Once relegated to the lowly computer programmers interested in the dark art, virus creation is getting a second outlook from a new class in virus writing that could bring aid to a hard-fought struggle.
With the threat of computer viruses increasing in frequency, malicious hackers have found the perfect pipeline to spread their creations. Although there are some software methods that have been utilized, the threat remains large.
Hoping to allow its computer science students to understand their enemy, the University of Calgary introduced a class last fall that allows students to learn the skill of virus creation.
Aside from offering a chance for students to create the viruses, the class also teaches them the history and legal aspects of the computer menace. Students are taught what the viruses can do in an effort to prepare them for real-world threats that may arise.
Ken Barker, head of Calgary’s computer science department, said the idea for the class came from a staff member who wanted to improve the outlook for combating the threat of viruses.
“Basically, one of our faculty members saw this as a need in the academic community and the business community to assure that they can combat the security threats that are coming about,” Barker said.
Barker said the greatest benefit of taking the class is that students will be better equipped at understanding a problem and know the best way to work at solving it.
“The key thing here is knowledge is going to empower people,” Barker said. “The greatest benefit is that our students are going to be able to go out into the industry to find a way to fight the problems that may come their way so that they may be able to help the businesses avoid costly malfunctions caused by the spread of viruses.”
The class, titled “Computer Viruses and Malware,” was offered by Calgary last fall to 16 senior computer science majors who have had extensive training and understand the legal, ethical and technological issues that arise with their creations, Barker said. He said that this would make the likelihood that they would do something malicious minimal.
In dealing with the problems associated with teaching a class in virus architecture, Barker said the school takes extreme precautions to keep it safe.
“The first thing is the lab itself is in an incredibly secure facility that compares to a high security biological hazard area,” Barker said. “In addition, things are sanitized on the way in and the way out to assure accountability.”
Calgary has set up a special lab only for those students who are enrolled in the class. The lab is locked 24 hours a day and is operated on a closed network that is not connected to the rest of the school.
In addition to the tight security in the practice environment, the school has not released the names of the those who are involved with the class for fear it may influence future employers’ decisions on whether to hire them.
Barker said his department plans on offering the class in the fall and that the demand has been astounding.
According to Dewey Rundus, associate department chair and professor at USF’s computer science and engineering department, there are no plans for offering a class in virus creation at USF.
Although there are several who feel the class is the right way to go in the fight against viruses and worms, there are those who feel the class is only adding to the problem.
The main concern that opponents raise is that the class could allow the students to use their knowledge to create more viruses or find ways to circumvent the errors made by previous hackers in their attempt to infect computers.
Other critics say the class could encourage those who were already interested in hacking to use their newfound knowledge to begin experimenting.
Jeremy Rasmussen, adjunct instructor at USF’s computer science and engineering department, said the problem with arguments like these is that the knowledge to create viruses is readily available.
“I don’t see (this class) as creating a new legion of virus-writers,” Rasmussen said. “People who were going to do something malicious would figure out a way to do it anyway, with or without a college course to teach them.”
Rasmussen said he believes current efforts to combat viruses are not effective enough, and he welcomes the opportunity to bring a fresh angle to the fight.
“Anti-virus technology is not keeping up with virus trends,” Rasmussen said. “We are losing the battle (against viruses) and we need to come up with some fresh ideas quickly in order to combat the rising tide of malicious code. Courses like the one at the University of Calgary could produce some new thinking that might ultimately lead to better virus prevention.”
According to Rasmussen, the class offers some similarities to the classes he teaches in that both teach students to know their enemy so they can formulate an affective response against them.
Rasmussen also said the current crop of viruses are being made by hackers who are not highly educated, but know typical usage patterns.
“Most of the e-mail-borne viruses coming out lately are not especially innovative, and they don’t look like they were written by super savvy programmers educated in formal methods of virus-writing,” Rasmussen said. “But they are clever at using social engineering techniques to entice users to propagate them.”
A solution that might help ease the problem of viruses would be to better educate the population on how to use computers safely so that most of the issues would disappear, Rasmussen said.
Regardless of which side they may choose in the discussion, industry officials will likely agree that they have to find some new ways to combat the spread of malicious viruses. Whether or not this solution comes in the form of having better-informed workers, there will likely be some changes in methods used in the near future.
As far as Barker is concerned, he said his argument for educating students would rest in the large amount of malicious code that can currently be accounted for.
“I would point to the 80,000 counter examples of virus that exist in the world today,” Barker said. “I don’t think it’s dangerous to show students how to create the virus in a controlled academic environment, because they are learning how to create (the viruses) while at the same time keeping an understanding of problems that can occur.”