MalCon: Malware Hacking Conference for Twisted Pen Testers

While most Americans will be lulled into a Turkey coma, or perhaps fighting Black Friday crowds, a MalCon conference in Mumbai will be kicking off with a wicked ‘muhahaha’ from malware and information security researchers as they dive into twisted pen testing. It’s a bit like the anti-antivirus crowd. While MalCon said it does not promote malware creation, it also laughs and answers “no” to the question of if it’s a trap to profile malcoders.

The eight-hour Twisted Penetration testing workshop, according to MalCon, is exactly what it reads; “A fresh and twisted approach towards penetration testing from MalCon, it can help get results the unconventional way in regular network and system audits, vulnerability assessment and penetration testing.”

Last years’ MalCon had some security-minded individuals practically foaming at the mouth. Infoworld warned that no good could come out of a malware convention, adding “MalCon organizers want us to believe that the security community can benefit from an event showcasing and teaching malware.” Then SecurityCurve asked whether “MalCon is the devil or just a more specialized BlackHat?” Krebs on Security said the conference was more like a “call for ethical malcoding.”

Yet the wild speculation has started again, as bringing together a large group of malcoders seems to make some people nervous. After being “pretty shocked” by a MalCon Twitter update about a research paper submission, The Hacker News wondered if perhaps Stuxnet 3.0 might be released at the conference? “While this may just be a discussion and not a release, it is interesting to note that the speaker Nima Bagheri presenting the paper is from IRAN.” Duqu which is similar to Stuxnet had just been analyzed around that time and the MalCon research paper abstract discusses rootkit features, and may show a demonstration “related to hiding rootkits and advanced Stuxnet-like malwares.”

While Microsoft BizSpark recently announced the new Kinect Accelerator program that supports “entrepreneurs, engineers and innovators to bring to life a wide range of business ideas that leverage the limitless possibilities Kinect enables,” it’s doubtful Microsoft will be as enthused about the MalCon 2011 Challenge to Code a malware utilizing Xbox Kinect. 15-year-old Shantanu Gawde will present a proof-of-concept paper “of an advanced malware for Xbox Kinect” that will work on Windows 7, will take pictures silently from the Xbox Kinect and will post those “pictures on a specified Facebook / Social website without knowledge of victim.” Another MalCon workshop is titled,” Xbox Kinect Coding for fun and profit.”

Hacker News reported:

Rajshekhar Murthy, Director at ISAC, (Information Sharing and Analysis Center), a scientific non-profit body that holds the International Malware Conference, MalCon said, “We believe that in coming years, a lot of windows based applications will be developed for Kinect and the device will gain further immense popularity and acceptance- and from a perspective of an attacker, such a popular device can be an exciting target for visual and audio intelligence. At MalCon research labs, we promote proactive security research and the malware utilizing Kinect is only a proof of concept.”

Also on the MalCon agenda is Android Hacking and an anticipated release to get root on Windows 8.  Ars Technica reported on the “first known bootkit for Windows 8-an exploit that is able to load from a hard drive’s master boot record and reside in memory all the way through the startup of the operating system, providing root access to the system.” Yet Austrian security analyst Peter Kleissner’s appearance is still considered tentative, since Kleissner has an upcoming court date on “charges related to Stoned Bootkit.”

Other qualified papers to be presented at MalCon 2011 include: Atul Alex‘s Advanced Malware for Apple Products. Watch out Apple fanboys as the “invisible” malware features will include accessing all mail and text, controlling devices via SMS, upload/download user data, record and listen to all calls remotely, and using a VNC server to view remote screen. David Baptiste will teach how to make your own home botnet. Dhruv Soi will show how to exploit the exploit kits.

Law enforcement and government officials are encouraged to attend MalCon, and that isn’t too surprising since many security firms sell malware and exploits to governments. The “Big Talks” will include “Hackers for National Security and Cyber Law.”

Like this? Here’s more posts:

• Fourth Amendment’s Future if Gov’t Uses Virtual Force and Trojan Horse Warrants?
• 4th Amendment vs Virtual Force by Feds, Trojan Horse Warrants for Remote Searches?
• Hacker takes aim at Homeland, posts ‘proof’ of hacking SCADA for Houston’s water supply
• Skype Exploits: I know where you are, what you are sharing, and how to best stalk you
• FBI rolling out nationwide face search and recognition system
• Alabama Sheriff Demands Go Daddy Kill AntiSec Hackers’ Websites for Data Dumps
• Privacy Nightmare: Data Mine & Analyze all College Students’ Online Activities
• Busted! DOJ says you might be a felon if you clicked a link or opened email
• Too much social media networking: Paranoia of Big Brother surveillance may destroy ya
• Secret Snoop Conference for Gov’t Spying: Go Stealth, Hit a Hundred Thousand Targets
• PROTECT-IP or control freaks? Monster Cable blacklists Sears, Facebook as rogue sites
• 4Chan Founder Moot Cherishes Choices: ‘Facebook and Google Do Identity Wrong’
• Do you give up a reasonable expectation of privacy by carrying a cell phone?

Follow me on Twitter @PrivacyFanatic