10 ms·
Scans of North Korean IP Space
- alexivanovs 12y agoIt seems strange the the author implies us to do some searching through the findings, but really, he has already given away most of what you can find... EDIT: where did I imply that this is about SONY? Have any of you who commented back on this, have actually checked the actual findings? They're yearly dated records, it seems very hard to believe that he only observed them prior to writing his piece. P.S. - I do think it's a very good technical report, though I don't recall saying it's not.
- yourad_io 12y agoAs I understand it, the author is saying: "I got this data; this is what I got out of it & my read on it; why don't you have a play with it as well."
- JonnieCache 12y agoKudos for resisting the temptation to login to that macbook's VNC server. Or at least, kudos for not telling us about it.
- mrleiter 12y agoKudos for pointing it out to us, then.
- deleted 12y ago[deleted]
- pXMzR2A 12y agoGreat, everyone's gone apeshit insane w/ false flag ops just to bury the senate report on CIA torture.
- spacefight 12y agoWell, at least some of us haven't forgotten it. Not yet.
- VieElm 12y agoThis was an interesting technical article about the publicly visible networks inside a closed country. Nowhere does it mention Sony or "The Information". Your comment is probably off topic and I think a bit conspiracy crazed.
- berberous 12y agoThe general population doesn't know or give a shit about the torture report. The educated don't really give a shit beyond shaking their head while reading the report in the Times, or posting a link on their FB saying that it is 'shameful.' Sad, but true. We've known about these practices for years. The Abu Ghraib scandal was 11 fucking years ago. We've known about waterboarding and Guantanamo for years as well. All of which is to say, I think if you believe that the U.S. government needs to create a false flag operation to bury the report, you are seriously out of touch with the political reality. Public apathy will bury it for them.
- nether 12y ago> Everyone is so dumb, except for enlightened HN readers Jesus this is turning to reddit.
- mason240 12y agoThis far more relevant to HN than anything to do with the torture report.
- totony 12y agoDespite the controversial topic, I think it is interesting to see what one can conclude about a country from freely available information (even though the nmap'ing might have been illegal, I'm not sure about laws regarding nmap anymore).
- spacefight 12y agoAnd one can try to imagine if the alleged 100TB went that way.
- dba7dba 12y agoNo it surely did not. N Korea however has rather free movement of people/cargo with china, limited to govt official/cargo. I'm pretty sure N Korea did it.
- imperialdrive 12y agoFantastic read - and amazing amount of thought put into taking on this research, and it's fascinating to read. I just started using nmap this year, now I'm tempted to perform similar wide scans. I'm curious how to managed keeping your IP from being blocked? Or, did you use a different EC2 instance each time?
- laumars 12y agoMy advice would be "don't". There are quite significant potential legal ramifications for scanning other peoples infrastructure and thus you could land yourself in a lot of trouble if you're not careful. This isn't to say that nmap (and it's ilk) are not useful diagnostic tools. But I'd recommend you leave the scanning to infrastructure you either own or have the owners consent - at least for now while you're still learning the tools.
- hobs 12y agoAgreed, if you want to scan the entire internet, you better be someone like fyodor, and even then the authorities will probably come a knocking. https://www.youtube.com/watch?v=Hk-21p2m8YY https://www.youtube.com/watch?v=Hk-21p2m8YY
- chubot 12y agoWhat are some good books/resources on things like "allocated" and "assigned" IP addresses? i.e. Internet governance, and IP in general? Where is he getting the data like: "inetnum: 175.45.176.0 - 175.45.179.255 ..."? Also are there tools that take a list of services on ports and map it to likely hardware/OS? I have been programming for a long time but somehow I missed out on this kind of networking knowledge. Are most people who know this stuff network engineers?
- decwakeboarder 12y agoWikipedia has a great map of ports to registered and common services: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number... Nmap can scan and show the application and version based on various responses and req/response fingerprinting: http://nmap.org/book/vscan-examples.html http://nmap.org/book/vscan-examples.html
- yourad_io 12y agoalso, very conveniently under /etc/services (Linux, MacOS) $ grep SSH /etc/services ssh 22/tcp # SSH Remote Login Protocol $
- rid 12y agoThe whois utility [1] is available on most Linux distros and *nix flavours, it will give you information such as: - Using an IP, netrange and information regarding the network owner (contact and abuse info). Gathered from the Regional Internet Registry (RIR) databases. - Using a domain, registrant info --if public, abuse details etc.. [1] http://linux.die.net/man/1/whois http://linux.die.net/man/1/whois
- jmnicolas 12y agoI was surprised they're using Cisco. Some Chinese hardware (Huawei ?) would make more sense : both are back-doored, but at least the Chinese are kind of allies.
- jaimehrubiks 12y agodo you have any link with info about cisco backdooring?
- higherpurpose 12y agoCisco is the one that came up with the "legal intercept" backdoor IETF protocol for routers. There have also been "mistakes" where Cisco had remote access to people's routers, when they upgraded them to new firmware. There were some Snowden revelations about Cisco routers being backdoors as well, although without specifically putting the same on Cisco, just on NSA putting the backdoors in Cisco's factory, with which I'm sure Cisco had no relation.
- fragmede 12y agoI make no claims of whether or not Cisco at large is in bed with the NSA, but you must admit a government mole secretly working in the factory to install backdoored firmware is not the same thing as the NSA going to Cisco's CEO and 'convincing' Cisco that installing backdoored firmware at the factory is in their best interests.
- mtmail 12y agoIt made news around May when Glenn Greenwald's book came out https://airvpn.org/topic/11564-fyi-nsa-actively-installed-spyware-on-cisco-routers/ https://airvpn.org/topic/11564-fyi-nsa-actively-installed-sp...
- kw71 12y agoI can tell you that Cisco has no scruples at all. During the course of my seven years employment at Cisco Systems, I came along on sales calls to the Chinese Government where the staff (some in police or military uniforms) were very candid to my American coworkers (a VP and two sales reps) and I about their goals of censorship and identification of troublemakers. During a visit to a SARFT operations center in central Beijing I was asked to explain some details about how Cisco hardware and software products could assist in their mission. The Chinese even mentioned Falun Gong by name and indicated that they were a source of embarrassment that had to be cleansed from the old and new media. I don't know what came of that visit, but months later the VP nominated me to my manager for an internal award because of my assistance on that trip; I got a framed certificate and a monetary bonus (one of many I got from Cisco.) As an American I'm rather ashamed to have participated in such.
- billions 12y agoThere is no way North Korea had the sophistication to hack SONY. Hacking requires knowledge of the latest security vulnerabilities. It's impossible to develop good hackers on such a censored network.
- briandear 12y agoYou are making the fatal assumption that those hacker teams are actually within North Korea. The U.S. military doesn't train for jungle warfare in the United States, they often used Panama, among other places. You'd be surprised how the NKs operate. Many of their operators are based in Japan, for instance, to say nothing of training conducted in China.
- gregimba 12y ago"It's impossible to develop good hackers on such a censored network." Really?
- tireded 12y ago> There is no way North Korea had the sophistication to hack SONY. Hacking doesn't necessarily require sophistication. > Hacking requires knowledge of the latest security vulnerabilities. Again, no. > It's impossible to develop good hackers on such a censored network. Also no. I can imagine being on a heavily censored network being a prime breeding ground for great hackers. Either way, if I were a nation state sponsoring a hack I would presumably give uncensored access to my hack team.
- joelrunyon 12y agoWhy are there all new accounts dismissing this stuff out of hand?
- scastillo 12y agoTotally. Indeed the times i have been more driven and successfull at hacking something, has been on the most restricted environments looking for freedom. bypassing the proxy for example trough icmp tunnels... when you already have the freedom there is less passion to hack something
- ll123 12y agoCountdown until North Korea starts nuclear war with us after a vigilante counter hacks them
- driverdan 12y agoAnyone have an idea how much bandwidth NK has? How easy would it be for a large botnet to DDoS the whole country?
- junto 12y agoAnyone have an idea how much bandwidth NK has? How easy would it be for a large botnet to DDoS the whole country? How ironic would that be? Anonymous gathers up all its 4chan script kiddies to LOIC NK, to save the face of a company that has systematically treated its customers like criminals, namely those script kiddies with their DRM'ed Playstations and Audio CDs and DVDs, whilst fancifully offering up their credit card details online to be hacked and dumped on black hat card trader websites. Oh, yep. Sign me up to some of that illegal shit. /end sarcasm. I genuinely find the suggestion to attack an entire countries internet infrastructure to be a poor idea, whoever they are.
- deleted 12y ago[deleted]
- personjerry 12y agoOk, but you can also consider it from a theoretical point of view and try to think of the ramifications rather than simply dismiss it as impractical. Personally my hacker side finds the idea intriguing and I hope someone could answer this question.
- junto 12y agoAgreed it is an interesting theoretical question. But, sometimes theoretical questions have shaky moral ground, and more importantly, put stupid ideas in stupid people's heads. Adam and Eve is probably the classic example.
- functional_test 12y agoAvoiding questions because of theoretical potential outcomes of people knowing the answer is neither good nor useful. Knowledge is not implicitly dangerous or immoral. Also, in this particular case, it seems that the people interested in that sort of thing could figure it out anyway. Obscurity isn't security.
- deanclatworthy 12y agoFascinating. Has anyone ever penetrated the NK intranet via an internet-facing machine, to do a thorough analysis? I've read a few articles [1] but never a detailed analysis of what's available. [1] http://www.fastcolabs.com/3036049/what-its-like-to-use-north-koreas-internet http://www.fastcolabs.com/3036049/what-its-like-to-use-north...
- internetisthesh 12y agoMy webpage get a few visits from NK every week. A bit curious wether this is common. Anyone else seeing this in their logs?
- lucb1e 12y agoWell look what the author did: just scan the whole country. And I personally know people who scanned the whole Internet on certain ports (so that's not that big a deal). I would be surprised if North Korea didn't do entire Internet sweeps themselves.
- internetisthesh 12y agoThat's why I wondered if other people saw the same pattern. Not sure why they would sweep the Internet themselves though. If they want to know what OS:es are used there's already statistics for that.
- coroxout 12y agoWe looked at our web stats for the past year recently and found we'd had visits from every country except two, NK being one of the two not logged. (I forget the other, and I don't recall what definition of "all the countries" was used.) So I'm thinking not common. Anyone else seen or conspicuously not seen hits from NK?
- internetisthesh 12y agoI looked a bit closer at my web server logs and the IP addresses matched one of the ranges described in the blog post. My application is translated to Korean by end-users, and reading the logs I see that the user downloaded it, read some tutorials in the documentation and some months later downloaded the latest version. I'm not sure why it surprised me that there visitors from NK when I saw it yesterday, it makes sense when I think about it. I already know that my software happens to be used by governments in several dictatorships (yay for open source.)
- j2kun 12y agoI was surprised to see a hit from the DPRK on my blog about math and programming. I wonder what the reasons were, though chances are it was an irrelevant search hit.
- kbart 12y agoMight as well be an infected PC wandering around looking for vulnerabilities (i.e. recent Wordpress comment hack). When I was developing Internet facing device, I had seen tons of scans, loging attempts etc. daily.
- gojomo 12y agoBe cybercareful! You may have just cyberstarted a cyberwar! Also, note that when the next forensic analysis of some hack occurs, the scanning IPs have now "communicated with IPs associated with North Korea". So any future activity of your IPs may be attributed to NK, by the FBI/etc.
- jedberg 12y agoSo they seem to have at least some commercial software and hardware made by American companies. Given that the US cannot trade with NK that means either 1) the companies broke the embargo or 2) they bought through a 3rd party or 3) the software is pirated/stolen/ I'll assume #1 isn't true since it would be stupid for those companies to do that for so little money. #2 has interesting implications about trade embargoes. Unless everyone in the world participates, it seems like all an embargo does is add complexity and middle-men to the transaction. For example, if they legally acquired the software and hardware through a Chinese or Russian reseller, then all that happened was the Chinese or Russians took a cut. #3 interestes me because what happens there? Ok, they are using clearly stolen software, now what? Are there any consequences?
- ghshephard 12y agoThere is a huge market (In the Billions of dollars) for used technology hardware - I've seen some warehouses that had over $500million dollars (at list price) of used Networking and Server equipment. I can't believe it would be particularly difficult for places like Cuba, North Korea, etc... to purchase a bunch of containers of Cisco Routers or HP servers and have them routed through cut-out countries before final shipping to them.
- gwern 12y agoThe generally old-school services available and minimal turnover suggests to me that the official IP space is entirely controlled by a few NK government entities (maybe one of the universities?) and the real NK IP space is dispersed among Chinese allocations/assignments. Is there any way to know how representative these results are of overall NK Internet usage?
- azernik 12y agoThat's possible, but the general consensus is this (FTA): "The country is said to have a fairly large internal domestic internet disconnected from the rest of the world. Most citizens with access to computers are only allowed to access this network, not the global computer network the rest of us connect to." That is, absolutely, the official IP space is assigned to government and government-affiliated institutions. The rest of the local internet isn't in the Chinese address space, though; it's instead on a disconnected network with its own address space allocations, which may overlap with addresses in the rest of the world's IPv4 instance.
- threeseed 12y agoI've been to North Korea and confirm this is accurate. They have an internal intranet with message boards etc. Pretty dated. Also when Indian contractors were brought in to work on the pyramid hotel in Pyongyang I was told that they had a special network provided by NK government which curiously had full access to everything e.g. Facebook etc.
- gwern 12y agoNo, I meant, it seems unlikely that the sum total, grand total, whole kit and kaboodle of all NK Internet activity is solely confined to the tiny handful of easily attacked, easily monitored IP addresses officially assigned to NK. Completely ignoring the intranet, I would expect there to be a great deal of NK Internet activity which is occurring in Chinese IP ranges.
- grobinson 12y agoSeeing as North Korea only have 3 allocated address blocks, 175.45.176.0/22, 210.52.109.0/24 and 77.94.35.0/24 they only have approx. 1530 globally reachable IP addresses. However, North Korea must have more than ~1530 hosts. Does this mean that they use some kind of NAT, or is their number of internet connected hosts just that small? Is there any information about the intranet in North Korea? Do they have a private class A network that everyone in the country is connected to with their own DNS servers, routers, etc which are unreachable from the rest of the internet?
- palunon 12y agoOnly a small number of authorized persons and high ranking government officers have access to the Internet in North Korea, so I guess it is that small. The common people have access to the Kwangmyong, which is an IP network not physically connected to the Internet.
- vesche 12y agoIt's very likely they run larger private ip space behind these IPs...
- spacefight 12y agoA small IP range is not relevant these days. Almost every fuckin' telco uses NAT and proxies for their mobile customers, at scale.
- symlinkk 12y agoI don't really see how this tells us anything interesting. You would see pretty similar results no matter where you scanned, with the exception of the Red Star OS stuff.
- kubiiii 12y agoThat's interesting by itself. One could expect something unusual in NK.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- dylanerichards 12y agoRedirect
- sysk 12y agoAs a side note, I recently learned that it was possible to scan the whole Internet in a few hours on a regular connection: https://www.youtube.com/watch?v=UOWexFaRylM https://www.youtube.com/watch?v=UOWexFaRylM
- richardkeller 12y agoThe author notes that they picked up an MacBook Air during one of the scans. Probably unrelated, but interesting nevertheless, is that Kim has been seen using Apple products [1], specifically an iMac. Perhaps the author came across Kim's own notebook? [1] http://www.telegraph.co.uk/technology/apple/10619703/North-Korean-computers-get-Apple-makeover.html http://www.telegraph.co.uk/technology/apple/10619703/North-K...
- kbuck 12y agoSmall correction: VMware authd runs on the host machine, not the guest. That's actually a Windows machine running VMware Workstation.
- drippingfist 12y agoMaybe the DDOS is just a distraction.
- forensichell 12y ago#NorthKoreaOffline http://www.NorthKoreaOffline.com http://www.NorthKoreaOffline.com