Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

cbc.ca

Post reply on HN
Print view View original

31–40 of 83 posts

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#31

Post by 3pt14159 »

This is the first major commit where they pulled in the existing codebase almost a year ago:

https://bitbucket.org/cse-assemblyline/assemblyline/commits/...

Couple interesting bits:

1. Bcrypt looks trusted. I guessed as much given that I've seen it used in other GC projects that were "Protected B" (think Revenue Canada / similar).

2. It doesn't look like they enabled HSTS by default until a couple months later in the repo:

https://bitbucket.org/cse-assemblyline/assemblyline/commits/...

Again, unsurprising since the CSE / CST main page doesn't have HSTS.

3. This part of the original version of the README is interesting:

#### License (or lack thereof) and Conditions of use

As is fairly evident, we haven't selected a license for this project as of yet. As discussed when members were first granted read access to the repository, dissemination is based on the premise of originator controlled. If you feel there are other partners that would benefit from an early view and would be able to contribute, please contact the project leads and we should be able to sort it out.

We will soon be splitting the platform and services into two separate repo's, so please treat the services as slightly more sensitive than the platform itself, ie: release it and perish!!! ... but seriously, we do not grant anyone the right to do anything other than deploy the platform and use it. No sharing, presenting, etc without our knowledge.

We hope to have a clear release plan soon.

So it looks like they passed it around a bit either internally in the CSE or to a wider audience that may have included other departments. Probably getting more eyes on it to stop something stupid from going out.

4. There are some fun little commits like this:

https://bitbucket.org/cse-assemblyline/assemblyline/commits/...

Or this (adding the French version is always one of the last steps before something goes public):

https://bitbucket.org/cse-assemblyline/assemblyline/commits/...

Or this (we've all been there):

https://bitbucket.org/cse-assemblyline/assemblyline/commits/...

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#32

Post by gnode »

bfred_it wrote: post #30
e1ven wrote: post #17

Earlier quoted context omitted.

It's MIT license, and the repo seems to have full history.

That doesn’t mean that the binaries match the repo content.

Does it even have binaries? It's a Python app, isn't it?

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#33

Post by excalibur »

KGIII wrote: post #4
stephengillie wrote: post #2

> Assemblyline is described by CSE as akin to a conveyor belt: files go in, and a handful of small helper applications automatically comb through each one in search of malicious clues. On the way out, every file is given a score... This sounds like it could sit nicely between Github and CI (Jenkins/Travis/Circle/etc), and be a pre-integration security scan. Can we name it Sherlock?

Mountie might be better.

Hogline

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#34

Post by 52-6F-62 »

revelation wrote: post #25
52-6F-62 wrote: post #5

Earlier quoted context omitted.

CSE is comparable to America's NSA in general function and scope. While CSIS does intelligence work with computers and hires a lot of programmers and analysts, CSE is traditionally the more technologically-focused of the two. You also hear significantly less about it than even CSIS. They're good at their jobs. edit: Spelling. They changed it from CSEC to CSE

Citation needed.

https://www.cse-cst.gc.ca/en/about-apropos/faq

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#36

Post by 52-6F-62 »

douglas_k wrote: post #14
jordigh wrote: post #3

The main repo seems to be here: https://bitbucket.org/cse-assemblyline/assemblyline/src Released under the MIT license with crown copyright. Looks like a plain ol' Flask application. I don't know what I was expecting from the government. Maybe more Microsoft and more Oracle, more "enterprise". And the git history goes back ten months with an initial commit of December 21, 2016. I'm actually surprised to learn that CS…

CSIS likes very much to not be in the news. They seem to actively work to stay unknown. I've heard, but cannot verify, that they are the only government agency that is not required to have a "Government of Canada dept X" sign outside their buildings. They do have them outside some buildings, but not all buildings.

It's kind of what I like about them. Now quiz time. Who's heard of JTF2?

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#37

Post by 52-6F-62 »

3pt14159 wrote: post #31

This is the first major commit where they pulled in the existing codebase almost a year ago: https://bitbucket.org/cse-assemblyline/assemblyline/commits/... Couple interesting bits: 1. Bcrypt looks trusted. I guessed as much given that I've seen it used in other GC projects that were "Protected B" (think Revenue Canada / similar). 2. It doesn't look like they enabled HSTS by default until a couple months later in the…

Lol. I don't know if you clicked the username, but it's appropriate: https://bitbucket.org/sgaron-cse/

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#38

Post by vkou »

mtgx wrote: post #26
3pt14159 wrote: post #22

Earlier quoted context omitted.

If you read through the Snowden leaks you'll see just how normal the CSE is. If you're a reasonably good hacker think how you'd do it. They probably do it kinda like that.

They've been given additional powers lately to expand surveillance on regular citizens, so I wonder how much that "sweet innocence" of theirs will last and how long until they also become more like the NSA, especially under a conservative government in the (near) future.

They don't have to be.

They can spy on Americans, the NSA can spy on Canadians, and the two governments can freely share information between eachother. (Because it's not information about their own citizens.) Canada is one of the five eyes, after all.

Re: Canada's 'secret spy agency' is releasing a malware-fighting tool to the public

#40

Post by giarc »

douglas_k wrote: post #14
jordigh wrote: post #3

The main repo seems to be here: https://bitbucket.org/cse-assemblyline/assemblyline/src Released under the MIT license with crown copyright. Looks like a plain ol' Flask application. I don't know what I was expecting from the government. Maybe more Microsoft and more Oracle, more "enterprise". And the git history goes back ten months with an initial commit of December 21, 2016. I'm actually surprised to learn that CS…

CSIS likes very much to not be in the news. They seem to actively work to stay unknown. I've heard, but cannot verify, that they are the only government agency that is not required to have a "Government of Canada dept X" sign outside their buildings. They do have them outside some buildings, but not all buildings.

I had a colleague that applied, and was subsequently interviewed for a position with CSIS. He said he was instructed to go to a large office tower in Toronto, go to x floor and ask for a particular person. Nothing was labelled as CSIS.
Post reply on HN