Turning Young Minds Full Of Mush Into Cyber Criminals

03 Jun, 2003 by John Hawkins

Print this article Font size -16+

Turning Young Minds Full Of Mush Into Cyber Criminals: It’s ridiculous that any college would have a course like this…

“A university course in Canada teaching students how to create computer viruses has been met with derision by angry industry watchers, who believe it will create a pool of future virus writers.

The ‘Computer Viruses and Malware’ course will begin next autumn at the University of Calgary.

It is described as focusing on “developing malicious software such as computer viruses, worms and Trojan horses that are known to wreak havoc to the tune of billions of dollars worldwide on an annual basis”.

The thinking behind the course is that educating students in virus writing will lead to a greater understanding of how to stop viruses. The teaching will also cover legal, ethical and computer security issues.”

Let me get this straight…they’re going to teach these kids how to do something with no socially redeeming values so they’ll be better equipped to stop it? Well what’s next?

Pimping 101: Learn how to spot vulnerable runaways, when to lay the pimp hand down on your hos, and how much of money should you let your hos keep.

Setting Up Your First Meth Lab Where to get the chemicals you’ll need without attracting unwanted attention, how to make sure that new employee isn’t a NARC, and when to do a drive-by on the competition.

Being a New York Times Reporter: How to make sure the stringers do all the work and you get all the credit, brown nosing Howell Raines until you get promoted, and how to pretend you’re writing stories from all over the globe without ever leaving the comfort of a New York City bar.

Excuse me for being for crude, but this is the biggest steaming load of crap I’ve seen since they were digging through that huge pile of T-Rex dung looking for a cell phone in Jurassic Park 3. No responsible teacher would ever teach a bunch of a college kids how to make viruses. It’s obviously just a bad idea…

***Update***: Since I’ve had some reasonable people disagreeing with me in the comments, I thought I should elaborate a bit. Not to put too fine a point on it, but unless you work for Symantec, McAffee, or a similar company, there is absolutely no legitimate reason you’d ever need to take a class to learn how to make viruses.

Moreover, if you have the programming skills to get hired by one of these companies, they can teach you what you need to know about making viruses. I do think this is the equivalent to teaching someone to set up a meth lab, or pimp, or even build bombs. There’s a very tiny subset of people who actually need this information for a legitimate purpose, but a much larger group of people who’d be likely to misuse this info.

Because of that, as time goes on, you’re going to have 50 people pumping out viruses for every one person who actually uses the skills they learn in this class legitimately. That’s why a university has no business setting up a class designed to teach their students how to do something like this. If people want to get detailed instructions on how to create cyber mayhem with viruses they’re going to find the information somewhere. However, that place shouldn’t be the University of Calgary…

***Update #2***: Some quotes from an article in Computerworld on this issue…

“The announcement has raised a few eyebrows. Antivirus vendor Sophos PLC’s CEO Jan Hruska, for example, said in a statement that those who have engaged in writing viruses need not apply to the company for a job.

“You are of no use to us. The skills required to write good antivirus software are far removed from those needed to write a virus. With 80,000 viruses in existence there can be no excuse for teaching students on how to create more.”

One industry expert noted that taking a proactive educational process could be dangerous.

“It’s sort of like asking if you provide people with the recipe for how to build an atomic bomb, what will they do with it,” said Jim Hurley, vice-president of security and privacy at Aberdeen Group Inc. in Boston. He added that it will be very difficult to determine if teaching students how to write malicious code would lead to “good hackers or bad hackers” after completing such a class.”

Furthermore, if you go to the Avien homepage you’ll find an open letter signed by a long list of security professional’s that states…

“The signatories of this public letter, all security professionals with years of experience in dealing with computer viruses, and who work in all sectors, wish to express their whole-hearted support of the following principle:

It is not necessary and it is not useful to write computer viruses to learn how to protect against them.”

Exactly.