AV Firms Split Over Defcon Contest

Use Netsparker


Now this is a pretty interesting contest from the guys at Defcon, antivirus evasion! It’s a question that gets asked a LOT…how do I avoid AV?

There are various ways to do it and I’ll be interested to see which are used in the contest, the most elegant solutions of course get better prizes.

Security firms have split over the merits of a hacking contest aimed against anti-virus packages planned for August’s Defcon conference.

Anti-virus firm Sophos reckons the exercise will serve only to increase the volume of malware in circulation, further taxing the resources of already hard-pressed security firms. However, net security services firm MessageLabs reckons the proposed Race to Zero competition has some merits as an exercise. It compared the wheeze to penetration testing against corporate networks.

During the proposed Race to Zero contest, delegates to the Defcon hacker conference will be invited to develop techniques to modify supplied virus samples so that these variants are able to evade detection by anti-virus packages. The contest will progress in difficulty leading to awards at its conclusion including “most elegant obfuscation” and “most deserving of beer” as well as an overall winner.

I am of course pro-knowledge, so I think this contest is a great idea. As stated similar research conducted in the past has been useful..so why not this time?

Personally I think signature based virus detection is very weak and heuristic scanning is nowhere near as good as it should be. The AV vendors needs to get their collectives acts together and develop some cool new stuff that effectively blocks unknown malware rather than permanently playing a catch-up game.

Contest organisers said that the exercise will help to demonstrate shortcomings in signature-based virus detection. They also want to highlight weaknesses among anti-virus vendors exposed by the testing process, which will involve passing modified samples through a number of antivirus engines housed on a closed portal. Modified samples will not be released into the wild, the organisers explain. Results of the contest, a fringe event planned outside the main Defcon conference programme, are due to be presented during the annual Las Vegas-based hacking jamboree.

Despite these assurances some security vendors are less than impressed. Graham Cluley, senior technology consultant for Sophos, said: “The last thing the world needs is more malware. It’s really disappointing to see that Defcon appears to be condoning the creation of malware in this way.

“If people really want to test the quality of different anti-virus products there are well established ways of doing it – and testing industry initiatives like ATMSO are working hard at improving standards,” he added.

I would have thought Sophos were amongst the more progressive AV vendors, but it seems not so. Anyway it’s definitely something to watch and we’ll be keeping an interested eye on it.

Source: The Register

Posted in: Countermeasures, Events/Cons, Malware

, , , , , ,


Latest Posts:


Intercepter-NG - Android App For Hacking Intercepter-NG – Android App For Hacking
Intercepter-NG is a multi functional network toolkit including an Android app for hacking, the main purpose is to recover interesting data from the network stream and perform different kinds of MiTM attacks.
dcipher - Online Hash Cracking Using Rainbow & Lookup Tables dcipher – Online Hash Cracking Using Rainbow & Lookup Tables
dcipher is a JavaScript-based online hash cracking tool to decipher hashes using online rainbow & lookup table attack services.
HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.


3 Responses to AV Firms Split Over Defcon Contest

  1. Yash Kadakia April 29, 2008 at 9:12 am #

    I think its a great initiative and hopefully it should make AV vendors get their act straight and do a decent job for once.

    Don’t get me wrong; I think AV softwares are great for general purpose home users but when you think from a security or “hacker” perspective; they do little to nothing against targeted attacks with modified or packed code.

  2. Sandeep Nain April 30, 2008 at 5:32 am #

    That is right Yash
    AVs are usually good against nothing but already reverse engineered malware… not many AVs have got good protection against polymorphic viruses… and stopping new sophisticated viruses is still a distant story..

    and I’m sure contests like this will definitely raise a concern.. and will make the AV vendors work harder..

  3. arwab May 1, 2008 at 7:56 pm #

    This is a great idea. In much the same way as M$, they know their software has problems, they just don’t want them and possibly more discovered and broadcast for the world to see.

    As a software developer I wouldn’t want a potentially harmful bug to be broadcast but I would at least like to know about it. This could help the AV companies more than it would hurt them.

    “If people really want to test the quality of different anti-virus products there are well established ways of doing it…” well these ways are not very effective, time to think outside the box and come up with more creative solutions. A computer virus doesn’t adhere to any rules, why should a quality tester?