Slashdot Mirror
Inside North Korea's Naenara Browser
msm1267 (2804139) writes with this excerpt from Threatpost Up until a few weeks ago, the number of people outside of North Korea who gave much thought to the Internet infrastructure in that country was vanishingly small. But the speculation about the Sony hack has fixed that, and now a security researcher has taken a hard look at the national browser used in North Korea and found more than a little weirdness. The Naenara browser is part of the Red Star operating system used in North Korea and it's a derivative of an outdated version of Mozilla Firefox. The country is known to tightly control the communications and activities of its citizens and that extends online, as well. Robert Hansen, vice president of WhiteHat Labs at WhiteHat Security, and an accomplished security researcher, recently got a copy of Naenara and began looking at its behavior, and he immediately realized that every time the browser loads, its first move is to make a request to a non-routable IP address, http://10.76.1.11./ That address is not reachable from networks outside the DPRK.
"Here's where things start to go off the rails: what this means is that all of the DPRK's national network is non-routable IP space. You heard me; they're treating their entire country like some small to medium business might treat their corporate office," Hansen wrote in a blog post detailing his findings. "The entire country of North Korea is sitting on one class A network (16,777,216 addresses). I was always under the impression they were just pretending that they owned large blocks of public IP space from a networking perspective, blocking everything and selectively turning on outbound traffic via access control lists."
"Here's where things start to go off the rails: what this means is that all of the DPRK's national network is non-routable IP space. You heard me; they're treating their entire country like some small to medium business might treat their corporate office," Hansen wrote in a blog post detailing his findings. "The entire country of North Korea is sitting on one class A network (16,777,216 addresses). I was always under the impression they were just pretending that they owned large blocks of public IP space from a networking perspective, blocking everything and selectively turning on outbound traffic via access control lists."
IPv6 will never take off, so in the end we'll be bridging national internets just like this one.
I didn't think it was possible to make the Internet Explorer and Windows XP I'm forced to use at work seem like a privilege. Congrats, North Korea. You pulled it off.
The internet browses YOU!
Taking guns away from the 99% gives the 1% 100% of the power.
1976.1.11?
This means that North Korea is VIOLATING RFC 1918! Forget all that other stuff, this must be stopped by any means necessary!
In other words, the U.S. government could make attackers coming from inside the DPRK a non-issue through a (relativey cheap for a national government) DDOS service?
Nobody will ever need more than 16 777 216 I.P. addresses.
signed,
Kim Jong-un
North Korea, Supreme leader
If I were in charge of the network in a place like North Korea where it's heavily monitored and locked down, I'd run it like a big corporate LAN too, utilizing the 10.x.x.x block. The IP that every browser hits on load would be set up as an anycast address with nodes in datacenters near large groups of users (corporate campuses, or cities with lots of PCs in this case.)
The article also provides some good insight for those who aren't aware how malware can discretely provide security holes... using only one encryption key, allowing for easy man-in-the-middle attacks, as in this example.
I like how the summary posts the non-reachable IP address just so we can slashdot it anyway.
DPRK has one network under central control, much like a large corporate entity... it's not like there is a choice of ISPs who have to link with each other! Anyways, the DPRK internet as used by the those DPRK citizens (still a very small percentage of the overall population) is completely airgapped from the public internet as we know it. Only a very very small number of elites have access to the 'real' internet...
Can you really generalize that all the internal network must be from the 10.0.0.0/8 block? What prevents those addresses from being used other than convention and router setup. Perhaps they are only for the internal government computers to make them completely invisible to outside networks.
The article seemed a bit overexcited to me. Is it really that surprising that they use 10.x space? It's not like Internet access is widely used in NK. And most of the other items were not what I would call weird, just what you would expect in a regime like this. Still, kudos to the author for doing this analysis.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Just wait until everyone in North Korea finds out that the animals in the rest of the world don't actually speak English!!!!
opt out link
There are some addresses on the internet that are only associated (except for misuse) with 1 device, these are "public IP".
There are some addresses on the internet that are intended to be associated with multiple devices, these are "private IP".
Private addresses can only be "seen" on a local network, so only one instance of a private address per local network. If you ask for a connection to a private address and the local network doesn't have it, your network won't make any connection for you (even though hypothetically there is several people in the world on other local networks with that address).
It's like being at a family reunion and asking for "John", and not getting a response because no one there is named John, even though a lot of people in the world share that name. On the other hand, if you ask for "Gilgamesh", well then people know to send you to ancient Sur, even though no one in your family is named "Gilgamesh". John is a private reusable identifier, Gilgamesh is a public unique identifier.
The consequence of this is that to run a service for which machines from outside of your local network can connect to, you have to associate the service with a public address. Due to North Korea being one gigantic "local network" (something that usualy only exists on the scale of homes and companies), no one in the world can request a connection to anyone in North Korea, unless a public address/port pair is preallocated to that person. NKoreans can still request connections to the rest of the world, assuming that the routers on the edge of their private network can remember all those connections. For a healthy country, remembering so much would be almost impossible, but for North Korea, it is a sign of how few people can make Internet connections to the rest of the world.
Scroll to the bottom of the page and select "Slashdot Classic". That's it. I had to do that this morning, too.
God is imaginary
The entire country of North Korea is sitting on one class A network (16,777,216 addresses).
Possible but not likely. It is more likely that the country is split into many state run networks, all of which have a state owned machine with a 10.76.1.11 interface. It would provide more IP space, segregate the country into different Internet groups (in N Korea probably social classes), provide protection for some of those classes against DDOS worms infecting other classes, and make the "for your own good citizen" monitoring more tractable.
http://slashdot.org/?nobeta=1.
I don't waste time with setting preferences to opt in or out of whatever abomination they've come up with this time (last I checked, "classic" mode wasn't classic enough). I also treat it like a poll, in that they can see from the logs how often that URL is accessed versus the regular one.
When I first saw an image of the browser I was awe-struck to see that it made a request to an adddress (http://10.76.1.11/) upon first run.
This guy may want to tweak his astonishment threshold before going outside.
"Here's where things start to go off the rails: what this means is that all of the DPRK's national network is non-routable IP space.
Not necessarily. He might well be right, but it might it not just be that the address is actually routeable from within DPRK, and that the IP address was deliberately chosen so as not to be routeable from the outside world?
systemd is Roko's Basilisk.
Hey I have written a TCP/IP stack* and don't remember the specifics anymore... Thinking that every technical person remembers every thing they ever touched is idiotic. Thinking every technical person knows details of everything is even more idiotic.
(* embedded stuff using good old SLIP)
How does North Korea have anyone talented enough to write such software or carry out all these sophisticated attacks? Do they recruit educated people from the south or abroad with the promise of unlimited hookers, blow, cash, and total insulation from international laws? Be as black hat as you wanna be as long as you do this for us?
Clearly, you can NAT an entire nation! IT JUST WORKS!
(Of course, the fact that one of the most reclusive and oppressive nations in the world is using this isn't a shining endorsement, but still....)
Welcome to the Panopticon. Used to be a prison, now it's your home.
Network Address Translation, do you speak it?
The part about the whole DPRK essentially being on a single giant LAN that you can't reach from the outside. That's not news to me.
"When information is power, privacy is freedom" - Jah-Wren Ryel
This isn't reddit. We don't kindly explain things to people, we tell them they're stupid and shove them off. Unless you are trying to turn slashdot into an image linking site about celebrities, I suggest you d
Can someone translate this for the people that do not understand network speak.
Network Addresses, known as IP Addresses, are allocated into several groupings, namely Public, Private, Multicast, Local, and non-usable.
The addresses are also allocated in blocks - A, B, and C - which has to do with how many addresses are available in the block purchased.
The Private group consists of addresses 10.a.b.c, 192.168.x.y, and 172.16.x.y. These are considered class A, B, and C respectively. These addresses are suppose to only be used on private networks - e.g in your home, office, etc - as such, networks are typically configured to now be able to route to them. So if your at location A 10.0.0.1 will be a different server specifically on their network than if you were at location B.
The Local group is similar and consists of 127.a.b.c, though typically only 127.0.0.1 is used. The big difference is that it will never route off the computer you are using.
The Multicast group is a special group reserved at the upper end of the IPv4 spectrum. It was suppose to be for things like Video distribution where you have one sender and many receivers so as to optimize the network by allowing everyone to listen to the same stream - kind of like a TV over-the-air broadcast. However, they've been reclaiming addresses from it for the Public group because the Internet is basically not configured to support Multicast functionality.
The Public group is pretty much everything else except the a special IP address in the 169.a.b.c range that is "do not use" range.
So essentially, North Korea is making the entire country look like your work office or home network. At least, that's the claim.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
There are some addresses on the internet that are only associated (except for misuse) with 1 device, these are "public IP".
There are some addresses on the internet that are intended to be associated with multiple devices, these are "private IP".
That has nothing to do with it.
All IP addresses are only suppose to point to one device; though a device may have multiple IP addresses. The difference is whether or not they are publically visible and routeable.
There is nothing saying that North Korea didn't take a part of the 10.a.b.c range and define it as a public network within their country. So they are not necessarily segregating the whole country. Simply put - there is not enough information to substantiate whether the whole country is in a private range, or if they just utilized part of the private range for some country specific services, and made that range public within the country.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
My name is John Gilgamesh you insensitive clods.
Any insufficiently advanced magic is indistinguishable from technology.
Or maybe the Internet doesn't browse at all.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
He should have told him to point his browser to http://127.0.0.1/ for an insightful article on non-routable IP addresses.
We don't have a state-run media we have a media-run state.
Another summary written by a clueless, not a nerd.
10/8 network is a perfectly routable IP range.
http://10.76.1.11./ is a URL, not an IP address.
It also has an extra dot before the closing slash.
"News for _nerds_", sure...
Wow. Where to start with this post.
Maybe I don't understand how the internet work. so like, one router in North Korea handles all the connections? I guess other countries have more routers to connect to other countries?
North Korea does not just have 1 router. And most countries do not have 'more' routers. Countries have tens of thousands to hundreds of thousands of routers.
192.168.0.0/16 and 10.0.0.0/8 are private IP addresses. You can use the same private range as your neighbour and their neighbours neighbour.
As others have noted, North Korea probably has lots of small networks with a government mandated router listening on 10.76.1.11 on each one of those networks.
I don't see many articles and personal blogs from the people of North Korea. Maybe only the wealthy people can afford internet access?
Because nobody in North Korea posts articles or blogs. (I'd love to see one if there was.) The common North Korean citizen does not get internet access. If you're lucky enough to get internet access (you're of some high status) it is only the internal internet (or North Korean Intranet) not the outside internet. Only the supreme ruling elite get access to the outside Internet.
That is why you won't find articles or blog posts from people from within North Korea....
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
That's not true. Our great nation has at least one hundred times more computers than that.
signed,
Kim Jong-un
North Korea, Supreme leader
Gilgamesh and Enkidu, at Uruk.
Get free satoshi (Bitcoin) and Dogecoins
made that range public within the country.
The word you (and others) are looking for is "route-able", not "public".
There are a lot of IANA-assigned (i.e., "public") IPs that aren't routable from all other arbitrary IP addresses, while many places have made private IPs routable for some or all of their network, just like North Korea has done.
Gilgamesh and Enkidu, at Uruk.
Darmok and Jalad at Tanagra.
made that range public within the country.
The word you (and others) are looking for is "route-able", not "public".
There are a lot of IANA-assigned (i.e., "public") IPs that aren't routable from all other arbitrary IP addresses, while many places have made private IPs routable for some or all of their network, just like North Korea has done.
Typically the "public" IP is considered "route-able"; but regardless, I was trying to stay within the bounds of the OP's request of:
translate this for the people that do not understand network speak.
The term "route-able" would be considered "network speak"; thus I avoided it.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
You mixed up some private/non-routable networks: 10.x.x.x - class A 172.16.x.x - 172.31.x.x - class B 192.168.x.x - class C
Plenty of people get RFC 1918 or RFC 6598 instead of public addresses from their ISP. I would guess that the majority of internet connections in the world are given private space.
It is not common in the US because the US is still drowning in IP addresses, and a lot of the customers are using cable or DSL. In Europe you will often be behind CGN when you use a mobile ISP, and in Asia you will likely be behind CGN no matter how you connect.
Welcome to 2015.
(Of course most ISP's do not hand out browsers at all, much less browsers which are remote controlled from a server somewhere. It is hardly a surprise that North Korea does.)
Finally! A year of moderation! Ready for 2019?
It's a censornet.
My ism, it's full of beliefs.
You really shouldn't link so brazenly to hackers' command-and-control servers on a public forum like this. Someone might get hurt.
Okay, in that case, no one will need more than 17,891,327 addresses (the total number of private Class A, B AND C addresses put together)
Actually, w/ all that IPv4 address shortage, what's the function of all addresses from 127.0.0.2 to 127.255.255.254? Why would any network need 16,580,608 loopback addresses?
Clearly, you can NAT an entire nation! IT JUST WORKS!
(Of course, the fact that one of the most reclusive and oppressive nations in the world is using this isn't a shining endorsement, but still....)
Sure, but your big NK router only has 64K ports per external IP address. It will probably croak well before it has 64K NAT sessions going, though.
Fiat Lux.
Even if your idea had been done, it would have grown from 32 bits to 36. But that aside, even if it had grown from 32 bits to 33, you'd still have a completely incompatible protocol, even if they preserved NAT and everything else already there in IPv4, since your IPv4 header would have changed. Which would have required all networking gear worldwide to be redone.
The 128 bit representation - if you want, you could have represented an address of 2001:db8:fab:cad::1 in decimals as 8193.3512.4011.3245.0.0.0.1. While this particular address might not look ugly, one could have addresses like 8193.3512.42674.13579.59867.27384.57365.37485. Which would be about as ugly as hex. One advantage of hex - you are automatically clamped at ffff within a segment, as opposed to remembering not to exceed 65535 for any block, which would be somewhat more complicated than remembering not to exceed 255.
It shouldn't be that difficult for network admins to understand: as for the average Billy Joe Blow, he'd have trouble even understanding subnet masks, NAT, Class C addressing and so on. Link Local addresses are addresses that belong to a link, and which don't need a network - you can connect 2 computers via an ethernet cable, and the addresses they'll use to communicate w/ each other would be the link local addresses. Node local is loopback address, this time, instead of reserving all of 127.x.x.x, they've just assigned 1 address ::1 to it. The site unique addresses are the equivalent of private addresses that one would use behind a NAT (in IPv4, concepts like link-local and site unique addresses are all conflated, due to the limited addresses). However, instead of the 192.168.1.176 that a lot of computers might get, this one is likely to be a unique address since it's randomly assigned from 112 bits: as a result, overlapping 2 VPNs is less likely to have conflicting addresses than in IPv4.
So the Sony Hack came from IP address 10.76.1.11.
That will be the final and uncontrovertible PROOF that North Korea did it!
__
L.
That's not how it works... that's not how any of this works!
Technology isn't neutral. And some technologies are not positive. And some otherwise-positive technologies can be abused in ways or on scales which couldn't be achieved in their absence. Any so-called "nerd" or enthusiast of technology who is not also cautious of technological advancements and their uses is a zealot.
If technological zealotry is indeed a waning trend on Slashdot, so much the better.
Tangra.
I know tobacco is bad for you, so I smoke weed with crack.