First of all, sorry for the lack of posts. I’ve spent the past few weeks at my new job! No, it’s not a IT related job. I’m working 10-12 hour shifts at a sports store to earn money so that I can pay for tuition and so that I can take my girlfriend on holiday. Anyway, back to the story at hand:

Two days ago Newsweek published a somewhat confusing article on a lecturer teaching students how to write viruses and find exploits in software.

“In a windowless underground computer lab in California, young men are busy cooking up viruses, spam and other plagues of the computer age. Grant Joy runs a program that surreptitiously records every keystroke on his machine, including user names, passwords, and credit-card numbers. And Thomas Fynan floods a bulletin board with huge messages from fake users. Yet Joy and Fynan aren’t hackers—they’re students in a computer-security class at Sonoma State University. And their professor, George Ledin, has showed them how to penetrate even the best antivirus software.”

It’s a great article that I recommend you read, but before you do, please note that the author, Adam B. Kushner has put a large amount of spin on it.

This is exactly what academia is inteneded for: enabling students to reach the boundaries of education and knowledge by breaking every rule in the book. Teaching students how to make viruses is no different from a car mechanic learning how an engine works by taking it apart. By far the best way of learning about something is to actually use and develop it yourself. It’s a fantastic way to teach students about Programming and Operating Systems and it gives Computing students some work they can genuinely be proud of. It’s this kind of programming activity that should be a part of all Computing-based Academia; work that could really further security.

It is absurd that the author would take the side of a corporate security company that sells millions of dollars of software that fails to work as well as some of the free alternatives out there. This kind of research is what keeps the security companies in business, although by their treatment of these students in refusing to hire any of them I can see these companies falling to pieces.

In my honest opinion I believe that all CS students would benefit from these kind of activities. What the author fails to show is that these experiments are being performed in sealed labs, away from any open network that could result in a ‘leak’ for a potential virus. These experiments are completely harmless and unlike real viruses could never cause real damage.

However, in many ways, I think that these viruses should do real damage.

There, I said it! I would love to see a university develop a killer virus, capable of taking down a computer, regardless of whether it is a PC or a Mac. Hell, I would love to see a virus that could snap Linux like a twig. Why? Simply because we’ve become too complacent with software, especially major firms. If a virus that could easily destroy Windows were to be released the world would stand still, resulting in Microsoft programmers shifting their priorities from stupid acquisitions to improving the security on their products. In the same light a Linux virus would get obsesssed fans off their high horses and make them realise that the only way a product becomes great is by constant criticism. Not only would it be great for the quality of software, it would be phenomenal for the business of a small university with a poor reputation. If a small university were to claim that they had a computer virus that could take down millions of servers around the world thousands of companies would want the code and millions of potential students would read about it.

I hold the name George Ledin in high regard after reading about his course, and I can only hope that other lecturers read the article and see the benefits such a class could bring to the IT industry.