University of Calgary to Offer Virus-Writing Class

It's just incredible .....

Quote:

---

full article here It has come to this: A professor at the University of Calgary in the fall will teach a class that will show students how to code viruses and Trojans. The university is billing the class as the first of its kind in Canada, and it may well be the first such course anywhere.

The class, entitled "Computer Viruses and Malware," will "focus on developing malicious software such as computer viruses, worms and Trojan horses," according to a press release announcing the availablilty of the course. Students will also learn how to deconstruct and analyze malicious programs and delve into the ethics and legalities surrounding viruses.

---

What's the next step a course about rape & murder .........

Eh, I can sort-of see the point, I mean I see both sides, but if you know how to write a virus or trojan you know how they operate and should be able to assess the situation quicker and more efficiently.

I agree with Bludgeon. In order to better protect against viruses and worms, people should know how they function. But I think ( and hope) that the class will focus more on the analysis of the viruses and the ethics of their use than on the construction part.

yeah! u r right but on the other side of the moon there r script kiddies ...

I mean the one who built virii don't need that course, the one who fight virii should have good programming skills and system undertstanding and may need that type of course but the dangerous one's a r script kiddies who learn just how to modify for their own benefit existing progz with the minimum programming skills.

I think this type of course should be under close survey and dedicated for professional working for antivirii cie...

Maybe students details are filled in a "FBI" database for that purpose ...

"Maybe students details are filled in a "FBI" database for that purpose ..."
Eh, that would go against my ideals on privacy, and I see your point. . .but quite a few college classes could be considered putting 'bad' knowledge into people's heads. . .ie chemistry.

Quote:

---

Originally posted here by bludgeon
"Maybe students details are filled in a "FBI" database for that purpose ..."
Eh, that would go against my ideals on privacy, and I see your point. . .but quite a few college classes could be considered putting 'bad' knowledge into people's heads. . .ie chemistry.

---

i know people that took Chemistry and started making there own hallucinogenics.... It all depends how you use the knowledge you gain. for all we know someone taking the virii class may find a way to prevent them better and also find a way to prevent virii that arent even made yet.

Quote:

---

Originally posted here by Networker
yeah! u r right but on the other side of the moon there r script kiddies ...

---

exactly. most skript kiddies wish to remain as such, and have no interest in coding, so they propably won't bother going to this class. It's much easier to download the newest point and click exploits than to learn C++ ... or any language for that matter...

by the way, is h4x0r pronounced "hacker" or "Hacksor"? I was playing mancala with a script kiddie this weekend, and he was wearing the latest in "i'm a wannabe hacker" apparel and said that he had "leet hacksor skills." (1337 h4x0r 5k1LL5?)

just curious as to how that is spoken IRL.

One of the most informative documents I ever read was "The <color here> book of Virus writing" -I never created a virus but I thought information presented was extrmely valuable and gave me some development insights. I think it was the Red book. . . but I am not sure.

Cheers,

-D

Dspeidel, I think it's the "little black book of virus writing".
As for the script-kiddies, I might be wrong but aren't most script-kiddies just bored teens who eventually grow out of their "script-kidding" days and start their lives?
Second, just because the class teaches you how to build virii doesn't mean the class is easy.
Sure, it'll probably give you the outlines but as most CS classes, the major part of the work is done on your own. And the class will probably have some kind of prerequisite (intro to C, C++,...) and I doubt script-kiddies can put themselves into the "pain" of learning these programming languages.
Sorry about the avatar. I couldn't find any different and tried to pick the most decent one.
You know that I'm talking to you, N. ( I hope this one is better).
Cheers

Quote:

---

Originally posted here by Networker

Maybe students details are filled in a "FBI" database for that purpose ...

---

I doubt that the University of Calgary would work with the FBI on this one (different countries). Maybe the RCMP. That said, if the professor teaches the course like I teach mine there is a degree of ethics and an agreement that students have to understand. Most students that take a course like this aren't there to do destructive behaviour. They truly want to understand how things work by creating something like that. It's more fun when the topic is interesting. I have no doubts that the students in that course will learn tonnes.

In addition, most courses like this carry a lot more of a risk factor. Usually it's a "you break the rules, you're expelled and the cops will be waiting for you when leave the campus" kind of a thing. So it's fairly easy to find those that might turn to the "dark side".

Here's the link to their description (short descript):

http://www.ucalgary.ca/pubs/calendar...s/CPSC.htm#599

Given the position in the degree (4th year, Honours year) and the fact you have to meet the Head of the Department, makes me think a lot is required of this course and it's no script kiddie course.

I'm with you msmittens. most people don't go through four years of college to turn stupid a few months before they grauduate. (and by turn stupid, I mean do foolish and eeeeevil things with their virus knowledge.)

also, i didn't insinuate the class was easy. In fact, I was insinuating that it was not easy, and that most skript kiddies would prefer sub 7 and netbus to learning how to program.

Personally, I think that those who are bent toward doing evil with their programming knowledge will do so with or without a class being taught. The information is out there.

I also think that books like Hacking Exposed, Hack Attacks Revealed, Counter Hack and the like are essentially based on the concept that to be a good security administrator it helps to know exactly how the hackers/crackers are attacking in the first place.

It seems logical on those same lines that learning advanced virus-writing techniques may prove valuable in defending against those same techniques or even possibly coming up with the next generation AV software that will protect better. The current virus-signature based protection can only go on so long. What happens in a year? 5 years? 10 years- when the number of viruses and worms grows exponentially and the signature/footprint database is 150Mb? There has to be another way to catch and block these threats other than signatures.

I also think that by knowing exactly how the viruses and worms work it may be more possible to create the vaccine or anti-worm that could be unleashed on the Internet to eradicate and counteract these threats (although counter-hacking is still a controversial topic of ethics and legality).

AVIEN / EWS of which I am a member has issued a press release strongly advising against this class or teaching this sort of material. Here is an article about this topic: Article

I just posted my own article on this topic:

Quote:

---

The University of Calgary will be teaching some students how to write viruses. Some of the security community vehemently oppose sharing this knowledge and would prefer to practice security through obscurity when it comes to virus defense.

---

Click here to read the full article at About.com: Virus Writing 101

Heh heh, I got drive by'ed. . .gotta love this place. . . :) btw, That was an excellent article tonybradley!!

Many many good points in this thread.....

As Tony pointed out, the knowledge is out there and as the old saying goes, "People do what they want to do." I'm sure some of you have seen the Virus Lab Kit right? For those who haven't it basically has point-and-click virus creation capabilities while at the same time generates and displays the code used to perform the action. With programs like this available, what is the sense of not offering a course that actually teaches *proper* coding techniques in a controlled environment?

Trying to discourage people from taking courses like this, in my opinion, is closed minded and backwards. I have a lab here at my facility where I teach my junior security technicians the mechanics of high profile exploits. After that, I show them how to use those skill sto identify unpublished vulnerabilities. Once they have a true understanding of how an exploit works, I believe that they will be better technicians. Will they or could they pump this info into the underground? Sure, but to me the benefits of them knowing far outwiegh the potential damage they could do with their new skills. How many people here get pissed off when a netadmin doesn't understand how domain broadcast traffic is handled? Same idea here folks. Sure, by knowing exactly how domain broadcast traffic works, you can potentially hose up WINS resolution but wouldn't you want the admin to know how this works should your PC stop performing lookups across network segments? See my point here?

(Rant over) :)