Virus Composition 101

Well, while I'm not against the idea of teaching people how to write virus code in order to help train them to recognize what it's attempting, or to write more secure legitimate software, I *do* think that a college course might not be the ideal location [or even time in life] to teach it.

Perhaps when a student has gone through many prerequisite courses on various languages, upper level software development, ethics, and a course in secure code... Maybe then it would be appropriate to hold acourse in how a virus is written... However, byt then it is certainly a senior-level course, and perhaps graduate-level. In which case, it would make sense that this be something intended for software professionals.

I would feel more secure [pun intended] if this were a course for corporate training, rather than a potential formal training of a script kiddie.

OK, so I checked the site at the school:

http://www.cpsc.ucalgary.ca/Courses/#FOURTH

It stills tells you nothing of the particular course, though it's listed at the 500 level, and is considered a 'special topic'.

If anyone has more information on this, particular something first hand, I'm interested in seeing it.

A few thoughts, the first may be quite an ugly but realistic view.

1) generally, the people who write the best viruses are the best people to hire to analyze a new virus. I think this is why hackers and virus writers are always being hired by thetop security companies. I think this thought process would be the ONLY valid reason to teach such a course.

2) This is a way to teach the tech wannabes how to write malicious code. This is a dangerous road to take because if someone doesn't have the skills to obtain an IT job or was fired for incompetency or poor ethics, now the person will know how to get revenge at the industry, a specific company or end user.

If this type of course will be taught, it should be limited to EMPLOYED security professionals. They should be CAREFULLY screened and qualified with any code samples kept in a secured classroom environment. I know this sounds a little extreme but some code is so malicious that it must be seen as a threat similar to any contractable human virus, ie. smallpox, black plague etc. Although these diseases are life threatening, a company can also be destroyed, along with hundreds if not thousands of employee livliehoods over malicious code.

I could see where such a course could be useful for creating new virus designs in a controlled environment. If the course encourages synergistic thinking, it might be possible to invent a new family of virus that could then be sent to the antiviruscompanies for preventative measures.

Of course, it had better be a well controlled environment with background checks on the students and high level 'safe computing' measures in place. If there are any means by which a virus can escape the controlled environment, they need to be secured. This would include network connections to an outside network, ZIP drives, diskette drives, CD-R\RW, removable hard drives and other related items.

Ideally, such an environment should be in a locked roomthat is only opened when it can be watched. Securing it against IR, wireless and even an extra long network cable needs to be considered.

Call it paranoia. But considering how important computers are to tech society, paranoia regarding virus work should be at the same level as paranoia regarding biochemical work.

Max, I am glad that you started this thread.

I saw an article on the course myself, and was similarly appalled.

I wonder if professor Aycock is looking at his course the same way academia looked at the first generation of sex education programs.

Perhaps, he believes that if you teach programmers how to write virus code, you will take away the desire to write malicious code.

This makes almost as much sense as college courses in the philosophy of Homer Simpson.

At a minimum, Mr. Aycock needs a lessen in human nature.

Chas

There was a post on media sensationalism, and I not only agree but believe the IT security profession is a guilty party as well.

Each year a million new recruits in armed forces world wide learn how to kill in a variety of ways. How have I avoided being a murder victim?

Each year thousands of new pilots are trained. Should I seek cover every time a plane passes over head?

Doctors and pharmisists learn the recipes and effects of chemical and biological poisoning durng their training.No more annual check ups or legal drugs for me.

The millions of licensed drivers are all trained in using a guided ground to ground assault weapon. Outside of Australia and California, road rage is not as scary as cell phone users to me.

Locksmiths have learned how to bypass or defeat my mechanical property defenses. Each morning I expect to wake to a house empty of belongings and a garage empty of cars. No such luck. The wedding gifts are still here, along with my clunkers.

The issue is not knowledge, but abuse of knowledge.

When bank employees and Secret Service agents are taught how to recognize counterfeit money, they are NOT shown the various samples of it, they study the real thing so thoroughly they can spot the fake instantly.

You don't have to study viral code to be a goo programmer nor do you have to be a virus maker to be a good security tech.

Things like this disgust me. We have kids entering the 12th grade who are functionally illiterate yet are being brainwashed that "Cindy has two mommies and that's OK'. Young people aren't taught the discipline necessary to learn on their own yet they ARE taught how to create virii. Gag.

Ralph