Filthy Calgary Canadians Teach Computer-Virus Writing Class at University.
http://www.globetechnology.com/servlet/story/
RTGAM.20030526.gtmalware...
Groups cry foul over malware course
By JACK KAPICA Globe and Mail Update
A decision by a University of Calgary professor to teach students how to create computer viruses has raised the anger of groups dedicated to fighting malicious computer code.
The course, called Computer Viruses and Malware, will be taught by computer sciences professor John Aycock in the fall in the university's Computer Science program, and will offer credit toward a degree.
The course 'will focus on malicious software, or malware, such as computer viruses, worms, and Trojan horses,' Prof. Aycock's Web page says. A maximum of 16 students who 'should have strong low-level programming skills' will be admitted to the course, which will be taught in a computer laboratory completely cut off from any network so the student's homework will be escape into the wild, it adds.
In addition to creating viruses, students will also examine 'benevolent'' forms of malicious software and how to fight viruses. The course will also cover legal and ethical issues, as well as security.
But teaching students such skills is 'completely unnecessary,' says Robert Vibert, speaking for activists at the Anti-Virus Information Exchange Network and the Anti-Virus Information and Early Warning System.
Mr. Vibert, administrator of AVIEN, has issued a press release demanding that the university 'review its decision to include the instruction of programming of malware as part of its curriculum.'
Numerous ways to teach students about viruses exist without resorting to the creation of more viruses, say members of AVIEN and AVIEWS, grassroots organizations that claim to represent more than five million PCs and the majority of Anti-Virus developers.
Prof. Aycock was not available for comment Monday.
His course description states that, 'due to the inherent danger of this software, students may only work on these assignments in the designated lab room for the course. STRICT lab protocols will be in effect; failure to adhere to these protocols will result in an 'F' grade in the course.
'Students will be required to sign a form stating that they have read and understood the lab protocols, and that they understand that misuse of the information in this course can result in civil and criminal penalties under the laws of Canada and of other countries.'
But AVIEN and AVIEWS members are not reassured.
'There is no reason to actually 'write' malware to become an expert in the field or to learn how to protect against it,' they say in a joint statement. 'Writing safe programs that demonstrate an infection vector is adequate [to demonstrate a vulnerability] without building in the reproductive sequences. In general, anti-virus product developers do not write malicious code, as there is no need to do this to achieve a better understanding of how to defeat viruses.'
They add that most antivirus developers have policies against the hiring of virus authors.
The groups are also concerned that despite all disclaimers, students will regard the course as instruction in the 'dark side' of computing.
Warning that the university would face a public-relations catastrophe should a virus developed by the students escape into the wild, the groups suggest students instead be taught how to track down malware, how to capture live virus activity on an isolated network, how to close vulnerabilities employed by malware, analysis of well-known viruses of different types, reverse engineering of malicious code, as well as the phenomena of virus hoaxes, chain letters and frauds.
more posts...