05-31-2003, 05:30 AM
|
|
Executive Editor
Join Date: Aug 2006
Posts: 29,160
|
|
Class on Virus Creation Draws Industry Ire
"When the University of Calgary announced plans this week to offer a course that includes instruction on writing computer viruses, officials expected the antivirus industry to support the move--designed to help educate future virus fighters. Instead, industry leaders have roundly criticized the plan.
"It legitimizes the creation of destructive code and provides justification for virus writers to do their work," says Robert Vibert, administrator of the Antivirus Information and Early Warning System and the Antivirus Information Exchange Network. Both organizations help antivirus researchers and virus fighters share information about new and emerging threats."
Interesting to see such a controversial move being taken by the university in my home town. What do you think? Is there value in this approach, or is it just asking for trouble?
|
| |
|
|
|
05-31-2003, 05:47 AM
|
|
5000+ Posts? I Should OWN This Site!
Join Date: Aug 2006
Posts: 5,616
|
|
I hope they offer it as a weekend course.
Lessee, my student number was a 9xxxxx and I was there eight years ago. They must be well into the millions (if not actually into ten millions) for student numbers by now.
__________________
iPhone 4! ☠☠☠ Mid-2010 15" MacBook Pro! ☠☠☠ Gateway LT2102h! ☠☠☠ Dell XPS M1210!
|
| |
|
|
|
05-31-2003, 05:50 AM
|
|
Thinker
Join Date: Apr 2004
Posts: 327
|
|
Draw The Line
Frankly, this is somewhat akin to teaching classes on how to make explosives out of ordinary household chemicals. What would be the purpose of the class ? If you want to find out how to do that kind of stuff, there are plenty of resources. Using educators to propogate the knowledge is not very bright. :idea:
|
| |
|
|
|
05-31-2003, 05:58 AM
|
|
Ponderer
Join Date: Feb 2004
Posts: 91
|
|
I have to completely disagree with dma1965. The best way to educate people on the threat of virii is to educate them. One thing we need less of in the world is ignorant people. dma1965, I'm not say that you are, but I think it has legitimate educational value. Granted, some people who take the class may have ulterior motives. I think over all it would be a very educational class to take. I'd go if I lived in Calgary...
What about a class for bomb experts? Isn't that the same principle? Obviously in a class like that, they would teach how bombs are made, but the purpose of the class is to prepetuate understanding....
|
| |
|
|
|
05-31-2003, 06:01 AM
|
|
Moderator
Join Date: Aug 2006
Posts: 6,878
|
|
Quote:
|
Originally Posted by ctmagnus
I hope they offer it as a weekend course.
|
Nah, more like M-W-TR 2:45 -> 3:50 A.M. :wink:
Steve
While it may be natural for some CIS students to "play" with writing malicious code, I can't believe a University would actually teach doing it... :roll:
__________________
"My eyes are rolling back in my head so far I can see my grey matter bubbling and frothing from reading this thread....bleh." JD
|
| |
|
|
|
05-31-2003, 06:39 AM
|
|
Philosopher
Join Date: Aug 2002
Posts: 593
|
|
At Iowa State University there is a course where two teams build a server (easy enough for ComE majors) and also program a virus and anti-virus program. They battle each other until a server is brought down. Just a interesting side note.
But really though, if you are having to teach how to program viruses, this will not become a problem. It would be hard to create an effective virus writer from a class. It reminds me of a story of a Purdue University student who happened to be Pakistani; when this student registered with the INS (as reregistration was required by DoJ) the person noticed that this student was taking a Nuclear Engineering class. Now, as it turns out Nuclear Engineering is the easiest engineering elective offered; even though the student had to beg from being referred to a lengthy review process, there was never a threat. Why? Because a single class is not sufficient for significant harm. Same thing here, take a C programming class and tell someone what a master boot record is, that is sufficient for a bothersome virus, but there is not need to be over protective.
|
| |
|
|
|
05-31-2003, 07:07 AM
|
|
Thinker
Join Date: Dec 2003
Posts: 416
|
|
Re: Class on Virus Creation Draws Industry Ire
Quote:
|
Originally Posted by Jason Dunn
Interesting to see such a controversial move being taken by the university in my home town. What do you think? Is there value in this approach, or is it just asking for trouble?
|
Is there value in the approach of offering this course in your hometown? I doubt it.
OH, I get it :roll: , you meant value in teaching the course at all!! Ohhh..
Yes I think there is -- if they teach concepts as opposed to teaching how to write a virus. I don't think an exercise like "write a virus that does such-and-such" is beneficial, but I do think an exercise like "I (the instructor) wrote a virus -- figure out how to analyze and stop it based on the virus writing techniques we studied".
__________________
"And then she understood the devilish cunning of the enemies' plan. By mixing a little truth with it they had made their lie far stronger."-C.S. Lewis
|
| |
|
|
|
05-31-2003, 08:57 AM
|
|
Swami
Join Date: May 2004
Posts: 4,396
|
|
Next Up -- SPAM!
Quote:
|
Originally Posted by `Helios
I have to completely disagree with dma1965. The best way to educate people on the threat of virii is to educate them. One thing we need less of in the world is ignorant people. dma1965, I'm not say that you are, but I think it has legitimate educational value.
|
You can be educated to the dangers of things without actually creating them. Do medical schools teach doctors how to make poisons in order to teach them how to diagnose and treat poisoning cases? I don't think so.
However, given your outlook, I suppose you'd also support a course teaching how to spam. :-D
Steve
|
| |
|
|
|
05-31-2003, 09:04 AM
|
|
Swami
Join Date: May 2004
Posts: 4,396
|
|
How Hard Is Writing A Virus?
Quote:
|
Originally Posted by Gremmie
But really though, if you are having to teach how to program viruses, this will not become a problem. It would be hard to create an effective virus writer from a class.
|
Why not? If this is a one-semester class for computer science majors, they already have decent programming training, and you can do a lot of programming in a semester. Viruses are usually small, and I'd think you could easily code a fairly nasty one in a semester.
It's not like the operating system and compiler classes I took, where you just got some broad overview and a few projects because compilers and operating systems are typically large, complex programs.
One of the experts in the article I read said that programming a virus was a fairly trivial task. He said that programmers with talent got paid for doing programming and didn't need to write viruses.
Steve
|
| |
|
|
|
05-31-2003, 10:15 AM
|
|
Neophyte
Join Date: Dec 2002
Posts: 5
|
|
I had to think about this one for a bit. My gut instinct was, "sure... why not" and then I began to read what I first thought was the best argument against the class: "we do not teach doctors how to make poisons, so we shouldn't teach programmers how to write virii". That made sense to me at first until I realized that poisons DO NOT THINK (ie. you don't need to THINK like a poison in order to aid someone who has been poisoned). [Note: no offense to Pony99CA intended... I initially agreed with your argument and then decided to disagree  ] Of course, virii don't think either, but their creators do.
Why does this matter? Well, there is a problem solving process known as the "adversarial method" which involves putting yourself into the shoes of the person on the other side of the problem. This method is particularly good for writing algorithms because if you can figure out the worst scenario possible, then you "should" be able to write a good algorithm for the solution. For example, let's say you have in your possession, the most "secure" code and hardware on the market. How would one improve on this system? Well, the best way would be to try to break it by attempting to write a virus that takes advantage of some previously vulnerability in the code. In order to do this, you would need to be VERY good since you'll be writing a virus to break the "best". As such, a course (or even graduate degree) in virus writing would be important.
Today, our method of virus protection is really a "fire-fighting" approach. We wait until an experienced hacker writes a virus to break a previously secure application and then we write a patch to fix the vulnerability. This course may move us towards a "proactive" approach in which we (the good guys) find the vulnerability first and patch the problem before hackerX figures out the vulnerability.
All in all, I think this is a great idea. We need to be more proactive in our approach to fighting virii. I just hope some basic background checking and interviewing is done before admitting a student into a "virus creation program". For a single course, I don't think this is necessary. Just remember, if the course were a "anti-virus course" then nobody would be complaining BUT odds-are that the curriculum would be the same as the "virus-creation" course since the lowest common denominator in either case is the requirement that the student needs to be able to identify vulnerabilities in code in order to either patch them or exploit them. "Six or half a dozen"... it's all the same except the name
|
| |
|
|
|
|
|
Linear Mode
