Learn to write viruses to protect against them?

[jonathanmb]

http://gauntlet.ucalgary.ca/story/9496

I haven't heard of or read any new articles regarding whether or not they're going to cancel the class or not, but that's probably not relevant (meaning if they consider a clase once and choose not offer it, it's safe to assume they will consider the same class again in the future).

I'm a firm believer that a person typically understands a topic better after hands on experience rather than just watching someone do it, however, does the course UoC is offering fall into this same situation?

I'm still torn on the entire idea.

--
Jonathan

 

[Grenage]

I don't agree with having such courses, I very much doubt a programmer on "the dark side" will be any better at understanding a virii than one on "the light side".

The trouble with malicious code/programs/virii is that there are so many possible things they could be doing.

People already understand virii and how to prevent them (the vunerability exploited by MSBlast was exposed months ago) but they just don't bother to keep their systems patched.

 

[MDXer]

I don't agree with Schools and Universities teaching these types of classes. After all a good portion of the malicous stuff out there is more than likely written by people still in College. I do agree however that these types of classes are of benefit in the professional enviroment.

Many admins no to keep there virus software up to date, and install updates, to prevent these types of attacks, but how many actually know what is happening. By knowing the inner workings of such things you actually gain an understanding for what is going on and better ways to prevent not only the current issue but the future possibilities. The manner in which Ernst & Young train to defend against hackers is by teaching you how to hack, but they do have strict registration requirements. Malicous activity is created typically by people with a diffrent mindset. Yes poking around to find published issues in software can allow any good programmer to create a virus or hack a system, but packaging it in a manner that is difficult to detect is something you learn by doing.

http://www.ey.com/GLOBAL/content.nsf/US/AABS_-_TSRS_-_STS_-_Courses_-_Extreme_Hacking

"Shoot Me! Shoot Me NOW!!!"
- Daffy Duck

 

[skiflyer]

Why not? If someone wants to learn to write good virii, they'll learn. That article has a bad analogy about police officers and breaking into cars. Perhaps the better question is... should we be teaching students how to break into a car if they're building car alarms?

I've taken two courses in the past that touched on security, and in both of them we were assigned to take some nefarious action against test systems because it's important to know. Additionally we learned how to patch and deter such attacks.

How many times need we hear it in the industry... security through obscurity is bad.

-Rob

 

[jonathanmb]

I think one of my primary concerns is that it's being offered as an undergraduate class rather than a graduate class.

I'm an undergraduate myself with plans to go into graduate school after I get my BSCSE in the next year. From my own personal observations, I find that most undergrduates in the CS and CSE programs are immature and unprofessional. Although I'm not a graduate student, I'm making the assumption that those in graduate programs are quite the opposite (otherwise why are they there?).

Because of the immaturity of undergraduates, I'm more inclined to believe that they will use the knowledge they might gain from such a class that's being offered at UoC for destructive purposes. I'm less inclined to believe that someone of a more mature and professional attitude would use the knowledge in the same way I think an undergraduates would.


People say that if someone wants to do something, they'll take the time to learn how to do it. That's not always the case. Let's take the Tek-Tips forum as an example. Most of us here are here to help one another and learn. However, a number of people post here for a quick and easy solution to a problem without the intention to learn -- they just want someone to tell them how to do it, and why it works is irrelevant.

A large number of students in college have the aforementioned mindset in a lot of areas; I see a lot of these students in the CS and CSE program. They want a solution to the problem with no effort on their parts. I foresee these same students using a class on how to write and prevent viruses as a solution on how to write a virus without taking from the course the intended knowledge of how to prevent and stop viruses.

I'm afraid of what kind of super virus could be created by a room full of college students working together whose intentions are less than honest. Aren't you?

--
Jonathan

 

[TheVampire]

Being in the security industry, I can see how this sort of thing would be needed. To protect your system against it, you have to understand how it works in the first place.

You can't design a security system correctly if you don't try to figure out all of the ways that it could be defeated.

It's perfectly acceptable to create the things that you want to protect against. After all, they have real viruses that are used to test anti-virual agents against. Why not computer viruses as well?

Robert

 

[Grenage]

Do councelors at drug addiction clinics try herion to find out what the withdrawel symptoms are like? No, it's a poor analogy but no poorer than the one used in the article.

I fail to see how knowing the intricate details of a virus working (and lets be honest it's a piddly piece of malicious code, and like a snowflake every one is different) will help anybody defend any better.

You will still need anti-virus software and you will still need a properly configured firewall. Aside from that it's all down to user rights and common sense - which is already in place and a course like this would benefit no-one (except possible script kiddies).

 

[lionelhill]

Well, presumably people who write anti-virus software have to have a teeny bit of understanding of how a virus works, but I fail to see that there's enough demand for that to justify an undergrad course. If I were an undergrad I'd go out of curiosity.

But if the course is as up-to-date as most undergrad courses, we haven't a lot to worry about.

 

[Grenage]

lol touche

 

[skiflyer]

I'll say it one last time just cause it's monday and I'm slow on the uptake for the rest of my work.

The analogy in the article was garbage, your heroin analogy doesn't even make sense... but if you want to address it, you're wrong anyway... groups like NA and AA have plenty of rehabbed individuals assisting in the process, because users are more able to trust someone who's been through it, etc.

To use a valid analogy, look at the home security market... every year they have a conference where people roll out their new stuff, and offer differing rewards for people to bust into it... reformed theives of all sorts come out and do what they used to do. Often the best are hired to help. Several reformed computer hackers are doing the same thing.

Computing cycles are too cheap these days, computers are too visible. Hiding the key under the doormat doesn't work in this arena.

-Rob

 

[sleipnir214]

I am of two minds on this one.

On one hand, teaching this subject can legitimize the activity of creating and releasing virii, particularly undergraduates.

On the other hand, there is a legitimate academic interest. The computer virus was first conceived of by Fred Cohen in his 1984 doctoral thesis. (He was awarded his doctorate, and published his thesis in a book titled, appropriately, Computer Viruses (ASP Press; 1986).)

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[lionelhill]

Hiding the key under the doormat never really worked, even for keys and doormats. I suppose courses like this might legitimize things, but hopefully they'd do so with appropriate consideration of risks. To carry on with the (I agree very dodgy) analogy, if you work on smallpox for legitimate reasons, you can nevertheless expect the world to come down on you like a ton of bricks if you have so much as the tiniest release scare. And rightly so. I note the article talked about all the work being done on a closed, isolated system.

 

[jonathanmb]

I still think the largest problem with the course being offered by UoC is its target audience, undergraduate students.

This isn't a course that will be taken by professionals who wish to learn about and devise strategies against viruses. I think it's a safe assumption, based on the undergraduate students I know and see, that it is a course that will be taken primarily by students who would get a rush from writing a virus that made it on the news.

Will the students be working in a closed, isolated environment? The article claims they will be. Let's assume that the professor makes a strong effort to prevent students from taking soft or hard copies of any virus out of the lab. How will students be prevented from recreating a virus outside of class?

I don't know how long it has been since any of you attended college or a major university. I'm on my fourth year now, and I can tell you that I know few people who would take this course with legitimate intentions.

--
Jonathan

 

[GwydionM]

If one of your neighbours was studying explosives and booby traps, would you believe this was a legitimate interest?

The thing about a virus is that it is ALWAYS an intrusion on someone else's freedom, as is Spam. The dream of an on-line community has been spolited by people having fun at the expense of others.

You can only hold an intelligent discussion on a forum like this, where someone is monitoring and controlling it.

My solution would be a law banning virus writers from owning computers. We don't allow dangerous drivers to go on using their cars, even though there are limits to the amount of damage that one carelss driver can do.

 

[DarenNM]

If one of your neighbours was studying explosives and booby traps, would you believe this was a legitimate interest?

If he was part of a Royal Engineers mine-clearing team I would.

I think you could apply some of the arguments here to many jobs e.g should we train people to be locksmiths in case they abuse the knowledge etc.

The article does state that they won't be creating anything new, only studying what is already there.

Dr. Ken Barker, Head of the Department of Computer Science, explains that students will not be creating virus de novo, but will examine viruses already in the wild. "That's exactly the kind of misinformation that concerns us," he said. "Nobody here says that we will create new viruses. Some media have reported that students will create new viruses, that is not correct. They're recreating viruses, not creating new viruses."

I'm not sure how else you would train people to write anti-virus software. I can see why people are concerned that it is being offered as an undergraduate course though. The article states it will be a fourth-year course. What age-group are we talking about here - 20/21? Hardly kids anymore surely?



Must think of a witty signature