Is there nothing that can be done to fight cyber-pirates? Are they really uber-geeks or do they have a weakness we can exploit to fight them?
By DAVID SHAMAHhaifa graf 88 224(photo credit: Courtesy photo)
The term "hacker" brings images of gloom and doom to mind. These are the cyber-pirates, the invincible race that can enter, control, and kill your computer at will. It's as if they were an all-powerful alien race that could, at the slightest whim, put us and our computers out of business - permanently.
Is there nothing that can be done to fight them? Are they really uber-geeks? Do they not have a weakness we can exploit to fight them?
Well, as it turns out, they do have one weakness: They love to see their names in lights. In other words, they're vain. And Israeli start-up SecureVision has a Web site where hackers can show off their Web page defacements - the sites they hack into, taking over Web servers and leaving a message - thus allowing the company's staff to easily identify the hack and the hacker, and enabling the company to know where Web sites are being hacked world wide and generate real statistics and track trends.
That, in fact, is exactly how the SecureVision staff were able to determine the location of the Iraqi hacker who managed to break into the MSN Israel Web page for Army Radio, just minutes after the defacement occurred.
The vanity showcase Web site for hackers to strut their stuff is just one method used by the SecureVision team, led by Moran Zavdi, to "harden" the protection of Web sites, mail servers, corporate networks and other computer systems from not only site defacements, but also invasion, server hijacking, industrial espionage and the million and one other things that can happen to a computer system that has "unprotected interfacing" with the Internet.
Zavdi, as well as the rest of his staff, know the ins and outs of the computer security business: CEO Zavdi has been hacking since he was a kid, and development manager Dina Shomer has been dealing with computers and security for some 20 years.
Web site defacements are all the rage among "script kiddies" - hackers who don't really innovate, but search Web forums and newsgroups for exploits they can copy and paste, using them against their targets. But according to Zavdi, there is no reason in the world sites like Galei Zahal, or, in a less publicized August incident, the IT Department of Haifa University site, should get defaced or otherwise attacked at all.
"Ideally, such attacks would not happen at all, if users were on top of security, installing all necessary patches and keeping ahead of the hackers," he says.
Certainly makes a lot of sense. So why would a system administrator not make sure their computers and servers were up to date with the latest and greatest?
"Because," says Shomer, "it's not just an operating system issue, in which users or administrators install Microsoft's patches. Thousands of software programs also need to be updated, and it's almost impossible to keep track of everything."
For example, Shomer says, an unprotected mail server could cost a company large amounts of money in lost business, if a rival company gets compromising information off the mail server by hacking into it.
And don't put it past your competitors to do such a thing, she says - hiring some script kiddies or professional hackers to do the dirty work for them.
"A mail server could get hijacked for spam or rifled through by hackers seeking important information if they can utilize an exploit your mail server is not protected from," she says. But many mail server programs in companies have been in place for years, and it's not unusual for new system administrators to even know what version of the mail server program is running, and whether it's the latest update. That, says Shomer, could be an open invitation to a hacker.
And that's where SecureVision comes in, she says.
The company's latest product, called iAware, is aimed at small businesses and organizations - and for about $30 a month, SecureVision's teams will provide a detailed analysis of everything there is to know about the computer systems' vulnerabilities when they are exposed to the Internet.
"With iAware, we scan for more than 15,000 different vulnerabilities, from open ports to missing patches to known security holes and the database is growing on a daily base," Shomer says.
This is far more than the port scan that most business servers utilize, satisfying themselves that they're "protected" - and it goes far beyond installing an anti-virus program or firewall (although both are must-haves, of course).
"Most companies, even large ones, perform a wide ranging security analysis only a couple of times a year" says Zavdi. "The problem is that new security holes pop up all the time since hackers work overtime seeking them out. SecureVision is the only company that performs weekly security analyses at prices that even small businesses can afford." (The iAware system, in which SecureVision remotely audits the doings on office computers and servers that are exposed to the Internet, and will ensure that they are protected.) For larger organizations, the company has a separate product, called ProAssesor, which uses advanced artificial intelligence to determine a system's vulnerability status at any given moment, "on the fly."
And, it can happen to anyone, Zavdi says - even to companies that claim to know security. Just a few weeks ago, the Web servers of Kerspersky, a large anti-virus program publisher, were either hacked or otherwise compromised in installations belonging to the company in various locations around the world, as their Web site was defaced - potentially making available valuable data.
"It's an absurd situation when an anti-virus company doesn't take care of its own vulnerabilities," Zavdi says.
SecureVision's technology has been in development for over two years. It's still small - the company currently has about 10 employees - but it's big in spirit, Shomer says, willing to take on the bad guys wherever and whenever they strike - using the same dirty tricks they employ against the common Web front.
It's a good thing Zavdi, Shomer and the rest of the SecureVision team are on our side - no telling what the Internet would look like if they ever went over to the "dark side!"
startup@newzgeek.com
if(catID != 151){
var cont = `Take Israel home with the new Jerusalem Post Store
