31

I volunteered to instruct an after school computer club at my son's middle school. There has been a lot of interest in computer viruses. I was thinking about showing them how to create a simple batch file virus that will infect other batch files in the same directory. Also show how creating a batch file with the same name, but that is closer in the path, can replace another program.

It could also allow for discussion of anti-virus techniques - recognizing viruses and virus like behavior.

I mentioned the idea to my wife and she thought it was a terrible idea. Compared it to giving them loaded weapons. I don't see it as dangerous since this technique wouldn't be immediately applicable for any real mischief on any modern operating systems.

Am I being too cavalier or is she being too concerned? This isn't a settle this argument for me question, I am just trying to get another opinion.

Update: I don't plan to cover moving between systems (or even directories) or any malicious behavior. And lest anyone think I am revealing any deep dark secrets, here is a book from 1996 I found at the library that goes into a lot more detail than I planned to cover. If some is motivated to be malicious they will find a way.

Improve this question
12
  • Remember the "I love you" virus? Written by a lovesick kid which caused massive downtimes and havock on e-mail systems around the world? He probably didn't have more knowledge than you are proposing to impart...
    – Marjan Venema
    May 29, 2011 at 6:59
  • 2
    If I remember well, the 'lovesick' argument only apply to the movie they made recently, it has nothing to do with that worm.
    – Federico klez Culloca
    May 29, 2011 at 9:39
  • 1
    @Marjan: Yeah, but with the knowledge to write an "I love you" virus you won't get very far anymore nowadays...
    – fretje
    May 29, 2011 at 11:11
  • 16
    Sure you should stop. While you are at it make sure not to teach teenagers about sex, drugs, war, murder, rape, assault, theft, espionage, guns, swear words, dishonesty and the numerous other things that people do which are wrong. Knowledge of the thing of which you are learning about and the consequences of using said knowledge is the best preventative you can give someone. Ignorance is far more likely to lead them to misuse any knowledge they find on their own rather than being well educated on a subject.
    – Cromulent
    May 29, 2011 at 14:07
  • 2
    @Simon,Denis I'm sure they don't teach how to deliberately infect people with virusses during sex ed, so why do it during computer lessons? Teaching kids how to create virusses is immoral and unethical, possibly illegal.
    – jwenting
    May 31, 2011 at 6:04

14 Answers 14

Reset to default
54

I recently found a picture of me when I was 12 and reading a book about computer viruses. It was in 1988. Like your students, I was fascinated by them.

The next year I started high school and was accused to being the origin of the virus infection of all computers in the school. Of course, it wasn't me. I was good at computers, so the teachers said it was me.

If I put myself in back in time, I can tell you that since I was very well informed by the effects of those viruses, I would never have done such a thing. Why I would do that? Harm people? No way!

Therefore I think that the more they are informed by the effects, the less likely they use them.

But this statement is linked to boys that were like me, in a good environment with strong rules and education.

If you teach computer viruses to students with a history of doing bad things, not well educated, or troubled, they will certainly use them to do bad things. So it highly depends on the audience, your students.

Improve this answer
7
  • 1
    I wish I could upvote this more than once.
    – Marcin
    May 29, 2011 at 12:08
  • @Walter: thanks for your edits. They help me a lot with my English.
    – user2567
    May 29, 2011 at 13:18
  • 6
    I remember reading of a dad in a violent community, who taught his kids how to use rifles. His intention was wise. He bought them rifles and sent them to training centres where responsible people taught the kids how to use the rifles and all the technical details that they needed to know. They were also taught that shooting a person implied 'MURDER'. The kids also had plenty of chances to fire their weapon at the range. It certainly whetted their appetite to use weapons, but at the end of the day, they were responsible people who knew how to use their skill & weapon safely.
    – Nav
    May 30, 2011 at 4:19
  • 2
    Could not agree more, Pierre. [And I'd add, as a rough generalisation: More knowledge it almost always a good thing... Totalitarian regimes try to ban knowledge - for a reason. It stops people thinking, and if they can't think then they might be able to criticise.]
    – quickly_now
    May 30, 2011 at 8:49
  • There's something to be said for giving damaging or dangerous knowledge to the immature or adolescent. I think the word is "Caution".
    – snakehiss
    May 31, 2011 at 4:16
13

I think the idea is excellent: people need to know how viruses work so that they can (a) write antivirus tools and (b) learn how to break things. The latter will serve them in good stead when they have to write solid code.

Learning about viruses and how they can propagate sounds like a springboard for many lines of investigation - how programmers make mistakes, what mistakes they make, how to avoid making them, how computers actually work, operating systems, network code, ...

I think a healthy dose of ethics would go well in the course: what damage viruses have done, for instance. You don't need to be preachy about it. Robert Morris didn't mean to write the first worm - or at least didn't mean for it to get out of hand - so it can be an instructive lesson not only in what kinds of bad things can happen, but also how something that seems like a good idea can go out of control.

Improve this answer
1
  • 3
    Robert Morris said he didn't mean for it to get out of hand, after the fact, once he'd been caught. His actions, though, suggest otherwise. If he hadn't known he was doing something very wrong, he wouldn't have been so sneaky about releasing it.
    – Mason Wheeler
    May 31, 2011 at 3:02
5

I learned how to write a COM and EXE viruses when I was in high school back then in '96. It's what got me to programming and switching from Basic to Pascal & Assembly and learned how the underlying hardware's mechanism works. Rewriting Norton commander from Peter Norton/John Socha's book (verbatim) was quite an achievement and exhilarating.

So I think teaching teens how to write a virus could be helpful to some extent to foster their sense of curiosity and inquisitive mind, because it's interesting for them. From my own account, the only bad thing I did was to infect my friend's 5.25" disk's boot sector but that's how far I went about it.

Surely as Pierre 303 noted you have to evaluate your students' attitude and then try to exploit and direct their interests to something more useful like giving them tasks to create programs etc.

Improve this answer
5

I don't think it's a good idea, for pragmatic rather than ethical reasons.

People (almost certainly boys) who want to learn how to write a virus or how they work will learn very well without your help. Nobody ever taught me, and I could write simple viruses by 13. Those who would be capable of using that ability for good will understand how to do it merely by learning the basics of programming. Those who would be interested only because it's a virus, rather than as a particular niche of programming, are better off having to learn the hard way.

Improve this answer
1
  • I think that is a really good point.
    – Jim McKeeth
    Jun 1, 2011 at 6:16
4

They will abuse it, it will cause hell on the school network, they will suddenly be breaking the law before you can blink.

A great idea to teach them about the general concepts (peer-to-peer distribution, minimal system resource use, and decentralized communication are some of the cool things conficker did, for example) but teaching them specifics is asking for trouble.

Improve this answer
10
  • 1
    We should also let them know the consequence of abusing it, such as they will get arrested, etc, etc.
    – Display Name
    May 29, 2011 at 8:45
  • Definitely, teach them to write peer-to-peer distribution software instead - they couldn't possibly get in trouble doing that...
    – Cyclops
    May 29, 2011 at 22:43
  • 1
    @cyclops And yet blizzard uses it every day. Yes, there are some problem areas with the tech, but there are more legit uses then, say, viruses.
    – Trezoid
    May 30, 2011 at 1:15
  • 1
    @trezoid - why teach kids how to play baseball because they will be beating others with bats before you know it! (ya...I know, it's a stretch :)) Most of the kids probably won't care outside the group and like xport said, letting them know the consequences as well lets them know how serious it can be.
    – Jetti
    May 30, 2011 at 18:25
  • 1
    In these days of zero tolerance, I can see so many ways that this would back-fire. Just being seen as encouraging the one kid who goes off and downloads the script-kiddie virus of the week will put you in hot water. It seems to me that there are so many other things to teach that are safer (for you).
    – dave
    May 30, 2011 at 21:49
3

I wouldn't do it. You're thinking of doing this of all the right reasons. There's just one thing you haven't taken into account. The teachers, the (non-IT) administrators. If you talk to the kids about viruses, suddenly every infection the coming 50 years or so will be your fault. You know, because you showed them how to do it with them computer thingies.

Improve this answer
1
  • 1
    Feel free to make this a comment to the question instead of an answer as this doesn't answer the question.
    – johnny
    May 31, 2011 at 7:36
2

They are too young to know how (not) to use that knowledge. Keep in mind that there are probably a few stars in there who will take what they know and add it to what you share which will fill in the details you have chosen to leave out. Depending on where you live, if they do damage to the school's machines you may face prosecution. I think what you're doing by mentoring is great, but do take care.

Improve this answer
1

The answer is of course going to be it depends, but as of Wednesday I'll be finished with high school and I'll say from personal experience it will probably not be much but you never know how far your influence will reach.

Now I've spent my last four years, what I've considered the 4 shittiest years, of my life making the school's network my bitch. The network guys all talked to me and threatened me with legal consequences multiple times but the sad fact is they have not been able to get me out of their system. They are probably rejoicing at the fact that I am graduating because I'll be out of their hair.

That said when I entered high school as a freshman I had absolutely no ill will towards the school. All computer security information I had learned and tested was purely academic. After a while though my high school experience became rather soured for a large number of reasons. At that point I pretty much devolved into a hateful beast and I spent many a time sitting in class watching my teacher's laptop and smartboard suddenly shutdown because I just damn well felt like doing it. I actually had the police interrogate me because I was poking around their payroll system and they flipped the hell out over that one.

So long as you are not teaching them how to write a RAT or run a botnet I really don't think it is equivocal to handing them a loaded .45 and saying have fun, but you should consider that although they may be nice little kids now, they all might not stay that way. I don't want to sound cryptic here, but life has ways of making you jaded that you would never ever think of, and once that happens you can't predict what will happen.

Improve this answer
5
  • 2
    So, instead, keep em in the dark, feed 'em on BS. And then they can go off to the library and borrow a book instead. With no further education about consequences / ethics / morals. Yeah, I can see that being a great step forward. Sounds like your network admins didn't know what they were doing. Most competent admins would stop your behaviour inside of a day or two.
    – quickly_now
    May 30, 2011 at 8:52
  • @quickly_now My point is not to leave them in the dark to learn on their own, which is arguably worse, but to be careful what you teach them and to reinforce the proper application of the knowledge. You never know how far your influences will reach. And I'm not even gonna touch on how shitty the network admins at my school district are...
    – user7007
    May 30, 2011 at 13:19
  • 2
    @quickly_now: Focusing the efforts of your teaching time on positive and productive methods and knowledge, is not 'keeping them in the dark'. Remember that this isn't a lecture course in software security... it's the after school special for high school kids. It shouldn't even be an issue of ethics... teach them how to program first before teaching them how to program maliciously.
    – Steven Evers
    May 30, 2011 at 21:44
  • 1
    Gee, my attempt at sarcasm failed miserably :) SnOrfus - I agree! esp: Teach them to program first.
    – quickly_now
    May 30, 2011 at 23:33
  • @quickly_now I think you forgot to close your sarcasm tag, </sarcasm>, got it for ya!
    – user7007
    May 31, 2011 at 1:49
1

I don't think this is even an issue of ethics. It's an issue of a better, more productive, use of yours and their time.

First teach them how to write code. Then we should consider teaching them how to write malicious code - or defensive code for that matter; but in my experience, knowledge of one requires knowledge of the other.

If it's the only thing that gets these kids interested in programming, and they may not attend or be interested if you're teaching anything else (not even the old stand-bys like game programming), then there may be a legimate reason to worry about their intentions.

Improve this answer
2
  • No explanation for the downvote? That's a shame. I'd be interested in some input on the issue.
    – Steven Evers
    May 31, 2011 at 16:12
  • I thought you had a good point. I didn't down vote you.
    – Jim McKeeth
    May 31, 2011 at 16:25
1

I think that they would learn about it if they want, whether you mention about it or not. In fact, they would learn more about viruses outside classes than in a class. I think that it is good if you mention and describe them. Not everyone will build a virus to make harm, but for academic's purposes

Improve this answer
1

If they can hack code together and use Google, they can write viruses. I would expect teaching them viruses would quickly lead to a bunch of 'hurr, I virused you' to result. I would also expect that if they are already interested, they will fire up Google, whether you like it or not.

You aren't going to win by excluding knowledge. You're going to win by teaching them ethical behavior, so that when their local viruses go off, they write smiley faces on the screen (or porno on a teacher's background), instead of booting up a node in a cobbled-together botnet.

It's dangerous. Agreed. But if they are going to code... they will have the capacity to whether you like it or not.

You should- IMO- treat it in the same fashion as teaching how to use a gun. Hunter's Ed courses start at 12 years old. Maturity can exist at that age.

Improve this answer
1

It depends.

In any case, you should include a part about the legal background and the consequences. Make it absolutely clear that spreading viruses, even ones that aren't designed to be harmful, is a severe crime. Have them formally agree not to use their knowledge to perform any illegal activities: make them (or their parents if they're minors) sign an agreement about this. It's standard procedure for any serious security and hacking related courses. Do this before you start the actual curriculum. This is not only to protect yourself, it's also to send a clear signal that says "you don't want to go there".

Even then, I'd only do this if you trust your students a little. If you suspect some of them to be of lesser ethical maturity, limit yourself to the "how do I protect myself from viruses and hacking" part.

Improve this answer
0

I don't know that it's clear ethically. Certainly if you know all the kids well and they are all responsible and mature for their ages then it's probably okay.

I think if you do teach them potentially dangerous or damaging information you must take some responsibility for it. Both in making sure that they are well educated in the subject and in it's consequences, but also in whatever ways they end up using that knowledge.

Improve this answer
0

It is common practice to teach students how to do bad things when programming. These types of lessons are invaluable in learning the caveats and dangers of programming. It also is needed information when learning how to identify and prevent attacks. Of course you must stress that they shouldn't do these things except on their own computers. They will. But if they are doing it to learn then they will be careful. I would consider it a failure as a teacher if you didn't cover such topics. The information they learn here actually is generally applicable. If they become proficient programmers, it is information that they will have to know.

Improve this answer
4
  • The OP is volunteering at a school to teach about computer viruses. Seeing not doing something while volunteering as a volunteer teacher as a failure is too much of an expectation.
    – vpit3833
    May 31, 2011 at 23:27
  • Sorry, but I don't understand what you're getting at. Can you reword it? If what I think you're saying is correct, you're a little off. He actually volunteered to teach a computer club at the school, so this is relatively long-term. Also, as one who has been taught malicious code in programming courses, I can attest that they are always taught with "DO NOT RUN THIS CODE" in big red letters, and also used as examples of how just a few lines of code can run amok. Also, his proposal of teaching about environment path precedence, while a potential exploit, is a common programmer's error as well.
    – Ben Richards
    Jun 1, 2011 at 2:52
  • I was referring to ' I would consider it a failure as a teacher if you didn't cover such topics.'.
    – vpit3833
    Jun 1, 2011 at 3:52
  • A quick Google showed me news.cnet.com/2100-1002_3-1010538.html. Couldn't find references to middle schools teaching this topic.
    – vpit3833
    Jun 1, 2011 at 4:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.