4 ms·

Thanks for sharing my site. Happy to answer any questions

monerozcash 10mo ago
Don't have questions, but your blog is very cool. A bit over a decade ago I used to spend a lot of time hacking North Korean web infrastructure, I mostly found that they tended to have firewalling around almost all boxes exposed to the global internet and usually had pretty impressive reaction times if you tried to access the country intranet through a compromised web server. I've always wondered how successful NSA and the likes have been at infiltrating DPRK networks, as it would inherently be fairly easy to detect any sketchy traffic from the outside. I wonder if the recent NYT story essentially confirms that difficulty. Regarding the NSA and DPRK, there's this document from 2007 least https://www.eff.org/files/2015/02/03/20150117-spiegel-fifth_party_access_-_when_the_targeted_fourth_party_has_someone_under_surveillance_who_puts_others_under_surveillance.pdf https://www.eff.org/files/2015/02/03/20150117-spiegel-fifth_... I guess I have a question after all: I'm not exactly clear on how NK treats end-user devices. Do you know if the endpoints used by NK based remote workers have internet and intranet access at the same time? If they do, such an endpoint could offer an easy and stealthy channel to access the intranet.
- superducktoes 10mo ago
  thanks really appreciate that! I've seen that doc before and it does really make me wonder. part of the leaks from the NSA tools years back had some references in there for detecting north koreas ant-virus silivaccine https://github.com/b30wulf/Malware-collection/blob/4f5906c93314757e85f3e764d07c6b0466befbd8/malware/malware-master/Fuzzbunch/Resources/Ep/Scripts/PSP/silivaccine.eps#L22 https://github.com/b30wulf/Malware-collection/blob/4f5906c93... There was also the hacking team leak from years ago and they were selling exploits for north korea's red star OS: https://nkinternet.wordpress.com/wp-content/uploads/2025/12/portfolio.pdf https://nkinternet.wordpress.com/wp-content/uploads/2025/12/... I assume they've been on their networks in the past but i think North Korea has also done a lot over the years to secure their side. it used to be a lot easier when they left everything as an open directory and didn't realize what they were doing.
  - monerozcash 10mo ago
    >There was also the hacking team leak from years ago and they were selling exploits for north korea's red star OS: https://nkinternet.wordpress.com/wp-content/uploads/2025/12/ https://nkinternet.wordpress.com/wp-content/uploads/2025/12/... South Korean NIS was in fact a hacking team client, so it would make sense. Especially considering how terrible Red Star OS was at the time, a HT engineer could probably have whipped those up in a couple of days. https://web.archive.org/web/20180302155452/http://english.yonhapnews.co.kr/news/2015/08/04/0200000000AEN20150804000900315.html https://web.archive.org/web/20180302155452/http://english.yo... >I assume they've been on their networks in the past but i think North Korea has also done a lot over the years to secure their side. it used to be a lot easier when they left everything as an open directory and didn't realize what they were doing. I'm sure they've had some success, but I'd expect it to be a really difficult environment to operate in. Even for the NSA. I suppose eventually there'll be a better leak and we'll get to find out just how well it's been going.
- superducktoes 10mo ago
  the end user devices are also really interesting. as far as i know they require a piece of software called netkey or oconnect as it's recently been renamed. that's for getting access inside the country and then for anyone outside they have software called hangro that is similar to a vpn for connecting back to north korea and getting messages
- anonu 10mo ago
  > this document from 2007 Interesting document - confirming "everyone spies on everyone". Is this from some sort of corporate NSA chat room?
  - monerozcash 10mo ago
    It's like the NSA Reddit, they've got memes and up- and downvotes. Some excerpts from a seemingly unreleased Snowden leak (from Dark mirror: Edward Snowden and the American Surveillance State): > “Why is a scoop of potatoes larger than a scoop of eggs in the cafeteria?” a contributor named Michael wondered one day. Paul jumped in to play the troll. “Let me be the first to down-vote you,” Paul wrote, naming several pedantic reasons. A side debate erupted: should Michael’s post be down-voted, flagged, or removed? Clyde returned to the topic at hand with a facetious theory that scoop volume is proportional to the relative size of potatoes and eggs themselves. In that case, Scott replied, what would happen if “we served eggs that were bigger than potatoes, like of an Ostrich?” Someone proposed a uniform system, “One Spoon to scoop them all,” an homage to Lord of the Rings. Punsters demanded the “inside scoop” and lamented the waste of time on “small potatoes.” Gotta say, it's pretty disappointing that Gellman, Greenwald, Poltras et. al. have been so stingy with these documents. It's definitely starting to have been long enough for them to just dump everything.
metadat 10mo ago
Impressive sleuthing! It's interesting to discover the reality that packet routing ends up following political affiliations. I didn't know North Korea only has 1,024 IPv4 addresses. Do you know why so few IPs? How did they get them?
- monerozcash 10mo ago
  DPRK can certainly get however many IP addresses they want, DPRK just doesn't have that much infrastructure that they want externally accessible. As far as I know, end-user traffic from within North Korea usually does not originate from those few IP addresses. Or at least not visibly so, they might be connecting to a proxy from a DPRK IP address.
  - lukan 10mo ago
    "DPRK can certainly get however many IP addresses they want" IP4 is quite limited as far as I know and not given out freely since a long time, or what do you mean here?
    - jauer 10mo ago
      IPv4 continues to be available to entities that have a need that fits a particular policy shape, just most people don't. Specifically, you can get IPv4 /24s for IPv6 transition purposes. This includes anycast DNS, MX, etc for legacy clients on other networks, v4-side of CGNAT, etc. E.g. I was able to get a /24 in the ARIN region in 2021 and could justify 2 more for a _logical_ network topology similar to what NK presents to the world. APNIC similarly has a pool available for IPv4 allocations: https://www.apnic.net/manage-ip/ipv4-exhaustion/#the-situationin-apnic https://www.apnic.net/manage-ip/ipv4-exhaustion/#the-situati...
      - eqvinox 10mo ago
        IPv4 is a question of money in almost all cases at this point. You can get what you can pay for.
    - 10mo ago
apercu 10mo ago
What a great read. Thanks.
NedF 10mo ago
[dead]
eqvinox 10mo ago
> … 2.5 GB per second between all the provinces. What's your source for that number? Is it GBit or GByte? Are they building out OTU1?

Don't have questions, but your blog is very cool. A bit over a decade ago I used to spend a lot of time hacking North Korean web infrastructure, I mostly found that they tended to have firewalling around almost all boxes exposed to the global internet and usually had pretty impressive reaction times if you tried to access the country intranet through a compromised web server. I've always wondered how successful NSA and the likes have been at infiltrating DPRK networks, as it would inherently be fairly easy to detect any sketchy traffic from the outside. I wonder if the recent NYT story essentially confirms that difficulty. Regarding the NSA and DPRK, there's this document from 2007 least https://www.eff.org/files/2015/02/03/20150117-spiegel-fifth_party_access_-_when_the_targeted_fourth_party_has_someone_under_surveillance_who_puts_others_under_surveillance.pdf https://www.eff.org/files/2015/02/03/20150117-spiegel-fifth_... I guess I have a question after all: I'm not exactly clear on how NK treats end-user devices. Do you know if the endpoints used by NK based remote workers have internet and intranet access at the same time? If they do, such an endpoint could offer an easy and stealthy channel to access the intranet.

superducktoes 10mo ago
thanks really appreciate that! I've seen that doc before and it does really make me wonder. part of the leaks from the NSA tools years back had some references in there for detecting north koreas ant-virus silivaccine https://github.com/b30wulf/Malware-collection/blob/4f5906c93314757e85f3e764d07c6b0466befbd8/malware/malware-master/Fuzzbunch/Resources/Ep/Scripts/PSP/silivaccine.eps#L22 https://github.com/b30wulf/Malware-collection/blob/4f5906c93... There was also the hacking team leak from years ago and they were selling exploits for north korea's red star OS: https://nkinternet.wordpress.com/wp-content/uploads/2025/12/portfolio.pdf https://nkinternet.wordpress.com/wp-content/uploads/2025/12/... I assume they've been on their networks in the past but i think North Korea has also done a lot over the years to secure their side. it used to be a lot easier when they left everything as an open directory and didn't realize what they were doing.
- monerozcash 10mo ago
  >There was also the hacking team leak from years ago and they were selling exploits for north korea's red star OS: https://nkinternet.wordpress.com/wp-content/uploads/2025/12/ https://nkinternet.wordpress.com/wp-content/uploads/2025/12/... South Korean NIS was in fact a hacking team client, so it would make sense. Especially considering how terrible Red Star OS was at the time, a HT engineer could probably have whipped those up in a couple of days. https://web.archive.org/web/20180302155452/http://english.yonhapnews.co.kr/news/2015/08/04/0200000000AEN20150804000900315.html https://web.archive.org/web/20180302155452/http://english.yo... >I assume they've been on their networks in the past but i think North Korea has also done a lot over the years to secure their side. it used to be a lot easier when they left everything as an open directory and didn't realize what they were doing. I'm sure they've had some success, but I'd expect it to be a really difficult environment to operate in. Even for the NSA. I suppose eventually there'll be a better leak and we'll get to find out just how well it's been going.
superducktoes 10mo ago
the end user devices are also really interesting. as far as i know they require a piece of software called netkey or oconnect as it's recently been renamed. that's for getting access inside the country and then for anyone outside they have software called hangro that is similar to a vpn for connecting back to north korea and getting messages
anonu 10mo ago
> this document from 2007 Interesting document - confirming "everyone spies on everyone". Is this from some sort of corporate NSA chat room?
- monerozcash 10mo ago
  It's like the NSA Reddit, they've got memes and up- and downvotes. Some excerpts from a seemingly unreleased Snowden leak (from Dark mirror: Edward Snowden and the American Surveillance State): > “Why is a scoop of potatoes larger than a scoop of eggs in the cafeteria?” a contributor named Michael wondered one day. Paul jumped in to play the troll. “Let me be the first to down-vote you,” Paul wrote, naming several pedantic reasons. A side debate erupted: should Michael’s post be down-voted, flagged, or removed? Clyde returned to the topic at hand with a facetious theory that scoop volume is proportional to the relative size of potatoes and eggs themselves. In that case, Scott replied, what would happen if “we served eggs that were bigger than potatoes, like of an Ostrich?” Someone proposed a uniform system, “One Spoon to scoop them all,” an homage to Lord of the Rings. Punsters demanded the “inside scoop” and lamented the waste of time on “small potatoes.” Gotta say, it's pretty disappointing that Gellman, Greenwald, Poltras et. al. have been so stingy with these documents. It's definitely starting to have been long enough for them to just dump everything.

metadat 10mo ago

Impressive sleuthing! It's interesting to discover the reality that packet routing ends up following political affiliations. I didn't know North Korea only has 1,024 IPv4 addresses. Do you know why so few IPs? How did they get them?

monerozcash 10mo ago
DPRK can certainly get however many IP addresses they want, DPRK just doesn't have that much infrastructure that they want externally accessible. As far as I know, end-user traffic from within North Korea usually does not originate from those few IP addresses. Or at least not visibly so, they might be connecting to a proxy from a DPRK IP address.
- lukan 10mo ago
  "DPRK can certainly get however many IP addresses they want" IP4 is quite limited as far as I know and not given out freely since a long time, or what do you mean here?
  - jauer 10mo ago
    IPv4 continues to be available to entities that have a need that fits a particular policy shape, just most people don't. Specifically, you can get IPv4 /24s for IPv6 transition purposes. This includes anycast DNS, MX, etc for legacy clients on other networks, v4-side of CGNAT, etc. E.g. I was able to get a /24 in the ARIN region in 2021 and could justify 2 more for a _logical_ network topology similar to what NK presents to the world. APNIC similarly has a pool available for IPv4 allocations: https://www.apnic.net/manage-ip/ipv4-exhaustion/#the-situationin-apnic https://www.apnic.net/manage-ip/ipv4-exhaustion/#the-situati...
    - eqvinox 10mo ago
      IPv4 is a question of money in almost all cases at this point. You can get what you can pay for.
  - 10mo ago

apercu 10mo ago

What a great read. Thanks.

NedF 10mo ago

[dead]

eqvinox 10mo ago

> … 2.5 GB per second between all the provinces. What's your source for that number? Is it GBit or GByte? Are they building out OTU1?