10-02-2005 05:45									#1
	A virus, spyware writing university course... Support Apolyton, buy Galactic Civilizations: Deluxe Edition

http://software.silicon.com/securit...39127703,00.htm

quote: University offers spam and spyware writing course February 08 2005 by Will Sturgeon The virus writing class of 2006 now get to create their payload... The controversial computer science department at the University of Calgary has once again kicked off heated debate in the security industry by offering students a course in writing spyware and the tools for sending and propagating spam. The move follows the introduction of a widely-criticised virus writing course offered by the university in 2003. However, the reaction to the latest addition to the syllabus has been more measured, with many in the security sector saying the right skills, taught in a controlled environment will prove a useful addition to their industry. Steve Purdham, CEO of SurfControl, said he'd certainly look favourably upon any applicant who was a graduate of the course. "If we're looking for an engineer to help us combat problems like spam then we'd rather have somebody who has already been taught about these things and who knows how they work." Purdham says it does the students and the university a great disservice to assume they will abuse the knowledge rather than put it to good use. "It's like teaching safe sex," he said. "Rather than hiding ourselves away from this stuff and mystifying it – which can actually make it more appealing – we need to understand the mechanics in order to protect ourselves. Mark Murtagh, European technical director at Websense, said: "Any good security analyst will have used spyware and hacking tools like Trojans and keyloggers to keep them up to speed on the dangers out there. Knowledge is power, and the security space is like a game of chess - you need to be completely up to date on what's available to ensure you understand your opponents potential next move." Murtagh said there are no guarantees that students won't be 'tempted by the dark side' but said if an individual really is intent on writing spyware or spam tools they don't have to go to the lengths of enrolling in University courses. "This information is all freely available on the internet," said Murtagh. But not everybody in the industry is in favour of the idea. Pete Simpson, ThreatLab manager at Clearswift, expressed shock that the university has re-opened old wounds and criticised what he sees as the unnecessary risk of training students to use techniques which can jeopardise the safety of internet users. "When the University of Calgary first caused controversy with the virus writing course, their dubious defence was that only by writing viral code could a student fully understand and be able to protect against real viruses, but I'm sorry, that argument really falls flat for spamming tools." Clearswift's Simpson believes the saleability of spam tools may create too much of a financial temptation for hard-up students. And unlike with viruses the covert nature of spyware and spam tools means it may be even more difficult to trace any abuse back to students at the university if they do stray. The university threatens students with a fail and prosecution if they are involved in any irresponsible or criminal use of malicious code.

I took the original course last term.

I never could understand the backlash it generated.

Is this a bad thing, or a good thing?

	10-02-2005 05:53									#2
	Got spare money?

its a good thing - people can then fix all the bugs in everything microsoft, so they dont have to pay the price of having buggy software.

	10-02-2005 05:53									#3
	Support Apolyton, pre-order Civilization IV

I soo hope I can take a course like that in college

	10-02-2005 05:55									#4
	Got spare money?

I voted for bananna because people who make actual deadly viruses don't need no steenking edumacation. But who knows?

	10-02-2005 06:03									#5
	Increase Your PM Length

Anti-viruses are actually small doses of the virus.

Is that true in computerland?

	10-02-2005 06:09									#6
	Suffering from ads?

It's a dual-edged sword. All education has the potential to be misused, and generally, the courses with the greatest abhorrance to ethics, tend to be the most abused.

There needs to be a code of conduct for all the students, and a system in place such that any work they do can be traced back to them, while they are students at the university.

	10-02-2005 06:56									#7
	Support Apolyton

Short answer: yes.

Long answer: This is always a problem with teaching computer security -- it seems like every security engineering book I've ever read has a preface saying "should this book even have been written?" or something along those lines. But as a matter of principle, security through obfuscation is a recipe for failure. Also, as a matter of practicality, you don't need to take a programming course to become a script kiddy.

	10-02-2005 09:25									#8
	Support Apolyton, buy Civilization III: Complete

No.

Teaching computer security is one thing, showing them how to write spyware and spam is entirely different.

For example, you can talk about buffer overruns and how to avoid them. You can talk about why various modules must have clearly defined interfaces and responsibilities.

Telling students how to takeover unprotected Wintel boxes and send spam from those is entirely not necessary.

	10-02-2005 09:31									#9
	Support Apolyton buy from Amazon

quote: Telling students how to takeover unprotected Wintel boxes and send spam from those is entirely not necessary.

That's not what the course does.

The course teaches you how to identify those kind of exploits yourself. Either by looking at the source code (in the case of open source projects), or by looking and playing with a binary.

It's not a course on how to be a script kiddy or use known vulnerabilities, it's a course on how to identify new vulnerabilities and use them.

Which is extremely valuable, IMO, to learning how to make your own code bulletproof.

FWIW, UR, the course and its programs and hacking and virus writing is done on Linux and Solaris, not Windows.

I also disagree that teaching "computer security" is enough. The sad fact is many people today don't understand the difference between smashing the stack and heap vulnerabilities -- yourself included.

	10-02-2005 10:33									#10
	Support Apolyton, buy GURPS/ Alpha Centauri

quote: Originally posted by Asher FWIW, UR, the course and its programs and hacking and virus writing is done on Linux and Solaris, not Windows.

That's at least 1000 times harder than writing viruses for Windows. I reckon all the students will fail if they are required to write a working sample.

quote: Originally posted by Asher The sad fact is many people today don't understand the difference between smashing the stack and heap vulnerabilities -- yourself included.

The heap is not executed. I thought you knew that?

	10-02-2005 10:36									#11
	Support Apolyton, buy GURPS/ Alpha Centauri

quote: Originally posted by Urban Ranger That's at least 1000 times harder than writing viruses for Windows. I reckon all the students will fail if they are required to write a working sample.

Oh yeah, there are never any Linux software vulnerabilities.

quote: The heap is not executed. I thought you knew that?

That's not what a heap vulnerability is.

	10-02-2005 12:44									#12
	Browse Apolyton AD-FREE

I think the important question is whether or not it should be an undergrad course.

SP

	10-02-2005 17:46									#13
	Full PM-box? Change here!

quote: Originally posted by Asher Oh yeah, there are never any Linux software vulnerabilities.

I see that you did not answer my question.

quote: Originally posted by Asher That's not what a heap vulnerability is.

You probably don't even know what the heap is.

	10-02-2005 17:50									#14
	Enter the AD-FREE zone

Yes, it's good, as long as students are also properly explained that setting viruses loose is not a good idea. It will give better insight in that part of coding... and let's face it, anyone who is a programmer does anyway have enough knowledge to write a virus. Yes, it might be misused potentially, but a greater awareness of how viruses work will only help.

	10-02-2005 17:57									#15
	Browse Apolyton AD-FREE

quote: Originally posted by Solver Yes, it's good, as long as students are also properly explained that setting viruses loose is not a good idea. It will give better insight in that part of coding... and let's face it, anyone who is a programmer does anyway have enough knowledge to write a virus.

Before the advent of Windows, particularly ActiveX, viruses were hard to write, even on MS-DOS.

quote: Originally posted by Solver Yes, it might be misused potentially, but a greater awareness of how viruses work will only help.

I maintain a general knowledge of how viruses spread is sufficient at this point.

	10-02-2005 19:41									#16
	Support Apolyton, buy Civilization: The Boardgame

In the early-90s, there was a course at my university that taught students how to write virii. One of my coworkers was remarking on it, because he wrote his for a Mac. He kept losing it, because our Macs had anti-virus software (our PCs were like gas station bathroom doorhandles by comparison). I don't see what the big deal is.

	10-02-2005 19:51									#17
	Remove this text

you have to know this stuff for a security class.

	10-02-2005 20:08									#18
	Support Apolyton

quote: Originally posted by Urban Ranger I see that you did not answer my question.

There was no question.

You still don't get it -- there are tons of security vulnerabilities for Linux, there are tons for Solaris, there are tons for Windows...

My school is a *nix school, we develop and we're used to Solaris and Linux and AIX.

quote: You probably don't even know what the heap is.

You're the one that called a heap lookaside vulnerability a "stack smashing" vulnerability...then I corrected you on it...and now you're the one saying I don't know what a heap is.

	10-02-2005 20:10									#19
	Support Apolyton or Terrorists Win

quote: Originally posted by Urban Ranger Before the advent of Windows, particularly ActiveX, viruses were hard to write, even on MS-DOS.

This is complete nonsense.

One of the first things you learn in the course is the majority of viruses don't rely on exploits, they rely on social engineering and getting people to run code they didn't want.

The reason there weren't as many before ActiveX and such is because there was no internet on most computers at the time.

You need to get a sense of perspective -- it's not a fundamental Windows issue, it's an issue with it being the dominant platform and a huge anti-social cracker target.

quote: I maintain a general knowledge of how viruses spread is sufficient at this point.

You're clearly not in a position to make such judgement, since you have no clue at all how these spread. You're a perfect candidate to take a course such as this, to get a reality check and dismiss your simple claims that Viruses wouldn't be a problem were it not for Windows...

It's not a simple case of them telling you buzzwords like "stack smashing" and blaming that on how viruses spread, clearly that is not adequate for you at the very least. It's a hands-on exercise, one that teaches you what to look for in vulnerabilities in programs. This is an invaluable skill to learn, and teaches you far more about security.

My school has always had a course like this, minus the name including "virus" (whcih caught PR). Coincidentally, the most secure operating system on Earth -- OpenBSD -- is based in Calgary and its main architects consist of mostly University of Calgary grads.

	10-02-2005 20:20									#20
	Support Apolyton buy from Amazon

quote: Originally posted by Asher One of the first things you learn in the course is the majority of viruses don't rely on exploits, they rely on social engineering and getting people to run code they didn't want.

Those are modern virii. Back in the day, virii were generally boot sector virii, which have nothing to do with social engineering.

	10-02-2005 20:21									#21
	Support Apolyton buy from Amazon

quote: Originally posted by chegitz guevara Those are modern virii. Back in the day, virii were generally boot sector virii, which have nothing to do with social engineering.

It's not a history course, Che.