Feeds

Anti-virus hacking contest polarizes vendors

Race to Zero intolerance

The Essential Guide to IT Transformation

Security firms have split over the merits of a hacking contest aimed against anti-virus packages planned for August's Defcon conference.

Anti-virus firm Sophos reckons the exercise will serve only to increase the volume of malware in circulation, further taxing the resources of already hard-pressed security firms. However, net security services firm MessageLabs reckons the proposed Race to Zero competition has some merits as an exercise. It compared the wheeze to penetration testing against corporate networks.

During the proposed Race to Zero contest, delegates to the Defcon hacker conference will be invited to develop techniques to modify supplied virus samples so that these variants are able to evade detection by anti-virus packages. The contest will progress in difficulty leading to awards at its conclusion including "most elegant obfuscation" and "most deserving of beer" as well as an overall winner.

Contest organisers said that the exercise will help to demonstrate shortcomings in signature-based virus detection. They also want to highlight weaknesses among anti-virus vendors exposed by the testing process, which will involve passing modified samples through a number of antivirus engines housed on a closed portal. Modified samples will not be released into the wild, the organisers explain. Results of the contest, a fringe event planned outside the main Defcon conference programme, are due to be presented during the annual Las Vegas-based hacking jamboree.

Despite these assurances some security vendors are less than impressed. Graham Cluley, senior technology consultant for Sophos, said: "The last thing the world needs is more malware. It's really disappointing to see that Defcon appears to be condoning the creation of malware in this way.

"If people really want to test the quality of different anti-virus products there are well established ways of doing it - and testing industry initiatives like AMTSO [Anti-Malware Testing Standards Organisation] are working hard at improving standards," he added.

Anti-virus firms will be obliged to add detection for malware variants created during the Race to Zero contest in order to ensure that they are not "dinged" in future tests which may include them, Cluley added. "That means that anti-virus researchers will be working at detecting malware that needn't have ever been created in the first place - analysing code inspired by the Race To Zero competition rather than working on detecting the latest malware written by criminal hackers.

"The end result is that detection databases grow in size, require more memory and take up more space on users' computers - all because Race to Zero thought this was a good idea."

Would-be participants in the contest are being encouraged to practice prior to the contest. Another bad idea, according to Cluley. "Race to Zero's website is linking to known virus exchange websites and suggesting that interested parties 'hone their skills' by practising on malware based on those sites. The opportunity for amateurs to make mistakes and release malicious code into the wild is worryingly high."

Other security experts are more sanguine. Alex Shipp, a researcher at web security firm MessageLabs, said at least some of the six stated aims of the contest are likely to be realised.

"I have found research along similar lines to the contest to be valuable in the past, so although the results of this particular contest might not be useful to me, the general idea of investigating my own product by trying to find and fix its weaknesses is valid and seems to me similar to the concept of pen testing," Shipp told El Reg.

Plans to mount the first Race to Zero contest were announced last week in a posting to a security mailing list. Organisers of the contest are yet to respond to a request for comment on the merits of the exercise.®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.