Paypal to acquire Israeli cybersec firm CyActive

CyActive, an Israeli start-up that says its technology can disable viruses before they are even created, is being acquired by international payments firm Paypal. Terms of the deal were not disclosed, but sources said that the deal was worth at least $60 million.

This will be PayPal’s second acquisition in Israel. In 2008, the company bought out financial fraud monitoring company FraudSciences for $169 million.

The CyActive buyout sum is a significant one for a company that is barely a year old, and which already has substantial numbers of customers for its security technology.

CyActive’s technology takes advantage of what CEO Liran Tancman calls “laziness” on the part of hackers. “Much of the code found in even major attacks is reused over and over again in new attacks,” Tancman said. “There has actually never been a hack attack that did not draw substantially on components that were already in existence.”

By isolating these components, CyActive believes it can mitigate these attacks, halting “lazy” hackers who keep reusing code in their tracks.

CyActive has developed smart algorithms that Tancman says explore and analyze malware to see where it came from, and where it is going. “You can see very clearly what the ‘keychain of exploitation’ is, the methods hackers are using now and the variants they are likely to use,” said Tancman. “Even the major attacks of recent years, like Flame, Stuxnet, and others, use a similar core.”

By disabling those components – key to the malware’s functioning – CyActive can disable the malware altogether.

In a report released in January, CyActive listed the top five “recycled” viruses of 2014. According to the company’s analysis, the viruses with the greatest “hacker return on investment” (in this case, amount of damage done or resources pillaged for the least amount of cost on their part) were all based on recycled components, rehashed from previous malware attacks to once again inflict damage. In all, there were 35 reused components in the top five attacks. Those five – Snake, Black POS, Gyges, Dragonfly, and Zberp – caused no end of trouble for system administrators and security firms.

Even what was arguably the most destructive virus of 2014 – the server hack that nearly ruined the business of Sony Pictures by releasing movies and confidential e-mails last November – was largely a “rerun. There is much similarity, both in code and methods, between the malware that hit Sony — Trojan Destover\BKDR_WIPALL.A, — and two other data-erasing malware – Disttrack\Shamoon — that hit Saudi company ARAMCO in 2012, and the DarkSeoul attack on South Korean banks and TV broadcasters in 2013,” CyActive said in its report. “Even in such damaging scenarios, the cyber attacker’s tools are reused. For them, if it worked once, tweak it a bit and it will work again. The attack on Sony demonstrates quite clearly that this method works quite well.”

CyActive’s technology can beat those “repeaters,” and disable new viruses that are based on the existing ones, said Tancman. “Since we know what goes into such malware, we can defend against that specific vulnerability, as well as others that hackers are likely to go after that are related to the original hack. CyActive’s system does this by analyzing the vulnerability and seeing what directions hackers are likely to take in order to ‘retool’ it to get around existing anti-virus systems.

“Instead of being on the defensive, we can develop these anti-virus tools before the new hacks are even created, putting the burden on the hackers,” added Tancman.

CyActive was was the first start-up accepted into a cyber-security accelerator established by Jerusalem Venture Partners (JVP) in Beersheba. According to Yoav Tzruya, a partner at JVP and a member of CyActive’s board, “this technology is just amazing and a great example of the cyber-security capabilities being developed in Israel at JVP’s incubator. What they are essentially doing is applying the principles of genetic computation to detect the next generation of viruses.”