Class on virus creation draws industry ire

When the University of Calgary announced plans last week to offer a course that includes instruction on writing computer viruses, officials expected the antivirus industry to support the move--designed to help educate future virus fighters. Instead, industry leaders have roundly criticized the plan.

"It legitimizes the creation of destructive code and the justification for virus writers to do their work," says Robert Vipert, administrator of the Antivirus Information and Early Warning System and the Antivirus Information Exchange Network. Both organizations help antivirus researchers and virus fighters share information about new and emerging threats.

"You can quote me on this," he says. "Please don't do this, please don't teach people to write viruses."

Proactive Approach?

Despite the industry's negative reaction, university officials insist the class will help develop the next generation of computer-security specialists, not rogue virus writers.

"The course is about understanding viruses adequately in order to stop them from happening," says Dr. Ken Barker, chair of the Department of Computer Sciences at the university. "We want to create the next antivirus professional who can be proactive at anticipating the next kind of virus software, the next innovators in antivirus."

Class participants would write their code in a secured computer lab, so the viruses would not reach the Internet, Barker says. And students would not create new viruses; instead they would recode existing ones. Finally, the virus writing would be only one part of a larger computer-security program that includes discussions of computer ethics and legal issues.

But representatives of antivirus software companies rejected the idea that teaching students to work on viruses would benefit anyone.

"There's no value teaching people to write viruses. They are extremely simple," says David Perry, global director of education at Trend Micro. "Looking at the 10- or 12-line replication routine once tells you all you need to know about (a virus). That's why they're being written by 15 year old kids."

Besides, says Ian Hameroff, security strategist at Computer Associates, there are already legitimate antivirus labs in place---and they don't teach students how to make viruses.

"The University of Hamburg has a trusted laboratory that contributes a lot to antivirus, but they're not creating viruses out there," he says "We as computer users don't want to make the unorganized availability of this information on the Web organized as a course and formalized in a university offering without having the right protections in place."

No Guarantees

Beyond the possibility of a new virus finding its way into the real world, there's the chance that not every student would sign up for the course for the right reasons, say some opponents.

"How do they know the people who come into their course will not come out and start writing viruses?" says Vincent Gulotto, vice president of AVERT for Network Associates. "How can we, as an Internet community, be assured that (the knowledge) offered in their course wouldn't be used against us some time later?"

"It's like teaching someone to steal cars so we can design better antitheft systems in the future," he says.

Calgary's Barker says people are missing the point, and notes that most computer-science graduates today already have the technical knowledge to create a virus.

"Any of the kids that have gone through four years of university can download a kiddie script and write a virus themselves," Barker says. "These things exist out there now."

"We're not creating a bunch of people who will go out and create viruses, at least that's not my intention," he says. "These aren't hackers sitting around in the middle of the night looking to damage computers."

No Jobs for Grads?

While the goal of the course is to prepare computer science students for work in the security and antivirus industry, executives in those industries say students who take the class may be shooting themselves in the foot.

"I have 35 researchers that didn't take any courses writing viruses," AVERT's Gulotto says. "If these students had this course on their resume, I wouldn't hire them because, among other reasons, it might perpetuate the myth that antivirus companies write the viruses we're paid to eradicate."

Other vendors echo those comments. "We will not hire anybody with a known history of virus writing," says Chris Belthoff, Senior Security Analyst for Sophos.

Sophos has long held such a policy, but Belthoff says it "wasn't as well enunciated" before. "It wasn't something you paraded around, because there wasn't this (potential) pool of virus writers."

Trend Micro's Perry says his company will be equally clear about their position. "We don't hire computer-virus writers in the industry at all. If we find out they wrote viruses, they're out the door. We tell them, 'get out, we don't want you.'"

PCWorld.com's Sean Captain contributed to this report.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Andrew Brandt

PC World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?