AVIEN
and AVIEWS take stance against Virus Creation Course
May 26, 2003
Members of the
Anti-Virus Information Exchange Network (AVIEN) and the Anti-Virus
Information & Early Warning System (AVIEWS) reacted with
dismay today
when they were informed of the intention of University of Calgary
Professor
Dr. John Aycock to teach the creation of malware as part of a course
on Computer Viruses
and Malware.
(AVIEN and AVIEWS
are the largest grassroots organizations representing more
than 5 million PCs and the majority of Anti-Virus developers.)
In response,
most AVIEN and AVIEWS members have endorsed the following statement:
We call upon
the University of Calgary to review its decision to include the
instruction of programming of malware as part of its curriculum.
There are
numerous ways to instruct students in the subject of malware without
resorting to the creation of more viruses.
The creation
of new viruses and other types of malware is completely unnecessary.
Medical doctors do not create new viruses to understand
how existing viruses function and neither do Anti-Virus professionals.
It is
simply not necessary to write new viruses to understand how they
work and
how they can be prevented. There are also enough viruses on the Internet
already that can be dissected and analyzed without creating new threats.
There is no reason to actually "write" malware
to become an expert in the
field or to learn how to protect against it. Writing safe programs
that
demonstrate an infection vector is adequate (to demonstrate a vulnerability)
without building in the reproductive sequences. In general, Anti-Virus
product developers do not write malicious code, as there is no need
to do
this to achieve a better understanding of how to defeat viruses.
In fact,
most have policies against the hiring of virus authors.
Just as a public
relations catastrophe would ensue if a virus written in-house by
a member of staff of an antivirus company escaped 'into the wild'
and its source were correctly traced back to them, would not the
University's reputation be sullied, very publicly, when the inevitable
occurred, despite your best efforts to mitigate the risk?
There are any
number of analogies which can be used to demonstrate the folly
of attempting to justify the writing of malware, including that one
doesn't
need to design a new biohazard or caustic chemical substance in order
to
learn about effective NBC suits.
AVIEN and AVIEWS
members would like to suggest that the University of
Calgary include topics such as these in any course on Malware:
- How to use the tools available to help track down malware.
- Techniques of discovery of malware
- How to capture live virus activity on an isolated network.
- How to use
data gathered to help close vulnerabilities employed by
malware.
- In depth analysis
of several well-known viruses of different types, recording their actions in a controlled environment.
- Subject matter
relating to prevention, protection, and cure, rather than how to attack and destroy.
- Reverse engineering of malicious code.
- Virus hoaxes,
chain letters, and frauds, with a discussion of the relevant legal
aspects.
We are also concerned
about the message being sent to students by this course.
It is entirely likely that students will interpret it as supporting the
'dark side' arguments that the writing of malware is appropriate
and motivated by the intellectual challenge and that these
activities are pure research. The underlying message remains
that the University is condoning virus writing and that they believe it has valid, educational merits.
In consideration
of these facts, we strongly encourage the University to re-model
the course in question in such a fashion as to encourage computer security rather than diminish it.
As an organization
made up Security Professionals from industry and other educational
institutions, involved in the daily struggle against malicious software,
our members would gladly work with Dr. Aycock to explore alternative instructional methods.
Robert Vibert
Administrator
on behalf of AVIEN & AVIEWS
