PC World, Malcon, and Our Industry’s Flawed Logic

Malcon: the malware authorship industry conference.  You’ve heard about it here, you’ve heard about it on anti-virus rants, and now you’ve heard about it on PC World.

As you might be able to tell from the title of their article (“Malware Convention — Not a Good Idea”), that PC World…  well, they don’t think it’s a good idea.

They quote Grimes who says the following:

No good can come from the conference…  There have been similar projects before: virus coding books (plenty of them), dozens of malware ezines, etc., and none add to the good side of the equation…”

Pretty strong words.  I’d be on board with that as I stated the other day, but something about the logic of all this doesn’t sit right with me.  And the more I pick at it, the more it bothers me. Expressed as a syllogism:

• Major premise:  All conferences that provide details on how to create malware are a “bad idea”
• Minor premise:  Malcon is a conference that provides details on how to create malware
• Conclusion: Malcon is a “bad idea”

And then:

• Major premise:  All conferences that provide details on how to create malware are a “bad idea”
• Minor premise:  Blackhat/Defcon provide details on how to build malware (e.g. the Invisible Things Blue Pill presented at Defcon 2006; stated goal, “creating 100% undetectable malware”)
• Conclusion:  Blackhat/Defcon is a “bad idea”.

But it clearly isn’t – at least most of us don’t think so.  As PC World points in their first paragraph, Blackhat/Defcon is a “reputable venue” in the security community.  And I keep getting boxed in by the logic.  Either the major premise is false and Blackhat is reputable (i.e., not a “bad idea”), or the major premise is true and Blackhat is not reputable  (a “bad idea”)… in exactly the same way as Malcon is.

Now, I know this is not going to be a popular position…  But I’m not willing to give up the ghost on Blackhat.  I like Blackhat.  I’ve been going to Defcon for over a decade.  So I don’t think that it’s a bad idea.  I think historical precedent has given those conferences respectability… which it probably wouldn’t have if it started today.

So by virtue of the fact that my brain can’t handle the cognitive dissonance associated with defying the logic, I’m going to put the stake in the ground that MalCon is OK.  Or, at least, not “bad” based solely on the single criteria that they’re discussing details about how to create malware.  Maybe somebody else is willing to throw some hate Blackhat’s direction and say it’s not a good idea either… but saying one is OK and one isn’t?  I’d advocate that if you’re going to come out against one, you should stop attending the other.