The Race to Zero

[Humpty]

Ethical or not?

There has been a fair amount of controversy as of late surrounding The Race to Zero contest to be unofficially held at DEFCON 16 this coming August. To briefly summarize, contestants are to be given samples of computer viruses/malware and access to a contest portal. The portal will take malware samples submitted by the contestants and run them through a collection of anti-virus engines, checking to see if the samples are detected. The contestants will make modifications to the malware samples in attempts to slip modified samples past the AV engines undetected. In keeping with the mischievous hacker zeitgeist of DEFCON, awards will be given for the ?Most Elegant Obfuscation,? ?Dirtiest Hack of an Obfuscation,? ?Comedy Value? and ?Most Deserving of Beer.?

 

AV vendors were predictably upset by the prospect of this exercise. Most objections seemed to boil down to two main assertions:

 

1. The contest involves the creation of new strains of malware, which can serve no constructive purpose.

2. The contest will only serve to help the bad guys learn new techniques in their arms race with AV vendors.

 

Contest organizers have stated their goal is simply to demonstrate the limitations of AV software, information that AV customers deserve to have. Their position is that the contest explores legitimate areas of security research and that investigation of AV bypass techniques is a worthwhile goal. Organizers have also pointed out that new malware is being created 24?7x365 in the wild, while at the contest?s conclusion any new malware samples created will be securely deleted from the contest systems.

Race To Zero