11 ms·
Snapshot of North Korea’s DNS data taken from zone transfers
- axyjo 10y agognu.rep.kp. That's pretty interesting. I wonder what they've got on that.
- lb1lf 10y agoRed Star OS repos, presumably?
- emilburzo 10y agohttp://gnu.rep.kp/ http://gnu.rep.kp/
- NetStrikeForce 10y agoI am not sure I want to click on that...
- Gurrewe 10y agoThe site is available to the world, http://gnu.rep.kp/ http://gnu.rep.kp/
- yitchelle 10y agoIs it malicious?
- sillysaurus3 10y agoNah. Here are some screenshots (google translated): http://imgur.com/a/C2Gp7 http://imgur.com/a/C2Gp7
- userbinator 10y ago> Dafeng strange fruit spreads across the Great Hall won the People's love and young manhood of the world's largest hot in that reverence Kim Jong-un... North Korean is a different dialect so it's no surprise Google struggles with it. It looks like a news/propaganda site.
- duskwuff 10y agoNot just the dialect that's tough to translate, but also the diction. DPRK propaganda tends to use a lot of bombastic language -- it shows in their English press releases as well.
- Angostura 10y agoAll the gnus that's fit to print.
- witty_username 10y agoIf you run it while disabling JS and Flash, it should be safe.
- waltwalther 10y agoHere's 4 screenshots I took of a few I visited... http://imgur.com/a/Czllv http://imgur.com/a/Czllv
- zhan_eg 10y agoBased on Google Translate, it's nothing related to GNU, but "Pyongyang broadcast "national unity" editorial".
- bjornsteffanson 10y agoGNU actually refers to 'grand national unity' in this context, one of the three fundamentals for Korean unification outlined in the 1972 North-South Joint Declaration (the other two being peace and independence). Based on the screenshots, gnu.rep.kp appears to be a website for the Pyongyang Broadcasting Station.
- audeyisaacs 10y ago5 day TTLs seems a little long? To help with outages maybe ;P Edit: Awesome find, and monitoring project btw. Thanks!
- arbitrage 10y agoIf their topography is mostly static, it doesn't matter much if the TTL is 24 hours or 7 days.
- vmp 10y agoFascinating, that's the complete zone for the whole country? And it's run on 5 servers? (only 5 different IPs mentioned as far as I can tell)
- bluecmd 10y agoUsually you run NS behind anycast, so the actual number of servers can be vastly bigger. But since this is NK, maybe 5 is reasonable.
- charlesdm 10y agoWould many people within the country even have access to this intranet?
- EE84M3i 10y agoThis is a bit misleading. According to Will Scott, who taught CS in North Korea, there are some 3000-5000 sites on the national intranet, but it is entirely disconnected from the internet at large. So these zones are ones that are intended for consumption by foreigners. Source: http://motherboard.vice.com/read/how-to-teach-computer-science-in-north-korea http://motherboard.vice.com/read/how-to-teach-computer-scien... (super interesting, suggest reading it)
- nunez 10y agoHoly shit; they are still teaching classful routing (Class A, B, C, D...)
- jwr 10y agoI find it amazing that you can actually read (yourself) all of the content of all the toplevel DNS zones of a country. In 2016. Two subdomains in .edu.
- jbg_ 10y agoWhat do you mean by "In 2016"? This is by design...
- lost_my_pwd 10y agoI think GP means it is notable that, in 2016, the zone list for NK is so small that it can be perused in mere seconds due to its short length (as compared to any other country).
- LeifCarrotson 10y agoThe interesting parts are not by design. Yes, you can query the server, that's the expected behavior. But: 1. It's not normal to allow global zone transfers on most country-code nameservers, which enables other Internet users to get the full list of registered domains. Yes, some do it: https://github.com/mandatoryprogrammer/TLDR/blob/master/README.md https://github.com/mandatoryprogrammer/TLDR/blob/master/READ... 2. It's not normal for the list of all the domains registered to a TLD to be readable by a human in a short timeframe. If you could get a list of all .com or .co.uk domains, you probably could not read all the domains which start with 'aa', much less the complete list.
- riotdash 10y ago"On Sept 20, 2016 at approximately 10:00PM" This hasn't even happened yet...
- julsimon 10y agoSomeone is going to get executed with an anti-aircraft gun :D
- Avalaxy 10y agoHow is that funny?
- orliesaurus 10y agoWatch as they're going to blame the US and/or South Korea of hacking them
- kalleboo 10y agoWell if this happened in the US, wouldn't this count as hacking under the CFAA? For instance weev got 3 years for running some GET requests on a sequential number.
- Retr0spectrum 10y agoFor someone who isn't particularly familiar with DNS, what are the implications of this?
- aerovistae 10y agoAnd/or what can be learned from the leaked data?
- k__ 10y agoWhat websites they have? airkoryo.com.kp. cooks.org.kp. // receips are important friend.com.kp. // facebook clone? :D gnu.rep.kp. // yay at least their software is free kass.org.kp. kcna.kp. kiyctc.com.kp. knic.com.kp. koredufund.org.kp. korelcfund.org.kp. korfilm.com.kp. // movie4k clone at least there it is legal, lol ma.gov.kp. masikryong.com.kp. naenara.com.kp. nta.gov.kp. portal.net.kp. // yahoo clone ;) rcc.net.kp. rep.kp. rodong.rep.kp. ryongnamsan.edu.kp. sdprk.org.kp. silibank.net.kp. star-co.net.kp. star-di.net.kp. star.co.kp. star.edu.kp. star.net.kp. vok.rep.kp. don't seem that much
- charlesdm 10y ago> korfilm.com.kp. That 1990s style animated banner.. THE PYONGYANG INTERNATIONAL FILM FESTIVAL. I bet a ton of celebs visit that!
- varjag 10y agoRed carpet doesn't get redder than this. That said they had some surprising entries: > In 2006, the Swedish horror comedy Frostbiten was shown at the festival, the first foreign horror film to ever be shown in North Korea.
- Keyframe 10y ago<META content="MSHTML 6.00.2900.2180" name=GENERATOR> Who wouldn't?
- 10y ago
- viach 10y agoYou better don't visit North Korea as a tourist now
- benedikt 10y agoSlightly related, I ran nmap scans on the known NK internet for a while. The data can be found here: https://github.com/benediktkr/nk-scans https://github.com/benediktkr/nk-scans
- wuschel 10y agoWell, I hope for the head of the NK chief propaganda minister that the grand divine dictator's internet does not break down with all the traffic from Hacker News.. "Kim Jong Un, Chairman of the Workers' Party of Korea, Chairman of the State Affairs Commission of the DPRK and Supreme Commander of the Korean People's Army, visited the Sohae Space Centre to inspect the ground jet test of a new type high-power engine of a carrier rocket for the geo-stationary satellite." It sounds really hilarious, but it reminds me of the soviet era in the Warsaw Pact member states. Poor citizens. We are so lucky to have a degree of control over our supreme leadership..
- mikeash 10y agoIt should remind you of that, since that's basically what they are. They're on the wrong side of Russia to be in the Warsaw Pact, but they follow the same basic model as other Soviet puppets, except for the part where they succumbed to revolution in the 90s.
- shermozle 10y agosilibank.net.kp must be where they make the counterfeit currency?
- deleted 10y ago[deleted]
- vocatus_gate 10y ago"Sillybank" I know it's childish but I couldn't help but laugh at this.
- retox 10y agoWhere the funny money comes from.
- pawal 10y agoIf you want to keep secrets, publishing them in DNS is the wrong place for it.
- deleted 10y ago[deleted]
- CCing 10y agoIt's safe visit these websites ? I've visited cooks.org.kp with JS enabled-_- (but origin ublock active)
- CCing 10y agoI'm not fucking kidding, but after I've visited cooks.org.kp my internet is slow and I've some packet loss and timeout...but nothing weird on little snitch
- kalleboo 10y agoIf North Korea had 0-day browsers exploits, they wouldn't be using them on cooks.org.kp
- deleted 10y ago[deleted]
- runholm 10y agoublock only blocks known trackers or obvious ones, so it doesn't do anything to protect against potential browser exploits Kim could be running. That being said, I doubt North Korea is sitting on too many unknown browser exploits.
- callesgg 10y agoSomeone might be getting killed over this.
- fleitz 10y agoMachine gun or anti-aircraft gun?
- WhitneyLand 10y agoAnd we're not helping 25 million prisoners escape from this starvation cult run by a megalomaniac child because? 1) China would get mad 2) No one would want the refugees 3) There's no will to help people you largely can't see 4) After deposing the Kim regime no one knows how to nation build while avoiding the usual quagmires. 5) Would cost too much money Am I missing anything or does that about cover it?
- caleblloyd 10y agoIt would result in a Conventional War costing potentially millions of lives
- emptyfile 10y ago*nuclear war
- minikites 10y ago2 and 3 are some of the biggest issues for any developing nation. We all tend to spend our internet discussion time with people who are "like us" which means it's easy to turn away from the suffering of others. And even when you can see them (Syria comes to mind), 2 is still a big motivator that generates all sorts of excuses at best or outright fabrications at worse.
- FreakyT 10y agoYou are phrasing this as if it were possible to just magically make the Kim regime vanish, and the only reasons we aren't are self-serving and wrong. Your point #4 is far more important than any other: > "After deposing the Kim regime no one knows how to nation build while avoiding the usual quagmires." The fact is, if the west went in and blew up Pyongyang, do you really think there would be a peaceful transfer of power? I highly doubt it. Furthermore, Seoul is within easy artillery range of the North. No matter how quickly a hypothetical strike on the North was executed, Seoul will likely be at least partially obliterated.
- dominotw 10y agoI think you missed a couple of big ones 1. They can reach Seoul with conventional weapons 2. Ideologically aligned population loyal to Kims. This is still true.
- lgats 10y agoIs the north korea Internet now down?
- misterbwong 10y agoSide note: I'd really like to visit this NK ski resort. It'd be amazing to snowboard on what looks like completely empty snow. http://masikryong.com.kp/ http://masikryong.com.kp/ https://en.wikipedia.org/wiki/Masikryong_Ski_Resort https://en.wikipedia.org/wiki/Masikryong_Ski_Resort
- feralmoan 10y agoWow, timing out. It's already fallen over from referral traffic :D I hope no-one gets shot over this
- richman777 10y agoJust don't use the ski lift....(if you didn't read the article it's a 30 year old retired lift)
- Nadya 10y agoDid nobody think to use archive.org on these sites while they were still up? :( Or was that not possible. Something like HTTrack would have been useful, rather than a few people screenshotting the sites.
- dprkinaddr 10y ago; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +tcp @ns2.co.kp axfr 176.45.175.in-addr.arpa ; (1 server found) ;; global options: +cmd 176.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082900 28800 86400 1209600 86400 176.45.175.in-addr.arpa. 432000 IN NS ns1.kptc.kp. 176.45.175.in-addr.arpa. 432000 IN NS ns2.kptc.kp. #10.176.45.175.in-addr.arpa. 432000 IN PTR smtp.star-co.net.kp. 15.176.45.175.in-addr.arpa. 432000 IN PTR ns1.kptc.kp. 16.176.45.175.in-addr.arpa. 432000 IN PTR ns2.kptc.kp. 61.176.45.175.in-addr.arpa. 432000 IN PTR smtp.star.net.kp. 67.176.45.175.in-addr.arpa. 432000 IN PTR naenara.com.kp. 70.176.45.175.in-addr.arpa. 432000 IN PTR mail.silibank.net.kp. 176.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082900 28800 86400 1209600 86400 ;; Query time: 455 msec ;; SERVER: 175.45.176.16#53(175.45.176.16) ;; WHEN: Wed Sep 21 03:54:17 UTC 2016 ;; XFR size: 10 records (messages 1, bytes 317) ; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +tcp @ns2.co.kp axfr 178.45.175.in-addr.arpa ; (1 server found) ;; global options: +cmd 178.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082903 28800 86400 1209600 86400 178.45.175.in-addr.arpa. 432000 IN NS ns1.kptc.kp. 178.45.175.in-addr.arpa. 432000 IN NS ns2.kptc.kp. 170.178.45.175.in-addr.arpa. 432000 IN PTR smtp.star.net.kp. 55.178.45.175.in-addr.arpa. 432000 IN PTR smtp.star-co.net.kp. 178.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082903 28800 86400 1209600 86400 ;; Query time: 1628 msec ;; SERVER: 175.45.176.16#53(175.45.176.16) ;; WHEN: Wed Sep 21 03:56:19 UTC 2016 ;; XFR size: 6 records (messages 1, bytes 223) ; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +tcp @ns2.co.kp axfr 179.45.175.in-addr.arpa ; (1 server found) ;; global options: +cmd 179.45.175.in-addr.arpa. 432000 IN SOA ns1.star.edu.kp. root.kptc.kp.179.45.175.in-addr.arpa. 2013082900 28800 86400 1209600 86400 179.45.175.in-addr.arpa. 432000 IN NS ns1.star.edu.kp. 69.179.45.175.in-addr.arpa. 432000 IN PTR mail.star.edu.kp. 76.179.45.175.in-addr.arpa. 432000 IN PTR ns1.star.edu.kp. 179.45.175.in-addr.arpa. 432000 IN SOA ns1.star.edu.kp. root.kptc.kp.179.45.175.in-addr.arpa. 2013082900 28800 86400 1209600 86400 ;; Query time: 465 msec ;; SERVER: 175.45.176.16#53(175.45.176.16) ;; WHEN: Wed Sep 21 03:56:25 UTC 2016 ;; XFR size: 5 records (messages 1, bytes 194) You forgot to dump the PTR records for their IP ranges
- A1kmm 10y agoLooking at the A records tells an even more interesting story: (for i in *.zone; do expand $i | grep " A " | cut -c 50-; done) | sort | uniq -c | sort -n 1 75.45.179.76 16 75.45.176.15 16 75.45.176.16 25 75.45.176.8 25 75.45.176.9 It looks like all those websites are hosted on only 5 IP addresses. They could be load balancers, but still, that is certainly not many hosts!