Canadian University to Begin Training Hackers

torok writes "According to an article at The Edmonton Journal, The University of Calgary is going to start teaching select computer science students to write software viruses in a special new disconnected lab. Will Canada be accused of training the world's next generation of cyber-terrorists... or peacekeepers?"

Comments

Crackers

[ramzak2k]

Crackers, not hackers.
I understand this is a losing battle but lets not get it wrong on slashdot.

Re:Crackers

[ramzak2k]

here you go, a nice explanation of the meaning :

http://www.grinberg.net/vitaliy/hacker.html

in short ,
hackers: just enthusiasts
crackers: evildoers

Re:Crackers

[PM4RK5]

Someone correct me if I'm wrong, but I believe that "hacking" is the (lost?) art of taking apart, fiddling, and generally reverse engineering. The purpose of "hacking" was (is?) to educate oneself on the inner workings of a device. A common misconception would be that "hacking" was limited to computers. It is generally used in reference to technology, but it may be any digital (or analog for that matter) device. One could also stretch the meaning of "hacker" and apply it to fields such as automobiles - taking apart and "modding" your car could be considered "hacking."

Crackers (and cracking), on the other hand, are those who maliciously exploit hardware and software that is not their own, for personal gain, and sometimes just for the sake of having done it.

Did that help clarify the difference? Hackers are reverse-engineers who seek to educate themselves, without inflicting damage. The objective of a cracker, however, is damaging a system (in whatever way), and being able to claim responsibility for it, because they (and their clique) may consider it "cool" or "macho," or in some cases, because they can fraudulently benefit from it (usually economically...)

I hope that helps. If I'm wrong, someone please correct me.

P.S. The "cool" and "macho" part was added by me, but I can see no other motivation to do it.

Re:Crackers

[McAddress]

They are most certainly hackers, not crackers. They are learning about the knowledge in a safe lab, as not to cause accidental damage, for a useful non-malicious purpose. That is a lot better than many of the current experts on these issues.

Re:Crackers

[Anonymous Coward]

You don't seem to understand the real meaning of "reverse engineering". It is NOT reverse compiling, disassembling, or otherwise looking at the code. It IS putting in a particular input and watching the device's (or program's) output.

Reverse engineering is protected by numerous free trade laws. I also quite seriously doubt that the DMCA could have any effect on you if you are in a country other than the US. Unless you pull a Skylarov and come over here, that is.

Re:Crackers

[Anonymous Coward]

You don't seem to under the real meaning of "reverse engineering". :) Sorry. There's really two different classes of reverse engineering: clean room and non-clean room (WhatIs).

The former is the only type of reverse engineering that has in court cases been upheld as a legal form (of course, this is prior to the DMCA). Realistically, the latter form, involving any and all means to understand the way in which something works is what's normally done when it's seen as unlikely that a competitor has even a remote chance of prosecuting for not doing clean room reverse engineering. Why, you might ask? When you want to see how your competitor's product works, the fastest way is to test some inputs first, then disassemble the parts you don't automatically understand. When time to market matters, and it always does to some extent, shortcuts are the prefered way.

But what does that mean? In the physical world, reverse engineering is so likely that patents are the norm for virtually anything produced. It's understood that competition would otherwise make void all the research needed in making a new product. In the software world, even with patents, clones abound (voris vs mp3, png vs gif, etc). The culture of at least the ideal hacker has resulted in patents for the most part being abhored and circumvent by one means or another (make a clone, offer that gif module off-shore where the patent doesn't apply but people can still get it, publish a long document on all sorts of features you discover). Of course, anything not patented in the physical world is cloned as well and almost never is there a legal fight over it--saying you can't make and sell your own lemonade after finding out what the competitor's lemonade is made of would be scoffed at, assuming it wasn't patented.

But, with the DMCA, copyrighted works have more or less gained the same level of protection as patented works, which is ironic since those companies most likely to invoke the DMCA use it against copyrighted works which are encrypted, something entirely opposite to the openness of patented works. Reverse engineering becomes virtually impossible, except through tedious clean room methods and even then so long as it doesn't happen to circumvent a copy protection mechanism. It seems the DMCA was written without the realization that copyright law is designed to promote the arts and sciences. By this I mean, it gives authors the ability to simutaneously profit from the works they've made while preventing others from directly profiting as well. And society profits as well, by viewing the author's work they benefit as a whole from the work itself possibly, but they also benefit from the extensions others make. If we were to believe the principle ideas of the DMCA and the very narrow scope as defined by fair use in quoting a work, we'd have had to wait the lifetime + 90 years of an author for another competitive work to include an original idea presented, something resulting in a massive stagnation of arts and sciences.

And realistically, this has not happened. Fair use is not needed to quote why ideas might be read and reused by another in even a few months after a best selling novel (fair use wouldn't be a valid exception anyways). The result is laws which in words prevent much more than what the spirit of the courts have shown as accepted behavior. However, when it comes to things in the technical field, an almost magical spell exists where the letter of law is so closely followed like it were a new fronteer where new laws need written to protect what is already protected.

But I digress. The DMCA is a means of creating a new law to prevent another law from being broken. Because of its vague wording (and mostly because the spirit of the law hasn't been established well in this new fronteer), various companies have invoked it to stop "legal" and non-"legal" reverse engineering. For the most part, it has been demo

Re:Hacking ethics

[boredMDer]

For those of you blindly following that link and getting 404's or similar, here's both the corrected version (Berkeley is spelled w/ 3 e's) and in link form -
http://www.cs.berkeley.edu/~bh/hackers.html

Re:Hacking ethics

[ciroknight]

oopse, error on my notecards... thanks!

Re:U of "C" doesn't teach "C"

[freeweed]

University isn't about training coders. That's what college is for.

A Computer Science program at any (Canadian) University worth its salt has maybe 3 or 4 programming courses, and the other 30+ are algorithms, databases, networks, algebra, AI, operating systems, distributed systems, parallel systems, real-time systems, security, automata, digital logic, data structures, software engineering, graphics, instruction set architectures, compilers, professional ethics...

Note that any and all of the above are (relatively) language-independent. A CS student should be able to pick up a new language in a matter of days/weeks - but CS is not about syntax memorization.

your're an idiot.

[Anonymous Coward]

SOA trains on counter insurgency (how to squash left wing rebellions in your/my pathetic Latin American country) like the FARC in Columbia (although they're just about the drug money now) The FARC, et al are the terrorists.

Although many right wing Latin American dictators(Galtieri) and generals were trained there, they aren't terrorists.

You must understand:

left wing oppression == terrorist: FARC, SHINNING PATH

right wing oppression == no other way to stop the misguided commies. Pinochet wasn't all that bad.

It's nice and cute to be living in the first world and complain about how bad human rights are in (insert your favorite Latin American shithole here) but the truth is, human rights get REALLY bad when the left takes over.

Instead of complaining about the SOA, why don't you complain about Cuba training and supporting terrorists in Columbia and most poignantly Venezuela. Where Chavez followed Castro's(and Hitler's) playbook to the letter. I will summarize, talked a good (leftist) game, got elected by 80% of the vote, promptly revamped the constitution and parliament, extended his term twice. He's there for life.

I lucky escaped my Latin American shithole, I know what goes on there. You should regurgitate shit you hear on NPR but don't fully understand.

I've had this prof before . . .

[Brad Cossette]

The instructor is Dr. John Aycock, and he's definitely one of the better instructors we have in CPSC. His focus is in compilers and OS's, and taught the 3rd-year OS class for I think the first time last Winter.

He definitely has a strong security focus in his courses, and has one of the highest standards I've encountered in a prof regarding testing ( after turning in our implementation of an md5 hash as a system call in OpenBSD, he asked the class if anyone had tried testing with 1 Gb input strings. Just an example).

There's another course with a similar bent - a 4th year SysAdmin course that's year-long and involves substantial network programming. I'm told that the instructors will take down the network during your examination, forcing you to fix things while still completing your test online. Past grads also like to hammer the servers the students setup.

Personally, I'm glad to see these courses - most of these problems are things I've no clue about or would even think about how to prevent. Exposure is a start.

Re:U of "C" doesn't teach "C"

[dghcasp]

Disclaimer: I'm a U of C grad, but I graduated in 1993.

At the time, U of C didn't teach C either. Students were expected to be able to learn "C" on their own by third year, since they'd already been exposed to three or four different programming languages from different spheres. Once you were in third year, you could, for the most part, do your projects in whatever language you wanted, as long as the TA knew the language. Most students did their projects in C.

As well, the first year courses almost always used languages that students were unlikely to have encountered ever before. This helped level the field between the people who were "xc3113nt C h4x0rz" and everyone else. Everyone started from first principles in functional programming.

By the time I'd hit third year, I'd had courses where the language of choice were Pascal and Modula/2 from the "Von Newman" sphere, ML from the functional sphere, and PDP-11 assembly (was being replaced with SPARC assembly at the time) from the low level sphere.)

By the time I'd graduated, I'd added courses that required languages based on category theory (Charity) and one based on primitive recursion (it only had zero(), succ() and recurse(x,y) functions and you had to define the whole rest of the language yourself based on those.) If I'd taken different courses, I would have been exposed to Lisp, Prolog, SQL, etc.

The theory behind all this was they wanted to teach you different ways to think about problems, not just how to pound in a solution in C. People who just wanted to learn to code in C, be able to say they were a "programmer" and go on to a career went to SAIT or DeVry.

Pick any academic program and you'll find people who think something is "missing" or can be "better." That's why they evolve over time. The main flaw I found with the U of C program (IMHO) was that the only course that really required you to deal with a large project (CPSC 510, full year, write a compiler from scratch) wasn't a mandatory course.

But I'm glad I got my degree from U of C. And I'm not crippled in my ability to work in C/C++ because I never took a half-year course in it.

Re:Just tools

[Sherloqq]

[...] there are probably many schools in the US doing this [...]

There are also some schools out there that will let you propose a course, provided that:
- the subject is educational
- you find more than the minimum required number of students
- you find someone to teach the class

[...] I took an Information Warfare class [...]

Funny you mention that, so did I -- at the aforementioned school. Officially it was called "Computer Ethics", but we've learned a lot about breaking into computers as well. There was even this one guy there, whose name eludes me for security purposes, who looked to be in his 30s at the time and who claimed to have worked for the gov't and was getting his masters at the time, IIRC. At the end of the semester the class got divvied up into groups for a project/presentation, so I made sure I was in the same group as he was. I've learned of a few neat tricks that the gov't was able to do with their technology, though no specifics (for obvious, classified reasons), like being able to pick up EM radiation from a monitor cable and reconstruct the video -- from a few hundred feet away.

But getting back on-topic... if there's a will, there's a way. If students are interested in learning something the school doesn't offer, they should try rallying up support from both their peers as well as the professors to have courses offered.

Re:Just tools

[Idarubicin]

I've learned of a few neat tricks that the gov't was able to do with their technology, though no specifics (for obvious, classified reasons), like being able to pick up EM radiation from a monitor cable and reconstruct the video -- from a few hundred feet away.

This isn't just something the government can do--this is something that a dedicated amateur can do with a little time and money. In addition to some expertise, you will need the following equipment:

• A good commercial wide band radio receiver preferably designed for surveillance (requires a little modification) with spectrum display. Sensitivity and selectivity are paramount. Not all receivers will do the job adequately
• Horizontal and vertical sync generator. Commercially available and will require some modification.
• Multi-Scan Video Monitor with Shielded cables
• Active Directional Antenna (phased antenna array) with shielded cables. Think radio telescope.
• Video tape recording equipment.

This stuff will all fit in a van. The government may have more effective purpose-built tools, but there's nothing preventing a compentent technician from building such a device.