Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
#87 - Hacker History: The Colonial Pipeline
The Cybersecurity Defenders Podcast, published December 28, 2023, is an episode recounting the May 2021 Colonial Pipeline ransomware attack that halted operations and led to a ransom payment. Casey Ellis, Founder and CSO at Bugcrowd, joins as a guest to help tell the story of the attack and its aftermath.
Inside Bugcrowd's plans to “demystify” AI security with new vulnerability reporting scheme
This IT Pro article, published December 20, 2023, examines Bugcrowd's plan to add vulnerabilities in large language models to its Vulnerability Rating Taxonomy (VRT). In it, chief strategy officer Casey Ellis says the standardized approach helps demystify the technology, broaden hacker participation, and create more transparent vulnerability reporting.
The Unlikely Romance of Hackers and Government Suitors
This Dark Reading commentary from December 14, 2023, examines how most federal infrastructure is managed by contractors and how hackers and government officials interact. Casey Ellis, principal at Tall Poppy Group, argues that decades of hacker community education and Capitol Hill partnership produced bills like this one.
Critical Cisco SMB Router Flaw Allows Authentication Bypass, PoC Available Critical Cisco SMB Router Flaw Allows Authentication Bypass, PoC Available Critical Cisco SMB Router Flaw Allows Authentication Bypass, PoC Available
A Dark Reading article details a critical authentication bypass vulnerability in Cisco small-to-medium business routers with publicly available proof-of-concept exploit code. Casey Ellis contributed security analysis and context on the vulnerability's impact and remediation guidance for affected organizations.
401 Access Denied Podcast Ep. 94
This broadcast episode, Ep. 94 of the 401 Access Denied Podcast, was published by 401 Access Denied on November 29, 2023. Casey Ellis, founder of Bugcrowd, appears as a guest alongside host Joseph Carson to discuss coordinated vulnerability disclosure and its evolution within the cybersecurity field.
Why transparency and accountability are important in cyber security | Computer Weekly
This opinion column, titled "Why transparency and accountability are important in cyber security," was published by ComputerWeekly.com on 21 November 2023. Casey Ellis, founder and chief strategy officer at Bugcrowd, argues that accepting human fallibility with good grace could improve cyber standards, and he opens by invoking Auguste Kerckhoffs and Claude Shannon.
Hacking is not a crime, criminal activity is
IT Pro, a technology news publisher, ran this 2023 press piece arguing that the law should draw a clearer line between ethical hacking and cyber crime. Casey Ellis, founder of the crowdsourced security platform Bugcrowd, warns that weak legal protection could discourage ethical hackers and urges the UK to mirror US reforms.
Cyber Incident at DP World Australia Shut Down Port Operations, Backed Up 30,000 Shipping Containers - CPO Magazine
This CPO Magazine article covers a cyber incident at DP World Australia that shut down port operations and backed up about 30,000 shipping containers. Casey Ellis, founder and Chief Strategy Officer at Bugcrowd, says the outsized effect of such an attack on markets and supply chains is what makes this target unique.
How to Turn Off Facebook’s Two-Factor Authentication Change
This WIRED article from November 16, 2023, explains how to turn off Meta's automatic trust for frequently used devices in Facebook's updated two-factor authentication process. Casey Ellis, founder and chief strategy officer at Bugcrowd, says that automatic device trust locks in long-term access to logged-in accounts, and he is uneasy about the change.
IBM: New Gootloader Variant Moves Laterally and Is Harder to Detect
Security Boulevard reports on a new Gootloader variant using a different method for command-and-control and lateral movement, making it harder for enterprise defenses to detect. Casey Ellis, chief strategy officer at Bugcrowd, calls the operation a very organized and thoughtful initial access broker whose opportunistic SEO deployment suits that attack model.
European reaction to Biden’s Executive Order on AI
The November 1, 2023 SC Media UK article on European reactions to Biden's Executive Order on AI covers a US order ensuring AI systems are extensively vetted before public release. Casey Ellis, CTO and founder of Bugcrowd, says the order reflects a proactive approach to managing AI's promise while mitigating its risks.
Global AI Cybersecurity Agreement Signed At Turing's Bletchley Park
This Dark Reading article from November 2023 covers a global agreement on AI cybersecurity signed at Bletchley Park, the British home of WWII codebreakers. Casey Ellis, founder and CTO of Bugcrowd, says the agreement shows global leaders taking a proactive approach to developing safe AI, calling the Bletchley Declaration a significant step forward.
BOLD TALKS with Casey Ellis founder of Bugcrowd
BOLD Talks is a 2023 broadcast video interview, hosted on YouTube and published by the BOLD Awards on October 27, 2023. In this episode of the series, Casey Ellis is featured as a guest speaker, and the program identifies him as the founder of the crowdsourced security platform Bugcrowd.
The EU’s Cyber Resilience Act needs some fine-tuning
This SC Media perspective column, dated October 16, 2023, is titled "The EU's Cyber Resilience Act needs some fine-tuning" and is written by Casey Ellis, Bugcrowd co-founder and CTO. Casey argues that the EU's proposed vulnerability disclosure rules could limit ethical researchers' access to VDP testing and invite attacks on exposed vulnerabilities.
Dave Gerry and Casey Ellis - TechSpective Podcast 119 - YouTube
TechSpective Podcast 119 features Dave Gerry and Casey Ellis discussing artificial intelligence's role in cybersecurity. Ellis examines how AI affects attack costs, expands access to technical expertise, and enables automation of reconnaissance and lateral movement tactics.
MGM Resorts Refused to Pay Ransom but Lost $100 Million in Wake of Cyberattack
A Gizmodo article from October 6, 2023, reports that MGM Resorts declined to pay a ransom after a September cyberattack that cost about $100 million. Casey Ellis, a cybersecurity expert, tells News3 Las Vegas that the cost is a lot of money, and that MGM's ability to recover suggests its defenses were not sufficient.
Russian Firm Looks to Corner the Market on Mobile Zero-Day Exploits With Standing Offer of up to $20 Million - CPO Magazine
This October 2023 CPO Magazine article covers Operation Zero, a Russian firm offering up to $20 million for mobile zero-day exploits. Casey Ellis, founder and CTO of Bugcrowd, notes these sales are highly regional and says dealing with Operation Zero would violate technology and financial transfer sanctions.
New EU vulnerability disclosure rules deemed an "unnecessary risk"
This IT Pro article from October 2023 examines how disclosure rules in the EU Cyber Resilience Act could affect security research. Casey Ellis, founder and CTO of Bugcrowd and a signatory to an open letter, told ITPro the rules could have a chilling effect on good-faith researchers and white hat hackers.
Russian Company Offers $20m For Non-NATO Mobile Exploits
This Infosecurity Magazine article, dated September 29, 2023, covers Operation Zero, a Russian firm offering up to $20 million for non-NATO mobile exploits. Casey Ellis, founder and CTO of Bugcrowd, says working with the firm would breach US technology and financial transfer sanctions, and calls the $20 million offer irrationally high for a full mobile chain.
Hackers Let Loose on Voting Gear Ahead of US Election Season
This Dark Reading article from September 2023 covers ethical hackers given voluntary access to voting scanners, ballot markers, and electronic pollbooks. Casey Ellis, founder and CTO of Bugcrowd, says in an emailed statement that security research happens whether vendors invite it or not, and that this approach makes the democratic process more resilient.
Hacker Conversations: Casey Ellis, Hacker and Ringmaster at Bugcrowd
This SecurityWeek interview, published September 19, 2023, is part of its Hacker Conversations series, written by Kevin Townsend. Casey Ellis, founder, chairman and CTO of Bugcrowd, explains his own definition of a hacker and discusses the crowdsourced ethical hacking platform that runs bug bounty programs for organizations.
The Future of Cybersecurity: Generative AI and its Implications
The Data Exchange with Ben Lorica published this September 14, 2023 podcast episode on generative AI and cybersecurity. Casey Ellis, Founder, Chair and CTO of Bugcrowd, discusses the security implications of AI and insights from the company's "Inside the Mind of a Hacker 2023" report on hacker motivations and specializations.
CoC Asks SEC for More Time to Implement Cyber Reporting Rule
This August 2023 Security Boulevard article reports that the U.S. Chamber of Commerce asked the SEC for more time to implement its proposed cyber incident reporting rules. Casey Ellis, founder and CTO of Bugcrowd, says the concerns are valid but near-total opacity stops shareholders from managing their own risk.
S06E06 - Bug Bounties Unleashed: A Deep Dive into Infosec with Casey Ellis, Founder of BugCrowd
This podcast episode, published August 24, 2023 by The RSnake Show on Apple Podcasts, features a conversation recorded in Las Vegas during Black Hat. In it, Casey explains how he moved into bug bounties, built BugCrowd, changed the economics of bug finding, and shares views on AI's fragility in security, entrepreneurship, and mentoring.
All Your Vulns Are Belong to Terms and Conditions
A talk titled "All Your Vulns Are Belong to Terms and Conditions" was presented at DEF CON 31 in August 2023. Casey Ellis examines how vulnerability disclosure policies and legal frameworks shape the security research landscape and researcher protections.
Joint Advisory Warns of Threat From IDOR Vulnerabilities
This Security Boulevard article reports on a joint ACSC, CISA and NSA advisory warning that insecure direct object reference (IDOR) flaws pose a major threat. Casey Ellis, founder and CTO of Bugcrowd, is quoted calling IDOR simple to abuse, since editing a number in a user's URL can expose another user's data.
Hungry, Hungry Hackers: A Hacker's Eye-view of the Food Supply
A talk at BSidesLV in August 2023, "Hungry, Hungry Hackers: A Hacker's Eye-view of the Food Supply" examines security vulnerabilities in food systems from an attacker's perspective. Casey Ellis discusses the threat landscape facing the food supply chain and the importance of addressing critical security gaps in this essential infrastructure.
CISA, Australia warn of IDOR vulnerabilities after major breaches
The Record published this July 28, 2023 news article on a joint CISA and Australian agency warning about IDOR vulnerabilities that let attackers alter or delete data. BugCrowd CTO Casey Ellis says changing a number in a URL can expose another user's data, and suggests the Optus breach likely prompted the advisory's timing.
The Rise of QR Codes Spurs Rise in 'Fresh Phish'
A July 2023 Security Boulevard article reports on INKY research showing attackers increasingly use QR codes to phish credentials. Casey Ellis, founder and CTO at Bugcrowd, says QR codes are inherently untrustworthy, yet the COVID-19 pandemic pushed them into highly trusted uses, which makes them an attractive delivery vehicle for attackers.
Hackers: We won't let artificial intelligence get the better of us | Computer Weekly
This Computer Weekly article from ComputerWeekly.com, published in July 2023, examines how artificial intelligence is changing the work of ethical hackers. Casey Ellis, Bugcrowd founder and CTO, says hacking is now seen as a skill and notes that under-18 participation rose from 3% to 6% year-on-year.