What went into making of MalCon?
By Sameer and DJ

Mumbai hosted the MalCon conference on Dec 3.  On its site, it describes itself as ‘the world’s first platform bringing together Malware and Information Security Researchers from across the globe to share key research insights into building and containment of the next generation malware’.  Being the first of its kind of public conference, it drew much international attention

Rajshekhar Murthy is an Information security researcher based out of India. A CISSP with over a decade of experience, his interests include Malwares, Cryptography, Artificial Intelligence, CPTED and Astronomy.  Techgoss caught up with Rajshekhar who was also one of the key people behind the conference.

Techgoss (TG): What all is involved in organizing such a conference which is the first of its kind in India?
Rajshekhar Murthy (RM): MalCon is an International platform for demonstrating advanced research in Malwares, addressing both offense and defense. As we are focused exclusively on malwares, one of the biggest challenges in organizing such a conference is short listing the research papers. Unlike regular hacker conventions, executing and managing MalCon requires a research team with a high degree of technical expertise.

MalCon also focuses on simplifying the universe of Malwares through its practical workshops. This year, the theme was "malware creation in under two minutes", where we demonstrated how easy it is to create a malware. One of the speakers Atul Alex demonstrated an advanced backdoor for Symbian OS, and another speaker David Baptiste during his talk "The art of making bad jokes" created a live virus during the session from the inputs given by the audience. The objective was to show how ineffective our current anti-virus technology is and how vital it is to focus on proactive research of malware creation approaches and mitigation.

In the coming year, the challenge in organizing MalCon 2011 will be even larger as we will have "Capture the Mal" contest. We are also exploring the options of funding some unique projects in Malware research.

TG: How did the conference go? Did it meet all the aims you had targeted?
RM: I would say, the conference has just taken baby steps. It has a long way to go. I am not sure how you measure success, but on a personal note, yes. The conference had an overwhelming response. People flew all the way from US, Europe, Singapore, Africa, Central America to attend the conference. Over 25% of the seats were reserved by the Government, including Navy, Army, Cyber cells and other Intelligence agencies.

We hope that in coming years MalCon inspires students from schools and Universities to take up research in Malware coding, analysis and mitigation.

We are extremely thankful to the Indian Government, Information Sharing and Analysis Center (ISAC), Orchidseven Infosec, ESIEA (France), QuickHeal and Microtechnologies for supporting and sponsoring the event.

(Techgoss had published the following on Aug 30, 2010)

Mumbai MalCon gets media
By Sameer

Mumbai will be hosting the MalCon conference on Dec 3, 2010.  On its website, it describes itself as ‘the world’s first platform bringing together Malware and Information Security Researchers from across the globe to share key research insights into building and containment of the next generation malware’. 

If the organizers of this Malware meet achieve their aims,  not only will they have ethical hackers and security experts at the conference,  but also some people who have practical experience in developing viruses, worms, Trojans and keyloggers.  The conference is also asking ‘malware researchers and coders to submit their work for research’

Even as MalCon in Mumbai makes it clear that ‘it does NOT promote malware creation’, as this is a first of its kind of public conference, it has drawn some international attention.

Security guru Brian Krebs, who worked as a reporter for The Washington Post from 1995 to 2009, has blogged about it.

One of the world’s most respected security blogs Threatpost has also given MalCon a substantial write up.

The world’s most popular website for geeks, Slashdot, has also written about MalCon

It is rare for any new Indian idea in the field of security software to get so much international attention.

So how are things at MalCon leading up to their first conference?  In August, MalCon has received Call for Paper (CFP) entries from International speakers who have previously presented at Defcon and BlackHat. Over half a dozen CFP entries for malwares on mobiles have been submitted by young students (from school).  MalCon has also received a couple of entries from researchers on new algorithms to detect Malwares. Not surprisingly, some Law enforcement agencies are also supporting the concept, as they feel that participants will be able to assist the Law in effective countermeasures for National Critical Infrastructure Protection.

Techgoss caught up with Rajshekhar Murthy who is a key player in India’s security software industry as well as one of the organizers of the conference.  Rajshekhar told Techgoss: "It is not about rapid malware analysis but about detection. Technology or not, MalCon conference or not, there are new malwares out there constantly being created. Even if the available handful of security vendors have their own team of researchers for analysis, this is not enough. Active and open participation by ‘ethical malcoders’ will help advance the research and containment capability of our existing methods. So the question is, do you have enough confidence on your anti-virus / anti-malware program? If yes, then you have nothing to worry about. If No, then its all the more important you attend this conference".