Israel makes headway in cyber security
In a quiet corner of an Israeli farming village, Tanya sits at her computer and chats online with some of the most skilled hackers in cyberspace. Some are just having fun; others are planning heists of credit card details, or denial-of-service attacks that would cripple targeted websites.
None of them knows who they are talking to, or indeed that they are all interacting with the same person – Tanya juggles more than 20 different identities and screen names, each with its own avatar, full background history and social media accounts.
Tanya (who declined to disclose her last name) works for SenseCy, an Israeli cyber intelligence service that aims to use old-school spy tactics to unearth – and warn clients about – cyber attacks before they happen. By engaging with the hackers on their own turf Tanya learns who will be targeted next, and how.
SenseCy is part of a new generation of cyber security companies that have risen in the past few years to challenge incumbents such as Intel Security, formerly McAfee, that are best known for their PC antivirus software.
Cyber attacks are rising, up 14 per cent last year, according to data from Cisco, and boardrooms are getting increasingly worried about the potential threats to their business, after a Russian teenager was linked with the theft of over 70,000 customer details from Target, the US retailer.
The new generation of cyber security companies is growing in clusters in Silicon Valley, Washington DC and Atlanta but Israel is making headway: a quarter of all venture capital funded cyber security start ups are headquartered in Israel, according to research firm PrivCo.
Instead of using firewalls or other automated cyber-defences, SenseCy and its rivals CrowdStrike and iSight Partners, which work with the FBI and NSA, run private intelligence services that serve as a proactive form of cybersecurity.
In December 2013, Tanya and her colleagues heard the first stirrings of a cyber attack codenamed #OpIsrael planned for April this year by AnonGhost, a Tunisian hacktivist group. In closed forums, AnonGhost provided supporters with a target list and attack tools, including a self-developed malware called AnonGhost DdoSer.
Since SenseCy’s operatives were already inside the loop, they were able to download and analyse the malware when AnonGhost released it. The information was passed to clients on the target list, enabling them to reconfigure their cyber-defences and repel the attack.
“We collect data about cyber threats and send that data analysed to our clients,” says Assaf Keren, VP of Cyber Solutions at SenseCy and the former head of Israeli government cyber security. “We have a very large capacity and methodology in how to go online and find information which is available on the internet but not available to somebody just googling ‘cyber-threats’.”
“We do something called ‘virtual humint’ [human intelligence]. We operate avatars or characters using our analysts. We create content and a personality and put them inside the areas which are interesting,” he says.
SenseCy was established in February by parent company Terrogence, which has used techniques such as those used by Tanya for the past decade, though mainly to expose potential real-world terror and criminal plots.
“Our clients are everybody who has something to protect. They range from governments to midsize enterprises,” says Mr Keren.
Unlike many Israeli start-ups, where the founders learnt technical skills and bonded during their military service, none of SenseCy’s analysts draws directly on Israeli military experience because such tactics are not yet part of the official cyber-defence strategy of Israel – or that of most other countries.
“The methodology was developed here almost 10 years ago and is unique,” says Mr Keren. “We are teaching governments how to do this. Government intelligence agencies generally started getting into this field two years ago,” he says.
SenseCy analysts must know how to juggle online identities and operate in hostile cyberspace. The company specialises in Arabic, Farsi, Turkish, Russian, European languages and English, reflecting Israel’s immigrant population. Mr Keren admits that Chinese and Asian languages and cultures are more of a challenge.
Keren Elazari, a cybersecurity industry analyst for Gigaom.com and former hacker, says such work complements mechanised cyber-defences.
“The firewalls and antivirus engines are simply not detecting a lot of these advanced attacks. If we can get them with intelligence from those forums and know more about how that malware works, we are that much more prepared to stop it,” says Ms Elazari.
“This intelligence-gathering capability and presence takes years to cultivate,” says Ms Elazari. “It’s becoming complementary and sometimes even mandatory in order to enhance whatever the technical measures can do.”
Giora Engel, a founder of Light Cyber, an Israeli cyber security company specialising in automated breach detection, says the ‘human intelligence’ approach has its limits because a tightly knit group is less likely to communicate through semi-public chat.
“It’s complementary to what we do, but it can’t cover the whole attack surface,” says Mr Engel. “Many attacks are carried out by small groups of people who already know each other and don’t use these kind of forums. You cannot penetrate a group that already knows each other.”