problem: how ethical hackers face prosecution to this day
A Cybernews article examines the ongoing legal risks that ethical hackers encounter despite the expansion of bug bounty programs. Casey Ellis discusses how the disconnect between security research and legal frameworks leaves researchers vulnerable to prosecution and advocates for clearer protections.
Ukraine deserves an IT army. We have to live with the fallout
VentureBeat published Casey Ellis's analysis of Ukraine's volunteer IT Army formed in response to the Russian invasion. Ellis examines the ethical tensions and long-term consequences of state-endorsed hacktivism, arguing that while Ukraine's defensive response is justified, the precedent raises complex questions about accountability and international norms.
Supply chain integration issues costing 38% of companies $500,000 or more a year
An SC Media report details research showing that supply chain integration problems are costing 38 percent of companies $500,000 or more annually. Casey Ellis contributed to the findings on the financial impact of supply chain security gaps and integration challenges affecting enterprise operations.
Whether Ukraine is in a ‘cyberwar’ or not, it’s getting bad
VentureBeat published an analysis of escalating cyber attacks during the Russian invasion of Ukraine, examining the involvement of hacktivist groups and distributed denial-of-service operations. Casey Ellis provided commentary on the nature and scope of the cyber conflict unfolding alongside conventional military operations.
Ukraine-Russia Cyber Warzone Splits Cyber Underground
Threatpost published an article examining how the Russia-Ukraine conflict is fracturing the cybercriminal underground and forcing ransomware groups to take geopolitical stances. Casey Ellis is quoted discussing the implications of these divisions for threat intelligence and the evolving landscape of organized cybercrime.
How to Avoid Being Hacked By the Russians
TheStreet published an article titled "How to Avoid Being Hacked By the Russians" offering cybersecurity advice and best practices for individuals and businesses. Casey Ellis contributed guidance on protecting against potential Russian-sponsored cyber threats.
Chipmaker Nvidia Suffers a Major Blow
A TheStreet article from February 2022 reports on a major data breach at Nvidia in which the LAPSUS$ hacking group claimed to have stolen approximately one terabyte of proprietary data from the chipmaker. Casey Ellis commented on the incident and the broader implications of the breach for corporate security practices.
What You Can Do to Protect Yourself From a Cyberattack
NBC Bay Area published a local news segment offering practical tips for protecting personal information and devices from cyberattacks. Casey Ellis contributed expert guidance on cybersecurity precautions that individuals can implement to reduce their vulnerability to attacks.
Ice Phishing Takes Advantage of Tectonic Shift to Web3
Security Boulevard published this February 2022 article on ice phishing, a Web3 scam that uses urgency and loss aversion to trick users into signing malicious transactions. Casey Ellis, founder and CTO at Bugcrowd, says speed is the natural enemy of good security unless continuous feedback and user education are built in from the start.
Cybercriminals Have yet to Exploit Russia-Ukraine Tensions
Security Boulevard published an article in February 2022 examining the absence of widespread cybercriminal exploitation tied to Russia-Ukraine tensions at that time. Casey Ellis provided analysis on threat actor behavior and the evolving security landscape during the geopolitical crisis.
Skyrocketing cryptocurrency bug bounties expected to lure top hacking talent
A CSO article from February 2022 examines how cryptocurrency and Web3 companies are offering substantial bug bounty rewards to attract security researchers. Casey Ellis comments on the competitive dynamics of these high-value bounties and their impact on talent recruitment in the emerging blockchain security sector.
New Zealand government mandates bug reporting process for federal agencies
PortSwigger Daily Swig reported on New Zealand's mandate requiring federal agencies to establish formal vulnerability reporting processes for security researchers. Casey Ellis was cited as supporting the policy initiative, emphasizing the importance of structured bug disclosure channels for government entities.
Microsoft's latest vulnerability: 'Clear disclosure, rapid fix'
VentureBeat's February 2022 article reports on a Microsoft vulnerability affecting Windows 10 and Windows 11 PCs and Windows Server 2019 and 2022. Casey Ellis, Bugcrowd's founder and CTO, says the flaw mainly boosts attackers who already have initial access, shifting prevention focus from stopping intrusion to assuming and containing it.
New Cyber Safety Review Board Will Tackle Log4j Debacle First
Security Boulevard published this February 2022 article on the Department of Homeland Security's launch of the Cyber Safety Review Board. Casey Ellis, co-founder and CTO at Bugcrowd, hopes the board will focus on broader lessons like open source supply chain security and holiday-season incident response, not just Log4j.
Microsoft Win32k bug added to CISA's exploited vulnerabilities list
A ZDNet article reports on CISA's addition of a Microsoft Win32k privilege escalation vulnerability to its list of known exploited bugs requiring federal agency patching. Casey Ellis commented on the vulnerability's severity and the importance of timely remediation for affected systems.
The teenage hackers paid millions to expose corporations’ weak spots
The Telegraph published a feature article examining how corporations pay large sums to ethical hackers, including teenagers, through bug bounty programs to identify security vulnerabilities. Casey Ellis is cited as a key figure in legitimizing and scaling this practice through his work in the bug bounty space.
Updates released for multiple vulnerabilities found in 42 Gears' SureMDM products - ZDNET
This ZDNet article, published January 31, 2022, reports on security updates 42 Gears released for multiple vulnerabilities in its SureMDM products, following research by Immersive Labs. Bugcrowd founder Casey Ellis takes a positive view of the disclosure timeline, praising 42 Gears for openness to external security feedback and Immersive Labs for organized, professional conduct.
42 Gears’ SureMDM platform was potentially open to supply chain attack
SC Media reported on the discovery of multiple vulnerabilities in 42Gears' SureMDM platform that could have enabled supply chain attacks against its customers. Casey Ellis contributed analysis of the security findings and their potential impact on enterprise mobile device management deployments.
Why Ransomware Remains Top Priority for IT and Security Pros
A Dice article examines why ransomware continues to rank as a critical concern for IT and security professionals due to its potential for widespread disruption and financial damage. Casey Ellis discusses the persistent threat ransomware poses to organizations and the strategies security teams employ to defend against evolving attack methods.
Vulnerability Disclosures Rise to Meet Federal Requirements
A Security Boulevard article from January 2022 examines the rise in vulnerability disclosure programs driven by U.S. federal requirements and CISA directives. Casey Ellis comments on how federal mandates are prompting organizations to establish clearer processes for receiving and managing vulnerability reports.
Cybersecurity industry trends from 2021 bound to shape this year's threat landscape - Help Net Security
Help Net Security published this January 2022 article on Bugcrowd's report on 2021 cybersecurity trends, including rising crowdsourced security adoption. Casey Ellis, Bugcrowd's CTO, says an emerging ransomware economy and blurring lines between state actors and e-crime groups have democratized threats, and he expects more of the same in 2022.
Moncler discloses data breach. Ransomware in the public and not-for-profit sectors. Vulnerability trends. Pegasus update.
The Cyber Wire's Privacy Briefing for January 19, 2022, covers data breaches, ransomware threats across sectors, and vulnerability trends. Casey Ellis contributed to a Bugcrowd report highlighting a significant rise in serious vulnerabilities targeting the financial sector.
Bugcrowd reports increase in critical vulnerabilities found in 2021
A ZDNet press article reports on Bugcrowd's findings of a 185% increase in high-risk vulnerabilities discovered in the financial services industry during 2021. Casey Ellis, Bugcrowd's founder and chief technology officer, provided analysis and commentary on the security trends and implications for financial sector organizations.
High risk vulnerabilities in fintech soar over the past year - BetaNews
BetaNews published this January 2022 article reporting that financial services companies on the Bugcrowd platform saw a 185 percent rise in Priority One submissions. Casey, founder and CTO of Bugcrowd, says threats have democratized through a ransomware economy and blurred lines between state actors and e-Crime groups.