8 ms·
North Korea’s Naenara Web Browser: Weirder Than We Thought (2015)
- scyclow 10y agoYes, yes, yes, but what is it's ES6 support like?
- percept 10y agoOh crap, you mean I have to support Naenara now, too? (.00001% of the market)
- danirod 10y agoShouldn't this be tagged as (2015)? On the other side, it is interesting how close they have made recent versions of Red Star OS to look like MacOS X. I guess they don't care a lot about copyright infringement. Which is possibly related to the fact that Kim Jong Un has had, at least in the past, access to an iMac [1]. [1] http://www.businessinsider.com/brand-new-photo-confirms-that-kim-jong-un-is-a-mac-user-2013-3 http://www.businessinsider.com/brand-new-photo-confirms-that...
- forinti 10y agoI don't think there is copyright infringement in this case, as I doubt anyone holds copyrights in North Korea.
- maaarghk 10y agoThis is not the case. DPRK is a member of the World Intellectual Property Organisation [0] and has laws relating to IP [1]. It is perfectly possible to register intellectual property there and plenty of multinational organisations do so. [0] http://www.wipo.int/treaties/en/ShowResults.jsp?country_id=94C&treaty_id=101 http://www.wipo.int/treaties/en/ShowResults.jsp?country_id=9... [1] http://www.wipo.int/wipolex/en/profile.jsp?code=KP http://www.wipo.int/wipolex/en/profile.jsp?code=KP
- ivanca 10y agoI wonder if they apply the 3-generations jail sentence for copyright infringement as well...
- jakub_h 10y agoThey just might, for copying western books, for example. ;)
- RaleyField 10y agoThat was in poor taste.
- zymhan 10y agoYes, it should be. I was disappointed not to see any new information about it.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- ikeboy 10y agohttps://archive.is/GRjr8 https://archive.is/GRjr8 if not loading
- jandrese 10y agoI'm disappointed he didn't check the cert store on the browser. He seemed shocked that they would allow HTTPS, but that's perfectly fine as long as their proxy has a root cert installed so it can re-sign every HTTPS transaction. I would be shocked if the DPRK is not doing this. It's also a potential security issue since many of those certificate re-signing devices fail to verify the original certificates first, causing them to happily re-sign traffic that was already MITMed and erase all of the evidence.
- Kenji 10y agoExcept that he did check the certs and they're doing exactly that. 13. In looking around at the certificates that they support, I was not surprised to find that they accepted no other certificates as valid – only their own. That means it would be trivial to man in the middle any outbound HTTPS connection, so even if they do allow outbound access to Google’s JSON location API it wouldn’t help, because the connection and contents can be monitored by them. Likewise, no other governments can man in the middle any connections that the North Koreans have (I’m saying that with a bit of tongue in cheek, because of course they can according to Wikileaks docs, but this probably makes the DPRK feel better — and more importantly they probably don’t know how to do it in the same way as the NSA does, so they have to rely on draconian Internet breaking concepts like this).
- mmanfrin 10y agoI don't think you read the whole article.
- jamestenglish 10y agoI believe the author did cover this in point 13: In looking around at the certificates that they support, I was not surprised to find that they accepted no other certificates as valid – only their own. That means it would be trivial to man in the middle any outbound HTTPS connection, so even if they do allow outbound access to Google’s JSON location API it wouldn’t help, because the connection and contents can be monitored by them.
- gfo 10y agoIt's an interesting point that they're using a Class A address space for the country, but it's also North Korea... are we really expecting all of its citizens to be on this? Either way they'll probably run into issues down the road but I'm sure it's working just fine for them right now. Of course, my knowledge of how distributed their network infrastructure is across their country is lacking so maybe it does cause issues for them?
- digi_owl 10y agoIt would not surprise me that any large office or such is using the B or C ranges on top of the A range being national.
- inopinatus 10y agoIt would not surprise me that a large office is using the 10/8 range internally and NATting to the national 10/8 range and suffering from horrible ICMP misrouting issues.
- Symbiote 10y agoA large office could easily use some allocated range, like 25/8 which is allocated to the UK Ministry of Defence but not advertised on the public Internet.
- Laforet 10y agoYou have to be careful though, last year a good number of companies was burned when DoD started to route their previously unutilised class A block 11.0.0.0/8. https://news.ycombinator.com/item?id=10006534 https://news.ycombinator.com/item?id=10006534
- baby 10y agoThis is super weird. And it seems obvious that most of these measures are in place to spy on people. It also makes sense to treat the country like a small company's network if they have so few clients. The other thing I'm wondering, could they have been doing this to avoid outsiders to access their network? If we try to access 10.something it will try to reach an internal network and thus we won't be able to access their ips. If we somehow manage to send the request to 10.something over the network some node/server on the way will probably drop it.
- niij 10y ago>some node/server on the way will probably drop it If you're familiar with how routing works at all, you'd know it wouldn't even route outside your local network. There are Millions of seperate 10.x.x.x networks.
- baby 10y agoSee how I phrased it: "If we somehow manage to send the request to 10.something over the network" There are ways to send such packets outside of your local network.
- DashRattlesnake 10y ago> When I first saw an image of the browser I was awe-struck to see that it made a request to an adddress (http://10.76.1.11/ http://10.76.1.11/) upon first run. ... > Here’s where things start to go off the rails: what this means is that all of the DPRK’s national network is non-routable IP space. [emphasis mine] That's quite an unsupported leap. He found some software that uses non-routable IPs, that doesn't mean the entire country's network only uses them.
- walrus01 10y agoActually it's not difficult to determine, this is not in the article, North Korea has VERY small allocations of publicly routable ipv4 space from APNIC. It used to be as small as a single /24. It's also possible they're using IP space from several of their upstream Chinese ISPs that they are dependent upon, in which case it would be much more difficult to determine than an IP is physically located in .KP rather than on the Chinese side of the border.
- xiii1408 10y agoA guy who spent a year teaching in North Korea touched on this at CCC a couple years back. North Korea's intranet has its own DNS system, and they also (contrary to the article) assign a bunch of IP blocks not in RFC 4192 internally. People who do have access to the outside Internet do so through an HTTP or SOCKS proxy with login credentials. https://youtu.be/zuxlLLeKZZ8?t=421 https://youtu.be/zuxlLLeKZZ8?t=421
- walrus01 10y agoamusing about the new TLDs for their internal use, it looks like Donuts LLC (the company which runs a shitload of new GTLDs) and north korea have similar lines of thinking, but for very different reasons. http://www.donuts.domains/services/domain-names http://www.donuts.domains/services/domain-names
- inopinatus 10y agoIt's not a leap too far; it just needs a few data points to confirm with reasonable confidence. The DPRK has exactly one known ISP (Star JV, AS131279) and (as far as I can tell from various looking glasses) they advertise exactly three /24s out of their 175.45.176.0/22 allocation, via exactly one Chinese transit provider (China169, AS4837 which is China Unicom's backbone). We can also see from registries and generally poking around that 175.45.176/24 is used for authoritative nameservice (e.g. the DNS servers for .kp and reverse delegations for the Star JV /24s are here) and website hosting, which makes it very unlikely to be used for non-infrastructure host addresses. Being an old ISP lag I might also guess that there'll be an pair of NTP peers in there, an MTA, and separate source addresses for DNS resolvers (although I'd concede that with the DPRK no guess is reliable) That leaves a total of 508 globally reachable IPv4 host addresses for the whole country. I suggest that this is insufficient even for the devices allocated to the relatively small group of individuals permitted to access the internet, from which it is not unreasonable to infer that everything else is in RFC1918 (or equivalent) space behind a proxy, which this article suggests is 10/8 or (my guess) most likely some structured sub-allocations thereof.
- Animats 10y agoIs there some way to look at North Korea's network 10 IP space from the outside? There are tools which let you look at the Internet from inside the Great Firewall of China.[1] Is there one for North Korea? [1] http://www.websitepulse.com/help/testtools.china-test.html http://www.websitepulse.com/help/testtools.china-test.html
- percept 10y agoThis had made the rounds a while back: http://nknetobserver.github.io/ http://nknetobserver.github.io/
- rdtsc 10y ago> They use the same tracking system Google uses to create unique keys, except they built their own. That means the microtime of installation is sent to the mothership every single time Did everyone else know about this? I didn't. Interesting. I stopped using Chrome and switched back to Firefox 3-4 years ago because Firefox got a better, and was slightly worried Google would eventually do stuff like that.
- bognition 10y agoI'd love an explanation on how these microtimestamps can be used to unmask people
- ralmeida 10y agoOne simple example: you browse a bunch of stuff, and they are able to know these were from the same person due to the identifier. Then you log into, say, Gmail. Now they have information to deduce you are that person. Not saying they necessarily do that, but if they are indeed able to associate the "installation ID" to every request made with the browser, they have the information to do this, if they decide to do so.
- jonchang 10y agoIn Firefox the requests made to Google's safe browsing are sent using a completely separate cookie jar that is isolated from the rest of the browser, so that even if Google is tracking the requests to its safe browsing service it wouldn't be able to identify you on the basis of the unique cookie alone.
- antsar 10y agoNot alone, but correlated with other traffic from your IP address, browser fingerprinting, etc.
- rdtsc 10y agoI'd never heard specifically of Chrome but in general I would imagine if they record the time application was installed down to some microseconds and then are able to see all requests tagged with that timestamp, and one of the requests is linked to you signing in to GMail they can link the two. Now in general they don't even need it, other browser fingerprints are working pretty well: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- ihaveahadron 10y agoThe article lost all it's credibility when it complained about how the menus look.
- dandelany 10y agoSeriously? You just lost all credibility by judging the entire detailed analysis based on a jokey throwaway comment at the beginning of the article.
- xiii1408 10y agoWe don't need to reverse engineer a browser to get hints about how North Korea's internet and intranet work, since people who've been there have given talks about it. https://www.youtube.com/watch?v=zuxlLLeKZZ8 https://www.youtube.com/watch?v=zuxlLLeKZZ8
- Lich 10y agoIf anyone's curious, Naenaera means "My country". So, literally, "My Country Browser". Nae = me/my and naera = "country"
- gfaure 10y agoIt's _nara_ "country", not _naera_.
- meshko 10y ago|but the wifi URL for GEO still points to |https://www.google.com/loc/json https://www.google.com/loc/json maybe it a cry for help? Someone "accidentally" left a single https request there, hoping google will redirect North Korean requests to an open proxy allowing them full access to the Web.
- kalleboo 10y agoI would presume all those URLs that point to the NK IP address are more likely a result of the authors doing a (poor job of) a search/replace on "mozilla.org" and "google.com" on the source code than NK actually supporting all those features specifically/proxying google/safe browsing lists etc. 90% of them are probably 404s. We're probably talking about an IT team with skills on par with your average high school.
- knodi123 10y ago> We're probably talking about an IT team with skills on par with your average high school. I don't think that's necessarily true, and it kinda seems like you're falling into the trap of believing your enemy to be a real-life cartoonish caricature. North Korea is still a large nation, and while their resources are very limited, it's still a lot in absolute terms (as in, not compared to other nations). Anyway, there is some evidence to the contrary of your assumptions: http://www.bbc.com/news/technology-32925503 http://www.bbc.com/news/technology-32925503
- kalleboo 10y ago> I don't think that's necessarily true, and it kinda seems like you're falling into the trap of believing your enemy to be a real-life cartoonish caricature. On the contrary I think they're pretty normal and like anywhere IT gets no respect or resources
- sn41 10y agoI doubt that. There is evidence that they have competent programmers. For example, in this year's ICPC, the North Korean team came 30th. That's pretty impressive, considering that they may not have access to all the regular contest websites that people practice on: https://icpc.baylor.edu/scoreboard/ https://icpc.baylor.edu/scoreboard/
- pwdisswordfish 10y agoThat doesn't actually prove very much. Successes in programming contests may demonstrate you can hack your way around an algorithmic problem that you're solving from scratch. Modifying a browser, an operating system and the communication protocols they use to add robust surveillance capabilities demands a different type of skill and resources: proficiency with an entire stack of technologies and knowledge of good engineering practices. This analysis seems to provide some evidence against the latter.
- gambiting 10y agoI work for a large games publisher and using our in-game tracking we can see some(usually just a few) connections from North Korea - I always wondered if it's kids of rich NK elite playing on imported PS4s and Xbox Ones, and how bizarre it must be to have something like a PS4 in such a closed country.
- NietTim 10y agoHow big of a chance is it that these IP's are labeled wrong in your system?
- gambiting 10y agoHard to tell. In a game with millions of users we literally have 5-6 profiles created from north korean ips("star joint venture" appears as the isp) so I guess it's plausible that just a handful of people have got imported consoles there. At the same time, the sample size is so small it could be spoofed maybe? I am not sure if there's any way to know for certain really. Edit: it's also possible that people living in embassies in NK have consoles, but I have no idea how they get internet there, probably not through the national ISP.