The Canadian Communications Security Establishment — the most secretive of Canada's spy agencies — has released the sourcecode for Assemblyline, a "Swiss Army Knife for malware analysis" that rolls up several malware analysis tools into a single unit, which can scan files for known malware and also assign a score to files indicating the likeliness that the file has a previously unseen form of malware.
The move is most welcome, and exemplifies the ways that security services can serve the mission of national security by rooting out malware and vulnerabilities. It's a real contrast to this year's meeting in Ottawa where Australia's top spy proposed deliberately introducing vulnerabilities into commonly used tools to preserve spies' ability to hack their adversaries./
The possibility that CSE's own tool could be used to detect spy software of its own design, or that of its partners, is not lost upon the agency."Whatever it detects, whether it be cybercrime or [nation] states, or anybody else that are doing things — well that's a good thing, because it's made the community smarter in terms of defence," said Jones.
Nor does he believe that releasing Assemblyline to the public will make it easier for adversaries to harm the government, or understand how CSE hunts for threats — quite the opposite, in fact."We believe that the benefits far outweigh any risks and that we can still use this to be ahead of the threat that's out there."
Canada's 'super secret spy agency' is releasing a malware-fighting tool to the public
[Matthew Braga/CBC]
