7 ms·

North Korea’s Naenara Web Browser: It’s Weirder Than We Thought

117 points by ivank 12y ago

ritonlajoie 12y ago
cache http://webcache.googleusercontent.com/search?q=cache:4-YCKBVsvtQJ:https://blog.whitehatsec.com/north-koreas-naenara-web-browser-its-weirder-than-we-thought/+&cd=1&hl=fr&ct=clnk&gl=fr&lr=lang_en%7Clang_fr http://webcache.googleusercontent.com/search?q=cache:4-YCKBV...
- danielweber 12y ago
  Their website is also getting hammered for https://github.com/WhiteHatSecurity/Aviator/issues/24 https://github.com/WhiteHatSecurity/Aviator/issues/24
hosay123 12y ago
They use the same tracking system Google uses to create unique keys, except they built their own. That means the microtime of installation is sent to the mothership every single time someone pulls down the anti-phishing and anti-malware lists (from 10.76.1.11) in the browser. This microtime is easily enough information to decloak people, which is presumably the same reason Google built it into the browser. Anyone know what mechanism this refers to?
- jacquesm 12y ago
  Androids UDID? Not based on microtime though.
- gcp 12y ago
  Unique user key that was used for pre-HTTPS SafeBrowsing updates? It was necessary to get the updates MACed before Google had full HTTPS deployment. You got the key over HTTPS, then all subsequent HTTP downloads could use that key for message authentication.
- pilif 12y ago
  They are talking about the Safe Browsing API. I don't see where this is sending microtimes though: https://developers.google.com/safe-browsing/developers_guide_v3 https://developers.google.com/safe-browsing/developers_guide... Also, I kind of dislike the alarmist tone of this paragraph. Saying that google's anti malware blacklist (used by all browsers out there aside of IE) is a secret plan to de-anonymize people by using a microtime of a request timestamp seems... far fetched.
  - gcp 12y ago
    I don't know where microtimes comes from either. It's entirely possible the per-user key is or contains a microtime - I've never investigated. The per-user key does allow the entity operating the blacklist to easily detect any user who's moving between network access points. This is known. The feature is and was always stripped out in stuff like Tor browser for that reason. There's good reasons to believe it wasn't malicious (it was necessary for secure updates pre-universal-HTTPS, and was removed as soon as HTTPS was deployed universally at Google), but it's also not really arguable it could be used for that purpose, either.
    - pjc50 12y ago
      Are you saying that the "google api key" passed by Firefox is user-specific?
      - gcp 12y ago
        No, not at all. SafeBrowsing had a separate encryption/MAC key. I think some of the confusion is because the parent poster posted a link to v3 of the protocol, which dropped the key in favor of HTTPS, but the old Firefox version implements v2.
  - crdoconnor 12y ago
    >Saying that google's anti malware blacklist (used by all browsers out there aside of IE) is a secret plan to de-anonymize people by using a microtime of a request timestamp seems... far fetched. Uh, not really. Tracking users is at the heart of their business model.
hultner 12y ago
I were surprised first time I heard that they even got an computer network for their people. I would love to see the inside of a North Koreans developers mind, do they know about the outside world?
- slowmotiony 12y ago
  It's probably contractors from China who developed the software.
- deleted 12y ago
  [deleted]
- dominotw 12y ago
  yep most younger ppl(atleast in the cities) grew up on listening to chinese/south korean radio, there is a big underground market for cds and usb drives with all sorts of stuff on them. Access to internet is also not that uncommon among the elite.
- deleted 12y ago
  [deleted]
- christop 12y ago
  Most likely they do. Beyond TV/radio etc, at least grad students get internet access in North Korea, so perhaps developers have some level of access too. See this talk from 31C3 a couple of weeks ago: http://media.ccc.de/browse/congress/2014/31c3_-_6253_-_en_-_saal_2_-_201412292115_-_computer_science_in_the_dprk_-_will_scott.html http://media.ccc.de/browse/congress/2014/31c3_-_6253_-_en_-_...
- gambiting 12y ago
  Apparently North Korean Universities have access to the real internet, but there is only a dozen or so computers connected to it, and for every computer there is a government official sitting in a room next door seeing what the person using the computer is seeing....and probably taking notes. So researchers can visit any sites they like...but as soon as you start reading something anti-NK you are very likely to get arrested.
smaili 12y ago
Does anyone have a sample User Agent? I'd be very curious if anyone has tried doing some regex's on some request logs to see if they got any page hits from North Korea :)
- lars_francke 12y ago
  It's right there in the article: Mozilla/5.0 (X11; U; Linux i686; ko-KP; rv: 19.1br) Gecko/20130508 Fedora/1.9.1-2.5.rs3.0 NaenaraBrowser/3.5b4
  - tomwilde 12y ago
    Notice that the user agent string gets rewritten to something innocuous in HTTP headers but not JS. So sniff client-side through JS.
  - S4M 12y ago
    There are the IP's from North Korea available as well, it was discussed couple of time ago on HN[0]. I think checking by IP is more reliable than checking the browser: Red Star OS is not the only OS in North Korea and someone could use Naenara Browser from the outside as well... [0] https://news.ycombinator.com/item?id=8777226 https://news.ycombinator.com/item?id=8777226
pilif 12y ago
This article is full of inaccuracies, alarmist FUD and sensationalism. If I could downvote an article, I would this one. >I was always under the impression they were just pretending that they owned large blocks of public IP space from a networking perspective, blocking everything and selectively turning on outbound traffic via access control lists. Apparently not It was always public knowledge that NK has more or less one publicly routed /22. That's far removed from "large blocks of public IP space". > This microtime is easily enough information to decloak people, which is presumably the same reason Google built it into the browser I doubt that was Google's intention behind the Safe Browsing API (https://developers.google.com/safe-browsing/developers_guide_v3 https://developers.google.com/safe-browsing/developers_guide...) >So every time the browser fails for some reason they get information about it. Useful for debugging and also for finding exploits in Firefox, without necessarily giving that information back to Mozilla – a U.S. company Or if could be that most of the users of the browser in question do not in fact have full internet access and thus no reports would be sent anyways. Also, FF 3.6 is long out of support, so by getting access to these crash reports, the people behind Naenara get a chance at fixing issues (I'm not saying they do or don't, but getting the crash reports directly is the only way for remaining crashes to actually be fixed) >. Could the mothership be acting as a proxy? Is that how people are actually visiting the Internet – through a big proxy server? very likely, but not because of the way the URL for the startpage is formatted. That's just a convenience thing I guess where they ran wget or any other crawler against the original site and then they could just prepend their internal server to to URL and keep the patch to Firefox minimal. >it’s still very odd that they haven’t bothered using HTTPS internally They just don't care if "normal" people could potentially sniff each other calendars. If the government wants access to the calendar, they just look the data up I guess and because this is all a big intranet, the traffic doesn't cross any non-goverment-owned routers anyways. >This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json* https://www.google.com/loc/json* Likely none of the sites the browser is actually able to visit actually use the geolocation API, so they just forgot to change the URL. It's an interesting bug, but far removed from mind-blowing IMHO. >That’s actually a good security measure, but given how old this browser is, I doubt they use it often, and therefore it’s probably not designed to protect the user, but rather allow the government to quickly install malware should they feel the need. Wonderful.* I'm sure they have other methods of installing malware that then would run as a privileged account, not the unprivileged user account running Firefox itself (their OS doesn't officially allow root access as we've seen in yesterdays article). >It is odd that they can do all of this off of one IP address. Perhaps they have some load balancing but ultimately running anything off of one IP address for a whole country is bad for many reasons. when you have fewer than 10000 total users, that doesn't seem like such a bad idea - it's certainly convenient.
kapsel 12y ago
Do we actually know much about the North Korean "intranet"? I spent two weeks traveling around in North Korea in August 2012. One of our visits were in a military museum that had computers available (actually running RedStar OS!), containing some CD/DVD with MOV files (as far as I remember) and some other things. I remember the machine having a 10.x IP address but it was definitely not able to access any internet, but I wonder if it was connected to their actual intranet, or if they simply had some local network there.
- crdoconnor 12y ago
  I managed to glean a little from my visit, but not that much: * They apparently have something resembling a dating website. * They can download computer games (my tour guide complained that his son spent too much time playing them).
  - bduerst 12y ago
    Was that sincere or was it part of the show? I haven't been, but from what I've read/seen the tours are almost like an orchestrated front aimed at changing foreigners' perspectives.
    - crdoconnor 12y ago
      >Was that sincere or was it part of the show? I'm certain that part was sincere. There is a certain level of naive honesty among most of the North Koreans (similar to that of sheltered fundamentalist Christians). I could clearly detect this by seeing that some of them naively did or said the "wrong" thing a few too many times whereas others were clearly much more canny. The canny ones lied all the fucking time and probably knew they were lying. The naive ones let slip a few gems. The 'dating' website is probably more like a website for arranging arranged marriages, incidentally. Just in case you were wondering. >I haven't been, but from what I've read/seen the tours are almost like an orchestrated front aimed at changing foreigners' perspectives. The tour is orchestrated and it is clearly partly aimed at changing foreigners' perspectives, but the parts which are just for show and the kernels of honest truth are actually pretty easy to distinguish. Sometimes propaganda is embarrassingly terrible (e.g. just taking the number of actual US casualties in the Korean war and doubling it. facepalm). I'm sure the years before I went were even more blatant and terrible, actually. I didn't see any fake shops like in the interview but I suspect they may have existed in the years prior to my visit. I think they probably figured out that that was an abysmal idea. The North Koreans have very unsophisticated domestic propaganda compared to western domestic propaganda. They are NOT good at it. Getting better, but still terrible. Interestingly, western propaganda about North Korea is equally facile. The isolation makes it easy for outright lies to be believed on both sides I guess. Provided you haven't experienced both. Also there are certain things both sides refuse to talk about that the other side talks a lot about - propaganda that serves a purpose that is based in truth. North Korea doesn't talk about prison camps but every American knows about them. America doesn't talk about atrocities committed by GIs in the Korean war, but North Koreans schooled on them much like we are schooled on Nazi atrocities. Weirdly, North Korea was pretty open about the famine in the 90s. I expected them to gloss over it. Western media glosses over the fact that it actually ended, of course.
benbristow 12y ago
Site seems dead from my end. Archive.org link: https://web.archive.org/web/20150108223420/https://blog.whitehatsec.com/north-koreas-naenara-web-browser-its-weirder-than-we-thought/ https://web.archive.org/web/20150108223420/https://blog.whit...
- ifdefdebug 12y ago
  Same here. Thanks for link.
- razster 12y ago
  Works fine on my end: USA/Cali/CharterCom cable.
DonHopkins 12y ago
Gateway To Net Ten Mark Lottor [Original words and music by Jimmy Page and Robert Plant] There's a hacker who's sure all that's coax is fast and he's buying a gateway to net ten. When he gets it he'll know if the ports are all closed with a SYN he can get what he sent for. Ooh ooh ooh ooh, ooh ooh ooh ooh and he's buying a gateway to net ten. There's an RFC on the wall but he wants to be sure cause you know sometimes words have two meanings. In a note on the page there's a warning that says sometimes all of our code is broken. Don't ya know, it makes me wonder. There's an error I get when I send to the net and my packets are lost and retransmitting. In my logs I have seen loops of mail thru the machine, and the screams of those who are hacking. Oooh, it makes me wonder. And it's whispered that soon if we all fix and tune then the packets will reach their destinations. And a new day will dawn for hosts that stay long and the telnets will echo quite faster. Ohhhhh, it makes me wonder. If there's a bustle in your cisco, don't be alarmed now it's just a quick ping for the NIC machine. Yes there are two paths you can route by, but in the long haul there's still time to change the protocol. Yowwww, it makes me wonder. Your host is loaded and it will slow in case you don't know, the unix's are asking you to join them. Dear hacker, do you see the overflow, and did you know your gateway is still under development. And as we wind out more coax, and gateways slower than our hosts, There goes a message we all know, it updates routes and wants to show how everything still turns quite slow. And if you listen very hard, the bits will come to you at last. When all are ones and ones are all, to be a rubout and not a null. And he's buying a gateway to net ten...
- Mahn 12y ago
  This comment would have gone places in reddit :)
wtracy 12y ago
This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json* Maybe they just don't have Wi-Fi.

117 points by ivank 12y ago

cache http://webcache.googleusercontent.com/search?q=cache:4-YCKBVsvtQJ:https://blog.whitehatsec.com/north-koreas-naenara-web-browser-its-weirder-than-we-thought/+&cd=1&hl=fr&ct=clnk&gl=fr&lr=lang_en%7Clang_fr http://webcache.googleusercontent.com/search?q=cache:4-YCKBV...

danielweber 12y ago
Their website is also getting hammered for https://github.com/WhiteHatSecurity/Aviator/issues/24 https://github.com/WhiteHatSecurity/Aviator/issues/24

hosay123 12y ago

They use the same tracking system Google uses to create unique keys, except they built their own. That means the microtime of installation is sent to the mothership every single time someone pulls down the anti-phishing and anti-malware lists (from 10.76.1.11) in the browser. This microtime is easily enough information to decloak people, which is presumably the same reason Google built it into the browser. Anyone know what mechanism this refers to?

jacquesm 12y ago
Androids UDID? Not based on microtime though.
gcp 12y ago
Unique user key that was used for pre-HTTPS SafeBrowsing updates? It was necessary to get the updates MACed before Google had full HTTPS deployment. You got the key over HTTPS, then all subsequent HTTP downloads could use that key for message authentication.
pilif 12y ago
They are talking about the Safe Browsing API. I don't see where this is sending microtimes though: https://developers.google.com/safe-browsing/developers_guide_v3 https://developers.google.com/safe-browsing/developers_guide... Also, I kind of dislike the alarmist tone of this paragraph. Saying that google's anti malware blacklist (used by all browsers out there aside of IE) is a secret plan to de-anonymize people by using a microtime of a request timestamp seems... far fetched.
- gcp 12y ago
  I don't know where microtimes comes from either. It's entirely possible the per-user key is or contains a microtime - I've never investigated. The per-user key does allow the entity operating the blacklist to easily detect any user who's moving between network access points. This is known. The feature is and was always stripped out in stuff like Tor browser for that reason. There's good reasons to believe it wasn't malicious (it was necessary for secure updates pre-universal-HTTPS, and was removed as soon as HTTPS was deployed universally at Google), but it's also not really arguable it could be used for that purpose, either.
  - pjc50 12y ago
    Are you saying that the "google api key" passed by Firefox is user-specific?
    - gcp 12y ago
      No, not at all. SafeBrowsing had a separate encryption/MAC key. I think some of the confusion is because the parent poster posted a link to v3 of the protocol, which dropped the key in favor of HTTPS, but the old Firefox version implements v2.
- crdoconnor 12y ago
  >Saying that google's anti malware blacklist (used by all browsers out there aside of IE) is a secret plan to de-anonymize people by using a microtime of a request timestamp seems... far fetched. Uh, not really. Tracking users is at the heart of their business model.

hultner 12y ago

I were surprised first time I heard that they even got an computer network for their people. I would love to see the inside of a North Koreans developers mind, do they know about the outside world?

slowmotiony 12y ago
It's probably contractors from China who developed the software.
deleted 12y ago
[deleted]
dominotw 12y ago
yep most younger ppl(atleast in the cities) grew up on listening to chinese/south korean radio, there is a big underground market for cds and usb drives with all sorts of stuff on them. Access to internet is also not that uncommon among the elite.
deleted 12y ago
[deleted]
christop 12y ago
Most likely they do. Beyond TV/radio etc, at least grad students get internet access in North Korea, so perhaps developers have some level of access too. See this talk from 31C3 a couple of weeks ago: http://media.ccc.de/browse/congress/2014/31c3_-_6253_-_en_-_saal_2_-_201412292115_-_computer_science_in_the_dprk_-_will_scott.html http://media.ccc.de/browse/congress/2014/31c3_-_6253_-_en_-_...
gambiting 12y ago
Apparently North Korean Universities have access to the real internet, but there is only a dozen or so computers connected to it, and for every computer there is a government official sitting in a room next door seeing what the person using the computer is seeing....and probably taking notes. So researchers can visit any sites they like...but as soon as you start reading something anti-NK you are very likely to get arrested.

smaili 12y ago

Does anyone have a sample User Agent? I'd be very curious if anyone has tried doing some regex's on some request logs to see if they got any page hits from North Korea :)

lars_francke 12y ago
It's right there in the article: Mozilla/5.0 (X11; U; Linux i686; ko-KP; rv: 19.1br) Gecko/20130508 Fedora/1.9.1-2.5.rs3.0 NaenaraBrowser/3.5b4
- tomwilde 12y ago
  Notice that the user agent string gets rewritten to something innocuous in HTTP headers but not JS. So sniff client-side through JS.
- S4M 12y ago
  There are the IP's from North Korea available as well, it was discussed couple of time ago on HN[0]. I think checking by IP is more reliable than checking the browser: Red Star OS is not the only OS in North Korea and someone could use Naenara Browser from the outside as well... [0] https://news.ycombinator.com/item?id=8777226 https://news.ycombinator.com/item?id=8777226

pilif 12y ago

This article is full of inaccuracies, alarmist FUD and sensationalism. If I could downvote an article, I would this one. >I was always under the impression they were just pretending that they owned large blocks of public IP space from a networking perspective, blocking everything and selectively turning on outbound traffic via access control lists. Apparently not It was always public knowledge that NK has more or less one publicly routed /22. That's far removed from "large blocks of public IP space". > This microtime is easily enough information to decloak people, which is presumably the same reason Google built it into the browser I doubt that was Google's intention behind the Safe Browsing API (https://developers.google.com/safe-browsing/developers_guide_v3 https://developers.google.com/safe-browsing/developers_guide...) >So every time the browser fails for some reason they get information about it. Useful for debugging and also for finding exploits in Firefox, without necessarily giving that information back to Mozilla – a U.S. company Or if could be that most of the users of the browser in question do not in fact have full internet access and thus no reports would be sent anyways. Also, FF 3.6 is long out of support, so by getting access to these crash reports, the people behind Naenara get a chance at fixing issues (I'm not saying they do or don't, but getting the crash reports directly is the only way for remaining crashes to actually be fixed) >. Could the mothership be acting as a proxy? Is that how people are actually visiting the Internet – through a big proxy server? very likely, but not because of the way the URL for the startpage is formatted. That's just a convenience thing I guess where they ran wget or any other crawler against the original site and then they could just prepend their internal server to to URL and keep the patch to Firefox minimal. >it’s still very odd that they haven’t bothered using HTTPS internally They just don't care if "normal" people could potentially sniff each other calendars. If the government wants access to the calendar, they just look the data up I guess and because this is all a big intranet, the traffic doesn't cross any non-goverment-owned routers anyways. >This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json* https://www.google.com/loc/json* Likely none of the sites the browser is actually able to visit actually use the geolocation API, so they just forgot to change the URL. It's an interesting bug, but far removed from mind-blowing IMHO. >That’s actually a good security measure, but given how old this browser is, I doubt they use it often, and therefore it’s probably not designed to protect the user, but rather allow the government to quickly install malware should they feel the need. Wonderful.* I'm sure they have other methods of installing malware that then would run as a privileged account, not the unprivileged user account running Firefox itself (their OS doesn't officially allow root access as we've seen in yesterdays article). >It is odd that they can do all of this off of one IP address. Perhaps they have some load balancing but ultimately running anything off of one IP address for a whole country is bad for many reasons. when you have fewer than 10000 total users, that doesn't seem like such a bad idea - it's certainly convenient.

kapsel 12y ago

Do we actually know much about the North Korean "intranet"? I spent two weeks traveling around in North Korea in August 2012. One of our visits were in a military museum that had computers available (actually running RedStar OS!), containing some CD/DVD with MOV files (as far as I remember) and some other things. I remember the machine having a 10.x IP address but it was definitely not able to access any internet, but I wonder if it was connected to their actual intranet, or if they simply had some local network there.

crdoconnor 12y ago
I managed to glean a little from my visit, but not that much: * They apparently have something resembling a dating website. * They can download computer games (my tour guide complained that his son spent too much time playing them).
- bduerst 12y ago
  Was that sincere or was it part of the show? I haven't been, but from what I've read/seen the tours are almost like an orchestrated front aimed at changing foreigners' perspectives.
  - crdoconnor 12y ago
    >Was that sincere or was it part of the show? I'm certain that part was sincere. There is a certain level of naive honesty among most of the North Koreans (similar to that of sheltered fundamentalist Christians). I could clearly detect this by seeing that some of them naively did or said the "wrong" thing a few too many times whereas others were clearly much more canny. The canny ones lied all the fucking time and probably knew they were lying. The naive ones let slip a few gems. The 'dating' website is probably more like a website for arranging arranged marriages, incidentally. Just in case you were wondering. >I haven't been, but from what I've read/seen the tours are almost like an orchestrated front aimed at changing foreigners' perspectives. The tour is orchestrated and it is clearly partly aimed at changing foreigners' perspectives, but the parts which are just for show and the kernels of honest truth are actually pretty easy to distinguish. Sometimes propaganda is embarrassingly terrible (e.g. just taking the number of actual US casualties in the Korean war and doubling it. facepalm). I'm sure the years before I went were even more blatant and terrible, actually. I didn't see any fake shops like in the interview but I suspect they may have existed in the years prior to my visit. I think they probably figured out that that was an abysmal idea. The North Koreans have very unsophisticated domestic propaganda compared to western domestic propaganda. They are NOT good at it. Getting better, but still terrible. Interestingly, western propaganda about North Korea is equally facile. The isolation makes it easy for outright lies to be believed on both sides I guess. Provided you haven't experienced both. Also there are certain things both sides refuse to talk about that the other side talks a lot about - propaganda that serves a purpose that is based in truth. North Korea doesn't talk about prison camps but every American knows about them. America doesn't talk about atrocities committed by GIs in the Korean war, but North Koreans schooled on them much like we are schooled on Nazi atrocities. Weirdly, North Korea was pretty open about the famine in the 90s. I expected them to gloss over it. Western media glosses over the fact that it actually ended, of course.

benbristow 12y ago

Site seems dead from my end. Archive.org link: https://web.archive.org/web/20150108223420/https://blog.whitehatsec.com/north-koreas-naenara-web-browser-its-weirder-than-we-thought/ https://web.archive.org/web/20150108223420/https://blog.whit...

ifdefdebug 12y ago
Same here. Thanks for link.
razster 12y ago
Works fine on my end: USA/Cali/CharterCom cable.

DonHopkins 12y ago

Gateway To Net Ten Mark Lottor [Original words and music by Jimmy Page and Robert Plant] There's a hacker who's sure all that's coax is fast and he's buying a gateway to net ten. When he gets it he'll know if the ports are all closed with a SYN he can get what he sent for. Ooh ooh ooh ooh, ooh ooh ooh ooh and he's buying a gateway to net ten. There's an RFC on the wall but he wants to be sure cause you know sometimes words have two meanings. In a note on the page there's a warning that says sometimes all of our code is broken. Don't ya know, it makes me wonder. There's an error I get when I send to the net and my packets are lost and retransmitting. In my logs I have seen loops of mail thru the machine, and the screams of those who are hacking. Oooh, it makes me wonder. And it's whispered that soon if we all fix and tune then the packets will reach their destinations. And a new day will dawn for hosts that stay long and the telnets will echo quite faster. Ohhhhh, it makes me wonder. If there's a bustle in your cisco, don't be alarmed now it's just a quick ping for the NIC machine. Yes there are two paths you can route by, but in the long haul there's still time to change the protocol. Yowwww, it makes me wonder. Your host is loaded and it will slow in case you don't know, the unix's are asking you to join them. Dear hacker, do you see the overflow, and did you know your gateway is still under development. And as we wind out more coax, and gateways slower than our hosts, There goes a message we all know, it updates routes and wants to show how everything still turns quite slow. And if you listen very hard, the bits will come to you at last. When all are ones and ones are all, to be a rubout and not a null. And he's buying a gateway to net ten...

Mahn 12y ago
This comment would have gone places in reddit :)

wtracy 12y ago

This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json* Maybe they just don't have Wi-Fi.