You have very valid points about the CREA. We are working hard on getting the practical portion set up for this exam, and are currently "beta testing" a number of different practicals. We initially had a number of simple crackmes, but all of the CREA certification board members decided it would be best to include a mix of traditional "crackmes" and malware, because so many people out there are looking for reversers to reverse malware. The challenge has been how to properly distrubute malware for the pratical, we have to accomplish two goals:

1. Make sure there isnt a write up on the malware somewhere else, which would just encourage cheating or "peeking"
2. Properly "neuter" the malware so it cannot harm someone's computer who is doing the pratical.

Number 1 is much harder than number 2, because security community seems to love to rip apart just about every piece of widely circulated malware and post ooodles of details all over blogs, etc.

Anyway, to make a long story short, we are definately working hard on the pratical portion of the exam, and we do expect a rollout and conversion for certification candidates in Feburary of 2009.

I sure wish that all of our exam candidates were as hard working as
you. You should see the number of people complaining about having to do the
CEPT or CPT practicals. But, that is the whole idea, to weed these
candidates out.

I would recommend you take the exam now, and, for kicks, I will let you know
when the practical is ready and you can retake the practical portion if you
are up for it. Ill send it to you ahead of time before we release them to
the public, id like to hear your comments.