Sam Curry

Sam Curry (born October 17, 1999) is an American ethical hacker, bug bounty hunter, and founder. He is best known for his contributions to web application security through participation in bug bounty programs, most notably finding critical vulnerabilities in 20 different auto manufacturers including Porsche, Mercedes-Benz, Ferrari, and Toyota. In 2018, Curry began working as a security consultant through his company Palisade where he disclosed vulnerability publications for security findings in Apple, Starbucks, Jira, and Tesla.

In 2021, Palisade was acquired by Yuga Labs where Curry currently works as a security engineer. In 2023, Curry was detained and summoned to testify within a Grand Jury by the IRS-CI and DHS on wrongful suspicion of running a high-profile phishing website.

Curry has spoken on ethical hacking, web application security, and vulnerability disclosure at conferences including DEFCON, Black Hat Briefings, Kernelcon, and null.

Biography

Curry grew up in Omaha, Nebraska and attended Elkhorn High School. He began hacking at the age of 12, ethically disclosing vulnerabilities to various vendors over email. At University of Nebraska Omaha, Curry worked with students through the cyber security club NULLify.

Publications and articles

• "Researchers Secure Bug Bounty Payout to Help Raise Funds for Infant’s Surgery". vice.com. Retrieved June 2, 2021.
• "Pega Infinity hotfix released after researchers flag critical authentication bypass vulnerability" portswigger.net. Retrieved June 2, 2021.
• "We Hacked Apple for 3 Months: Here’s What We Found". samcurry.net. Retrieved April 9, 2021.
• "Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bounty". samcurry.net. Retrieved November 3, 2019.
• "Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More". samcurry.net. Retrieved November 26, 2023.
• "Hackers Could Have Scored Unlimited Airline Miles by Targeting One Platform". wired.com. Retrieved March 23, 2024.
• "Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds". wired.com. Retrieved March 23, 2024.