Class on virus creation draws industry ire

When the University of Calgary announced plans last week to offer a course that includes instruction on writing computer viruses, officials expected the antivirus industry to support the move--designed to help educate future virus fighters. Instead, industry leaders have roundly criticized the plan.

"It legitimizes the creation of destructive code and the justification for virus writers to do their work," says Robert Vipert, administrator of the Antivirus Information and Early Warning System and the Antivirus Information Exchange Network. Both organizations help antivirus researchers and virus fighters share information about new and emerging threats.

"You can quote me on this," he says. "Please don't do this, please don't teach people to write viruses."

Proactive Approach?

Despite the industry's negative reaction, university officials insist the class will help develop the next generation of computer-security specialists, not rogue virus writers.

"The course is about understanding viruses adequately in order to stop them from happening," says Dr. Ken Barker, chair of the Department of Computer Sciences at the university. "We want to create the next antivirus professional who can be proactive at anticipating the next kind of virus software, the next innovators in antivirus."

Class participants would write their code in a secured computer lab, so the viruses would not reach the Internet, Barker says. And students would not create new viruses; instead they would recode existing ones. Finally, the virus writing would be only one part of a larger computer-security program that includes discussions of computer ethics and legal issues.

But representatives of antivirus software companies rejected the idea that teaching students to work on viruses would benefit anyone.

"There's no value teaching people to write viruses. They are extremely simple," says David Perry, global director of education at Trend Micro. "Looking at the 10- or 12-line replication routine once tells you all you need to know about (a virus). That's why they're being written by 15 year old kids."

Besides, says Ian Hameroff, security strategist at Computer Associates, there are already legitimate antivirus labs in place---and they don't teach students how to make viruses.

"The University of Hamburg has a trusted laboratory that contributes a lot to antivirus, but they're not creating viruses out there," he says "We as computer users don't want to make the unorganized availability of this information on the Web organized as a course and formalized in a university offering without having the right protections in place."

No Guarantees

Beyond the possibility of a new virus finding its way into the real world, there's the chance that not every student would sign up for the course for the right reasons, say some opponents.

"How do they know the people who come into their course will not come out and start writing viruses?" says Vincent Gulotto, vice president of AVERT for Network Associates. "How can we, as an Internet community, be assured that (the knowledge) offered in their course wouldn't be used against us some time later?"

"It's like teaching someone to steal cars so we can design better antitheft systems in the future," he says.

Calgary's Barker says people are missing the point, and notes that most computer-science graduates today already have the technical knowledge to create a virus.

"Any of the kids that have gone through four years of university can download a kiddie script and write a virus themselves," Barker says. "These things exist out there now."

"We're not creating a bunch of people who will go out and create viruses, at least that's not my intention," he says. "These aren't hackers sitting around in the middle of the night looking to damage computers."

No Jobs for Grads?

While the goal of the course is to prepare computer science students for work in the security and antivirus industry, executives in those industries say students who take the class may be shooting themselves in the foot.

"I have 35 researchers that didn't take any courses writing viruses," AVERT's Gulotto says. "If these students had this course on their resume, I wouldn't hire them because, among other reasons, it might perpetuate the myth that antivirus companies write the viruses we're paid to eradicate."

Other vendors echo those comments. "We will not hire anybody with a known history of virus writing," says Chris Belthoff, Senior Security Analyst for Sophos.

Sophos has long held such a policy, but Belthoff says it "wasn't as well enunciated" before. "It wasn't something you paraded around, because there wasn't this (potential) pool of virus writers."

Trend Micro's Perry says his company will be equally clear about their position. "We don't hire computer-virus writers in the industry at all. If we find out they wrote viruses, they're out the door. We tell them, 'get out, we don't want you.'"

PCWorld.com's Sean Captain contributed to this report.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Andrew Brandt

PC World
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?