While the passions and confrontations of last year’s Arab spring have overthrown rulers of decades’ standing and injected life into stagnant political waters, they have also led to a spike in online cyber­attacks, as new electronic adversaries confront each other.

Over the past year, hackers have compromised the email account of Bashar al-Assad, the Syrian president, taken down the website of the Central Bank of the United Arab Emirates and gained access to the credit card numbers of thousands of Saudi citizens.

As the online world becomes a new front in the region’s many conflicts, banks and financial institutions – which often have the most to lose from a compromise of their technology infrastructure – are in the line of fire.

“Security has always been paramount for us since day one,” says Tony de Cristofano, the head of information technology for the Dubai Financial Services Authority, the regulator of the Dubai International Financial Centre.

“We haven’t really changed the way we look at it, but the issue is now much more out there and people are more aware of the threats.”

Headline-grabbing tales of compromised computer systems have helped people such as Mr de Cristofano convince those outside of technology circles – the rank-and-file staff and management in the Middle East’s finance industry – to take security much more seriously.

“Awareness is such a big part of it, and it can be difficult,” he says.

“It’s difficult for people to fathom the scale of the threat that is out there.”

The threats have taken on a new relevance in recent years.

As much of the Arab world’s political debate and public discussion moves to the less restricted, more inclusive online world, so too have the region’s conflicts from the battles between revolutionary youths and pro-regime hardliners to the animosity between Arabs and Israelis.

In each case, electronic fighters are confronting their enemies on new digital terrain, defacing websites, flooding social media sites with their messaging and breaking into enemy computer networks.

From the Stuxnet virus that was designed to cripple equipment in an Iranian nuclear facility, to simple denial-of-service attacks that flood a site with requests until it goes offline, the varying seriousness of the attacks matches the wide range of combatants on the field.

Governments are taking note.

In the UAE, a national emergency response team has been established to deal with cybercrimes, and Abu Dhabi now plays host to the regional edition of the Black Hat technology security conference.

In December 2011, the conference in the UAE capital was headlined with a keynote speech from former CIA director Michael Hayden, who spoke of the risks cybercrime poses to the region.

Conferences such as Black Hat, designed to engage regional decision-makers in issues of digital security, come as the increasingly tech-savvy young populations of the region become more capable of driving indigenous cyberattacks.

While the Arab world is still a smaller source of international hacking attacks than central and eastern Europe or Asia, an upward trend in malicious activity within the region has been noted by security experts.

In January 2012, during a tit-for-tat battle between Arab and Israeli hackers that saw the websites for banks on both sides of the conflict taken down, researchers at Kaspersky Lab, one of the world’s biggest cybersecurity companies, noticed something novel.

It was one of the first organised cyberattacks to be entirely directed from within the Middle East.

The attack made use of a so-called “botnet”, a network of hundreds of home computers that had been infected with a virus and, unknown to their owners, used to participate in denial-of-service attacks and similar hacks.

The botnet “was very unusual in that it was using command and control servers in Israel, and the software was found mostly on Iranian computers”, said Costin Raiu, director of global research and analysis at Kaspersky, at the time of the discovery.

The way the viral software was written, he said, indicated the hackers “were interested in getting something done quickly”.

Political differences are not the only reason hackers set their sights on Middle Eastern financial institutions.

The riches of the Gulf – which are growing in 2012 thanks to a sustained period of historically high oil prices – mean hackers are heading to the region just as keenly as international businesses eager to get in on the action.

“The Middle East is no different to any other region in the world in terms of the vulnerabilities and the opportunities for hackers, but it’s an increasingly appealing territory because of the wealth that is available,” says Ray Kafity, the Middle East sales director for FireEye, a technology security company.

“People are drawn to it.”

Get alerts on Arab banking & finance when a new story is published

Copyright The Financial Times Limited 2019. All rights reserved.
Reuse this content (opens in new window)

Follow the topics in this article