Slashdot Mirror
Canadian University to Begin Training Hackers
torok writes "According to an article at The Edmonton Journal, The University of Calgary is going to start teaching select computer science students to write software viruses in a special new disconnected lab. Will Canada be accused of training the world's next generation of cyber-terrorists... or peacekeepers?"
WHO LET THE H4X0RS OUT?
l33t,l337,l33t,1337
WHO LET THE H4X0RS OUT?
l33t,l337,l33t,1337
WHO LET THE H4X0RS OUT?
l33t,l337,l33t,1337
WHO LET THE H4X0RS OUT?
l33t,l337,l33t,1337
WHO LET THE H4X0RS OUT?
l33t,l337,l33t,1337
I just read a good article on this too. Apparently, if we train hackers at a young age, we can control them, and get much more work done. Read the article at http://www.cs.berkley.edu/~bh/hackers.html
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
I'm sure they will be ACCUSED of it, but I think everyone here sees the real reason. How can you know how to secure your systems if you don't know what the virus writers are doing?
And I'm sure that a select number of people will use this information maliciously, but everything comes at a cost. I don't think it would be a good idea if no one but the 'bad guys' knew how to write a virus, because then no one but them would know how to keep their systems secure from them.
Now we have a reason to invade Canadia.
Crackers, not hackers.
I understand this is a losing battle but lets not get it wrong on slashdot.
Siggy Say, Siggy Do
The fact they are learning the hows of a skill does not mean they will use the skill maliciously. :)
In fact, when educated, most people will use their powers for good, not evil..
Important info:
http://www.lifeaftertheoilcrash.net
http://dieoff.org/synopsis.htm
http://www.peakoil.net
it's just like the school of the Americas where we train most of the anti-terrorist forces, but it's also the place where most terrorists come out of. If they don't have a problem with that school, the same rationale should be applied to this school.
You gain a certain understanding for certain things when you're "at the wrong end of a telnet session" A lot of that knoweldge can be used for protecting against the same exploits. If they're writing viruses, maybe instead of having a definition file for each virus that has to constantly be updated, they could author some detection scheme that monitors for activity that is like a virus, or certain function within the code that can be stopped much simpler than the current methods
--fetch daddy's blue fright wig, i must be handsome when i release my rage
will this be offered as an online course?
Will Canada be accused of training the world's next generation of cyber-terrorists... or peacekeepers?"
Oh! Oh! I Know! Is it...terrorists?
Triv
Well, I'm quite proud to be an (adopted) Canadian. I see this as just another way for us to poke the Nazi Americans...what with SARs, mad cow, and our threat to decriminalize pot...why shouldn't we just push the envelope a little more? ;-)
-psy
Skills:
Comment:
While I realize the above skills may not be entirely useful for the position described, I have noted that you do have an internet connection to your primary server via IP address 66.35.250.150. Would you like me to tell you your root password during an interview, or should I be ready work at 8:30am tomorrow?
I am dubious to the value of using a bunch of students for this project. Many virus writers etc seem to be highly motivated, determinded individuals hell bent on annoying the crap out of the rest of us. I cant see the students replicating this commitment
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
Why not focus more on creating better programmers versus turning the the good ones to the dark side (of the language.)?
Virus writing was very easy last time I looked into how they were written and structured. What are the tools being used to create these 'viri'? My guess is Calgary has a site license for The Nowhere Man's Virus Creation Labratory software.
So l33t.
maybe it's just me, but this article has a rather tabloid-esque sensanionalist feel to it. where did they get the figure of $1.6-trillion of damage done by viruses? that's just not believable. then they quote unspecified "experts" and refer to vaguely conspiratorial theories of government-hired hackers in a "secret laboratory".
basically, they are printing a new course announcement and mixed it in with a bunch of hyped up BS in order to make it look like a real article.
you know, I've been working through the idea of a "hacking 101" course for pre-university students. Think about the concepts to you need to understand how to write a "simple" stack overflow ; all about how programs execute, how system calls work, machine language, probably network programming. Let alone the actual C and ASM hackery skills. More advanced hacks like infecting dynamic libraries etc require even more knowledge. By the end of it, you'd come out at least knowing if you liked computer science. I wish someone had done this for me when I was 16 or 17. Take the class over a few weeks, introducing one concept a week and then have a go at writing that part of your exploit.
...
It has been suggested to me that I might as well just teach a basic operating systems class, but it doesn't have to same ring to it
Not as crazy as it sounds...In the early days of virus outbreaks, it seems as often as not the problem was not so much the payload as it was poorly written code causing it to behave in an unanticipated way.
Mind you this was not always the issue...sometimes the poorly written code of a virus is what keeps it from running rampant.
Viral delivery, with a beneficial payload (it IS possible) could be a useful thing.
At the very least, maybe we'd see more efficient code with all those Outlook email floods!
After all, by studying how viruses are made, you can better understand them and thus make better anti-virus software. The kids going here are not going because they want to learn to be L33T cyber hackers or whatever, but knowing the tools of the trade (white and black hat) will help them in the computer programing/protection field.
Fuzzy Knights: New RPG Strips Tuesday and Friday!:
http://www.fuzzyknights.com
Prerequisite: reverse engineering software from a monopoly
You have to consider any methods of writing virus being taught at a university are without a doubt outdated and easily detected... Any who are able to take this information and progress it into a difficult to counter virus is intelligent enough that with that as their agenda they would have learned on their own anyway.
they actually teach people how the human body works, under the guise that they will "heal" people or at least "diagnose" what's wrong with them.
Yah, RIGHT. If you tell these murders that a certain body part is crucial to life, the first thing they'll do is cut it right out, because people are basically EVIL.
Similarly, anyone who knows how computers work is a cyberterrorist. Canadians are FRENCH! Did we forget what happened on 9/11?
I can see this getting way out of hand very quickly. Everytime some new virus hits inboxes across the world, this kind of class would become the easy scapegoat. While teaching them how to make viruses may be in good faith and in fact it is probably quite interesting, the rammifications are just to big for this class to be a success. Who knows, maybe we'll the the "I Love Hockey" virus out of it.
No matter what path they choose, whether to be malicious hackers or peacekeeping notify-devs-before-it-gets-noticed types, the end result will be the same: better code.
Now if only we can get MS to believe what us open source folks have been saying for years!
There seem to be alot of positive posts about this.
Fair enough, but would you still be for this if it were a bio program instead of a CS class?
Should we be having students create killer bacteria in order to see how terrorists might do that?
Hackers do it for the fun, achievement, and knowledge. It is like a sport for them. They do not do it to cause harm.
In this instance since they are doing it for fun and the end result of their quest is knowledge, and don't indend on causing any harm or havok with their code, they are hackers and not crackers.
I live within walking distance of this university and I am a professional developer and have been for a number of years. Last fall I contacted their IT people and asked if they have any courses on C++ cross platform development. (Rightly or wrongly I elected to use wxWindows and C/C++ from now on - but I still ahve a lot of legacy code of course).
I was suprised at the raw nerve I seemed to have hit with the prof I was speaking to because she became somewhat defensive.
My position is that if we for instance go to sourceforge and check the projects that we will find that C/C++ is perhaps the most popular language for these projects. If I look at my development requirements my conclusion is that C/C++ is THE ONLY viable languge I would even consider using! In my career I have programmed on over 13 platforms and I have used over 13 languages - many of which are now obsolete. I don't think I am biased towards C/C++ or say biased away from say Java. I have my career and at this point in my life I am managing it! I encourge all other programmers to do likewise. What this means is that for me - if a client asks me to program in VB, Java, etc. my answer is that I will NOT take on the job.
Given my strong feelings that C/C++ will be here for the foreseeable future - I find it totally ironic that the U of "C" doesn't even teach "C".
As such - I consider them rather irrelevant.
Furthermore as it turns out I was at the OpenBSD hackathon BBQ last weekend and made the point of asking the hackers how much Java there is in OpenBSD. They laughed. When I asked about C++ they were a little more serious and consided that perhaps there is some somewhere.
So I commented to them that the Uof"C" doesn't teach "C" and was actually quite surpised to hear one chap pipe up that his company doesn't hire UofC IT grads.
I think this is a really sad testiment to the department actually. My opinion is that they have a strong Java / M$ bias and I think this is rather sad. Just MHO...
--------------
BTW - these comments should not be construed to critisize Ruby, Python, Perl, Bash, PHP etc. These langages all have their place and I use some of them. My comments are about the use of C/C++ for general purpose applications development where you might end up with 50,000+ lines of code.
Wow, they only lifted 80 per cent of the press release...
http://www.ucalgary.ca/news/may03/virus.html
This is nothing particularly new where I come from . In ottawa a computer camp (Virtual Ventures) , which was run by carleton university students had a quasi course in virus writting for the attendees . While this new course is obviously much more indepth and would probably be of great interest to a computer science student . There are quite a few legitimate reasons to do this , firstly for antivirus people if we can have more "white hats" discovering new Microsoft "features" that allow "remote adminstration" or "security lockout override" we can hopefully develope better ways to protect against these problems. One of the few remaing growth industries in computers is in computer security currently .
One of the slightly less obvious benefits is these computer science students will know what its like to try and find "features" and will hopefully recognize more accidently "features" and take them out before they are exploited.
Joke (If you dont have a sense of humour do not read below this line):
As for everyone who is worried about canada being labelled a place for training cyber teriosist , dont worry most terrorist are educated in the united states and will continue to be we just want a small portion of those who cannot afford the high tution to us instituions [JK] .
nt
-1 Uncomfortable Truth
"The first official virus was in 1986 that someone was able to trace back to the perpetrators, which were two brothers in Pakistan," Seneker said.
They were easily traced because they embedded their names and address in a virus.
Or maybe this would be a course on how to avoid mistakes of the past...First lecture reminder: "DON'T write your names on the homework you turn in
Warning: Opinions known to be heavily biased.
sorry.
--
cHris
The course is open to 16 fourth-year students who must work under strict conditions in a secure lab cut off from Internet and cell- phones.
I can see the no internet connections, but no cell phones? I can't think of any viruses that travel over cell phone networks and I think it would be simple enough to ensure that they can't transfer anything to their cellphones so they can't email themselves programs. Also other than containing any viruses let loose in the lab I don't think you can do anything other than teach the students ethics so they don't let anything loose outside the lab. At the end of the day you have to count on responsible students, if you're teaching people you don't even trust with cellphones in the lab you're going to have serious problems.
I stole this Sig
> stupid mooseheads!
Mmmm. Moosehead.
As if I have no trouble keeping up with the latest M$ debuachle... Now I get even MORE snort Rulz to write....
One of the largest problems in the software business and the computer industry as a whole is an utter lack of knowledge. For some reason, I doubt that a field like, say, structural engineering would contain so many people who don't know jack. Buildings would collapse left and right. They don't, yet in computer jobs, there are hordes of people who make Windows applications by dragging shiny objects onto a pretty grid, fill in some properties, and call it programming. Lots of folks are taking computer science courses at the local community colleges, yet they don't seem "the type" to do this sort of work. (Indeed, I saw one girl studying at the local library... she was highlighting just about every sentence in a text about different types of loops, and she obviously wasn't "getting" it.) Why is this?
There are many programmers who "get by" by writing cheesy code (with as many holes in it as Swiss cheese). The problems caused by this lack of expertise are enormous. Billions of damages are caused to businesses every year because of computer failures. Many of those failures are due to bugs in software. Many are due to security problems. How can the problem be solved? Passing legislation that makes it illegal to discuss security problems won't solve the problem. There would be "underground" discussions of these things, and the crackers would freely share information that law abiding folks won't. Crackers will break into systems more easily than before the legislation and businesses will be slow to react, causing more damages. It would be the computer equivalent of making guns illegal to law abiding citizens. (After all, the criminals are above the law anyway. If someone is so inclined as to murder people, what difference does it make if some silly law says he can't have a gun?)
The unskilled programmers (who don't even like this work) should stop dreaming of getting rich quick. However, the programmers who are skilled should expand their skills in every direction possible. Certainly, each programmer should focus on the things he does best in order to be more effective at those particular skills, but there is nothing like experience in different types of programming to make someone flexible in this field, creating job security and expert authority. Perhaps a game programmer should try a small database job. Or a database programmer should try hacking some small feature into an operating system kernel.
Viruses are a legitimate subject of study. By teaching viruses, universities will give people a lot of power. Some will undoubtedly use it for evil, and we'll get some new viruses out there. But this would happen anyway.
Who, for example, are the best security consultants when it comes to credit fraud, insurance fraud, computer fraud, etc.? The perpetrators! There are examples of folks who committed all kinds of crimes and went to prison. Afterwards, they became "white-hat" consultants in their fields, teaching banks, governments, businesses, etc. how to protect themselves from people just like the consultant. They often make more money by teaching this knowledge for purposes of good than they did by committing the fraud in the first place. In other words, if you have experience with performing some act, then you undoubtedly know more about what makes someone vulnerable or safe from that act than any fool claiming to be a security expert.
The advantage of teaching viruses, which heavily outweighs the disadvantage of misuse by a large degree, is that programmers who have experience with viruses--not just by removing them from friends' clutter-ridden computers but by writing them and finding out what is effective from a virus writer's standpoint--will be more effective at designing systems and writing software that is less prone to the evils of viruses.
I think the field of Computer Science would benefit by teaching SPAM, cracking, and other forms of abuse in order that honest folks (nearly all of us) can protect themselves from the dishonest ones with the very same knowledge that makes the dishonesty so effective.
Anyone remember Mark Ludwig? I remember getting "The Little Black Book of Computer Viruses" and his other books. It contained excellent explanations of how programs work, COM, EXE strcutre and then how to use ASM to modify those programs. There were ever some polymorphic virus in there all with Source Code. His later books, The Big Black Book of Computer Viruses and Computers, Viruses and Artificial Life were all right, and discussed Alife ideas about the code really being alive in the "world" of the computer.
I haven't read his latest book, The Little Black Book of Email Viruses: A Technical Guide. I haven't thought about that stuff in a long time. It did allow me to find the ILoveYou virus and fix it at our company by quickly renaming the wscript.exe program since I learned to think about viruses in terms of what they needed to reproduce.
Personally I think the Novell file security system would be an excellent way to combat viruses and other things. Read, Write, Execute, Copy, Modify and a few others all as true seperate rights. Pain in the but to configure, but very nice once it was setup
Windows NTFS is a little better then just Read Only, Hidden, and System, but even the standard Linux RWX3 rights make me miss Novell. Anyone know if there is there a filesystem out there for Linux that has that level of rights?
Personally I don't know if it's possible to have a secure system that that is still usable by the masses who just want to check there email and click OK on every message box that pops up. It's hard enough to secure things when you know what your doing.
I am in computer science at the University of Calgary, and everyone before the 4th years this new school year were taught pascal and java right from the start(sic). I wouldn't be too scared of what they can do in this course after this school year.
System.out.println("You are owz3d!!1");
kyjello is too damn smooth to make a signature.
I couldn't say if it is, but that sounds like a reasonable number... We had virii rip though the office about 4-5 times a year at my last job, and the whole network would be down for the better part of a working day. $25/hr * 8hrs * 80ppl = $16,000 in paying employees to hang out at the water cooler, not to mention the loss of business revenue. And that's just one medium-small business. If 100,000 similarly sized businesses had one day like that a year, there's your 1.6 trillion.
-1 Uncomfortable Truth
This will let Bush make all those jokes about invading Canada become a reality.
Wait, I meant liberate Canada from cyber terrorists.
Outdoor digital photography, mostly in New Engl
...the University of Calgary has announced the addition of 133t-sp34k to its Foreign Languages department.
why they would not instead take a proactive approach and simply IMPROVE computer science / information systems courses to stress data and system security, and ways to better implement these aspects within applications, networks and operating systems.
-Cnik
The 'Eh?" virus coming our way.
If America and Canada got into a war, where would all the draft dodgers go?
"Everyone is entitled to their own opinion, but not their own facts."
/me ducks
...the civilian casualties are guilt-free!
Even though you will be among those lined up against the wall come the revolution, this one will never lose its charm - always good for a chuckle...
This method would also be cheap in terms of raw materials. If you can threaten an attacking country with the destruction of their economy or failure of basic utillity systems, without having to mobilize a pile of troops, you're money ahead. Sounds like a plan.
Disgruntled Professor in said subject goes insane (but his inherent humanity remains for later purposes in the script, naturally) and writes a virus that will 'bring down the planets computing power'. Former student and star of the class is brought in (obviously from somewhere and time at which they for some reason cannot face computers (possibilities: severe RSI, Epilepsy set off miraculously by 65-85Hz screens, Blindness...) to defeat the mad professor, before the final showdown with badly executed profundities.
And all the computer scenes have to use a bizarre and unique 3D styled UI, that looks wholly unusable, and slightly, if not completely frustrating.
Geee, I can't wait *lays on the fake exuberance*. These things always happen when something becomes more mainstream.
..and I thought I was going to be part of the next wave of terrorism.. pot smokers!
;)
It's weird, though, I always see us as peacekeepers once Bob has entered the room
Gun owners will argue that if your children learn to respect firearms, then they will be less likely to misuse them. Perhaps this will follow in the logic. But then again there is the "out of site, out of mind" theory as well.
If you're playing defence, you need to understand how the offence does it's thing. No great shock there.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
All too true...
in a special new disconnected lab
As if that would be a problem which can't be overcome. Or is it done on the iMacs which don't have floppies or CD-writers?
Edwin
bash$
Achille Talon
Hop!
I recommend strongly that anyone in a role like mine take some time to study viruses, exploits, rootkits, and other pieces of hostile code. These are a basic part of the security environment in the field. The more you understand the crap that the Net's rejects and crackheads are throwing at you, the better a job you can do.
Here's just one example of what we can learn from viruses; a bit of an older example, so I'm not doing too much of your work for you:
Let's say your client is considering a bonehead move -- like, say, deploying Microsoft Outlook enterprise-wide. Any security nerd can say "duh, Outlook sux0r, it's full of vulnerabilities, that's why it spreads viruses." However, if you have read the source code of the LoveLetter and Melissa viruses, you will realize (and can explain to your client) that these viruses do not exploit vulnerabilities at all -- at least, not in the sense of buffer overflows and other attacks which target bugs in software. These viruses don't crack anything -- they use perfectly ordinary, documented API calls. It isn't holes in the Windows Mail API that make it a virus breeding ground -- it's just its built-in, designed, intended functionality. That's why these viruses can still spread after years of bug fixes: their critical paths do not rely on bugs at all.
What do we learn from these viruses? Security is not about patching bugs, or having bug-free software. It is about correctly modeling the trust relationships people have with each other regarding their computer resources, in software. The Windows MAPI's design implies an assumption that people want to entrust word-processing documents with the power to send hundreds of emails. That's obviously wrong -- and that, not any bug, is what must be explained to convince someone that Microsoft's mail software is a bad security choice.
There are many more lessons to be learned by understanding hostile code. There are lessons about user interface design: many email viruses depend on getting the user to take some action (opening a message, running a macro, etc.) which unintentionally grants the virus trust and privilege (even the privilege to run code) that it should not have. To design secure systems for users, we must have user interfaces which do not promote such deception. There are lessons about system monitoring and the habits of sysadmins: Unix rootkits, which alter the system to conceal the tracks of an attacker, show just how easily a too-shallow maintenance or log-checking routine can be deceived. There are many lessons.
Get yourself some virus source code. Google will help. Read rootkit code, and the analyses thereof which researchers on SecurityFocus and other sites have published. Understand these attacks, and you will understand the systems they target better than you do now.
Mark Allen Ludwig wrote a controversial book on computer viruses in 1991. If I recall correctly he discusses (with full source) five viruses of increasing complexity - the ultimate being a "stealth virus." It's an interesting read for anyone into computer security. He has also written a second book on email viruses.
Little Black Book of Computer Viruses: Technical Aspects, Vol. 1
by Mark A. Ludwig
American Eagle Publications, Incorporated (May 1991).
ISBN: 0929408020
The Little Black Book of Email Viruses: A Technical Guide
by Mark Allen Ludwig
American Eagle Publications, Incorporated (February 2002)
ISBN: 0929408330
does west point train the next generation of postals or peacekeepers...
nææ forget it, with american foreing politics
they are bound to be postals.
he might shoot me som time so i kill him...
wow this got quite off topic now
The best bomb creators make the best bomb technitions.
:)
I'll take anti-virus software from the most "evil" virus creating minds in the industry over some programming wannabe's anti-virus software.
This is granted that these "evil" virus creating minds arn't too "evil" and put back-doors in their anti-virus software
- Jeff
Modesty is one of life's greatest attributes
SOA trains on counter insurgency (how to squash left wing rebellions in your/my pathetic Latin American country) like the FARC in Columbia (although they're just about the drug money now) The FARC, et al are the terrorists.
Although many right wing Latin American dictators(Galtieri) and generals were trained there, they aren't terrorists.
You must understand:
left wing oppression == terrorist: FARC, SHINNING PATH
right wing oppression == no other way to stop the misguided commies. Pinochet wasn't all that bad.
It's nice and cute to be living in the first world and complain about how bad human rights are in (insert your favorite Latin American shithole here) but the truth is, human rights get REALLY bad when the left takes over.
Instead of complaining about the SOA, why don't you complain about Cuba training and supporting terrorists in Columbia and most poignantly Venezuela. Where Chavez followed Castro's(and Hitler's) playbook to the letter. I will summarize, talked a good (leftist) game, got elected by 80% of the vote, promptly revamped the constitution and parliament, extended his term twice. He's there for life.
I lucky escaped my Latin American shithole, I know what goes on there. You should regurgitate shit you hear on NPR but don't fully understand.
Who gives a rats ass. If all they learn is how to hack out Windows software.
OH THE SHAME I fell off the wagon and use sigs again!
North Korea is graduating 100 hackers a year from it's elite school. How much longer past the end of NK communism will these people be making trouble?
Recent history has taught us an ex-communist is a lot nastier than a communist.
It's Christmas everyday with BitTorrent.
My mind is a little fuzzy at the moment, but didn't we had to deal with Commodore 64's disks with viruses long before 1986?
What the hell is up with the Maclean's ratings?? =)
The answer is: terrorists.
Hiring a cracker as a security expert is like starting a long-term relationship with someone who's cheating on their current partner: they've already demonstrated their willingness to cheat!
if ($Hacking == $VirusWriting)
{ print "the media has won"; }
for goodness sake...
mix_master_mike
vafrous
In fact, when educated, most people will use their powers for good, not evil.. :)
Exactly. Most virus code is horribly written. If we're going to have malicious self-replicating code running on our machines, we should demand high quality code that doesn't crash. So many virus writers can't code their way out of a paper bag.
I demand my viruses to be written by CS graduates. If you don't at least have a CS degree, I won't click on the attachment.
The instructor is Dr. John Aycock, and he's definitely one of the better instructors we have in CPSC. His focus is in compilers and OS's, and taught the 3rd-year OS class for I think the first time last Winter.
He definitely has a strong security focus in his courses, and has one of the highest standards I've encountered in a prof regarding testing ( after turning in our implementation of an md5 hash as a system call in OpenBSD, he asked the class if anyone had tried testing with 1 Gb input strings. Just an example).
There's another course with a similar bent - a 4th year SysAdmin course that's year-long and involves substantial network programming. I'm told that the instructors will take down the network during your examination, forcing you to fix things while still completing your test online. Past grads also like to hammer the servers the students setup.
Personally, I'm glad to see these courses - most of these problems are things I've no clue about or would even think about how to prevent. Exposure is a start.
-- "We are all in the gutter, but some of us are looking at the stars" [Oscar Wilde]
Sheila: Time's have changed
Our kids are kids are getting worse
They wont obey their parents
They just want to fart and curse!
Sharon: Should we blame the government?
Liane: Or blame society?
Dads: Or should we blame the images on TV?
Sheila: No, blame Canada
Everyone: Blame Canada
Sheila: With all their beady little eyes
And flappin heads so full of lies
Everyone: Blame Canada
Blame Canada
Sheila: We need to form a full assault
Everyone: It's Canadas fault!
Sharon: Don't blame me
For my son Stan
He saw the darn cartoon
And now he's off to join the Klan!
Liane: And my boy Eric once
Had my picture on his shelf
But now when I see him he tells me to fuck myself!
Sheila: Well, blame Canada
Everyone: Blame Canada
It seems that everythings gone wrong
Since Canada came along
Everyone: Blame Canada
Blame Canada
Some Guy: There not even a real country anyway
Ms. McCormick: My son could've been a doctor or a lawyer it's true
Instead he burned up like a piggy on a barbecue
Everyone: Should we blame the matches?
Should we blame the fire?
Or the doctors who allowed him to expire?
Sheila: Heck no!
Everyone: Blame Canada
Blame Canada
Sheila: With all their hockey hubbabaloo
Liane: And that bitch Anne Murray too
Everyone: Blame Canada
Shame on Canada
The smut we must stop
The trash we must smash
Laughter and fun
must all be undone
We must blame them and cause a fuss
Before someone thinks of blaming uuuuuuuuuuuuuuuuuus
668: Neighbour of the Beast
I studied computer science at the University of Massachusetts where we actually had a course in network security. It was pretty awesome - it was taught by the people who did the security for our school and went through things like IDSs, buffer overflows, busting stacks, ARP/IP spoofing, and encryption. We had a lab of 3 subnets of 3 linux boxes each, a router and a server (that incendentally was not hooked up to the internet or anyhting else for that matter) and did labs with SNORT and the likes - absolutely great experience and what I learned in that class helps me every day (I'm a lead tech now at a large webhosting company) Learning security and how exploits really work (versus script kiddies running ./HackThisBox.sh) really reinforces topics things like TCP/IP in ways that are really practical and gives you a much more concrete understanding of the underlying technology then the more traditional comp sci undergraduate classes.
If religous zealots don't believe in Evolution, then why are they so worried about bird flu?
My university here in California teaches a course similar to this at the 4th year undergrad or graduate level.
I just finished writing my final exam (actually, a report) in the "Network Security" class. It was actually quite fun. The class is divided into several teams of 3 or 4 students and each team sets up an e-commerce site that is visited by an administrative team that logs successful transactions from their own machines.
Each team's job is to keep their site up while simultaneously trying to knock other teams off of the network. Each site uses two machines with two different operating systems: Redhat 8 and Windows XP professional.
Needless to say, we checked the security and hacking sites several times a day to make sure to be aware of new exploits creeping out.
Hack sessions were "anything goes", we basically progressed from larval stage (script kiddie) to juvenile (perl, java and C based exploits.
No one wrote any new exploits this time around, but a whole new batch of wet-behind-the-ears "hackers" are released from this univeristy every semester.
Of course, the purpose of the class is to create an environment where teams can learn about security by practicing the arts of the "Black Hat". It was surely the most fun I have had yet in the university.
I tried every decent and legal way I could think of to resolve the issue w/the business before I rented the chicken suit
What? You mean to tell me that Maple Leaf Canucks are teaching people to hack. We all know that the United States has some of top H4XOR's in the world. The NSA actually hires people to do stuff to other govmt's.
I think you're confusing hate with envy here....
I could prove it: http://pages.cpsc.ucalgary.ca/~erik
But, looks like someone has been doing some early studying for the course; our DNS is pooched. Oh well, its after hours now - it'll have to wait until tomorrow...
No sig for you.
The first year results are held on an unpatched IIS box.
:o)
For your final exam, there's a security certified server that holds your results. If you can give yourself an A+, you probably deserve it.
Xix.
"Everything is adjustable, provided you have the right tools"
I read your book!
Knowing how enemies think and operate is the best defence against them. Having people trained to do so at the university level is in software security's best interest.
My university has been doing this sort of thing for over a decade. We have a graduate-level security class accompanied by a "live" network environment where there are no rules (except that nothing done inside the "sandbox" is to be exposed to the public internet). While many specific techniques like virus writing how-to's might present aren't formally taught, learning them is part of the course, as well as successfully using them against real machines that are actively defended.
Don't become a regular here, you will become retarded. -- Yoda the Retard
Comment removed based on user account deletion
that should be 1337 1337, 1337 1337 1337, not 1337, 1337, 1337, 1337. get it right.
Comment removed based on user account deletion
You'd never invade us - we're such a big, _friendly_ country! :)
:)
:)
That I'm reminding you of the way the rest of the world would rally behind Canada (talk to any non-American), and of the fact that the best snipers in the world are Canadian (look up longest combat kill), and of the fact that there's an iron core of determination under our cheerful exterior (look up Vimy Ridge), isn't a threat - they're just fun pieces of trivia!
So, really, the fact that invading Canada would turn into an incredibly bloody guerrila war ranging across the entire continent is irrelevant, since we're such a big, _friendly_ country!
Seeings how Canada is sitting on top of somewhere in the neighbourhood of 200 billion barels of recoverable oil in the tarsands of Northern Alberta. For God's sake, we shouldn't be giving those yankee bastards and their bushit never-ending war on "terra"(oil) any excuses!
You're using her as bait, Master!
Read the grandparent post again, this time without your DUMBASS cap on.
When they're on our side, they're called Freedom Fighters!
In Soviet America the banks rob you!
I'm in comp sci at the UoC... Becker mentioned this to me, but I had no idea it was out of the ordinary.
When someone might yell at me, it has to be OpenBSD.
You gotta love Canadia!
Brings a whole new meaning to "Calgary Flames".
*honk*
This is my sig. It's prescription, I swear. I need it for reading things... on the other side of things
Former student and star of the class is brought in (obviously from somewhere and time at which they for some reason cannot face computers (possibilities: severe RSI, Epilepsy set off miraculously by 65-85Hz screens, Blindness...) to defeat the mad professor, before the final showdown with badly executed profundities.
Nah, the former star student would be in jail and would be released a la The Jackal to catch the mad professor. Then they would let him "disappear" only to find him later at a cybercafe dead due to bloodclots in his legs...
Dacels Jewelers can't be trusted.
Writing viruses was actually covered in the assembly language class I took at UMaine circa 1992, in the last chapter of the instructor-written textbook. The rationale in that case was that in informing CS students how easy it is to write viruses, they would no longer see them as technically impressive and therefore not be interested in pursuing their creation. (I just taught my first assembly class this past semester, and use this as an anecdote without actually covering it myself.)
Since I have the text right here, I'll quote it: "...you do not have to be a genius to write a virus... Some people use virus writing to prove their programming skill, but this is poor proof of such skill in my opinion. It's about as much proof of genius as throwing a brick through a window."
We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
Darn that's so kewl
not hard for an amerigoon to be confused.
I agree somewhat with that approach, and am personally glad it's the one I took, but in some ways it defeats the purpose of the high-level abstraction. The point of abstracting memory management is not that you already know what's going on under the hood, but that you should be able to code at a high-level and let the compiler worry about what's going on under the hood. Ideally you would have no idea what was going on, though in practice this isn't entirely possible (since often you have to put implementation considerations into your high-level programming since compilers aren't yet good enough to optimize everything well).
Note though that C being "low level" is somewhat relative -- if you're running on a Lisp machine (where Lisp's primitives are implemented in hardware), then Lisp is low-level.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Computer Science is not just the study of algorithms and concepts. It is also the study of algorithms and concepts in computing.
Just as a student in a mathematics program learns both numerical and symbolic concepts, so also must the Computer Science student if he or she is to be worthy of a degree.
No, you should not study particular current software development technologies if it is done just for the sake of studying being able to say that you know them. That would have been a waste of my money which I wouldn't have stood for.
However, you must understand and be profecient with the allocation, deallocation, and addressing of memory as a means of implementing algorithms and concepts, i.e. of DOING computing.
Just as you learn how to both model and approximate the running time of a particular algorithm for a particular set of data, you also need to understand and take into account the concepts of: memory addressing, memory allocation, and memory deallocation.
These three concepts are not simply an artifact to be dealt with only by - gasp - software developers, but are in fact essential to the SCIENCE (the real and conceptually real world) of computing. We will always have limited available memory, and we will always have limited available running time.
"C" exposes all of these concepts to the student without the unnecessary complexity of assembly languge, and while still being high enough level to allow the student an appreciation of the algorithm.
Of course the student should also be exposed to LISP, but must still be exposed "C" or another language which exposes these concepts to the student.
I am not a software developer by the way. I am a student who completed an undergraduate CS degree and am now completing an undergraduate Philosophy degree.
Georgia Tech has a similar hacker lab. You
have to be in a special class, and the lab is not
on the net. To take the class you have to go
through some sort of clearance process. I've
heard they do attacks, virus writing, DNS
poisoning. They even do physical attacks,
making keyloggers, hack bioses, and other
dirty tricks. I hope I can take the course one
day!
It's about time CS students got back to learning some proper programming languages, methods, algorithms and system-level understanding. Having seen numerous UK Universities go from teaching assembler and hardware-level courses to being a middle-of-the-road Microsoft house, I think this type of course can give students a true understanding of the systems with which they're working. I just hope they're not only concentrated on .Net viri built using a template "virus wizard".
--
Core Wars should be part of every curriculum!
Contribute to the online videogame encyclopedia: GamerWiki
Whats the point in teaching this considering that anyone who can write a program which does what is supposed too, can make a virus? Seems like a waste of time. What should be taught is what viruses are and also why the virus makers are always one step ahead and therefore learning 10 year old techniques isn't going to make any difference! Learn something useful, like how to patch a system and keep it safe 98% of the time! Must be a crap Uni no offence.
C is becoming more and more the "assembler" of yesteryear.
Nobody today writes directly to CPU registers. But 20 years ago, they did.
Few people today bother with assembler. It's too low-level. Instead, people work with C/C++, or any of the numerous high-level languages. There was a time when "C/C++" was considered "high level". Well, Python/Perl/PHP/Java are the "new" C languages. Java in particular has more developers working on it than C, currently. They are high level, and provide new degrees of abstraction from the underlying system.
I'm nearly done with a 15,000 line project in PHP. To do the same in C would probably at least double, maybe quadruple the line count to get a product that's not noticably faster on a 1 Ghz Pentium.
As computers get faster, we move farther away from "bare metal" (such as assembler) and the languages become richer and more abstracted.
C's day is becoming more the art of the kernel and the low-level libs.
Wouldn't you rather not have to worry about allocating RAM before stuffing the ordinal value of 11 into a variable?
In PHP, that's
$a=5;
Sinple, no?
I have no problem with your religion until you decide it's reason to deprive others of the truth.
For hack (much more fun - but certainly related) :
...died as a serious scientific pursuit a long time ago.
;P).
Insisting on correctness has absolutely nothing in common with wearing vulcan ears in public.
Well, sure it does.
Language isn't a prescriptive animal: languages aren't constructed in dark corners by funny men with hats who bless some usages as "correct" and others as "heretical." (These nefarious dark corner dwellers have existed, true, but their success lied mostly in capturing the heretics, not in conjuring the spectre of "proper language.")
No, language is *descriptive.* The common use is as proper a use as any, if not "more proper" from the statistical standpoint.
"Cracker," as you mean it, has very little support even from the community that is supposed to embrace its use as "proper," really.
Some people use it, but, it's mostly people who either a) need a nit to pick or b) are trying to "fit in" after reading the Jargon File or something ("Ha ha! We've caught you, dear n00b, you can't be a real hacker now--you see, son, it's VEE EYE."
It's a naive argument to make--that all the real use out there by real people is someone wrong because anachronistic apocrypha tells you so.
Pfeh. Say, "cracker" if you want. It's not wrong but it's certainly not the one and only correct use.
by separating copy from read, and allowing copy privs but not read privs, you basically force the requirement of some kind of "copy-file" system call (instead of allowing it to be done "manually"). system calls can be logged for accounting purposes, and the resulting copied file can be made also w/o read privs, the end effect being whoever invokes that copy-file system call is guaranteed to be opaque to the data.
security is improved because you don't need to audit that program wrt that data (as much ;-). failure of that program (whether by implementation or by
external (virus) factors) has much less chance of compromising that data, and
what chance remains is highly localized.
Canadian University to Begin Training Hackers! They plan to be the third world largest hacker training ground, just after MIT and Berkley! Watch news at 9 pm! *sigh*
Karma: Positive (probably because of superiour intellect)
I don't know about you but I laughed really hard when I read this post, I think it ought to be modded up.
"Know your enemy, know yourself and in a hundred battles you shall not lose"
:)
Sun Tzu
Never by hatred has hatred been appeased, only by kindness - the Buddha
You're a producer aren't you?
Sorry, overly cruel!
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
Actually if they are cracking for good, then aren't they really hackers?
Quote: "Will Canada be accused of training the world's next generation of cyber-terrorists... or peacekeepers?"
We've always been seen (in US eyes) as a haven. A haven for terrorists, a haven for criminals, a haven for whatever it is that you want to leverage against Canada.
Humourously, if you watch Close Encounters of the Third Kind, you'll see on Richard Dreyfus' wall a newspaper clipping with the headline: "Is Canada a Haven for UFO's?".
This wasn't just plain terrible, this was fancy terrible. This was terrible with raisins in it. - Dorothy Parker
A language neutral course like, say, Information Extraction, is not without implementation - the students still have several projects to implement and can't merely do pencil-and-paper work. However, the focus is not on which language is used, but rather on what the results of the program are. In other words, the implementation is not critiqued or dealt with in the course except in terms of the external results.
For example, in the one graduate-level computer course I took (I was a math major; CS was just for fun), we were explicitly told by the professor to implement our projects in "whatever language you want". And we did; I was somewhat boring with my choices of C for the number crunching and perl for turning the numbers into nice summary reports, but several people used java, there was a dedicated group of matlab people, and one guy did almost everything in scheme. Supposedly, someone also implemented the first project as about 10 different interacting sh scripts and GNU expr, but I think that was just exaggerated rumor.
If the requirements for the assignments had specifically included performance, you probably would have seen less variation (at least the shell script tricks would have been out), but in this class they didn't happen to. The resulting language choice was a result of students needing to get the job done, not professorial fiat.
The point is, once you get to graduate level work, (as the grandparent post was talking about) the language itself is just a tool with which to study other aspects of computer behavior. (Unless, of course, you're explicitly studying the possibilities of computer languages themselves) Of course the university (in Canada, "university" means almost exclusively graduate work, unlike here in the US) doesn't teach C - it shouldn't really be teaching any specific language except possibly as an example of what a certain language family looks like.
I guess our friends at Mcaffee's and Norton's need better trained virus writers so they can get more people to buy their products.
Heck all the virus's to date are trivial! I remeber the Fuck virus on the Amiga, now that was a virus! the thing killed your Hard Drive to where it ws unusble. Or even the old Morris worm.
If someone really wanted to write an unstoppable virus they would include a mutation engine in it. That way NO virus checker would stop it!
But of course this would put Mcaffee and Nortons out of business.
The Truth is a Virus!!!
Hacking is a relative term.
With the cost of computers dropping and free operating systems available, hackers can hack to their heart's content without 'hacking' anyone off.
Because of the stigma attached to the word 'hacker', perhaps we need to reexamine the lexicon, and make up a new word for what we recognize as peaceful, non-intrusive exploration. Here is my go at it:
Phreaker - phone freak -
Cracker - W@rezd00dz
Hacker - mainstream meaning - person who breaks into computer systems illegally for malicious purposes (lets face it, the public perception will not go away)
Groker - take the verb 'grok', and turn it into a noun - implies the process of getting to the point where you grok something; eg. a hacker hacks until he groks what he is hacking groks ham radio; he transmits every night), or passive (he groks ham radio; but, he doesn't have an antenna up yet). Saying he is a groker would clear that up (he is a ham radio groker). Clearly 'groker' implies activity.
I think this (or something like it) would clear up the misconceptions people have.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
But how do we protect ourselves when people with skills start writing malware? Methinks the main advantage would be a quarantined lab environment where the dynamics of propagation could be studied.
Readers who find this idea interesting may want to read This Alien Shore by C.S. Friedman. While it's nothing relevant to current technology, it describes an interesting scenario of a well-written virus, and describes it from the point of view of both an untrained "cracker" and a schooled, skilled, & specialized "security specialist."
What this means is that for me - if a client asks me to program in VB, Java, etc. my answer is that I will NOT take on the job.
That's funny. Please tell these customers of yours to contact me, and I'll use whatever language they want.
In my 4 year career, I've used C, C++, Java, VB, ASP (VBScript and JavaScript), Perl, PHP, SQL, Basic, Assembly, Citect, Ladder Logic, and Flow charting (Steeplechase). Not to mention a couple other "proprietary" vendor specific languages that I can't even remember the names of.
Having done all that, let me tell you, I can write ANY task in ANY language, and I can do it modularly, with logical and meaningful data structures (or structured tag names, if user defined types are not included in the language), and maintainable (if that's a word). I can do this because my university education taught me the theory I needed to abstract every problem into concepts that could easily be implemented in any language.
The best language to teach in is whatever best suits the material of the course. For data structures, use C, for object oriented, use Modula, C++, or Java. For operating systems, use C or assembly. For automation, use ladder logic or flowcharts.
Trust me, when your customer asks you to provide a windows based user interface to display a flashing light indicating the status of your equipment, and you choose to write this in Visual C++ instead of Visual Basic, you're wasting your time. Choose whatever gets the job done fastest.
I'm just saying, don't be a one trick pony. The person who got a hammer for Christmas will see every problem as a nail.
"I have never let my schooling interfere with my education." - Mark Twain
This Mad Cow nonsense, (probably planted by some US black-ops dept.), and TIME magazine fueling ridiculous fears about Canada is complete crap. And probably will be effective crap too. It seems that many millions of Americans have been effectively programmed. (And we opened our homes to stranded US travelers during 9-11, for goodness sake!)
Anschluss, anyone? (Look it up.)
Just remember, my friends to the south. .
Hitler bit off more than he could chew, and so will Bush. Any study of WWII and the current world situation makes it painfully clear to the observer that Hitler had no chance, and neither does Bush! --Even just in a matter of numeric strength, the odds are overwhelming. Even with the famed technology and efficiency of the Nazi military, the German fascist state was crushed into dust in less than four years, thanks to Hitler's sociopathic/delusional brain wiring which always leans heavily towards short-term gain plans which are ultimately self-destructive. You think a nation of 350 million stands a chance against a billion Russian, Chinese, Saudi, European troops troops armed with European high tech military gear? --Even after trying to 'soften' them up with SARS? Give it a rest. The US is doomed if they don't do something about their dictator, which they won't.
WWII was a trial run for events unfolding today. And the results will be the same. The end result desired by the architects of this scenario is NOT the building of an American/Nazi empire, but the destruction/meat-grinding of a few billion people. America will be toppled, but only at great cost, and Humanity will not be the winner.
You have been warned. Good luck out there, and remember; any kind of murder ALWAYS costs you in the long run. When the crunch falls in your neighborhood, be kind and rational and supportive of those weaker than you. Act with grace, dignity and courage when facing down the Beast, and you will be okay. You might still die, but death is just a doorway and our bodies are just temporary containers. 'God and Heaven' are Mind control lies designed to create stupidity and fear and poor choices. How YOU react is what matters. You are the culmination of your choices. Make good ones, because nobody is coming to forgive you and save your soul if only you 'have faith and stop asking the hard questions'.
-Fantastic Lad
--Here's a copy of the Toronto Star's reaction to TIME Magazine's attack, since the link seems to be down at the moment. (Gee. With the CIA on the swtich of the entire Internet, is this a surprise?)
This is nothing new... Portland State University has tought a virus class for several years.
:)
;)
It is one of the more demanding classes in cs. In past classes students have even been able to have their programs battle it out in a sandbox to see who's virus can spread faster and kill the others.
Oh and the "Little Black Book"? Yes, that is the textbook for the class.
The Canadians are copycats.
If you don't understand it, then your options in fighting it are limited. A noob running a blade cluster on a t3 line has only one option when some script kiddie takes over his system: unplugging it. Far from optimal.
We have all this "anti-virus" software, but it is completely misnamed. If you get a flu shot, it's not an anti-virus, its a pallative. A weak shield against infection, not an active agent of protection. The same goes for the software that we currently use. I want to be able to unleash righteous nastyness against the damn viruses in my system, not poke around with fricking bloated software that's always playing catch up.
Until we learn to beat them at their own game, then it will BE their game.
Just my opinion.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Except, maybe, for the Chernobyl that trashed my motherboard (and a couple of friends' and coworkers') back when.
http://barrapunto.com/ - News for nerds, en español
CPSC 599.48, Computer Viruses and Malware.
Safari, feel the word sliding over your lips. Do you feel the rhythm, sure you do. It's definitely gay.
IPod, feel the word sliding over your lips. Do you feel the rhythm, sure you do. It's definitely gay.
Gay, feel the word sliding over your lips. Do you feel the rhythm, sure you do. It's definitely Apple.
> Teaching C, Java, PERL, whatever is the job of a trade school, or at most a community college. Teaching computer science is the job of a university.
wrong again. damn this persistent mentality of ivory tower academics with no concept of the industry. proficiency/fluency with any one programming language can take YEARS of experience precisely because no one is willing to take the time to condense knowledge learned from trial-and-error experience into courseware. programming is the same as any other art; think 4 months of jiu jitsu makes you proficient in martial arts? theory helps underscore knowledge and appreciate the history of its creation, but does little for anyone with a user-end application to write and a deadline to meet.
did you chew first before the compsci academic circles fed you this tripe, or did you just swallow it whole because you were a naive undergrad with no social interaction experience and didn't know any better?
Actually, it's "1337, 1337, 1337 - 1337".
Wait... I think we're admitting something terrible here.
His name will either be
"Linub Tervalds" or "Amanuel Goldstin"
He will be played by Leonardo DiCaprio in a pair of glasses, and they'll borrow that ridiculous VR interface from "Hackers".
H4xx0r the Gibson!