Class on virus creation draws industry ire

When the University of Calgary announced plans last week to offer a course that includes instruction on writing computer viruses, officials expected the antivirus industry to support the move--designed to help educate future virus fighters. Instead, industry leaders have roundly criticized the plan.

"It legitimizes the creation of destructive code and the justification for virus writers to do their work," says Robert Vipert, administrator of the Antivirus Information and Early Warning System and the Antivirus Information Exchange Network. Both organizations help antivirus researchers and virus fighters share information about new and emerging threats.

"You can quote me on this," he says. "Please don't do this, please don't teach people to write viruses."

Proactive Approach?

Despite the industry's negative reaction, university officials insist the class will help develop the next generation of computer-security specialists, not rogue virus writers.

"The course is about understanding viruses adequately in order to stop them from happening," says Dr. Ken Barker, chair of the Department of Computer Sciences at the university. "We want to create the next antivirus professional who can be proactive at anticipating the next kind of virus software, the next innovators in antivirus."

Class participants would write their code in a secured computer lab, so the viruses would not reach the Internet, Barker says. And students would not create new viruses; instead they would recode existing ones. Finally, the virus writing would be only one part of a larger computer-security program that includes discussions of computer ethics and legal issues.

But representatives of antivirus software companies rejected the idea that teaching students to work on viruses would benefit anyone.

"There's no value teaching people to write viruses. They are extremely simple," says David Perry, global director of education at Trend Micro. "Looking at the 10- or 12-line replication routine once tells you all you need to know about (a virus). That's why they're being written by 15 year old kids."

Besides, says Ian Hameroff, security strategist at Computer Associates, there are already legitimate antivirus labs in place---and they don't teach students how to make viruses.

"The University of Hamburg has a trusted laboratory that contributes a lot to antivirus, but they're not creating viruses out there," he says "We as computer users don't want to make the unorganized availability of this information on the Web organized as a course and formalized in a university offering without having the right protections in place."

No Guarantees

Beyond the possibility of a new virus finding its way into the real world, there's the chance that not every student would sign up for the course for the right reasons, say some opponents.

"How do they know the people who come into their course will not come out and start writing viruses?" says Vincent Gulotto, vice president of AVERT for Network Associates. "How can we, as an Internet community, be assured that (the knowledge) offered in their course wouldn't be used against us some time later?"

"It's like teaching someone to steal cars so we can design better antitheft systems in the future," he says.

Calgary's Barker says people are missing the point, and notes that most computer-science graduates today already have the technical knowledge to create a virus.

"Any of the kids that have gone through four years of university can download a kiddie script and write a virus themselves," Barker says. "These things exist out there now."

"We're not creating a bunch of people who will go out and create viruses, at least that's not my intention," he says. "These aren't hackers sitting around in the middle of the night looking to damage computers."

No Jobs for Grads?

While the goal of the course is to prepare computer science students for work in the security and antivirus industry, executives in those industries say students who take the class may be shooting themselves in the foot.

"I have 35 researchers that didn't take any courses writing viruses," AVERT's Gulotto says. "If these students had this course on their resume, I wouldn't hire them because, among other reasons, it might perpetuate the myth that antivirus companies write the viruses we're paid to eradicate."

Other vendors echo those comments. "We will not hire anybody with a known history of virus writing," says Chris Belthoff, Senior Security Analyst for Sophos.

Sophos has long held such a policy, but Belthoff says it "wasn't as well enunciated" before. "It wasn't something you paraded around, because there wasn't this (potential) pool of virus writers."

Trend Micro's Perry says his company will be equally clear about their position. "We don't hire computer-virus writers in the industry at all. If we find out they wrote viruses, they're out the door. We tell them, 'get out, we don't want you.'"

PCWorld.com's Sean Captain contributed to this report.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Andrew Brandt

PC World
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?